SlideShare a Scribd company logo
1 of 16
BE THE MASTER OF YOUR DOMAIN
Introducing OTX Reputation Monitor Alert – free service
Black Hat 2013
It’s 2AM. Do you know what
your servers are doing?
Source: http://www.vagabumming.com/drunkguypic/
You may not get drunk when managing your servers…
So… How can you become
master of your domain?
Source: http://blog.bufferapp.com/how-to-build-a-great-twitter-reputation-and-get-more-followers-and-retweets
OTX Reputation Monitor Alert – free service
What is AlienVault’s OTX Reputation Monitor Alert?
Leveraging the world’s only open and collaborative IP reputation database,
AlienVault’s OTX Reputation Monitor Alert monitors the reputation of your assets
(public IPs and domains) and emails you notifications whenever there are changes.
What threats does it
uncover?
Malware Infections
Spamming Hosts
Malicious Activity
Potential Breaches
Compromised Websites
Hosts being used
for Botnets
8
9
Where are we monitoring for you?
These events will trigger an alert:
 OTX IP/Domain Match
 Presence in Pastebin/Pastie
 Presence on a DNS Blacklist
 DNS Registration Update – informational only
 SSL Certificate Update – informational only
10
How does the service work?
1. Sign up via our OTX portal.
2. Register your organization’s public
IPs and domains.
3. When there’s a match on one of our
alert types, we’ll email you an alert
with more information and
remediation advice.
4. You’ll also receive our monthly threat
intelligence newsletter.
Registration takes just a few minutes…
How does AlienVault do it?
12
The Power of the “Crowd” for Threat Detection
 Cyber criminals are using (and
reusing) the same exploits against
others (and you).
 Sharing (and receiving) collaborative
threat intelligence makes us all more
secure.
 Using this data, identify, flag and
block known attackers by source IP
addresses.
 Organizations can’t build this
“neighborhood watch” infrastructure
on their own… that’s where
AlienVault comes in…
12
Source: http://www.cityofhemet.org/images/pages/N294/
Neighborhood%20Watch%20Sign.jpg
Global threat detection for local response
What is Open Threat Exchange (OTX)?
 An open and collaborative initiative for security
professionals to connect with their peers, find free tools
for security monitoring, and learn about the latest threats
and defensive tactics from security researchers.
 Open source threat intelligence projects and services including
OSSIM and OTX Reputation Monitor Alert
 Centralized place for these rich resources:
 OTX Projects
 OTX Blog
 OTX Forums
 OTX Learning Center
14
 8,000+
contributors
 140+ countries
Kramer’s out. But there’s still hope for you.
Source: http://home.swipnet.se/~w-44777/kramer2.jpg
Sign up now!
Several ways to do it:
• Scan the QR code on the card
• Use one of our demo “tables” in
the booth
• OR go to:
www.alienvault.com/blackhat-otx

More Related Content

More from AlienVault

AWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & ResponseAWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & Response
AlienVault
 

More from AlienVault (20)

Insider Threat Detection Recommendations
Insider Threat Detection RecommendationsInsider Threat Detection Recommendations
Insider Threat Detection Recommendations
 
Alienvault threat alerts in spiceworks
Alienvault threat alerts in spiceworksAlienvault threat alerts in spiceworks
Alienvault threat alerts in spiceworks
 
Open Source IDS Tools: A Beginner's Guide
Open Source IDS Tools: A Beginner's GuideOpen Source IDS Tools: A Beginner's Guide
Open Source IDS Tools: A Beginner's Guide
 
Malware detection how to spot infections early with alien vault usm
Malware detection how to spot infections early with alien vault usmMalware detection how to spot infections early with alien vault usm
Malware detection how to spot infections early with alien vault usm
 
Security operations center 5 security controls
 Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
 
PCI DSS Implementation: A Five Step Guide
PCI DSS Implementation: A Five Step GuidePCI DSS Implementation: A Five Step Guide
PCI DSS Implementation: A Five Step Guide
 
Improve threat detection with hids and alien vault usm
Improve threat detection with hids and alien vault usmImprove threat detection with hids and alien vault usm
Improve threat detection with hids and alien vault usm
 
The State of Incident Response - INFOGRAPHIC
The State of Incident Response - INFOGRAPHICThe State of Incident Response - INFOGRAPHIC
The State of Incident Response - INFOGRAPHIC
 
Incident response live demo slides final
Incident response live demo slides finalIncident response live demo slides final
Incident response live demo slides final
 
Improve Situational Awareness for Federal Government with AlienVault USM
Improve Situational Awareness for Federal Government with AlienVault USMImprove Situational Awareness for Federal Government with AlienVault USM
Improve Situational Awareness for Federal Government with AlienVault USM
 
Improve Security Visibility with AlienVault USM Correlation Directives
Improve Security Visibility with AlienVault USM Correlation DirectivesImprove Security Visibility with AlienVault USM Correlation Directives
Improve Security Visibility with AlienVault USM Correlation Directives
 
How Malware Works
How Malware WorksHow Malware Works
How Malware Works
 
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than EverNew USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
 
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
 New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
 
AWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & ResponseAWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & Response
 
Improve Threat Detection with OSSEC and AlienVault USM
Improve Threat Detection with OSSEC and AlienVault USMImprove Threat Detection with OSSEC and AlienVault USM
Improve Threat Detection with OSSEC and AlienVault USM
 
Best Practices for Configuring Your OSSIM Installation
Best Practices for Configuring Your OSSIM InstallationBest Practices for Configuring Your OSSIM Installation
Best Practices for Configuring Your OSSIM Installation
 
IDS for Security Analysts: How to Get Actionable Insights from your IDS
IDS for Security Analysts: How to Get Actionable Insights from your IDSIDS for Security Analysts: How to Get Actionable Insights from your IDS
IDS for Security Analysts: How to Get Actionable Insights from your IDS
 
Insider Threats: How to Spot Trouble Quickly with AlienVault USM
Insider Threats: How to Spot Trouble Quickly with AlienVault USMInsider Threats: How to Spot Trouble Quickly with AlienVault USM
Insider Threats: How to Spot Trouble Quickly with AlienVault USM
 
Alien vault sans cyber threat intelligence
Alien vault sans cyber threat intelligenceAlien vault sans cyber threat intelligence
Alien vault sans cyber threat intelligence
 

Recently uploaded

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
WSO2
 

Recently uploaded (20)

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)
 
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
Six Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal OntologySix Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal Ontology
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
 
Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptx
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 

AlienVault OTX Reputation Monitor

  • 1. BE THE MASTER OF YOUR DOMAIN Introducing OTX Reputation Monitor Alert – free service Black Hat 2013
  • 2. It’s 2AM. Do you know what your servers are doing?
  • 3.
  • 5. You may not get drunk when managing your servers…
  • 6. So… How can you become master of your domain?
  • 8. OTX Reputation Monitor Alert – free service What is AlienVault’s OTX Reputation Monitor Alert? Leveraging the world’s only open and collaborative IP reputation database, AlienVault’s OTX Reputation Monitor Alert monitors the reputation of your assets (public IPs and domains) and emails you notifications whenever there are changes. What threats does it uncover? Malware Infections Spamming Hosts Malicious Activity Potential Breaches Compromised Websites Hosts being used for Botnets 8
  • 9. 9 Where are we monitoring for you? These events will trigger an alert:  OTX IP/Domain Match  Presence in Pastebin/Pastie  Presence on a DNS Blacklist  DNS Registration Update – informational only  SSL Certificate Update – informational only
  • 10. 10 How does the service work? 1. Sign up via our OTX portal. 2. Register your organization’s public IPs and domains. 3. When there’s a match on one of our alert types, we’ll email you an alert with more information and remediation advice. 4. You’ll also receive our monthly threat intelligence newsletter. Registration takes just a few minutes…
  • 12. 12 The Power of the “Crowd” for Threat Detection  Cyber criminals are using (and reusing) the same exploits against others (and you).  Sharing (and receiving) collaborative threat intelligence makes us all more secure.  Using this data, identify, flag and block known attackers by source IP addresses.  Organizations can’t build this “neighborhood watch” infrastructure on their own… that’s where AlienVault comes in… 12 Source: http://www.cityofhemet.org/images/pages/N294/ Neighborhood%20Watch%20Sign.jpg
  • 13. Global threat detection for local response
  • 14. What is Open Threat Exchange (OTX)?  An open and collaborative initiative for security professionals to connect with their peers, find free tools for security monitoring, and learn about the latest threats and defensive tactics from security researchers.  Open source threat intelligence projects and services including OSSIM and OTX Reputation Monitor Alert  Centralized place for these rich resources:  OTX Projects  OTX Blog  OTX Forums  OTX Learning Center 14  8,000+ contributors  140+ countries
  • 15. Kramer’s out. But there’s still hope for you. Source: http://home.swipnet.se/~w-44777/kramer2.jpg
  • 16. Sign up now! Several ways to do it: • Scan the QR code on the card • Use one of our demo “tables” in the booth • OR go to: www.alienvault.com/blackhat-otx

Editor's Notes

  1. http://www.vagabumming.com/drunkguypic/
  2. http://blog.bufferapp.com/how-to-build-a-great-twitter-reputation-and-get-more-followers-and-retweets
  3. The AlienVault OTX Reputation Monitor enables end users to verify the security (or “reputation”) of their publicly addressable IP range(s). This allows immediate notification of Malware InfestationsSpamming HostsMalicious ActivityPotential BreachesCompromised WebsitesHosts being used for BotnetsRegistered users can instantly check their IP address range(s) and domains against the AlienVault OTX database as soon as they register. Additionally, registered users will receive instant notifications should those IPs ever show up in the future. In addition to instant alert notifications, registered users will also receive monthly threat intelligence reports via email.
  4. Pastebin/Pastie Alerts - we monitor hacker forums such as paste bin/pastie and a few other sites to see if we ever find the domains/IPs posted.  These sites are often used to store the output from recon tools and as the destination for data exfiltration. We will provide the specific link to where this information is found within the alert. OTX IP/Domain Match - we immediately and continually look for matches between the IP addresses/domains that the user entered and those in our OTX database. DNS Blacklist – we look for the registered domain names in any public blacklist.DNS Registration Update – we look for changes to the DNS registration information.  This can be an indicator of someone hijacking the domain or could be a routine change of the ISP – either way, we alert the user.SSL Certification Update – we look for updates to the SSL certificate.  This can be an indicator of someone compromising your website and trying to intercept traffic or could simply be a routine change of the ISP.
  5. This is a very simple four step process, all enabled through a web-based portal designed to be a “one-stop-shop” for all resources available to the AlienVault Community (Forum, Knowledge Base, etc). After registering, users enter the IP addresses owned by their organization, and these are checked against our OTX database as it is updated. If there is an “instant” match, then we provide information on the observed issues, along with some basic remediation suggestions. If there’s no match, we provide verification to the user that their IP addresses and domains are not in our database, but that we will continue to monitor them, and send them immediate notifications if their public IP addresses or domains ever show up in the OTX database. We will also send them monthly threat intelligence emails outside of the context of these alerts.
  6. http://www.cityofhemet.org/images/pages/N294/Neighborhood%20Watch%20Sign.jpg
  7. The industry’s only threat collaboration database with 9,500 contributors in 120+ countries
  8. http://home.swipnet.se/~w-44777/kramer2.jpg