1. SQRRLTHREAT HUNTING PLATFORM
ADAM FUCHS
CTO, SQRRL
COMMITTER, ACCUMULO
MEMBER, ASF

2. © 2016 Sqrrl Data, Inc. All rights reserved.
2
Accelerating Investigations

3. © 2016 Sqrrl Data, Inc. All rights reserved.
3
The SqrrlThreat Hunting Platform
SECURITY DATA
NETWORK DATA
ENDPOINT/IDENTITY DATA
Firewall / IDS Threat
Intel
Bro
SIEM
Alerts
NetflowProxy
ProcessesHR

4. © 2016 Sqrrl Data, Inc. All rights reserved.
4
Sqrrl Architecture
Visualization + API
Physical
Data Storage
Data Model
Processing
Interface
Audit
Encryption
Labeling+Policy
Query Engine:
Accumulo Iterators
Bulk/Graph Processing:
YARN + Spark
Raw Events Linked Data
HDFS Accumulo+
Commodity Hardware

5. © 2016 Sqrrl Data, Inc. All rights reserved.
5
The Apache Accumulo Project
Accumulo Stores Sorted Key,Value Pairs
High Performance Writes
Great Scalability
Embedded Processing (Iterators)
We leverage Accumulo for:
Low-Latency Information Retrieval
Indexing
Distributed Processing
GraphOrganization
Ingest-Time Aggregation
Secure Storage

6. Behavioral Analytics

7. © 2016 Sqrrl Data, Inc. All rights reserved.
7
Attack Chain Behavior detection
Adversary behavior is modeled based on a kill chain
Kill chain alignment of behavior detection analytics:
Helps to determine attack penetration and risk
Supports arguments of completeness of detection coverage

8. © 2016 Sqrrl Data, Inc. All rights reserved.
8
Kill Chain-Based Behavioral Analytic Example
• Lateral
Movement:
Multiple host
logins,
credential
theft
• Active
Directory
• Windows
event logs
• Unsupervised
machine
learning for
rarity
detection
• Graph
algorithm for
chaining
• Analyst
whitelisting
of false
positives

9. © 2016 Sqrrl Data, Inc. All rights reserved.
9
Collating Results ForVisualization and Analysis
Behavioral Analytics Entity Risk Scoring
Raw Data
Modeled Data (Graph)
API Applications
AnalyticsAnalyticsAnalyticsAnalytics

10. Target. Hunt. Disrupt.