Analyse de sécurité de bout en bout avec la Suite Elastic
•
0 likes•784 views
Vous voulez prendre une longueur d’avance sur la concurrence, dans l’univers en constante évolution des solutions de sécurité ? Découvrez comment créer une plateforme centralisée d’analyse de la sécurité qui réponde à vos exigences de volumétrie et de rapidité d’investigation.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Analyse de sécurité de bout en bout avec la Suite Elastic
Similar to Analyse de sécurité de bout en bout avec la Suite Elastic (20)
More from Elasticsearch
More from Elasticsearch (20)
Recently uploaded
Recently uploaded (20)
Analyse de sécurité de bout en bout avec la Suite Elastic
- 1. Vincent Maury Solutions Architect End-to-End Security Analytics with the Elastic Stack
- 2. Is security a love killer?
- 9. Let’s hunt!
- 10. Foundation for Effective Security Analysis (1/2) • Collect all parts of the puzzle • Normalize for aggregation and correlation across sources • Enrich to extend attributes available for analysis • Index data for fast search and analytics Collect Normalize Enrich Index
- 11. What Are Beats? Lightweight data shippers for *nix systems, macOS and Windows Packetbeat Traffic (I/O) Processes TLS HTTP payloads DNS Metricbeat Metrics Processes State of services PaaS modules Auditbeat Unix audit daemon File integrity Processes & users Monitor anything! Filebeat File shipper Osquery integ Winlogbeat Windows events AD activity Remote desktop Windows FW Sysmon integ inc MSSQL… Heartbeat TCP/UDP ICMP HTTP Expired TLS Journalbeat Systemd logs
- 12. Threat Intelligence Geo IP Information Other Information • Reputation information • Spammers (Spamhaus) • TIP feeds (STIX/TAXII) • Abuse.ch • Top N websites (WL) Data Enrichment • Country, State, … • Postal Code • Geo Fence • ISP • ASN • User Agent • Network model • CMDB • AD (user group…) • DNS (and reverse)
- 13. Logstash Inputs Beats … … JDBC … … TCP UDP HTTP Filters Extract Fields Geo Enrich Lookup Enrich DNS Lookups Pattern Matching ArcSight Codec … Network / Security Data Syslog Servers Infra / App Data IoT / Sensors Persistent Disk Based Queues Normalization and Enrichment Using Logstash Beats Outputs Elasticsearch … … … … … Kafka RabbitMQ RDBMS Centralized Configuration Management Elasticsearch
- 14. Foundation for Effective Security Analysis (2/2) • Analyze using machine learning (behavioral approach) • Alert on anomalies • Investigate at scale AlertAnalyze InvestigateIndex
- 15. Temporal and population analysis When something behaves like itself Monday Tuesday Wednesday Thursday When something behaves like its peers Friday
- 16. Integrating Alerts with Other Systems SOAR* Security Applications SDN Switches Messaging Services Issue Tracking Services Alerting *SOAR: Security Orchestration and Automated Response
- 17. Demo platform – payments.swiftcrypto.com Elasticsearch Beats Modsecurity Bad IPs GeoIP ASN User Agent CT Vacations Logstash James Spiteri Machine Learning Alerting Logstash Slack
- 18. DEMO 18
- 19. Wrap up 1. Captured data from everywhere (network, host, security devices, threat intel…) 2. Enriched (geo, security, user) 3. Displayed 4. Analyzed (static and learning approaches) 5. Alerted (Notification & ticket) 6. Reacted (IP block) 7. Investigated
- 20. 20
- 21. The sky’s the limit 21
- 22. 22 Key take-aways • Full stack view • Anomaly detection & response • Investigation at scale
- 24. IT’S A MATCH! Tinder and Elastic liked each other. elastic.co/elasticon/tour/2015/los-angeles/keeping-your-data-from-getting-swiped-right-away-security-analytics-at-tinder elastic.co/elasticon/conf/2017/sf/tinder-using-the-elastic-stack-to-make-connections-around-the-world
- 25. You know, for love
- 27. Thank you! Come and find us all at the AMA Booth James Spiteri