stoQing your Splunk
0 likes385 views
1) stoQ is an open source framework that enables automating processes, analytics, and tasks to reduce manual work. It uses plugins to leverage multiple tools simultaneously. 2) The presentation provides an overview of stoQ and its capabilities. It also demonstrates how stoQ can be used in conjunction with Splunk for a digital forensics investigation use case. 3) A Splunk app for stoQ is available to visualize stoQ results in Splunk and allow quick pivoting between data sources.
1 of 38
Download to read offline
Ad
Recommended
SIG-NOC Tools Survey 2019 Results 
SIG-NOC Tools Survey 2019 Results CSUC - Consorci de Serveis Universitaris de Catalunya Presentació a càrrec de Maria Isabel Gandia, cap de Comunicacions del CSUC, duta a terme al 10è SIG-NOC Meeting, celebrat els dies 13 i 14 de novembre de 2019 a Praga.
SplunkLive! London 2016 - John Lewis
SplunkLive! London 2016 - John LewisSplunk Presentation on how John Lewis uses Splunk Enterprise and Splunk Enterprise Security as a security platform.
City of San Diego Customer Presentation
City of San Diego Customer PresentationShannon Cuthbertson Gary Hayslip is the Deputy Director and CISO of the City of San Diego. Before implementing Splunk, the city lacked visibility and coordination across its IT systems. Splunk has provided the city with end-to-end visibility across its 24 networks and 40,000 endpoints. It uses Splunk for security reporting, threat detection, application management, analytics, and dashboards. Splunk has helped the city detect threats faster, improve operations, and protect critical data. The city plans to continue expanding its use of Splunk across departments to improve security and operations.
Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security and User Behavior AnalyticsSplunk This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Customer Presentation, FirstSolar
Customer Presentation, FirstSolarSplunk First Solar is a global leader in solar energy solutions with over 10 GW installed worldwide. They chose Splunk as their security information and event management (SIEM) solution after their previous solution provided cryptic, unusable alerts that wasted analysts' time. Splunk has provided First Solar with clarity into their environment, allowing them to distinguish real threats from false positives in under 30 minutes and improving security. They use Splunk for dashboards, malware detection, and accurate searches to quickly respond to incidents. First Solar now has complete visibility and faster response times with Splunk.
SplunkLive! Austin Customer Presentation - Baylor
SplunkLive! Austin Customer Presentation - BaylorSplunk - Baylor University is a private Christian university in Waco, Texas with over 17,000 students. The CISO, Jon Allen, built the university's security program from the ground up over 17 years.
- Before Splunk, it was difficult and inefficient for the security team to search logs and get the information they needed across different systems in a timely manner.
- Splunk provided a single platform to integrate and search all their log data, allowing the security team to quickly gain visibility, troubleshoot issues, and meet compliance requirements. It also helped break down silos between different IT teams.
- Splunk has improved operational efficiency by reducing the time to find information from hours to minutes. It also fosters
SplunkLive! Milano 2016 - Splunk Plenary Session
SplunkLive! Milano 2016 - Splunk Plenary SessionSplunk The document provides an agenda for the SplunkLiveMilano2016 event taking place on April 5th, 2016 in Milan. The agenda includes welcome and overview sessions in the morning, followed by use case presentations from Unicredit, Saipem, and Yoox-Net-a-Porter. There will be breakout sessions after lunch on various topics, and a happy hour with sponsors. The document also lists the dedicated Splunk team for Italy and provides information on upcoming Splunk events.
Splunk @ HomeAway
Splunk @ HomeAwaySplunk This document summarizes René X. Parra's presentation on Splunk usage at HomeAway. It discusses how HomeAway has grown from simple log aggregation to supporting high data volumes and near real-time analysis. HomeAway now ingests over 1TB of data per day across multiple indexers and search heads. The presentation demonstrates how Splunk supports both batch and real-time analytics and concludes with key takeaways around proper Splunk sizing, optimization, and engaging the Splunk community.
Splunk Enterprise for InfoSec Hands-On Breakout Session
Splunk Enterprise for InfoSec Hands-On Breakout SessionSplunk This document provides an agenda and overview of a Splunk Enterprise security workshop focusing on web attacks, lateral movement, and DNS exfiltration. The agenda includes introductions, demonstrations of SQL injection detection using regular expressions, detecting lateral movement through abnormal network traffic patterns, and using Shannon entropy and subdomain length to identify DNS exfiltration. Hands-on exercises are provided to allow attendees to search pre-loaded machine data and gain experience detecting these common security incidents.
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior AnalyticsSplunk This session will review Splunk’s two premium solutions - Splunk Enterprise Security (ES) is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and
incident response environments. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams.
2016 virus bulletin
2016 virus bulletinAdrian Sanabria Endpoint threats have entered a new era, and the security industry has been rushing to catch up. The result is a highly fragmented and confusing market that has doubled in size to over 70 vendors in the last four years. We're in the midst of the second great endpoint security consolidation and will discuss precisely what that means. We'll discuss six progressive stages endpoint security will work through as this market continues to mature over the next five years or so.
Splunk for Enterprise Security Featuring UBA
Splunk for Enterprise Security Featuring UBASplunk This document provides an overview and summary of Splunk's security products, including Enterprise Security and User Behavior Analytics. It discusses the key capabilities and features of these products, such as detecting advanced cyberattacks, identifying insider threats through machine learning, and integrating UBA with SIEM for improved threat detection. New features in recent versions are highlighted, like custom threat modeling and enhanced visibility into user, device, application, and protocol activity. Customer testimonials praise Splunk UBA's data-science approach to finding hidden threats.
Introduction to Splunk Presentation (DevOps)
Introduction to Splunk Presentation (DevOps)Knoldus Inc. As simply as possible, we offer a big data platform that can help you do a lot of things better. Using Splunk the right way powers cybersecurity, observability, network operations and a whole bunch of important tasks that large organizations require.
Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security and User Behavior AnalyticsSplunk This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Splunk at Sabre
Splunk at SabreSplunk - John Bland is a senior software developer at Sabre who is responsible for Splunk implementation and uses it extensively in his work.
- Before Splunk, Sabre struggled to view logs from different locations and applications in a centralized way and had to manually search through logs.
- Sabre now uses Splunk across multiple environments to gain visibility into applications, monitor performance, streamline development processes, and improve support capabilities.
- Splunk has helped Sabre improve uptime, reduce troubleshooting time, and provide better support to internal teams and customers. Sabre continues expanding their use of Splunk across more processes.
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior AnalyticsSplunk This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk for Enterprise Security featuring UBA Breakout SessionSplunk This document provides an overview of a presentation given by Dave Herrald, a security architect at Splunk, on Splunk's Enterprise Security and User Behavior Analytics solutions. The presentation covered new features in Splunk Enterprise Security 4.1, including enhanced threat intelligence integration, risk-based searching and incident review, and integration with Splunk User Behavior Analytics. It also reviewed capabilities in Splunk User Behavior Analytics 2.2 like custom threat modeling, expanded attack coverage, and context enrichment.
Splunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk The document is a presentation on cyber security trends and Splunk security products from Matthias Maier, Product Marketing Director for Security at Splunk. The presentation covers trends in security operations like the evolution of SOCs, new security roles, and data-centric security approaches. It also provides updates on Splunk's security portfolio including recognition as a leader in SIEM by Gartner and growth in the SIEM market. Maier highlights some breakout sessions from the conference on topics like asset defense, machine learning, and building detections.
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk Splunk Enterprise is a software platform for searching, monitoring, and analyzing machine-generated big data, such as logs, metrics, and mobile data. The presentation provided an overview of Splunk Enterprise capabilities including: live demonstrations of installing Splunk, searching data, creating dashboards and alerts. It also covered Splunk deployment architectures for scaling from single instances to distributed environments supporting hundreds of terabytes per day.
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseShannon Cuthbertson This document provides an overview and demonstration of Splunk Enterprise. It discusses Splunk's capabilities for indexing, searching, and analyzing machine data from various sources. The live demonstration shows how to install Splunk, import sample data, perform searches, create dashboards and alerts. It also covers Splunk's deployment architecture and scalability options. Attendees are encouraged to ask questions on Splunk's online communities and support channels.
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
Endpoint (big) Data In The Age of Compromise, Ian RainsburghNapier University This document summarizes a presentation on leveraging big data in cybersecurity. It discusses how current security challenges include breaches occurring within minutes while most go undiscovered for months or years. Inside-out security is proposed to detect both known and unknown threats using deep endpoint visibility and activity correlation. This allows proactive detection, assessment of sensitive data and risks, automated incident response, and recovery to reduce breach discovery times.
SplunkLive! Paris 2016 - Plenary session
SplunkLive! Paris 2016 - Plenary sessionSplunk Splunk provides a platform for operational intelligence that allows users to analyze machine data from any source. The document discusses Splunk products and solutions for IT service management, security intelligence, and Internet of Things applications. Splunk has over 11,000 customers across various industries.
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk for Enterprise Security featuring UBA Breakout SessionSplunk Splunk User Behavior Analytics (UBA) 2.2 provides enhanced security analytics and detection capabilities. It uses machine learning to establish baseline behaviors and detect anomalies. UBA analyzes activities across users, hosts, networks, applications and data to identify potential threats. The latest version features expanded visibility metrics, custom threat modeling capabilities, and improved context enrichment through integrations with additional security technologies.
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...Harry McLaren We’ll be exploring some of the more advanced capabilities of Phantom and also discussing the security framework from MITRE “ATT&CK” and it’s valued use when integrating it with Splunk Enterprise! We’ll also have two SplunkTrust members available for some general Q&A in our own ‘Meet the Experts’.
- Splunk Phantom Workbook Automation - SOAR (Security Orchestration, Automation & Response)
-- Tom Wise (Phantom Security Solutions Engineer & Trainer)
- Threat Hunting, Or: How I Learned to Stop Worrying & Love ATT&CK
-- Cian Heasley / Fraser Dumayne (Security Engineers)
- Meet the Experts with SplunkTrust
-- Harry McLaren (Senior Splunk Consultant)
-- Tom Wise (Splunk Consultant, Phantom Security Solutions Engineer & Trainer)
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics 
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics Harry McLaren This document provides an agenda and summaries for a Splunk User Group meeting in Edinburgh in April 2017. The meeting will include presentations and demos on building Splunk apps, development paths and certification, and Splunk User Behavior Analytics. The introductory presentation will be given by Harry McLaren from ECS and will provide background on ECS and the Splunk User Group. Additional presentations will cover building custom Splunk apps using both the web interface and direct XML editing, and paths for Splunk certification. The final presentation will demo Splunk UBA for detecting insider threats and advanced adversaries. Attendees are encouraged to discuss in-house developed apps and get involved in the Splunk community.
Getting Started with Splunk Breakout Session
Getting Started with Splunk Breakout SessionSplunk Splunk is a software platform that allows users to search, monitor, and analyze machine-generated big data via a web-style interface. It collects and indexes data from various sources like servers, networks, sensors, and applications. Splunk is used by over 9,000 customers across various industries for security intelligence, IT operations, and business analytics. It offers role-based access controls, multi-tenancy, and secure data transmission. Splunk components include universal forwarders for data collection, indexers for data storage, and search heads for data presentation.
Taking Splunk to the Next Level - Manager
Taking Splunk to the Next Level - ManagerSplunk Splunk can help customers document business value by providing deliverables like business cases, value realization studies, and adoption roadmaps. It has helped over 700 customers worldwide since 2013. Key value drivers reported by customers include IT operations, application delivery, security, and compliance. Common challenges to documenting value include lack of tools, benchmarks, and time. The document outlines best practices for positioning value at Splunk, including quantifying business value, qualifying pain points, aligning with objectives, and measuring success. It provides examples of value drivers achieved in areas like infrastructure optimization, revenue growth, and risk reduction.
WhiteSource Webinar-New Research Reveals Key Strategy to Manage Open Source S...
WhiteSource Webinar-New Research Reveals Key Strategy to Manage Open Source S...WhiteSource In our joint webinar with 451 Research, we discussed the key strategies to manage your open source security
The Hidden Empires of Malware with TLS Certified Hypotheses and Machine Learning
The Hidden Empires of Malware with TLS Certified Hypotheses and Machine LearningRyan Kovar The “threat hunting” landscape has drastically changed due to the increase in encrypted transport layer security (TLS) Internet traffic. The days of adversaries registering domains with their given names are gone, and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered tactics, techniques, and procedures, adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks. This talk focuses on expanding on techniques that have been researched and presented at various conferences by Mark Parsons, and specifically on his methods for using TLS certificates to find malicious malware infrastructure. We will build on Parsons’ body of work and show how his approach to malware certificate hunting can be expanded to detect instances of PowerShell Empire servers that have self-generated SSL certifications on port 443 and 8080. These certificates have a unique fingerprint that can be detected by leveraging tools like zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future. Finally, we will discuss our creation of hypotheses, codes and techniques, and methods of validation for verification. We’ll then release our tools and methodology for use by the community to explore other potential “hidden empires” of malware
Hidden empires of malware
Hidden empires of malwareRyan Kovar The landscape of "threat hunting" has drastically changed due to the increase in TLS encrypted Internet traffic. The days of adversaries registering domains with their given names are gone and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered TTPs, the adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks.
Our talk focuses on expanding upon techniques that have been researched and presented on at various conferences by Mark Parsons, specifically, his methods for using TLS certificates to find malicious malware infrastructure. We will build upon Parsons' corpus of work and show how his approach to malware certificate hunting can be expanded upon to detect instances of PowerShell Empire servers that have self-generated SSL certs on port 443 and 8080. These certificates have a unique finger print that can be detected by leveraging tools like zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future. Finally, we will discuss our hypotheses creation, our code and techniques, methods of validation for verification, and release our tools and methodology for use by the community to explore other "hidden empires" of malware that may exist.
Ad
More Related Content
Similar to stoQing your Splunk (20)
Splunk Enterprise for InfoSec Hands-On Breakout Session
Splunk Enterprise for InfoSec Hands-On Breakout SessionSplunk This document provides an agenda and overview of a Splunk Enterprise security workshop focusing on web attacks, lateral movement, and DNS exfiltration. The agenda includes introductions, demonstrations of SQL injection detection using regular expressions, detecting lateral movement through abnormal network traffic patterns, and using Shannon entropy and subdomain length to identify DNS exfiltration. Hands-on exercises are provided to allow attendees to search pre-loaded machine data and gain experience detecting these common security incidents.
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior AnalyticsSplunk This session will review Splunk’s two premium solutions - Splunk Enterprise Security (ES) is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and
incident response environments. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams.
2016 virus bulletin
2016 virus bulletinAdrian Sanabria Endpoint threats have entered a new era, and the security industry has been rushing to catch up. The result is a highly fragmented and confusing market that has doubled in size to over 70 vendors in the last four years. We're in the midst of the second great endpoint security consolidation and will discuss precisely what that means. We'll discuss six progressive stages endpoint security will work through as this market continues to mature over the next five years or so.
Splunk for Enterprise Security Featuring UBA
Splunk for Enterprise Security Featuring UBASplunk This document provides an overview and summary of Splunk's security products, including Enterprise Security and User Behavior Analytics. It discusses the key capabilities and features of these products, such as detecting advanced cyberattacks, identifying insider threats through machine learning, and integrating UBA with SIEM for improved threat detection. New features in recent versions are highlighted, like custom threat modeling and enhanced visibility into user, device, application, and protocol activity. Customer testimonials praise Splunk UBA's data-science approach to finding hidden threats.
Introduction to Splunk Presentation (DevOps)
Introduction to Splunk Presentation (DevOps)Knoldus Inc. As simply as possible, we offer a big data platform that can help you do a lot of things better. Using Splunk the right way powers cybersecurity, observability, network operations and a whole bunch of important tasks that large organizations require.
Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security and User Behavior AnalyticsSplunk This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Splunk at Sabre
Splunk at SabreSplunk - John Bland is a senior software developer at Sabre who is responsible for Splunk implementation and uses it extensively in his work.
- Before Splunk, Sabre struggled to view logs from different locations and applications in a centralized way and had to manually search through logs.
- Sabre now uses Splunk across multiple environments to gain visibility into applications, monitor performance, streamline development processes, and improve support capabilities.
- Splunk has helped Sabre improve uptime, reduce troubleshooting time, and provide better support to internal teams and customers. Sabre continues expanding their use of Splunk across more processes.
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior AnalyticsSplunk This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk for Enterprise Security featuring UBA Breakout SessionSplunk This document provides an overview of a presentation given by Dave Herrald, a security architect at Splunk, on Splunk's Enterprise Security and User Behavior Analytics solutions. The presentation covered new features in Splunk Enterprise Security 4.1, including enhanced threat intelligence integration, risk-based searching and incident review, and integration with Splunk User Behavior Analytics. It also reviewed capabilities in Splunk User Behavior Analytics 2.2 like custom threat modeling, expanded attack coverage, and context enrichment.
Splunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk The document is a presentation on cyber security trends and Splunk security products from Matthias Maier, Product Marketing Director for Security at Splunk. The presentation covers trends in security operations like the evolution of SOCs, new security roles, and data-centric security approaches. It also provides updates on Splunk's security portfolio including recognition as a leader in SIEM by Gartner and growth in the SIEM market. Maier highlights some breakout sessions from the conference on topics like asset defense, machine learning, and building detections.
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk Splunk Enterprise is a software platform for searching, monitoring, and analyzing machine-generated big data, such as logs, metrics, and mobile data. The presentation provided an overview of Splunk Enterprise capabilities including: live demonstrations of installing Splunk, searching data, creating dashboards and alerts. It also covered Splunk deployment architectures for scaling from single instances to distributed environments supporting hundreds of terabytes per day.
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseShannon Cuthbertson This document provides an overview and demonstration of Splunk Enterprise. It discusses Splunk's capabilities for indexing, searching, and analyzing machine data from various sources. The live demonstration shows how to install Splunk, import sample data, perform searches, create dashboards and alerts. It also covers Splunk's deployment architecture and scalability options. Attendees are encouraged to ask questions on Splunk's online communities and support channels.
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
Endpoint (big) Data In The Age of Compromise, Ian RainsburghNapier University This document summarizes a presentation on leveraging big data in cybersecurity. It discusses how current security challenges include breaches occurring within minutes while most go undiscovered for months or years. Inside-out security is proposed to detect both known and unknown threats using deep endpoint visibility and activity correlation. This allows proactive detection, assessment of sensitive data and risks, automated incident response, and recovery to reduce breach discovery times.
SplunkLive! Paris 2016 - Plenary session
SplunkLive! Paris 2016 - Plenary sessionSplunk Splunk provides a platform for operational intelligence that allows users to analyze machine data from any source. The document discusses Splunk products and solutions for IT service management, security intelligence, and Internet of Things applications. Splunk has over 11,000 customers across various industries.
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk for Enterprise Security featuring UBA Breakout SessionSplunk Splunk User Behavior Analytics (UBA) 2.2 provides enhanced security analytics and detection capabilities. It uses machine learning to establish baseline behaviors and detect anomalies. UBA analyzes activities across users, hosts, networks, applications and data to identify potential threats. The latest version features expanded visibility metrics, custom threat modeling capabilities, and improved context enrichment through integrations with additional security technologies.
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...Harry McLaren We’ll be exploring some of the more advanced capabilities of Phantom and also discussing the security framework from MITRE “ATT&CK” and it’s valued use when integrating it with Splunk Enterprise! We’ll also have two SplunkTrust members available for some general Q&A in our own ‘Meet the Experts’.
- Splunk Phantom Workbook Automation - SOAR (Security Orchestration, Automation & Response)
-- Tom Wise (Phantom Security Solutions Engineer & Trainer)
- Threat Hunting, Or: How I Learned to Stop Worrying & Love ATT&CK
-- Cian Heasley / Fraser Dumayne (Security Engineers)
- Meet the Experts with SplunkTrust
-- Harry McLaren (Senior Splunk Consultant)
-- Tom Wise (Splunk Consultant, Phantom Security Solutions Engineer & Trainer)
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics Harry McLaren This document provides an agenda and summaries for a Splunk User Group meeting in Edinburgh in April 2017. The meeting will include presentations and demos on building Splunk apps, development paths and certification, and Splunk User Behavior Analytics. The introductory presentation will be given by Harry McLaren from ECS and will provide background on ECS and the Splunk User Group. Additional presentations will cover building custom Splunk apps using both the web interface and direct XML editing, and paths for Splunk certification. The final presentation will demo Splunk UBA for detecting insider threats and advanced adversaries. Attendees are encouraged to discuss in-house developed apps and get involved in the Splunk community.
Getting Started with Splunk Breakout Session
Getting Started with Splunk Breakout SessionSplunk Splunk is a software platform that allows users to search, monitor, and analyze machine-generated big data via a web-style interface. It collects and indexes data from various sources like servers, networks, sensors, and applications. Splunk is used by over 9,000 customers across various industries for security intelligence, IT operations, and business analytics. It offers role-based access controls, multi-tenancy, and secure data transmission. Splunk components include universal forwarders for data collection, indexers for data storage, and search heads for data presentation.
Taking Splunk to the Next Level - Manager
Taking Splunk to the Next Level - ManagerSplunk Splunk can help customers document business value by providing deliverables like business cases, value realization studies, and adoption roadmaps. It has helped over 700 customers worldwide since 2013. Key value drivers reported by customers include IT operations, application delivery, security, and compliance. Common challenges to documenting value include lack of tools, benchmarks, and time. The document outlines best practices for positioning value at Splunk, including quantifying business value, qualifying pain points, aligning with objectives, and measuring success. It provides examples of value drivers achieved in areas like infrastructure optimization, revenue growth, and risk reduction.
WhiteSource Webinar-New Research Reveals Key Strategy to Manage Open Source S...
WhiteSource Webinar-New Research Reveals Key Strategy to Manage Open Source S...WhiteSource In our joint webinar with 451 Research, we discussed the key strategies to manage your open source security
More from Ryan Kovar (6)
The Hidden Empires of Malware with TLS Certified Hypotheses and Machine Learning
The Hidden Empires of Malware with TLS Certified Hypotheses and Machine LearningRyan Kovar The “threat hunting” landscape has drastically changed due to the increase in encrypted transport layer security (TLS) Internet traffic. The days of adversaries registering domains with their given names are gone, and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered tactics, techniques, and procedures, adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks. This talk focuses on expanding on techniques that have been researched and presented at various conferences by Mark Parsons, and specifically on his methods for using TLS certificates to find malicious malware infrastructure. We will build on Parsons’ body of work and show how his approach to malware certificate hunting can be expanded to detect instances of PowerShell Empire servers that have self-generated SSL certifications on port 443 and 8080. These certificates have a unique fingerprint that can be detected by leveraging tools like zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future. Finally, we will discuss our creation of hypotheses, codes and techniques, and methods of validation for verification. We’ll then release our tools and methodology for use by the community to explore other potential “hidden empires” of malware
Hidden empires of malware
Hidden empires of malwareRyan Kovar The landscape of "threat hunting" has drastically changed due to the increase in TLS encrypted Internet traffic. The days of adversaries registering domains with their given names are gone and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered TTPs, the adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks.
Our talk focuses on expanding upon techniques that have been researched and presented on at various conferences by Mark Parsons, specifically, his methods for using TLS certificates to find malicious malware infrastructure. We will build upon Parsons' corpus of work and show how his approach to malware certificate hunting can be expanded upon to detect instances of PowerShell Empire servers that have self-generated SSL certs on port 443 and 8080. These certificates have a unique finger print that can be detected by leveraging tools like zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future. Finally, we will discuss our hypotheses creation, our code and techniques, methods of validation for verification, and release our tools and methodology for use by the community to explore other "hidden empires" of malware that may exist.
10(?) holiday gifts for the SOC who has everything
10(?) holiday gifts for the SOC who has everythingRyan Kovar Automating your organization’s security operations is no longer optional. It’s essential. Increasing analyst productivity and decreasing response time can mean the difference between successfully containing an attack, and suffering a devastating breach. This talk will focus on
ten practical automation techniques—each implemented in either Python or PowerShell—
that extend the functionality of a popular commercial SIEM. Each technique will demonstrate how to automatically gather additional context on an alert, make configuration changes in an operational environment, or retrieve and analyze forensic evidence. Proof of concept code samples and live/recorded demonstrations will be provided.
SOCs for the rest of us
SOCs for the rest of usRyan Kovar In this talk we will discuss key traits of some of the largest and most successful security operations centers we’ve visited over the last two years. From automating tier-1 to integrating investigations into Slack channels, from curating toolchains to cutting out threat feeds, we’ll cover what’s working well and what challenges remain. Many industry verticals will be represented including financial services, multi-national conglomerates, entertainment, healthcare, energy, defense, technology, and dynamic internet startups.
How to be employed at the SOC of tomorrow... today.
How to be employed at the SOC of tomorrow... today.Ryan Kovar For years’ information security professionals have become used to 0% unemployment. However, machine learning is beginning to radically change the information security landscape. How do we deal with these upcoming shifts in technologies and skillsets? This talk focuses on what those changes are and how employees and employers can prepare for the SOC of tomorrow.
Threat Intelligence Victory Garden
Threat Intelligence Victory GardenRyan Kovar - The document discusses threat intelligence and provides an agenda for the presentation. It includes a disclaimer stating that any statements about future plans are subject to change and the names and examples are fictional.
- The presentation covers an overview of threat intelligence, why it's important, what threat intelligence is, how to implement it, and concludes with examples of done.
- The document contains instructions and suggestions for how to leverage internal security awareness data, decoy documents, passive DNS, and other free threat intelligence sources to build your own threat intelligence program.
Ad
Recently uploaded (20)
Avast Premium Security Crack FREE Latest Version 2025
Avast Premium Security Crack FREE Latest Version 2025mu394968 🌍📱👉COPY LINK & PASTE ON GOOGLE https://dr-kain-geera.info/👈🌍
Avast Premium Security is a paid subscription service that provides comprehensive online security and privacy protection for multiple devices. It includes features like antivirus, firewall, ransomware protection, and website scanning, all designed to safeguard against a wide range of online threats, according to Avast.
Key features of Avast Premium Security:
Antivirus: Protects against viruses, malware, and other malicious software, according to Avast.
Firewall: Controls network traffic and blocks unauthorized access to your devices, as noted by All About Cookies.
Ransomware protection: Helps prevent ransomware attacks, which can encrypt your files and hold them hostage.
Website scanning: Checks websites for malicious content before you visit them, according to Avast.
Email Guardian: Scans your emails for suspicious attachments and phishing attempts.
Multi-device protection: Covers up to 10 devices, including Windows, Mac, Android, and iOS, as stated by 2GO Software.
Privacy features: Helps protect your personal data and online privacy.
In essence, Avast Premium Security provides a robust suite of tools to keep your devices and online activity safe and secure, according to Avast.
Mastering Fluent Bit: Ultimate Guide to Integrating Telemetry Pipelines with ...
Mastering Fluent Bit: Ultimate Guide to Integrating Telemetry Pipelines with ...Eric D. Schabell It's time you stopped letting your telemetry data pressure your budgets and get in the way of solving issues with agility! No more I say! Take back control of your telemetry data as we guide you through the open source project Fluent Bit. Learn how to manage your telemetry data from source to destination using the pipeline phases covering collection, parsing, aggregation, transformation, and forwarding from any source to any destination. Buckle up for a fun ride as you learn by exploring how telemetry pipelines work, how to set up your first pipeline, and exploring several common use cases that Fluent Bit helps solve. All this backed by a self-paced, hands-on workshop that attendees can pursue at home after this session (https://o11y-workshops.gitlab.io/workshop-fluentbit).
Maxon CINEMA 4D 2025 Crack FREE Download LINK
Maxon CINEMA 4D 2025 Crack FREE Download LINKyounisnoman75 ⭕️➡️ FOR DOWNLOAD LINK : http://drfiles.net/ ⬅️⭕️
Maxon Cinema 4D 2025 is the latest version of the Maxon's 3D software, released in September 2024, and it builds upon previous versions with new tools for procedural modeling and animation, as well as enhancements to particle, Pyro, and rigid body simulations. CG Channel also mentions that Cinema 4D 2025.2, released in April 2025, focuses on spline tools and unified simulation enhancements.
Key improvements and features of Cinema 4D 2025 include:
Procedural Modeling: New tools and workflows for creating models procedurally, including fabric weave and constellation generators.
Procedural Animation: Field Driver tag for procedural animation.
Simulation Enhancements: Improved particle, Pyro, and rigid body simulations.
Spline Tools: Enhanced spline tools for motion graphics and animation, including spline modifiers from Rocket Lasso now included for all subscribers.
Unified Simulation & Particles: Refined physics-based effects and improved particle systems.
Boolean System: Modernized boolean system for precise 3D modeling.
Particle Node Modifier: New particle node modifier for creating particle scenes.
Learning Panel: Intuitive learning panel for new users.
Redshift Integration: Maxon now includes access to the full power of Redshift rendering for all new subscriptions.
In essence, Cinema 4D 2025 is a major update that provides artists with more powerful tools and workflows for creating 3D content, particularly in the fields of motion graphics, VFX, and visualization.
Pixologic ZBrush Crack Plus Activation Key [Latest 2025] New Version![Pixologic ZBrush Crack Plus Activation Key [Latest 2025] New Version](https://cdn.slidesharecdn.com/ss_thumbnails/fashionevolution2-250322112409-f76abaa7-250428124909-b51264ff-250504160528-fc2bb1c5-thumbnail.jpg?width=560&fit=bounds)
Pixologic ZBrush Crack Plus Activation Key [Latest 2025] New Versionsaimabibi60507 Copy & Past Link👉👉
https://dr-up-community.info/
Pixologic ZBrush, now developed by Maxon, is a premier digital sculpting and painting software renowned for its ability to create highly detailed 3D models. Utilizing a unique "pixol" technology, ZBrush stores depth, lighting, and material information for each point on the screen, allowing artists to sculpt and paint with remarkable precision .
Scaling GraphRAG: Efficient Knowledge Retrieval for Enterprise AI
Scaling GraphRAG: Efficient Knowledge Retrieval for Enterprise AIdanshalev If we were building a GenAI stack today, we'd start with one question: Can your retrieval system handle multi-hop logic?
Trick question, b/c most can’t. They treat retrieval as nearest-neighbor search.
Today, we discussed scaling #GraphRAG at AWS DevOps Day, and the takeaway is clear: VectorRAG is naive, lacks domain awareness, and can’t handle full dataset retrieval.
GraphRAG builds a knowledge graph from source documents, allowing for a deeper understanding of the data + higher accuracy.
How Valletta helped healthcare SaaS to transform QA and compliance to grow wi...
How Valletta helped healthcare SaaS to transform QA and compliance to grow wi...Egor Kaleynik This case study explores how we partnered with a mid-sized U.S. healthcare SaaS provider to help them scale from a successful pilot phase to supporting over 10,000 users—while meeting strict HIPAA compliance requirements.
Faced with slow, manual testing cycles, frequent regression bugs, and looming audit risks, their growth was at risk. Their existing QA processes couldn’t keep up with the complexity of real-time biometric data handling, and earlier automation attempts had failed due to unreliable tools and fragmented workflows.
We stepped in to deliver a full QA and DevOps transformation. Our team replaced their fragile legacy tests with Testim’s self-healing automation, integrated Postman and OWASP ZAP into Jenkins pipelines for continuous API and security validation, and leveraged AWS Device Farm for real-device, region-specific compliance testing. Custom deployment scripts gave them control over rollouts without relying on heavy CI/CD infrastructure.
The result? Test cycle times were reduced from 3 days to just 8 hours, regression bugs dropped by 40%, and they passed their first HIPAA audit without issue—unlocking faster contract signings and enabling them to expand confidently. More than just a technical upgrade, this project embedded compliance into every phase of development, proving that SaaS providers in regulated industries can scale fast and stay secure.
Who Watches the Watchmen (SciFiDevCon 2025)
Who Watches the Watchmen (SciFiDevCon 2025)Allon Mureinik Tests, especially unit tests, are the developers’ superheroes. They allow us to mess around with our code and keep us safe.
We often trust them with the safety of our codebase, but how do we know that we should? How do we know that this trust is well-deserved?
Enter mutation testing – by intentionally injecting harmful mutations into our code and seeing if they are caught by the tests, we can evaluate the quality of the safety net they provide. By watching the watchmen, we can make sure our tests really protect us, and we aren’t just green-washing our IDEs to a false sense of security.
Talk from SciFiDevCon 2025
https://www.scifidevcon.com/courses/2025-scifidevcon/contents/680efa43ae4f5
Landscape of Requirements Engineering for/by AI through Literature Review
Landscape of Requirements Engineering for/by AI through Literature ReviewHironori Washizaki Hironori Washizaki, "Landscape of Requirements Engineering for/by AI through Literature Review," RAISE 2025: Workshop on Requirements engineering for AI-powered SoftwarE, 2025.
Kubernetes_101_Zero_to_Platform_Engineer.pptx
Kubernetes_101_Zero_to_Platform_Engineer.pptxCloudScouts Presentacion de la primera sesion de Zero to Platform Engineer
Meet the Agents: How AI Is Learning to Think, Plan, and Collaborate
Meet the Agents: How AI Is Learning to Think, Plan, and CollaborateMaxim Salnikov Imagine if apps could think, plan, and team up like humans. Welcome to the world of AI agents and agentic user interfaces (UI)! In this session, we'll explore how AI agents make decisions, collaborate with each other, and create more natural and powerful experiences for users.
F-Secure Freedome VPN 2025 Crack Plus Activation New Version
F-Secure Freedome VPN 2025 Crack Plus Activation New Versionsaimabibi60507 Copy & Past Link 👉👉
https://dr-up-community.info/
F-Secure Freedome VPN is a virtual private network service developed by F-Secure, a Finnish cybersecurity company. It offers features such as Wi-Fi protection, IP address masking, browsing protection, and a kill switch to enhance online privacy and security .
Exploring Code Comprehension in Scientific Programming: Preliminary Insight...
Exploring Code Comprehension in Scientific Programming: Preliminary Insight...University of Hawai‘i at Mānoa This presentation explores code comprehension challenges in scientific programming based on a survey of 57 research scientists. It reveals that 57.9% of scientists have no formal training in writing readable code. Key findings highlight a "documentation paradox" where documentation is both the most common readability practice and the biggest challenge scientists face. The study identifies critical issues with naming conventions and code organization, noting that 100% of scientists agree readable code is essential for reproducible research. The research concludes with four key recommendations: expanding programming education for scientists, conducting targeted research on scientific code quality, developing specialized tools, and establishing clearer documentation guidelines for scientific software.
Presented at: The 33rd International Conference on Program Comprehension (ICPC '25)
Date of Conference: April 2025
Conference Location: Ottawa, Ontario, Canada
Preprint: https://arxiv.org/abs/2501.10037
Download YouTube By Click 2025 Free Full Activated
Download YouTube By Click 2025 Free Full Activatedsaniamalik72555 Copy & Past Link 👉👉
https://dr-up-community.info/
"YouTube by Click" likely refers to the ByClick Downloader software, a video downloading and conversion tool, specifically designed to download content from YouTube and other video platforms. It allows users to download YouTube videos for offline viewing and to convert them to different formats.
Societal challenges of AI: biases, multilinguism and sustainability
Societal challenges of AI: biases, multilinguism and sustainabilityJordi Cabot Towards a fairer, inclusive and sustainable AI that works for everybody.
Reviewing the state of the art on these challenges and what we're doing at LIST to test current LLMs and help you select the one that works best for you
Salesforce Data Cloud- Hyperscale data platform, built for Salesforce.
Salesforce Data Cloud- Hyperscale data platform, built for Salesforce.Dele Amefo Salesforce Data Cloud- Hyperscale data platform, built for Salesforce.
Top 10 Client Portal Software Solutions for 2025.docx
Top 10 Client Portal Software Solutions for 2025.docxPortli Discover the top 10 client portal software solutions for 2025. Streamline communication, ensure security, and enhance client experience.
Adobe Illustrator Crack FREE Download 2025 Latest Version
Adobe Illustrator Crack FREE Download 2025 Latest Versionkashifyounis067 🌍📱👉COPY LINK & PASTE ON GOOGLE http://drfiles.net/ 👈🌍
Adobe Illustrator is a powerful, professional-grade vector graphics software used for creating a wide range of designs, including logos, icons, illustrations, and more. Unlike raster graphics (like photos), which are made of pixels, vector graphics in Illustrator are defined by mathematical equations, allowing them to be scaled up or down infinitely without losing quality.
Here's a more detailed explanation:
Key Features and Capabilities:
Vector-Based Design:
Illustrator's foundation is its use of vector graphics, meaning designs are created using paths, lines, shapes, and curves defined mathematically.
Scalability:
This vector-based approach allows for designs to be resized without any loss of resolution or quality, making it suitable for various print and digital applications.
Design Creation:
Illustrator is used for a wide variety of design purposes, including:
Logos and Brand Identity: Creating logos, icons, and other brand assets.
Illustrations: Designing detailed illustrations for books, magazines, web pages, and more.
Marketing Materials: Creating posters, flyers, banners, and other marketing visuals.
Web Design: Designing web graphics, including icons, buttons, and layouts.
Text Handling:
Illustrator offers sophisticated typography tools for manipulating and designing text within your graphics.
Brushes and Effects:
It provides a range of brushes and effects for adding artistic touches and visual styles to your designs.
Integration with Other Adobe Software:
Illustrator integrates seamlessly with other Adobe Creative Cloud apps like Photoshop, InDesign, and Dreamweaver, facilitating a smooth workflow.
Why Use Illustrator?
Professional-Grade Features:
Illustrator offers a comprehensive set of tools and features for professional design work.
Versatility:
It can be used for a wide range of design tasks and applications, making it a versatile tool for designers.
Industry Standard:
Illustrator is a widely used and recognized software in the graphic design industry.
Creative Freedom:
It empowers designers to create detailed, high-quality graphics with a high degree of control and precision.
What Do Contribution Guidelines Say About Software Testing? (MSR 2025)
What Do Contribution Guidelines Say About Software Testing? (MSR 2025)Andre Hora Software testing plays a crucial role in the contribution process of open-source projects. For example, contributions introducing new features are expected to include tests, and contributions with tests are more likely to be accepted. Although most real-world projects require contributors to write tests, the specific testing practices communicated to contributors remain unclear. In this paper, we present an empirical study to understand better how software testing is approached in contribution guidelines. We analyze the guidelines of 200 Python and JavaScript open-source software projects. We find that 78% of the projects include some form of test documentation for contributors. Test documentation is located in multiple sources, including CONTRIBUTING files (58%), external documentation (24%), and README files (8%). Furthermore, test documentation commonly explains how to run tests (83.5%), but less often provides guidance on how to write tests (37%). It frequently covers unit tests (71%), but rarely addresses integration (20.5%) and end-to-end tests (15.5%). Other key testing aspects are also less frequently discussed: test coverage (25.5%) and mocking (9.5%). We conclude by discussing implications and future research.
Adobe After Effects Crack FREE FRESH version 2025
Adobe After Effects Crack FREE FRESH version 2025kashifyounis067 🌍📱👉COPY LINK & PASTE ON GOOGLE http://drfiles.net/ 👈🌍
Adobe After Effects is a software application used for creating motion graphics, special effects, and video compositing. It's widely used in TV and film post-production, as well as for creating visuals for online content, presentations, and more. While it can be used to create basic animations and designs, its primary strength lies in adding visual effects and motion to videos and graphics after they have been edited.
Here's a more detailed breakdown:
Motion Graphics:
.
After Effects is powerful for creating animated titles, transitions, and other visual elements to enhance the look of videos and presentations.
Visual Effects:
.
It's used extensively in film and television for creating special effects like green screen compositing, object manipulation, and other visual enhancements.
Video Compositing:
.
After Effects allows users to combine multiple video clips, images, and graphics to create a final, cohesive visual.
Animation:
.
It uses keyframes to create smooth, animated sequences, allowing for precise control over the movement and appearance of objects.
Integration with Adobe Creative Cloud:
.
After Effects is part of the Adobe Creative Cloud, a suite of software that includes other popular applications like Photoshop and Premiere Pro.
Post-Production Tool:
.
After Effects is primarily used in the post-production phase, meaning it's used to enhance the visuals after the initial editing of footage has been completed.
How to Batch Export Lotus Notes NSF Emails to Outlook PST Easily?
How to Batch Export Lotus Notes NSF Emails to Outlook PST Easily?steaveroggers Migrating from Lotus Notes to Outlook can be a complex and time-consuming task, especially when dealing with large volumes of NSF emails. This presentation provides a complete guide on how to batch export Lotus Notes NSF emails to Outlook PST format quickly and securely. It highlights the challenges of manual methods, the benefits of using an automated tool, and introduces eSoftTools NSF to PST Converter Software — a reliable solution designed to handle bulk email migrations efficiently. Learn about the software’s key features, step-by-step export process, system requirements, and how it ensures 100% data accuracy and folder structure preservation during migration. Make your email transition smoother, safer, and faster with the right approach.
Read More:- https://www.esofttools.com/nsf-to-pst-converter.html
Exploring Code Comprehension in Scientific Programming: Preliminary Insight...
Exploring Code Comprehension in Scientific Programming: Preliminary Insight...University of Hawai‘i at Mānoa
Ad
stoQing your Splunk
- 1. stoQ’ing your Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016
- 2. Ryan Kovar • Staff Security Strategist @Splunk • Does Security things and then talks about them • 17+ years defending networks private sector Marcus LaFerrera • Director of Development @PUNCH • Lead stoQ Developer • 18+ years supporting the government
- 3. Agenda • Overview of stoQ • Overview of Splunk • A DFIR use case walk through • Questions
- 4. TOOL * N == :( NOTHING COMMUNICATES " AND MOST TOOLS REQUIRE MANUAL INTERACTION"
- 5. HOW’S THE WEATHER OUT THERE OLLIE? IT’S CYBER
- 6. stoQ
- 7. STOQ IS A FRAMEWORK THAT ENABLES EVERYONE TO AUTOMATE PROCESSES, ANALYTICS, AND JUST ABOUT ANYTHING ELSE
- 8. AUTOMATE AND REDUCE THE MAJORITY OF YOUR MOST MUNDANE ANALYTIC TASKS
- 9. LEVERAGE ALL OF YOUR TOOLS SIMULTANEOUSLY, AND SAVE THOSE RESULTS FOR LATER
- 10. IT’S A FORCE MULTIPLIER
- 11. LOOK AT YOUR DATA, RATHER THAN SEEKING WAYS TO CAPTURE OR PRODUCE IT
- 12. COMMAND LINE, INTERACTIVE SHELL, OR FULLY AUTOMATED
- 13. EVERYTHING IS A PLUGIN, FROM INPUT TO OUTPUT AND EVERYTHING IN BETWEEN
- 14. Tell me more about Plugins… • Very simple and easy to write • Lots of documentation and examples • stoQ does most of the heavy lifting
- 15. Over 40 stoQ Plugins Available • E-mail Parser • VTMIS • TotalHash • Yara • Censys • Fireeye • IOC Extract • Pastebin • PassiveTotal • ClamAV • Opswat • TRiD • RabbitMQ • Suricata • Tika • PEinfo • Excel • XOR • Base64 • Bit RotaKon • Bro Intel • Fluentd • Google Cloud Storage • Amazon S3 • Slack • ThreatCrowd • MongoDB • ElasKcSearch • Exif • And many more…
- 16. IT’S OPENSOURCED
- 21. Monitor & Alert Search & InvesCgate Custom Dashboards & Reports AnalyCcs & VisualizaCon Meets Key Needs of SOC Personnel Splunk Can Ingest ALL THE DATA Real-Cme Machine Data Cloud Apps Servers Email Web Network Flows DHCP/ DNS Custom Apps Badges Intrusion DetecKon Firewall Data Loss PrevenKon AnK-Malware Vulnerability Scans AuthenKcaKon Storage Industrial Control Mobile Security Intelligence PlaOorm Threat Feeds Asset Info Employee Info Data Stores Network Segments External Lookups / Enrichment
- 22. Then Build Security Dashboards Incident InvesCgaCons & Management Dashboards and Reports StaCsCcal Outliers Asset and IdenCty Aware 22
- 24. The Splunk App for stoQ
- 25. THE STOQ DFIR APP FOR SPLUNK! • ALLOWS YOU TO VISUALIZE STOQ RESULTS • MAKE CONNECTIONS THAT WERE DIFFICULT TO SEE BEFORE • QUICKLY PIVOT TO NEW DATA SOURCES • APPLY THREAT INTELLIGENCE TO STOQ DATA
- 26. A DFIR Scenario
- 27. You are an analyst at a Fortune 100 company
- 28. A user reports an email with a suspicious attachment
- 29. We need to quickly identify if the file is good or bad
- 37. WHERE DO I GET ALL OF THIS INCREDIBLENESS??? https://splunkbase.splunk.com/app/3196/ http://stoq.punchcyber.com