Tune in to hear the most impactful lessons learned from Uber's security journey, and how security practitioners everywhere can tackle pervasive enterprise security challenges using the Elastic Stack.

1. Reinventing Enterprise Defense
with the Elastic Stack
Wes Connell
Security Engineering Lead, Uber

2. Agenda
Introduction1
Security Challenges3
Solution4
Conclusion + Takeaways5
Uber’s 5-Star Security Journey2

3. Introduction
• Security Engineering Lead @ Uber
• Passionate about dramatically improving
data hunting tradecraft within cyber
security domain

4. Uber Security >> Threat Response Organization

5. Platform + Detection: Mission Objectives
• Platform Team: Enable rapid discovery, detection, investigation, &
mitigation of threats using an innovative & robust security platform.
• Detection Team: We detect malicious activity early enough for Uber to
mitigate before significant business impact.
The Elastic Stack is the backbone that makes up our
new enterprise defense platform.

6. Agenda
Introduction1
Security Challenges3
Solution4
Conclusion + Takeaways5
Uber’s 5-Star Security Journey2

7. Uber’s 5-Star Security Journey
2017 to Present
2017
2018 -
2019
2020
Commercial SIEM
Vendor
Uber Homegrown
SIEM
New Enterprise
Defense Platform
Mature security
platform
Wildly expensive
Much cheaper
Operator efficacy
Affordable
10x operator
efficacy
Jack Crook
https://findingbad.blogspot.com/

8. Agenda
Introduction1
Security Challenges3
Solution4
Conclusion + Takeaways5
Uber’s 5-Star Security Journey2

9. Security Challenges
1. Lacking search engine for security logs
2. No common event model
3. No UI for visualizations + dashboards
4. Lethargic lead times for writing detections
5. Limited ability to retroactively search
observables
“Everything is on fire all the time” -Every security analyst on the planet

10. Agenda
Introduction1
Security Challenges3
Solution4
Conclusion + Takeaways5
Uber’s 5-Star Security Journey2

12. Solution: Griffith
• Observables API (Flask + Redis)
‒ Bulk retroactive lookup of observables, 12+ months
‒ Response times in nanoseconds / milliseconds
• Elastic Stack
‒ Common event model = Elastic Common Schema
‒ Timeline-oriented search
‒ Collaborative workspaces
‒ Detection rules engine
• Hadoop + Hive/Presto
Uber’s Observability Platform for Enterprise Defense

13. 1. Search Engine for Security Logs

14. 2. UI for Dashboards + Visualizations

15. 2. UI for Dashboards + Visualizations

16. 2. UI for Dashboards + Visualizations

17. 3. Common Event Model

18. 4. Detection Rule Development Cycle
Source:
https://medium.com/@ateixei/jira-workflow-for-detection-engineering-teams-a7433f4c2a9f

19. 4. Detection Rule Development Cycle

20. 5. Collaborative Workspaces

21. Agenda
Introduction1
Security Challenges3
Solution: Griffith4
Conclusion + Takeaways5
Uber’s 5-Star Security Journey2

22. Conclusion
• Implement a common event model - ECS works great
• Processes and tech should be as fluid as your security
investigations
• The Elastic Stack is optimized for collaboration
• Genuinely excited to see what’s next for Elastic!

23. Wanna Get Started? Lets Go!
BLOG:
https://medium.com/@wesleyraptor

24. Thank You!
Elastic Community Slack: https://ela.st/slack