Splunk Webinar Best Practices für Incident Investigation

1. Copyright
©
2015
Splunk
Inc.
Best
Prac=ces
für
Incident
Inves=ga=on

2. Copyright
©
2015
Splunk
Inc.
Legal
No=ces
During
the
course
of
this
presenta=on,
we
may
make
forward-­‐looking
statements
regarding
future
events
or
the
expected
performance
of
the
company.
We
cau=on
you
that
such
statements
reflect
our
current
expecta=ons
and
es=mates
based
on
factors
currently
known
to
us
and
that
actual
events
or
results
could
differ
materially.
For
important
factors
that
may
cause
actual
results
to
differ
from
those
contained
in
our
forward-­‐looking
statements,
please
review
our
filings
with
the
SEC.
The
forward-­‐looking
statements
made
in
this
presenta=on
are
being
made
as
of
the
=me
and
date
of
its
live
presenta=on.
If
reviewed
aRer
its
live
presenta=on,
this
presenta=on
may
not
contain
current
or
accurate
informa=on.
We
do
not
assume
any
obliga=on
to
update
any
forward-­‐looking
statements
we
may
make.
In
addi=on,
any
informa=on
about
our
roadmap
outlines
our
general
product
direc=on
and
is
subject
to
change
at
any
=me
without
no=ce.
It
is
for
informa=onal
purposes
only
and
shall
not
be
incorporated
into
any
contract
or
other
commitment.
Splunk
undertakes
no
obliga=on
either
to
develop
the
features
or
func=onality
described
or
to
include
any
such
feature
or
func=onality
in
a
future
release.
2

3. Copyright
©
2015
Splunk
Inc.
Ihr
Webcast
Team
3
Ma#hias
Maier
Senior
Sales
Engineer
mmaier@splunk.com
Thomas
Huber
Major
Account
Manager
thuber@splunk.com

4. Copyright
©
2015
Splunk
Inc.
Agenda
! Splunk
Overview
! Best
Prac=ces
for
Scoping
Infec=ons
&
Disrup=ng
Breaches
! Live
Demo:
Incident
Inves=ga=on
! Q&A
4

5. 5
Make
machine
data
accessible,
usable
and
valuable
to
everyone.
5
5
5

6. Copyright
©
2015
Splunk
Inc.
COLLECT
DATA
FROM
ANYWHERE
SEARCH
AND
ANALYZE
EVERYTHING
GAIN
REAL-­‐TIME
OPERATIONAL
INTELLIGENCE
The
Power
of
Splunk
6

7. 7
Turning
Machine
Data
Into
Business
Value
Index
Untapped
Data:
Any
Source,
Type,
Volume
Online
Services
Web
Services
Servers
Security
GPS
Loca=on
Storage
Desktops
Networks
Packaged
Applica=ons
Custom
Applica=ons
Messaging
Telecoms
Online
Shopping
Cart
Web
Clickstreams
Databases
Energy
Meters
Call
Detail
Records
Smartphones
and
Devices
RFID
On-­‐
Premises
Private
Cloud
Public
Cloud
Ask
Any
QuesOon
ApplicaOon
Delivery
Security,
Compliance,
and
Fraud
IT
OperaOons
Business
AnalyOcs
Industrial
Data
and
the
Internet
of
Things

8. 8
Why
Splunk?
FAST
TIME-­‐TO-­‐VALUE
ONE
PLATFORM,
MULTIPLE
USE
CASES
VISIBILITY
ACROSS
STACK,
NOT
JUST
SILOS
ASK
ANY
QUESTION
OF
DATA
ANY
DATA,
ANY
SOURCE

9. Copyright
©
2015
Splunk
Inc.
Phases
of
Opera=onal
Intelligence
ReacOve
Search
and
Inves=gate
Proac=ve
Monitoring
and
Aler=ng
Opera=onal
Visibility
ProacOve
Real-­‐=me
Business
Insight

10. 10
Plahorm
for
Applica=on
Delivery
and
IT
Opera=ons
ROOT
CAUSE
AND
ISSUE
RESOLUTION
PROACTIVE
MONITORING
AND
REAL-­‐TIME
ALERTING
DELIVER
BETTER
QUALITY
CODE
FASTER
CLOUD
APP
AND
INFRASTRUCTURE
MONITORING
MOBILE
APP
TROUBLESHOOTING
USER
&
USAGE
ANALYTICS

11. 11
Single
Plahorm
for
Security
Intelligence
SECURITY
&
COMPLIANCE
REPORTING
REAL-­‐TIME
MONITORING
OF
KNOWN
THREATS
DETECT
UNKNOWN
THREATS
INCIDENT
INVESTIGATIONS
&
FORENSICS
FRAUD
DETECTION
INSIDER
THREAT
Splunk
Complements,
Replaces
and
Goes
Beyond
Exis=ng
SIEMs

12. 12
Single
Plahorm
for
Security
Intelligence
SECURITY
&
COMPLIANCE
REPORTING
REAL-­‐TIME
MONITORING
OF
KNOWN
THREATS
DETECT
UNKNOWN
THREATS
INCIDENT
INVESTIGATIONS
&
FORENSICS
FRAUD
DETECTION
INSIDER
THREAT
Splunk
Complements,
Replaces
and
Goes
Beyond
Exis=ng
SIEMs

13. Copyright
©
2015
Splunk
Inc.
Best
Prac=ces
for
Scoping
Infec=ons
&
Disrup=ng
Breaches
13

14. Copyright
©
2015
Splunk
Inc.
14
Source:
Mandiant
M-­‐Trends
Report
2012/2013/2014
67%
Vic=ms
no=fied
by
external
en=ty
100%
Valid
creden=als
were
used
229
Median
#
of
days
before
detec=on
The
Ever-­‐changing
Threat
Landscape

15. Copyright
©
2015
Splunk
Inc.
15
Threat
Intelligence
Network
Endpoint
Access/Iden=ty
Data
Sources
Required

16. Copyright
©
2015
Splunk
Inc.
Data
Sources
Required
Persist,
Repeat
Known
relay/C2
sites,
infected
sites,
IOC,
amack/
campaign
intent
and
amribu=on
Who
talked
to
whom,
traffic,
malware
download/
delivery,
C2,
exfiltra=on,
lateral
movement
Running
process,
services,
process
owner,
registry
mods,
file
system
changes,
patching
level,
network
connec=ons
by
process/service
Access
level,
privileged
use/escala=on,
system
ownership,
user/system/service
business
cri=cality
16
• 3rd
party
Threat
Intel
• Open
source
blacklist
• Internal
threat
intelligence
• Firewall,
IDS,
IPS
• DNS
• Email
• Web
Proxy
• NetFlow
• Network
• AV/IPS/FW
• Malware
detec=on
• Config
Management
• Performance
• OS
logs
• File
System
• Directory
Services
• Asset
Mgmt
• Authen=ca=on
Logs
• Applica=on
Services
• VPN,
SSO
Threat
intelligence
Access/IdenOty
Endpoint
Network

17. Copyright
©
2015
Splunk
Inc.
The
capabili=es
required
to
dis=nguish
an
infec=on
from
a
breach
17

18. Copyright
©
2015
Splunk
Inc.
Capabili=es
-­‐
Scoping
Infec=ons
and
Breach
18
Report
and
analyze
Custom
dashboards
Monitor
and
alert
Ad
hoc
search
Threat
Intelligence
Asset
&
CMDB
Employee
Info
Data
Stores
ApplicaOons
Raw
Events
Online
Services
Web
Services
Security
GPS
Loca=on
Storage
Desktops
Networks
Packaged
Applica=ons
Custom
Applica=ons
Messaging
Telecoms
Online
Shopping
Cart
Web
Clickstreams
Databases
Energy
Meters
Call
Detail
Records
Smartphones
and
Devices
Firewall
Authen=ca=on
Threat
Intelligence
Servers
Endpoint

19. Copyright
©
2015
Splunk
Inc.
19
Capabilities - Scoping Infections and Breach
Analy=cs
Context
&
Intelligence
Connec=ng
Data
and
People

20. Copyright
©
2015
Splunk
Inc.
Adversary
Perspec=ve
-­‐
Amack
Kill
Chain
Erkundung
Weaponiza=on
Delivery
Exploita=on
Installa=on
Command
and
Control
(C2)
Ac=ons
on
Objec=ves
20
hmp://www.lockheedmar=n.com/content/dam/lockheed/data/corporate/documents/LM-­‐White-­‐Paper-­‐Intel-­‐Driven-­‐Defense.pdf

21. Copyright
©
2015
Splunk
Inc.
Exploita=on
!=
GameOver
21

22. Copyright
©
2015
Splunk
Inc.
Kill
Chain
–
Breach
Example
22
hmp
(web)
session
to
command
&
control
server
Remote
control
Steal
data
Persist
in
company
Rent
as
botnet
WEB
Delivery
Exploita=on
Installa=on
C2
Ac=ons
on
Objec=ves
.pdf
.pdf
executes
&
unpacks
malware
overwri=ng
and
running
“allowed”
programs
Svchost.exe
Calc.exe
Amacker
creates
malware,
embed
in
.pdf,
emails
to
the
target
MAIL
Read
email,
open
amachment
Threat
intelligence
Access/IdenOty
Endpoint
Network

23. Copyright
©
2015
Splunk
Inc.
Demo
–
Incident
Inves=ga=on
23

24. Copyright
©
2015
Splunk
Inc.
Demo
Review
! Challenge:
– Difficult
to
go
from
threat-­‐intel
match
to
root
cause
– Hard
to
determine
–
was
there
a
breach?
! Sources
– Threat
Intel
–
open
source
threat
intel
feed
– Network
–
web
proxy
logs,
email
logs
– Endpoint
–
endpoint
monitoring
agent
– Access/Iden=ty
–
asset
management
database
! Finding
the
root
cause:
connec=ng
the
dots
– Match
the
threat-­‐intel
IP
to
network
data
to
iden=fy
the
infected
machine
– Iden=fy
the
malicious
process
by
mapping
network
data
to
endpoint
data
– Discover
the
infected
email
by
matching
local
file
access
to
email
data
24

25. Copyright
©
2015
Splunk
Inc.
Demo
–
Scoping
if
targeted
Amack
25

26. Copyright
©
2015
Splunk
Inc.
Splunk
Inves=ga=on
Part
2
1. Where
did
this
file
come
from?
2. This
file
exists
in
mul=ple
sources
and
we
have
a
threat
match.
3. IP
54.211.114.134
accessed
2nd_qtr_2014_report.pdf
from
bumercupgames.com
web
portal
cymru_hmp
*
2nd_qtr_2014_report.pdf
threat_intel_source
54.211.114.134
Web
Portal

27. Copyright
©
2015
Splunk
Inc.
Splunk
Inves=ga=on
Part
2
4. What
else
did
this
IP
have
access
to?
5. How
did
the
file
end
up
on
Chris
Gilberts
computer?
6. Are
there
other
events
from
the
email
sender
host?
(No
but
message
slipped
through
detec=on.)
54.211.114.134
wp-­‐login.php
Brute
force
amack
jose.dave@butercupgames.com
194.151.189.201
chris.gilbert@bumercupgames.com
194.151.189.201
Mail
Gateway
An=virus
Passed
Message

28. Copyright
©
2015
Splunk
Inc.
Exploita=on
Act
on
Intent
Erkundung
Web
Portal
is
Compromised
PDF
file
is
stolen
An
email
with
a
malicious
amachment
is
sent
A
worksta=on
is
compromised
Data
is
stolen
Stolen
PDF
Portal
Malicious
Email
Infected
Endpoint
Exfil
Kill
Chain
Summary

29. Copyright
©
2015
Splunk
Inc.
Best
Prac=ces
–
Breach
Response
Posture
! Bring
in
data
from
(minimum
at
least
one
from
each
category):
– Network
–
next
gen
firewall
or
web
proxy,
email,
dns
– Endpoint
–
windows
logs,
registry
changes,
file
changes
– Threat
Intelligence
–
open
source
or
subscrip=on
based
– Access
and
Iden=ty
–
authen=ca=on
events,
machine-­‐user
mapping
! Establish
a
security
intelligence
plahorm
so
analysts
can:
– Contextualize
events,
analy=cs
and
alerts
– Automate
their
analysis
and
explora=on
– Share
techniques
and
results
to
learn
and
improve
29

30. Copyright
©
2015
Splunk
Inc.
Infizierungen
sind
unvermeidbar,
zu
Datenpannen
muss
es
aber
nicht
kommen
30

31. Copyright
©
2015
Splunk
Inc.
Thousands
of
Global
Security
Customers
31

32. Copyright
©
2015
Splunk
Inc.
Industry
Recogni=on
32
2012
2013
This research note is restricted to the personal use o
Table 2. Product/Service Rating on Critical Capabilities
Product/Service Rating
AccelOps
AlienVault
BlackStratus
EventTracker
HP(ArcSight)
IBMSecurity(QRadar)
LogRhythm
McAfee(ESM)
NetIQ
Real-Time Monitoring 3.50 3.00 3.00 2.9 4.1 4.0 3.75 3.75 3.90
Threat Intelligence 3.00 3.50 2.50 1.5 4.0 4.0 3.25 4.00 1.50
Behavior Profiling 2.50 3.50 2.50 2.8 4.0 4.5 3.38 3.50 3.25
Data and User Monitoring 2.97 2.43 2.16 3.2 4.2 3.8 3.41 4.44 3.56
Application Monitoring 2.90 3.65 2.90 3.2 4.5 4.3 4.10 4.20 3.40
Analytics 2.44 3.19 2.94 2.9 3.8 3.7 3.30 3.59 2.44
Log Management and Reporting 2.75 3.00 2.50 3.4 4.0 3.8 3.75 3.25 3.63
Deployment/Support Simplicity 3.50 4.00 3.00 4.3 3.7 4.3 4.25 4.00 3.50
Source: Gartner (June 2014)
Page 32 of 37

33. Dev.splunk.com
40,000+
quesOons
and
answers
600+
apps
Local
User
Groups
and
SplunkLive!
events
33
Thriving
Community

34. Copyright
©
2015
Splunk
Inc.
34
Tradi=onal
SIEM
Splunk
Next
Steps
• Info,
case
study,
analyst
report
at:
Ø Splunk.com
>
Solu=ons
>
Security
&
Fraud
• Try
Splunk
Enterprise
for
free!
Ø Download
Splunk
soRware
at
hmp://www.splunk.com/download
Ø Go
to
Splunk.com
>
Community
>
Documenta=on
>
Search
Tutorial
Ø In
30
minutes,
you
will
have
imported
data,
run
searches,
created
reports
Ø Free
apps
at
Splunk.com
>
Community
>
Apps
• Contact
sales
team
at
Splunk.com
>
About
Us
>
Contact

35. Copyright
©
2015
Splunk
Inc.
Tech
Brief
–
Advanced
Threat
Detec=on
and
Response
! hmp://www.splunk.com/web_assets/pdfs/secure/Splunk_for_APT_Tech_Brief.pdf
35

36. Copyright
©
2015
Splunk
Inc.
Tradi=onal
SIEM
Contact
us
/
Q&A
www.surveymonkey.com/s/DACH_Webinare
36
Ma#hias
Maier
Senior
Sales
Engineer
mamhias@splunk.com
Thomas
Huber
Major
Account
Manager
thuber@splunk.com

37. Copyright
©
2015
Splunk
Inc.
Thank
You!!!
Mamhias@splunk.com