SplunkLive! London 2016 Operational Security Intelligence
•
2 likes•326 views
Security Track session
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Similar to SplunkLive! London 2016 Operational Security Intelligence
Similar to SplunkLive! London 2016 Operational Security Intelligence (20)
More from Splunk
More from Splunk (20)
Recently uploaded
Recently uploaded (20)
SplunkLive! London 2016 Operational Security Intelligence
- 2. 2 Splunk Live Security Track Today 13:00-14:00: Opera-onal Security Intelligence 14:00-15:00: Splunk for Enterprise Security featuring User Behavior Analy/cs 15:00-16:00: Cloud Breach – Detec/on and Response 16:00-17:00: Happy Hour 17:00 – 19:30: Splunk London User Group Mee8ng ê Register and more Info/Agenda: hOps://usergroups.splunk.com
- 4. 4 Who I am • Now Product Marke/ng Manager EMEA • 7 Years Consultant Security + Big Data • 3+ Years at Splunk, McAfee (Intel Security), Tibco LogLogic • worked with top organiza/ons across industries advising customers • CISSP, Cer/fied ethical Hacker
- 11. 11
- 12. 12
- 14. 14 Lone hacker…
- 25. 25 Alerts Alert 1 Alert 2 Host A Host B Accessing unusual network segments Malware Found but couldn’t be removed Worth an Investigation? Which one to investigate first?
- 28. Persist, Repeat Threat Intelligence Access/Iden-ty Endpoint Network AOacker, know relay/C2 sites, infected sites, IOC, aOack/campaign intent and aOribu/on Where they went to, who talked to whom, aOack transmiOed, abnormal traffic, malware download What process is running (malicious, abnormal, etc.) Process owner, registry mods, aOack/malware ar/facts, patching level, aOack suscep/bility Access level, privileged users, likelihood of infec/on, where they might be in kill chain • Third-party threat intel • Open-source blacklist • Internal threat intelligence • Firewall, IDS, IPS • DNS • Email • Endpoint (AV/IPS/FW) • Malware detec/on • PCLM • DHCP • OS logs • Patching • Ac/ve Directory • LDAP • CMDB • Opera/ng system • Database • VPN, AAA, SSO Data Sources Required • Web proxy • NetFlow • Network
- 29. 29 Risk Based Analy/cs Network Endpoint Access Threat Intelligence Rules/String/Regex matching Sta/s/cal outliers and anomalies Session and Behavior profiling Scoring and aggrega-on
- 30. 30 Alerts Alert 1 Alert 2 Host A Host B Accessing unusual network segments Malware Found but couldn’t be removed Worth an Investigation? Which one to investigate first?
- 33. 33 Demo 1
- 35. 35 Context and Intelligence Integrate across technologies Automated context matching Automated context acquisi/on Post processing and post analysis Threat Intelligence Asset & CMDB API/SDK Integra-ons Data Stores Applica-ons
- 36. 36 Alerts Alert 1 Alert 2 Host A Host B Accessing unusual network segments Malware Found but couldn’t be removed Worth an Investigation? Which one to investigate first?
- 37. 37 Alerts Alert 1 Alert 2 Host A Host B Accessing unusual network segments Malware Found but couldn’t be removed Risk Score Host A: 75 Risk Score Host B: 5 Worth an Investigation? Which one to investigate first?
- 38. 38 Alerts Alert 1 Alert 2 Host A Host B Accessing unusual network segments Malware Found but couldn’t be removed Risk Score Host A: 75 Risk Score Host B: 5 System Owner: Juergen Klopp Loca/on: Liverpool System Owner: Donald Duck Department: Duckburg Confiden/ality Level: High Confiden/ality Level: Low Worth an Investigation? Which one to investigate first?
- 42. 42 Connec/ng People and Data Human mediated automa/on Sharing and collabora/on Free form inves-ga-on – human intui-on Interact with views and workflows Any data, all data Automa/on Collabora/on Inves/ga/on Workflows All data
- 43. 43 Demo 2
- 48. 48
- 50. 50
- 51. 51 SPLUNK IS THE NERVE CENTER 51 App Endpoint/ Server Cloud Threat Intelligence Firewall Web Proxy Internal Network Security Iden/ty Network
- 54. 54 SEPT 26-29, 2016 WALT DISNEY WORLD, ORLANDO SWAN AND DOLPHIN RESORTS • 5000+ IT & Business Professionals • 3 days of technical content • 165+ sessions • 80+ Customer Speakers • 35+ Apps in Splunk Apps Showcase • 75+ Technology Partners • 1:1 networking: Ask The Experts and Security Experts, Birds of a Feather and Chalk Talks • NEW hands-on labs! • Expanded show floor, Dashboards Control Room & Clinic, and MORE! The 7th Annual Splunk Worldwide Users’ Conference PLUS Splunk University • Three days: Sept 24-26, 2016 • Get Splunk Cer/fied for FREE! • Get CPE credits for CISSP, CAP, SSCP • Save thousands on Splunk educa/on!