使用 Elastic Stack 进行端对端安全分析
•
2 likes•646 views
This document discusses security analytics for detection and response. It summarizes collecting data from various sources, normalizing and enriching the data, indexing it, performing automated detection using machine learning, and interactive analysis and response. Key parts of the platform include collecting data using Beats, normalizing it with Elastic Common Schema, enriching it with contextual data, indexing it in Elasticsearch, detecting threats via dynamic correlation and machine learning, and responding by integrating alerts with other systems.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to 使用 Elastic Stack 进行端对端安全分析
Similar to 使用 Elastic Stack 进行端对端安全分析 (20)
More from Elasticsearch
More from Elasticsearch (20)
Recently uploaded
Recently uploaded (20)
使用 Elastic Stack 进行端对端安全分析
- 7. Collect Normalize & Enrich Index Index Automated Detection Interactive Analysis Respond Security Analytics for Detection & Response
- 9. Domain Data Sources Timing Collection Methods Network NetFlow, PCAP, Zeek Real-time, Packet-based Filebeat, Packetbeat, Logstash NetFlow module Application Log Real-time, Event-based Filebeat Logstash Cloud API, Log Real-time, Event-based Beats Logstash Host Signature Alert, System State Real-time, Asynchronous Auditbeat, Winlogbeat, Filebeat Osquery module Active Scanning User-driven, Asynchronous Vulnerability scanners Collect Data
- 10. Filebeat Log Files Metricbeat Metrics Packetbeat Network Data Winlogbeat Window Events Plus, a growing set of community Beats Heartbeat Uptime Monitoring Auditbeat Audit Data Functionbeat Serverless Shipper Collect Data with Beats
- 12. Normalize Data 10.42.42.42 - - [07/Dec/2018:11:05:07 +0100] "GET /blog HTTP/1.1" 200 2571 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36"
- 13. Normalize Data with Elastic Common Schema (ECS) Searching without ECS Searching with ECS src:10.42.42.42 OR client_ip:10.42.42.42 OR apache2.access.remote_ip: 10.42.42.42 OR context.user.ip:10.42.42. 42 OR src_ip:10.42.42.42 source.ip:10.42.42.42
- 14. Normalize Data to Streamline Analysis
- 15. • Physical location • Country, State • Postal code • Geo fence Geographical Information • Network model • Identity details • Org chart • DNS resolution Other Context • Vulnerabilities • IoCs • Reputation • TTPs Threat Intelligence Enrich Data
- 17. Logstash Inputs Beats … … JDBC … … TCP UDP HTTP Filters Extract Fields Geo Enrich Lookup Enrich DNS Lookups Pattern Matching ArcSight Codec … Network / Security Data Syslog Servers Infra / App Data IoT / Sensors Persistent Disk Based Queues Beats Outputs Elasticsearch … … … … … Kafka RabbitMQ RDBMS Centralized Configuration Management Elasticsearch Ingest Nodes (X) Index Data
- 19. Detection via Manual Correlation
- 20. 20 Reduce False Positives Avoid Manual Threshold Revision Identify Areas of Focus Understand Seasonality Detection via Dynamic Correlation
- 21. When something behaves like itself Monday Tuesday Wednesday Thursday When something behaves like its peers Entity Profiling with Machine Learning Behavior Analytics
- 23. Get Started with Machine Learning
- 25. SCALE Distributed by design SPEED Find matches in milliseconds RELEVANCE Get highly relevant results
- 28. Integrating Alerts with Other Systems Robotic Process Automation Security Applications SDN Switches Messaging Services Issue Tracking Services Elasticsearch
- 30. Power to the Practitioners
- 31. www.elastic.co