Video: https://www.youtube.com/watch?v=v69kyU5XMFI
A talk I gave at the Philly Security Shell meetup 2019-02-21 on how the Elastic Stack works and how you can use it for indexing and searching security logs. Tools I mentioned: Github repo with script and demo data - https://github.com/SecHubb/SecShell_Demo Cerebro - https://github.com/lmenezes/cerebro Elastalert - https://github.com/Yelp/elastalert For info on my SANS teaching schedule visit: https://www.sans.org/instructors/john... Twitter: https://twitter.com/SecHubb
Empower Your Security Practitioners with Elastic SIEMElasticsearch
Learn how Elastic SIEM’s latest capabilities enable interactive exploration and automated analysis — all at the speed and scale your security practitioners need to defend your organization.
See the video: https://www.elastic.co/elasticon/tour/2019/washington-dc/empower-your-security-practitioners-with-elastic-siem
Security Incident Event Management
Real time monitoring of Servers, Network Devices.
Correlation of Events
Analysis and reporting of Security Incidents.
Threat Intelligence
Long term storage
What is SIEM? A Brilliant Guide to the BasicsSagar Joshi
SIEM is a technological solution that collects and aggregates logs from various data sources, discovers trends, and alerts when it spots anomalous activity, like a possible security threat.
SIEM : Security Information and Event Management SHRIYARAI4
SIEM is a tool that collects, aggregates, normalizes the data and analyzes it according to pre-set rules and presents the data in human readable format
Elastic Agent is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also query data from operating systems, and more. A single agent makes it easier and faster to deploy monitoring across your infrastructure. Each agent has a single policy you can update to add integrations for new data sources, security protections.
Video: https://www.youtube.com/watch?v=v69kyU5XMFI
A talk I gave at the Philly Security Shell meetup 2019-02-21 on how the Elastic Stack works and how you can use it for indexing and searching security logs. Tools I mentioned: Github repo with script and demo data - https://github.com/SecHubb/SecShell_Demo Cerebro - https://github.com/lmenezes/cerebro Elastalert - https://github.com/Yelp/elastalert For info on my SANS teaching schedule visit: https://www.sans.org/instructors/john... Twitter: https://twitter.com/SecHubb
Empower Your Security Practitioners with Elastic SIEMElasticsearch
Learn how Elastic SIEM’s latest capabilities enable interactive exploration and automated analysis — all at the speed and scale your security practitioners need to defend your organization.
See the video: https://www.elastic.co/elasticon/tour/2019/washington-dc/empower-your-security-practitioners-with-elastic-siem
Security Incident Event Management
Real time monitoring of Servers, Network Devices.
Correlation of Events
Analysis and reporting of Security Incidents.
Threat Intelligence
Long term storage
What is SIEM? A Brilliant Guide to the BasicsSagar Joshi
SIEM is a technological solution that collects and aggregates logs from various data sources, discovers trends, and alerts when it spots anomalous activity, like a possible security threat.
SIEM : Security Information and Event Management SHRIYARAI4
SIEM is a tool that collects, aggregates, normalizes the data and analyzes it according to pre-set rules and presents the data in human readable format
Elastic Agent is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also query data from operating systems, and more. A single agent makes it easier and faster to deploy monitoring across your infrastructure. Each agent has a single policy you can update to add integrations for new data sources, security protections.
Get advice from security gurus on how to get up & running with SIEM quickly and painlessly. You'll learn about log collection, log management, log correlation, integrated data sources and how-to leverage threat intelligence into your SIEM implementation.
Openness is important at Elastic — we code in the open, communicate directly with our users, and offer free, powerful software that can be deployed across major cloud providers or through self-managed downloads. Learn how Elastic Security delivers on our free and open philosophy to help SecOps teams take a broader, more inclusive approach to security and set their organizations up for success.
the IBM Security Intelligence Platform, also known as QRadar®, integrates SIEM, log management, anomaly detection, vulnerability management, risk management and incident forensics into a unified, highly scalable, real-time solution that provides superior threat detection, greater ease of use, and low total cost of ownership compared with competitive products
Security Information and Event Management (SIEM)hardik soni
Leo TechnoSoft SIEM products help's every enterprise with all security threats. Security information and event management software provides real-time visibility.
Elastic Security : Protéger son entreprise avec la Suite ElasticElasticsearch
Elastic Security assure la prévention, la collecte et la détection globales des menaces qui pèsent sur les données, ainsi que la réponse globale à ces menaces. Découvrez comment prendre une longueur d'avance sur les utilisateurs malveillants grâce à une technologie multicouches, regardez des démos en direct et obtenez des réponses à vos questions.
Get advice from security gurus on how to get up & running with SIEM quickly and painlessly. You'll learn about log collection, log management, log correlation, integrated data sources and how-to leverage threat intelligence into your SIEM implementation.
Openness is important at Elastic — we code in the open, communicate directly with our users, and offer free, powerful software that can be deployed across major cloud providers or through self-managed downloads. Learn how Elastic Security delivers on our free and open philosophy to help SecOps teams take a broader, more inclusive approach to security and set their organizations up for success.
the IBM Security Intelligence Platform, also known as QRadar®, integrates SIEM, log management, anomaly detection, vulnerability management, risk management and incident forensics into a unified, highly scalable, real-time solution that provides superior threat detection, greater ease of use, and low total cost of ownership compared with competitive products
Security Information and Event Management (SIEM)hardik soni
Leo TechnoSoft SIEM products help's every enterprise with all security threats. Security information and event management software provides real-time visibility.
Elastic Security : Protéger son entreprise avec la Suite ElasticElasticsearch
Elastic Security assure la prévention, la collecte et la détection globales des menaces qui pèsent sur les données, ainsi que la réponse globale à ces menaces. Découvrez comment prendre une longueur d'avance sur les utilisateurs malveillants grâce à une technologie multicouches, regardez des démos en direct et obtenez des réponses à vos questions.
Empower your security practitioners with the Elastic StackElasticsearch
How does your organization detect and respond to cyber threats? Learn how the latest security capabilities in the Elastic Stack enable interactive exploration and automated analysis with speed and at scale.
Conferencia principal: Evolución y visión de Elastic SecurityElasticsearch
Los equipos de SecOps asumen más responsabilidad que nunca para aumentar actividad desde una fuerza de trabajo recientemente remota, lo que acelera la necesidad de la transformación digital. Conoce cómo evolucionó Elastic Security para ayudar a los equipos de SecOps tomar un enfoque más amplio e inclusivo en base a la seguridad y preparar a sus organizaciones para el éxito. Además, conoce la visión de lo que vendrá.
Overall Security Process Review CISC 6621Agend.docxkarlhennesey
Overall Security Process Review
CISC 662
1
Agenda
Review of the following technologies and current products:
SIEM
CASB
EDR (Enterprise Detection and Response)
NGFW (Next Generation Firewalls)
Threat Intelligence
Summary of Term
SANS Technology Institute - Candidate for Master of Science Degree
What is a SIEM?
SIEM - Security Information Event Management
Logging and Event Aggregation
Network (router,switch,firewall,etc)
System (Server,workstation,etc)
Application (Web, DB )
Correlation Engine
2+ related events = higher alarm (1+1=3)
3
At first glance SIEM's appliances and software look like an event aggregator. While a SIEM has the advantage of aggregating logs what puts them apart from the event aggregator market are the correlation engines.
The correlation engines allow the ability to uncover threats/attacks across multiple related events which by themselves would not be a cause for alarm.
SIEM
4
What is a SIEM?
5
Security information and event management (SIEM) is the technology that can tie all your systems together and give you a comprehensive view of IT security.
IT security is typically a patchwork of technologies – firewalls, intrusion prevention, endpoint protection, threat intelligence and the like – that work together to protect an organization’s network and data from hackers and other threats. Tying all those disparate systems together is another challenge, however, and that’s where SIEM can help.
SIEM systems manage and make sense of security logs from all kinds of devices and carry out a range of functions, including spotting threats, preventing breaches before they occur, detecting breaches, and providing forensic information to determine how a security incident occurred as well as its possible impact.
Using SIEM
How do SIEM Products help the following Security concerns?
Countermeasures to detect attempts to infect internal system
Identification of infected systems trying to exfiltrate information
Mitigation of the impact of infected systems
Detection of outbound sensitive information ( DLP)
6
These questions are a core part of a companies overall security architecture. If a SIEM isn't providing answers or solutions to these questions what is it doing?
If you aren't using your SIEM to solve issues like these it may just be an expensive log aggregator/collection system sitting in your network collecting dust.
SIEM Advantages
Correlation of data from multiple systems and from different events detecting security and operational conditions
Anomaly detection by using a baseline of events over time to find deviations from expected or normal behavior
Comprehensive view into an environment based on event types, protocols, log sources, etc
APT (advanced persistent threat) protection through detection of protocol and application anomalies
Prioritization based on risk of threat to assets, staff can triage the most vulnerable targets
Alerting and monitoring on events of interest to escalate pri ...
IBM Security Strategy Intelligence, Integration and Expertise
by Marc van Zadelhoff, VP, WW Strategy and Product Management and Joe Ruthven IBM MEA Security Leader
Elastic Security: Your one-stop OODA loop shopElasticsearch
Elastic Security, leveraging the expertise of the makers of Elasticsearch coupled with the subject matter experts of the security domain, brings enterprise-grade SIEM and response to all users. With Elastic Security and the Elastic Agent, users can search, see, and stop threats, adding the critical “act” step in the OODA loop cycle. Learn how to take control of your environment and see what Elastic Security has in store next.
This webinar series is designed to help internal auditors looking to equip themselves with competencies and confidence to handle audit of IT controls and information security, and learn about the emerging technologies and their underlying risks
The series focuses on contemporary IT audit approaches relevant to Internal Auditors and the processes underlying risk based IT audits.
Session 7 of 10
This Webinar focuses on SEIM Log Analysis
• Logging Sources & Servers
• What is a SIEM?
• Advantages of a SIEM?
• Using SIEM
• Detection of outbound sensitive information
• Data Collection
• Aggrefation, Normalization and Enrichment
• Reporting and Forensics
• Challenges in log management
Palestra de abertura: Evolução e visão do Elastic SecurityElasticsearch
Saiba como o Elastic Security evoluiu para ajudar as equipes de operações de segurança a adotar uma abordagem mais ampla e inclusiva à segurança e preparar sua organização para o sucesso.
We all love the chameleon, and SUSE is long known for its Linux OS - but there is so much more in the world of SUSE.
In this session Jurriën will dive into how SUSE is helping organizations accelerate their digital transformation through container management, hybrid cloud IT infrastructure, and IT operations at the Edge.
Because from core, to cloud, to Edge, SUSE is helping firms to innovate everywhere.
- General Demo
- SEP super flexible with respect to API's
- HANA backup (also on RHV)
- Ansible scripts provided on Github for automated SEP installation.
- Cloud 2 Cloud backup of your MS 365 / GSuite, Dynamics and Salesforce Cloud solution
Deploying NGINX in Cloud Native KubernetesKangaroot
Using cloud-native application services is easy, it “just works”. Many customers choose them without giving it a second thought. However, these app services vary from cloud to cloud, with differing levels of quality and numbers of features making visibility and control inconsistent across clouds.
And then there is cost…it’s hard to know what your deployment is going to cost until after it’s been built. Often the services must be compiled in a piecemeal fashion and many products carry bloated code that increases costs.
Finally, security is often an afterthought. Moreover, SecOps teams struggle to keep up with the breakneck app release cadence that has become typical. Often they are seen as DevOps viewing them as a major constraint on the ability to deliver software quickly.
In this workshop, we showcase the NGINX solutions for cloud native Kubernetes that will allow you to:
- Reduce tool sprawl and provide a standard set of services
- Control costs with lightweight and easy solutions
- Bring teams together with automation and self‑service capabilities
Cloud demystified, what remains after the fog has lifted. Kangaroot
o, you’ve been ordered to land the airplane in thick fog, zero visibility and you’re praying the ILS has got it right. That’s how most IT managers feel after their CIO/CEO told them to ‘put everything in the cloud, it’s cheaper’.
IaaS, DBaas, PaaS, SaaS, Literally everything as a service… But what is it, how does it compare to, say, Hosting, or to out-sourcing? Or does it actually compare at all, and is it really new?
There is also this thing with “Cloud-native”, what is that all about and how does this fit in a modern deployment architecture. Containers don’t really fly, right, what are they doing in the clouds then??
What are the things that do make a difference, what does it all look like after the fog has lifted?
Of course, the focal point in the presentation will be the relational database as it is and will remain the beating heart of the IT landscape. Join me in this investigation and see if we can actually land the plane and really get ahead using “The Cloud”.
From NetOps to DevOps, modern app teams need a self‑service, API‑driven platform that integrates easily into CI/CD workflows to accelerate app deployment and makes app lifecycle management easier – whether your app has a hybrid or microservices architecture.
Built to manage NGINX Plus instances, NGINX Controller is cloud‑native, secure, and high‑performance. During this webinar, we demonstrate how NGINX Controller can streamline the management of your NGINX Application Services.
Kangaroot EDB Webinar Best Practices in Security with PostgreSQLKangaroot
The webinar will review a multi-layered framework for PostgreSQL security, with a deeper focus on limiting access to the database and data, as well as securing the data.
Using the popular AAA (Authentication, Authorisation, Auditing) framework EnterpriseDB will cover:
- Best practices for authentication (trust, certificate, MD5, Scram, etc).
- Advanced approaches, such as password profiles.
- Deep dive of authorisation and data access control for roles, database objects (tables, etc), view usage, row-level security, and data redaction.
- Auditing, encryption, and SQL injection attack prevention
Do you want to start with OpenShift but don’t have the manpower, knowledge, e...Kangaroot
Do you want to start with containers or a Kubernetes platform? You don’t have the in-house knowledge, experience, manpower to setup OpenShift? Get OpenShift in a box, managed by Kangaroot.
Digital Transformation requires a change in culture ànd in tools. OpenShift-in-a-box contains a managed platform to give you the tools at a fixed monthly fee ànd workshops & services to help you drive your change in development culture.
Red Hat multi-cluster management & what's new in OpenShiftKangaroot
More and more organisations are not only using container platforms but starting to run multiple clusters of containers. And with that comes new headaches of maintaining, securing, and updating those multiple clusters. In this session we'll look into how Red Hat has solved multi-cluster management, covering cluster lifecycle, app lifecycle, and governance/risk/compliance.
There is no such thing as “Vanilla Kubernetes”Kangaroot
홏홝홚홧홚 홞홨 홣홤 홨홪환홝 황홝홞홣활 홖홨 홑홖홣홞홡홡홖 홆홪홗홚홧홣홚황홚홨. Do you want to start your Digital Transformation, but struggling to find your way in OpenShift or Kubernetes? Together with Red Hat where we'll compare Vanilla Kubernetes with OpenShift. #DigitalTransformation #DevOps #RedHat #Kubernetes #OpenShift #VanillaKubernetes #automation #containers #orchestration
Kangaroot open shift best practices - straight from the battlefieldKangaroot
Running & managing an OpenShift environment in a better way starts before even building your first test cluster and doesn’t stop when the design is up and running. Kangaroot has been running & maintaining OpenShift/Kubernetes clusters in production for several of our customers and this session brings you an overview of best practices, extra tools and methodologies to make your life easier.
OpenShift 4, the smarter Kubernetes platformKangaroot
OpenShift 4 introduces automated installation, patching, and upgrades for every layer of the container stack from the operating system through application services.
Connector Corner: Automate dynamic content and events by pushing a buttonDianaGray10
Here is something new! In our next Connector Corner webinar, we will demonstrate how you can use a single workflow to:
Create a campaign using Mailchimp with merge tags/fields
Send an interactive Slack channel message (using buttons)
Have the message received by managers and peers along with a test email for review
But there’s more:
In a second workflow supporting the same use case, you’ll see:
Your campaign sent to target colleagues for approval
If the “Approve” button is clicked, a Jira/Zendesk ticket is created for the marketing design team
But—if the “Reject” button is pushed, colleagues will be alerted via Slack message
Join us to learn more about this new, human-in-the-loop capability, brought to you by Integration Service connectors.
And...
Speakers:
Akshay Agnihotri, Product Manager
Charlie Greenberg, Host
DevOps and Testing slides at DASA ConnectKari Kakkonen
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
Elevating Tactical DDD Patterns Through Object CalisthenicsDorra BARTAGUIZ
After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!
The Art of the Pitch: WordPress Relationships and SalesLaura Byrne
Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes?
All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
UiPath Test Automation using UiPath Test Suite series, part 3DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 3. In this session, we will cover desktop automation along with UI automation.
Topics covered:
UI automation Introduction,
UI automation Sample
Desktop automation flow
Pradeep Chinnala, Senior Consultant Automation Developer @WonderBotz and UiPath MVP
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...DanBrown980551
Do you want to learn how to model and simulate an electrical network from scratch in under an hour?
Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)!
During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook.
PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides:
- A fully editable and extendable library for grid component modelling;
- Visualization tools to display your network;
- Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses;
The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well.
What you will learn during the webinar:
- For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills;
- For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.
GraphRAG is All You need? LLM & Knowledge GraphGuy Korland
Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs.
1. Unifying Large Language Models and Knowledge Graphs: A Roadmap.
https://arxiv.org/abs/2306.08302
2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs:
https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/
UiPath Test Automation using UiPath Test Suite series, part 4DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap.
The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies.
Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques
What will you get from this session?
1. Insights into SAP testing best practices
2. Heatmap utilization for testing
3. Optimization of testing processes
4. Demo
Topics covered:
Execution from the test manager
Orchestrator execution result
Defect reporting
SAP heatmap example with demo
Speaker:
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Albert Hoitingh
In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.
Essentials of Automations: Optimizing FME Workflows with ParametersSafe Software
Are you looking to streamline your workflows and boost your projects’ efficiency? Do you find yourself searching for ways to add flexibility and control over your FME workflows? If so, you’re in the right place.
Join us for an insightful dive into the world of FME parameters, a critical element in optimizing workflow efficiency. This webinar marks the beginning of our three-part “Essentials of Automation” series. This first webinar is designed to equip you with the knowledge and skills to utilize parameters effectively: enhancing the flexibility, maintainability, and user control of your FME projects.
Here’s what you’ll gain:
- Essentials of FME Parameters: Understand the pivotal role of parameters, including Reader/Writer, Transformer, User, and FME Flow categories. Discover how they are the key to unlocking automation and optimization within your workflows.
- Practical Applications in FME Form: Delve into key user parameter types including choice, connections, and file URLs. Allow users to control how a workflow runs, making your workflows more reusable. Learn to import values and deliver the best user experience for your workflows while enhancing accuracy.
- Optimization Strategies in FME Flow: Explore the creation and strategic deployment of parameters in FME Flow, including the use of deployment and geometry parameters, to maximize workflow efficiency.
- Pro Tips for Success: Gain insights on parameterizing connections and leveraging new features like Conditional Visibility for clarity and simplicity.
We’ll wrap up with a glimpse into future webinars, followed by a Q&A session to address your specific questions surrounding this topic.
Don’t miss this opportunity to elevate your FME expertise and drive your projects to new heights of efficiency.
3. SIEM app
released
2010 Today
Elasticsearch 0.4
released
ECS 1.0
released
Elasticsearch 1.0
released
Growing use of ELK
for threat hunting
Security consultancy
Perched acquired
Endgame
acquired
Logstash
joins forces
Kibana
joins forces
Beats to collect
all the data
Machine learning
firm Prelert acquired
Elastic Cloud
launched
4. 4
Elastic Builds Software
To Make Data Usable
In Real Time And At Scale,
Powering Solutions Like
Search,
Logging,
Metrics, Security
And more.
6. 6
Vision
To protect the world’s data from attack.
Goal
Deliver a single security solution, combining SIEM
and endpoint, powered by industry-leading and
validated protections to reduce risk for any user.
Elastic Security
14. 14
New threats
every day
# 2 Elastic Edge
• Everything is indexed
• Snappy search at scale
• Do more with machine
learning
15. 15
Volume pricing
not viable
# 3 Elastic Edge
• Licensing model that puts
the customer in control
• Flexibility to balance data
retention, performance, and
cost objectives
• Price points that don’t limit
decision-making
16. 16
Beyond SIEM
Extended SecOps functions beyond SIEM
Existing SIEM hitting limits
MSSP
Data store and search engine for security events
Service providers offer managed SIEM solution
SIEM Alternative Centralized log collection and security analysis
No existing SIEM
Custom Security Application
Platform for special security projects/apps
In-house app dev team creates app
OEM Solution
Data store, search engine, and analysis platform
Security vendor companies build an end-user product
Many Security Analytics Use Cases
20. 20
Kibana
Visualize your Elasticsearch data
and navigate the Elastic Stack
Elasticsearch
A distributed, RESTful search
and analytics engine
Elastic SIEM
A SIEM for Elastic Stack users everywhere
Elastic SIEM app
Elastic Common
Schema (ECS)
Network & host
data integrations
Security
content by
Elastic &
community
Beats Logstash
Elastic
Endpoint
21. 2121
Elastic SIEM
Same data. Different questions.
Ingest & prepare
Ecosystem of network and host data connectors
Elastic Common Schema (ECS)
Analytics
Machine learning and alerting
Ad hoc queries at scale
Graph analytics
Detect, hunt, investigate
Automated attack detection
Interactive threat hunting
Rapid event triage and investigation
22. 22
Auditbeat
● System module (Linux, macOS, Win.): packages,
processes, logins, sockets, users and groups
● Auditd module (Linux Kernel Audit info)
● File integrity monitoring (Linux, macOS, Win.)
Filebeat
● System logs (auth logs) (Linux)
● Santa (macOS)
Winlogbeat
● Windows event logs
● Sysmon
Curated integrations
Host
data
25. Elastic Common Schema (ECS)
Normalize data to streamline analysis
Defines a common set of fields and
objects to ingest data into
Elasticsearch
Enables cross-source analysis of
diverse data
Designed to be extensible
ECS is in GA and is being adopted
throughout the Elastic Stack
Contributions & feedback welcome
at https://github.com/elastic/ecs
26. 26
SIEM App Overview
Curated workflows for
the SOC team
Manage security events
• Visualize and analyze security events
Perform initial triage
• Investigate security events, alerts, and alarms
• Annotate investigations and create incidents
• Handoff incidents to third-party
case/incident/orchestration (SOAR) system
View SOC security posture
• Visualize overall event, alarm, investigation,
incident status and history
27. 27
SIEM App Timeline
Event Explorer
Analyst-friendly qualification
and investigation workflows
● Time ordered events
● Drag and drop filtering
● Multi-index search
● Annotations, comments
● Formatted event views
● Persistent storage
28. 28
Integrated
ML Detection
Trigger jobs and view
results in the SIEM app
● Enable and control pre-built
and custom ML jobs
● View results in Hosts and
Network views
● Links to ML app within Kibana
29. 29
SIEM + Maps
Geo-based analysis with
Elastic Maps
● Shows source and destination
geo location of network data
● Interactive — responds to
filters and allows setting filters
● Further plans for SIEM + Maps
30. 30 These are just some of our partners and community members. The presence of a vendor logo doesn’t imply a business relationship with Elastic.
Elastic SIEM
Ecosystem
Security orchestration,
automation, response
Security incident
response
General ticket & case
management
● Host sources
● Network sources
● Cloud platforms &
applications
● User activity sources
● SIEMs & centralized
security data stores
Community
Consulting
Education & training
Solutions Integrators,
Value-added Resellers,
MSPs & MSSPs
Internal context
External context
32. 3434
Logstash
Elastic Endpoint Security
As simple as antivirus, but way more powerful
Prevents malware and
ransomware before
damage and loss
AI-powered endpoint
detection and response
Built for today’s hybrid
cloud environments
Security starts at the endpoint
33. 3535
Attacks have evolved
Of companies experienced 1+
attacks that compromised
data or IT infrastructure54%
Of those attacks utilized
exploits or fileless techniques
77%
Cyber criminals have broadened their reach to bypass simple
security mechanisms and use bespoke software to target your organization.
Rise of nation state
hacking groups
Malware now works to
stay hidden
Automated and “Malware-as-a-Service” tools
have made file-based detection obsolete
35. 3838
Act
Remediate, validate, and
learn from the threat
Decide
Collaborate, scope, and
build the response plan
Orient
Detect, analyze, and
visualize the attack
Observe
Collect, store, and search
all your data
SecOps
OODA Loop
37. 40
Prevent
Block threats as early as
possible
In-line, autonomous prevention
Blocks ransomware, phishing, exploits, and
malware, with capabilities proven by
rigorous third party testing.
No cloud-analysis required.
Protections mapped to the MITRE
ATT&CK matrix
It’s not just about the payload. Prevent
adversarial behavior before damage and
loss.
Completely customized controls
Create your own protection policy and easily
apply it at scale
38. 41
Collect
Store, and search all
your security data
Zero-trust policy
Kernel-level data collection and enrichment
for adversary tamper resistance
Elastic Common Schema
Open-source specification for uniform data
modeling
Instant access to all data sources
Security, operations, and more data sources
in one product without limitations
Elasticsearch at the core
The heart of the Stack; search across all
your data in an instant
39. 42
Detect
Investigate at scale,
determine the scope
Simple Alert Triage
Assign and manage alerts with a simple
workflow.
Automatic attack visualization
ResolverTM
view for scoping the attack and
root cause analysis, enriched to accelerate
and elevate users
Global detections with customized
machine-learning
Pre-loaded, one-click machine-learning
analysis across all your data
40. 43
Respond
Remediate, eliminate,
validate
One-click containment
Quickly isolate endpoints to prevent further
adversary activity
Real-time, automated response
Autonomous, mIllisecond response actions
for detections deeper in the attack lifecycle
Detect once, prevent many
Easily convert detections to preventions
Fits into your existing workflow
OOTB integrations to fit into your existing
business processes