Uploaded byBaban Gaigole
Apache metron - An Introduction
Apache Metron is a cyber security application framework designed for organizations to ingest, process, and store diverse security data feeds in real-time for anomaly detection. It features advanced analytics capabilities, including data enrichment, full-packet capture, and a user-friendly interface for monitoring network traffic and machine logs. Key advantages include real-time alerting and the ability to automate the detection of up to 90% of malicious activities, thereby reducing the need for human intervention.
More Related Content
Similar to Apache metron - An Introduction
![[Hackersuli] Élő szövet a fémvázon: Python és gépi tanulás a Zeek platformon](https://cdn.slidesharecdn.com/ss_thumbnails/2024hackersulimeetupeloszovetafemvazon-240513132412-37dea2e4-thumbnail.jpg?width=640&height=640&fit=bounds)
Apache metron - An Introduction
- 1. Locuz Enterprise SolutionsLtd. All rights reserved. Converge to the Cloud Introduction to APACHE METRON Author: Baban Gaigole
- 2. 2 INTRODUCTION Apache Metron alsoprovides a scalable advanced security analytics framework which is built with Hadoop Community. Apache Metron is a cyber security application framework that provides organizations the ability to ingest, process and store diverse security data feeds in order to detect cyber anomalies and enable organizations to rapidly respond to them. Apache Metron is specifically designed to monitor network traffic and machine logs within an organization by continuously consuming live flowing data from a myriad of “data in motion” sources.
- 3.
- 4. 4 FEATURES Ability to capture,store and normalize any type of security telemetry data. Real-time processing. Data enrichment like threat intelligence, geolocation and DNS info. Serves as an efficient information storage Provides a user-friendly interface with a centralized view of data and alerts passed through the system. Provides a scalable platform for security analytics and functionalities like full-packet capture, stream processing, batch processing, real- time search and telemetry aggregation.
- 5.
- 6. 6 COMPONENTS METRON MODULES Various Metronmodules perform below main activities: Normalize telemetry data from native sensor format to Metron JSON. Stream network packets into HDFS for use with PCAP service. Enrich Metron JSON messages, cross-referencing them against threat intelligent stores and fire alerts. Starts service for running analytics, filter PCAP files put there by PCAP. Using sensors to feed Metron dashboards and analytics. Bulk loading of enrichments and threat intelligent stores. Metron UI Automating Metron deployments.
- 7. 7 DOMAIN SPECIFIC LANGUAGES Stellartransformation language Stellar query language
- 8. 8 WORK FLOW 1. Ingestdata using sensor probes PCAP Bro Snort File HTTP Syslog Sensor / Probes Kafka Topic PCAP Topic Bro Topic Snort Topic Syslog Topic Squid
- 9. 9 2. Parse /normalize the partitioned telemetry data KAFKA Topic PCAP Topic Bro Topic Snort Topic Syslog Topic Squid Topology PCAP Topology Bro Topology Snort Topology Syslog Topology Squid
- 10. 10 3. Enrich normalizedtelemetry data KAFKA Topic PCAP Topic Bro Topic Snort Topic Syslog Topic Squid Topology PCAP Topology Bro Topology Snort Topology Syslog Topology Squid Topic Enrichment
- 11. 11 KAFKA Topic PCAP Topic Bro TopicSnort Topic Syslog Topic Squid Topology PCAP Topology Bro Topology Snort Topology Syslog Topology Squid Topic Enrichment Threat Intelligent Topology 4. Label enriched telemetry data
- 12. 12 Topology PCAP Topology Bro Topology Snort Topology Syslog Topology Squid ThreatIntelligent Topology HDF S
- 13. 13 5. Alert, persistand index labeled telemetry data In case there are alerts initiated, then those events are stored in alert index store like Elasticsearch or Solr. The telemetry events can be stored in storages like HDFS or Hbase.
- 14. 14 INSTALLATION Apache Metron canbe downloaded from http://metron.incubator.apache.org/. Apache Metron is still under development and recently released Metron_0.2.0BETA_rc3 and available at GitHub in tarball format.
- 15. 15 INSTALLATION METHODS There arethree different ways to install Apache Metron: 1. Dev VM Install 2. Cloud Install 3. Metron Installation on an Ambari-Managed Cluster
- 16. 16 ADVANTAGES The most significantadvantage of Apache Metron is the real-time cross- referencing of these threat feeds against telemetry data that is being streamed into the system in order to send an alert instantaneously. After detecting the threat application immediately filters out the specific traffic associated with the malicious data. The data is tagged and can be assigned to junior analysts in SOC to review and take necessary action. As a result, 90% of malicious activity can be now automatically detected for SOC reducing human effort and intervention.
- 17.