使用 Elastic Stack 进行端对端安全分析

•

2 likes•654 views

This document discusses security analytics for detection and response. It summarizes collecting data from various sources, normalizing and enriching the data, indexing it, performing automated detection using machine learning, and interactive analysis and response. Key parts of the platform include collecting data using Beats, normalizing it with Elastic Common Schema, enriching it with contextual data, indexing it in Elasticsearch, detecting threats via dynamic correlation and machine learning, and responding by integrating alerts with other systems.

Response Prevention
DetectionRetrospection

Collect
Normalize
& Enrich
Index Index
Automated
Detection
Interactive
Analysis
Respond
Security Analytics for Detection & Response

Collect
Normalize
& Enrich
Index Index
Automated
Detection
Interactive
Analysis
Respond

Domain Data Sources Timing Collection Methods
Network
NetFlow,
PCAP, Zeek
Real-time, Packet-based
Filebeat, Packetbeat,
Logstash NetFlow module
Application Log Real-time, Event-based
Filebeat
Logstash
Cloud API, Log Real-time, Event-based
Beats
Logstash
Host
Signature Alert,
System State
Real-time, Asynchronous
Auditbeat, Winlogbeat,
Filebeat Osquery module
Active Scanning User-driven, Asynchronous Vulnerability scanners
Collect Data

Filebeat
Log Files
Metricbeat
Metrics
Packetbeat
Network Data
Winlogbeat
Window Events
Plus, a growing set of community Beats
Heartbeat
Uptime Monitoring
Auditbeat
Audit Data
Functionbeat
Serverless Shipper
Collect Data with Beats

Normalize Data
10.42.42.42 - - [07/Dec/2018:11:05:07
+0100] "GET /blog HTTP/1.1" 200 2571 "-"
"Mozilla/5.0 (Macintosh; Intel Mac OS X
10_14_0) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/70.0.3538.102 Safari/537.36"

Normalize Data with Elastic Common Schema (ECS)
Searching without ECS Searching with ECS
src:10.42.42.42 OR
client_ip:10.42.42.42 OR
apache2.access.remote_ip:
10.42.42.42 OR
context.user.ip:10.42.42.
42 OR src_ip:10.42.42.42
source.ip:10.42.42.42

• Physical location
• Country, State
• Postal code
• Geo fence
Geographical
Information
• Network model
• Identity details
• Org chart
• DNS resolution
Other
Context
• Vulnerabilities
• IoCs
• Reputation
• TTPs
Threat
Intelligence
Enrich Data

Logstash
Inputs
Beats
…
…
JDBC
…
…
TCP
UDP
HTTP
Filters
Extract Fields
Geo Enrich
Lookup Enrich
DNS Lookups
Pattern Matching
ArcSight Codec
…
Network / Security Data
Syslog Servers
Infra / App Data
IoT / Sensors Persistent Disk Based
Queues
Beats
Outputs
Elasticsearch
…
…
…
…
…
Kafka
RabbitMQ
RDBMS
Centralized
Configuration Management
Elasticsearch
Ingest Nodes (X)
Index Data

20
Reduce False
Positives
Avoid Manual
Threshold
Revision
Identify Areas
of Focus
Understand
Seasonality
Detection via Dynamic Correlation

When something behaves like itself
Monday
Tuesday
Wednesday
Thursday
When something behaves like its peers
Entity Proﬁling with Machine Learning
Behavior Analytics

SCALE
Distributed by design
SPEED
Find matches in milliseconds
RELEVANCE
Get highly relevant results

Integrating Alerts with Other Systems
Robotic Process Automation
Security Applications
SDN Switches
Messaging Services
Issue Tracking Services
Elasticsearch

Devon Energy is a leading independent oil and natural gas exploration and production company. Hear about their journey to augment and eventually replace their legacy SIEM solution with a homegrown analytics and automation platform. See the details of moving from using on-prem open source Elasticsearch to being the first ever user to run Elastic Cloud Enterprise in Azure. Plus, learn how the team uses Elasticsearch optimizations in their security telemetry pipeline, hear about cloud native deployment models, and see how the Logstash transform functions and using Kibana as frontend for security and operational logs have helped deliver big wins.

Achieving cyber mission assurance with near real-time impact

Elasticsearch

See how Elastic and ECS support the Mission Assurance Decision Support System (MADSS) program for the Navy with observability, data enrichment, and powerful search in a containerized environment. By correlating data from diverse sources using web-based services and secure, automated data transformation services, MADSS improves responsiveness, predictions, and event analysis for critical network and infrastructure outages.

Turning Evidence into Insights: How NCIS Leverages Elastic

Elasticsearch

OAP: Optimized Analytics Package for Spark Platform with Daoyuan Wang and Yua...

Databricks

Spark SQL is one of the most popular components in big data warehouse for SQL queries in batch mode, and it allows user to process data from various data sources in a highly efficient way. However, Spark SQL is a general purpose SQL engine and not well designed for ad hoc queries. Intel invented an Apache Spark data source plugin called Spinach for fulfilling such requirements, by leveraging user-customized indices and fine-grained data cache mechanisms. To be more specific, Spinach defines a new Parquet-like data storage format, offering a fine-grained hierarchical cache mechanism in the unit of “Fiber” in memory. Even existing Parquet or ORC data files can be loaded using corresponding adaptors. Data can be cached in off-heap memory to boost data loading. What’s more, Spinach has extended the Spark SQL DDL, to allow users to define the customized indices based on relation. Currently, B+ tree and bloom filter are the first two types of indices supported. Last but not least, since Spinach resides in the process of Spark executor, there’s no extra effort in deployment. All you need to do is to pick Spinach from Spark packages when launching the Spark SQL. sing corresponding adaptors. Data can be cached in off-heap memory to boost data loading. What’s more, Spinach has extended the Spark SQL DDL, to allow user to define the customized indices based on relation. Currently B+ tree and bloom filter are the first 2 types of index we’ve supported. Last but not least, since Spinach resides in the process of Spark executor, there’s no extra effort in deployment, all we need to do is to pick Spinach from Spark packages when launch the Spark SQL. Spinach has been imported in Baidu’s production environment since Q4 2016. It helps several teams migrating their regular data analysis tasks from Hive or MR jobs to ad-hoc queries. In Baidu search ads system FengChao, data engineers analyze advertising effectiveness based on several TBs data of display and click logs every day. Spinach brings a 5x boost compared to original Spark SQL (version 2.1), especially in the scenario of complex search and large data volume. It optimizes the average search cost from minutes to seconds, while brings only 3% data size increase for adding a single index.

Countering Threats with the Elastic Stack at CERDEC/ARL

Elasticsearch

Black friday logs - Scaling Elasticsearch

Sylvain Wallez

Elastic @ Adobe: Making Search Smarter with Machine Learning at Scale

Elasticsearch

Fighting Cybercrime: A Joint Task Force of Real-Time Data and Human Analytics...

Spark Summit

Cybercrime is big business. Gartner reports worldwide security spending at $80B, with annual losses totalling more than $1.2T (in 2015). Small to medium sized businesses now account for more than half of the attacks targeting enterprises today. The threat actors behind these attacks are continually shifting their techniques and toolkits to evade the security defenses that businesses commonly use. Thanks to the growing frequency and complexity of attacks, the task of identifying and mitigating security-related events has become increasingly difficult. At eSentire, we use a combination of data and human analytics to identify, respond to and mitigate cyber threats in real-time. We capture all network traffic on our customers’ networks, hence ingesting a large amount of time-series data. We process the data as it is being streamed into our system to extract relevant threat insights and block attacks in real-time. Furthermore, we enable our cybersecurity analysts to perform in-depth investigations to: i) confirm attacks and ii) identify threats that analytical models miss. Having security experts in the loop provides feedback to our analytics engine, thereby improving the overall threat detection effectiveness. So how exactly can you build an analytics pipeline to handle a large amount of time-series/event-driven data? How do you build the tools that allow people to query this data with the expectation of mission-critical response times? In this presentation, William Callaghan will focus on the challenges faced and lessons learned in building a human-in-the loop cyber threat analytics pipeline. They will discuss the topic of analytics in cybersecurity and highlight the use of technologies such as Spark Streaming/SQL, Cassandra, Kafka and Alluxio in creating an analytics architecture with missions-critical response times.

Cncf checkov and bridgecrew

LibbySchulze

Cloud monitoring

Gang Tao

Евгений Напрягло "Методы кэширования данных в распределенных высоконагруженны...

Fwdays

Евгений расскажет об основных методах кэширования данных в распределенных высоконагруженных приложениях. Вы услышите о различных подходах к организации распределнных кэшей и стратегий поддеражания данных в согласованном состоянии. После небольшого теоретического введения будет описан пример практического сценария, связанного с построением такого кэша в программном пакете, используемом одним из крупнейших европейских провайдеров телекоммуникаций.

Combining logs, metrics, and traces for unified observability

Elasticsearch

IMC Summit 2016 Breakout - Matt Coventon - Test Driving Streaming and CEP on ...

In-Memory Computing Summit

Apache Ignite is a high-performance, integrated and distributed in-memory platform for computing and transacting on large-scale data sets in real-time. But, did you know it provides streaming and complex event processing (CEP)? In this hands-on demonstration we will take Apache Ignite’s Streaming and CEP features for a test drive. We will start with an example streaming use case then demonstrate how to implement each component in Apache Ignite. Finally we will show how to connect a dashboard application to Apache Ignite to display the results.

What's hot

Elastic v5.0.0 Update uptoalpha3 v0.2 - 김종민

NAVER D2

University of Oxford: building a next generation SIEM

Elasticsearch

Open source log analytics

Vinod Nayal

Elastic Stack roadmap deep dive

Elasticsearch

Kibana + timelion: time series with the elastic stack

Sylvain Wallez

How eStruxture Data Centers is Using ECE to Rapidly Scale Their Business

Elasticsearch

Cloud native policy enforcement with Open Policy Agent

LibbySchulze

Industrial production process visualization with the Elastic Stack in real-ti...

Elasticsearch

Architecture at Scale

Elasticsearch

Elastic Cloud Enterprise in Azure with Devon

Elasticsearch

Achieving cyber mission assurance with near real-time impact

Elasticsearch

Turning Evidence into Insights: How NCIS Leverages Elastic

Elasticsearch

OAP: Optimized Analytics Package for Spark Platform with Daoyuan Wang and Yua...

Databricks

Countering Threats with the Elastic Stack at CERDEC/ARL

Elasticsearch

Black friday logs - Scaling Elasticsearch

Sylvain Wallez

Elastic @ Adobe: Making Search Smarter with Machine Learning at Scale

Elasticsearch

Fighting Cybercrime: A Joint Task Force of Real-Time Data and Human Analytics...

Spark Summit

Cncf checkov and bridgecrew

LibbySchulze

Cloud monitoring

Gang Tao

Евгений Напрягло "Методы кэширования данных в распределенных высоконагруженны...

Fwdays

What's hot (20)

Elastic v5.0.0 Update uptoalpha3 v0.2 - 김종민

University of Oxford: building a next generation SIEM

Open source log analytics

Elastic Stack roadmap deep dive

Kibana + timelion: time series with the elastic stack

How eStruxture Data Centers is Using ECE to Rapidly Scale Their Business

Cloud native policy enforcement with Open Policy Agent

Industrial production process visualization with the Elastic Stack in real-ti...

Architecture at Scale

Elastic Cloud Enterprise in Azure with Devon

Achieving cyber mission assurance with near real-time impact

Turning Evidence into Insights: How NCIS Leverages Elastic

OAP: Optimized Analytics Package for Spark Platform with Daoyuan Wang and Yua...

Countering Threats with the Elastic Stack at CERDEC/ARL

Black friday logs - Scaling Elasticsearch

Elastic @ Adobe: Making Search Smarter with Machine Learning at Scale

Fighting Cybercrime: A Joint Task Force of Real-Time Data and Human Analytics...

Cncf checkov and bridgecrew

Cloud monitoring

Евгений Напрягло "Методы кэширования данных в распределенных высоконагруженны...

Similar to 使用 Elastic Stack 进行端对端安全分析

Combining logs, metrics, and traces for unified observability

Elasticsearch

IMC Summit 2016 Breakout - Matt Coventon - Test Driving Streaming and CEP on ...

In-Memory Computing Summit

SQL Server 2008 R2 StreamInsight

Eduardo Castro

In this presentation we review the basic architecture behind SQL Server StreamInsight. Regards, Ing. Eduardo Castro Martínez, PhD – Microsoft SQL Server MVP http://mswindowscr.org http://comunidadwindows.org Costa Rica Technorati Tags: SQL Server LiveJournal Tags: SQL Server del.icio.us Tags: SQL Server http://ecastrom.blogspot.com http://ecastrom.wordpress.com http://ecastrom.spaces.live.com http://universosql.blogspot.com http://todosobresql.blogspot.com http://todosobresqlserver.wordpress.com http://mswindowscr.org/blogs/sql/default.aspx http://citicr.org/blogs/noticias/default.aspx http://sqlserverpedia.blogspot.com/

What is going on? Application Diagnostics on Azure - Copenhagen .NET User Group

Maarten Balliauw

We all like building and deploying cloud applications. But what happens once that’s done? How do we know if our application behaves like we expect it to behave? Of course, logging! But how do we get that data off of our machines? How do we sift through a bunch of seemingly meaningless diagnostics? In this session, we’ll look at how we can keep track of our Azure application using structured logging, AppInsights and AppInsights analytics to make all that data more meaningful.

Using Elastic to Monitor Anything

Idan Tohami

Event Driven Streaming Analytics - Demostration on Architecture of IoT

Lei Xu

Log analysis using elk

Rushika Shah

Novetta Cyber Analytics

Novetta

Despite billions spent on enterprise cyber security, breaches from advanced attacks, costing millions, are occurring on a daily basis. Our Solution: Complete Near Real-time Network Security Visibility and Awareness: If security analysts could see everything occurring on their network in real-time, breaches would occur but there would never be catastrophic damage – breach reaction would be almost instantaneous. Novetta Cyber Analytics is a linchpin enterprise security solution that enables security analysts, for the first time, to see a complete, near real-time, uncorrupted picture of their entire network. Security analysts then ask and receive answers to subtle questions – at the speed of thought – to enable detection, triage and response to breaches as they occur. The Benefits: Increase events-responded-to an estimated 30X over. Substantially reduce or eliminate damage from breaches. Create a dramatically more effective and efficient security team. Maximize current security infrastructure investment. Be far more confident that your network is actually secure. OUR DIFFERENTIATORS: Understands the truth of what is happening on your network. Detects advanced attacks that have breached perimeter defenses. Develops a complete, near real-time understanding of suspicious behaviour. Develops a battleground understanding of your entire security situation. Augments current security solutions. Proven speed, scale and effectiveness on the largest, most attacked networks on earth.

Zentral - what's new? - MacDevOps:YVR 2017

Henry Stamerjohann

Analyzing NGINX Logs with Datadog

NGINX, Inc.

On-Demand Link: https://www.nginx.com/resources/webinars/analyzing-nginx-logs-datadog/ About the Webinar Datadog is a SaaS-based monitoring and analytics platform for cloud-scale organizations. The company is an industry leader in monitoring and observability – with over 350+ vendor-supported integrations, Datadog seamlessly correlates metrics, traces, and logs across the full DevOps stack. With Datadog’s Log Management solution, you can cost-effectively collect, analyze, and archive all your logs with an easy-to-use, intuitive interface. Attend this webinar to learn how to analyze NGINX logs using Datadog to achieve business outcomes including SEO optimization, improved website performance, and detection of DDoS attacks.

Analyzing Data Streams in Real Time with Amazon Kinesis: PNNL's Serverless Da...

Amazon Web Services

Amazon Kinesis makes it easy to collect, process, and analyze real-time, streaming data so you can get timely insights and react quickly to new information. In this session, we first present an end-to-end streaming data solution using Amazon Kinesis Data Streams for data ingestion, Amazon Kinesis Data Analytics for real-time processing, and Amazon Kinesis Data Firehose for persistence. We review in detail how to write SQL queries for operational monitoring using Kinesis Data Analytics. Learn how PNNL is building their ingestion flow into their Serverless Data Lake leveraging the Kinesis Platform. At times migrating existing NiFi Processes where applicable to various parts of the Kinesis Platform, replacing complex flows on Nifi to bundle and compress the data with Kinesis Firehose, leveraging Kinesis Streams for their enrichment and transformation pipelines, and using Kinesis Analytics to Filter, Aggregate, and detect anomalies.

Sumo Logic Cert Jam - Security Analytics

Sumo Logic

IOT, Streaming Analytics and Machine Learning

DataWorks Summit/Hadoop Summit

File000126Desmond Devendran

What's new in log insight 3.3 presentation

David Pasek

Q radar architecture deep dive

Kamal Mouline

xGem Data Stream Processing

Jorge Hirtz

MMIX Peering Forum and MMNOG 2020: Packet Analysis for Network Security

APNIC

Making Runtime Data Useful for Incident Diagnosis: An Experience Report

QAware GmbH

QuASD/PROFES 2018, Wolfsburg: Talk by Marcus Ciolkowski (@M_Ciolkowski, Principal IT Consultant at QAware) and Florian Lautenschlager (@flolaut, Senior Software Engineer) === Please download slides if blurred! === Abstract: Important and critical aspects of technical debt often surface at runtime only and are difficult to measure statically. This is a particular challenge for cloud applications because of their highly distributed nature. Fortunately, mature frameworks for collecting runtime data exist but need to be integrated. In this paper, we report an experience from a project that implements a cloud application within Kubernetes on Azure. To analyze the runtime data of this software system, we instrumented our services with Zipkin for distributed tracing; with Prometheus and Grafana for analyzing metrics; and with fluentd, Elasticsearch and Kibana for collecting, storing and exploring log files. However, project team members did not utilize these runtime data until we created a unified and simple access using a chat bot. We argue that even though your project collects runtime data, this is not sufficient to guarantee its usage: In order to be useful, a simple, unified access to different data sources is required that should be integrated into tools that are commonly used by team members. Get the research paper: http://bitly.com/2QmSNwl

Observability from the Home

FaithWestdorp

Similar to 使用 Elastic Stack 进行端对端安全分析 (20)

Combining logs, metrics, and traces for unified observability

IMC Summit 2016 Breakout - Matt Coventon - Test Driving Streaming and CEP on ...

SQL Server 2008 R2 StreamInsight

What is going on? Application Diagnostics on Azure - Copenhagen .NET User Group

Using Elastic to Monitor Anything

Event Driven Streaming Analytics - Demostration on Architecture of IoT

Log analysis using elk

Novetta Cyber Analytics

Zentral - what's new? - MacDevOps:YVR 2017

Analyzing NGINX Logs with Datadog

Analyzing Data Streams in Real Time with Amazon Kinesis: PNNL's Serverless Da...

Sumo Logic Cert Jam - Security Analytics

IOT, Streaming Analytics and Machine Learning

File000126

What's new in log insight 3.3 presentation

Q radar architecture deep dive

xGem Data Stream Processing

MMIX Peering Forum and MMNOG 2020: Packet Analysis for Network Security

Making Runtime Data Useful for Incident Diagnosis: An Experience Report

Observability from the Home

More from Elasticsearch

An introduction to Elasticsearch's advanced relevance ranking toolbox

Elasticsearch

The hallmark of a great search experience is always delivering the most relevant results, quickly, to every user. The difficulty lies behind the scenes in making that happen elegantly and at a scale. From App Search’s intuitive drag and drop interface to the advanced relevance capabilities built into the core of Elasticsearch — Elastic offers a range of tools for developers to tune relevance ranking and create incredible search experiences. In this session, we’ll explore some of Elasticsearch’s advanced relevance ranking features, such as dense vector fields, BM25F, ranking evaluation, and more. Plus we’ll give you some ideas for how these features are being used by other Elastic users to create world-class, category defining search experiences.

From MSP to MSSP using Elastic

Elasticsearch

Eze Castle Integration is a managed service provider (MSP), cloud service provider (CSP), and internet service provider (ISP) that delivers services to more than 1,000 clients around the world. Different departments within Eze Castle have devised their own log aggregation solutions in order to provide visibility, meet regulatory compliance requirements, conduct cybersecurity investigations, and help engineers with troubleshooting infrastructure issues. In 2019, they partnered with Elastic to consolidate the data generated from different systems into a single pane of glass. And thanks to the ease of deployment on Elastic Cloud, professional consultation services from Elastic engineers, and on-demand training courses available on Elastic Learning, Eze Castle was able to go from proof-of-concept to a fully functioning ""Eze Managed SIEM"" product within a month! Learn about Eze Castle's journey with Elastic and how they grew Eze Managed SIEM from zero to 100 customers In less than 14 months.

Cómo crear excelentes experiencias de búsqueda en sitios web

Elasticsearch

Descubre lo fácil que es crear búsquedas relevantes y enriquecidas en sitios web de cara al público para impulsar las conversiones, incrementar el consumo de contenido y ayudar a los visitantes a encontrar lo que necesitan. Realiza un recorrido por las herramientas de Elastic a las que puedes sacar partido para transformar con facilidad tu sitio web, lo que incluye nuestro nuevo y potente rastreador web.

Te damos la bienvenida a una nueva forma de realizar búsquedas

Elasticsearch

Al igual que la mayoría de las organizaciones modernas, tus equipos probablemente usan más de 10 aplicaciones basadas en la nube a diario, pero dedican demasiado tiempo a buscar la información que necesitan en todas estas. Gracias a las características integradas de Elastic Workplace Search, podrás comprobar lo sencillo que resulta poner el contenido relevante al alcance de tus equipos gracias a la búsqueda unificada para todas las aplicaciones que usan para llevar a cabo su trabajo.

Tirez pleinement parti d'Elastic grâce à Elastic Cloud

Elasticsearch

Découvrez pourquoi Elastic Cloud est la solution idéale pour exploiter toutes les offres d'Elastic. Bénéficiez d'une flexibilité d'achat et de déploiement au sein de Google Cloud, de Microsoft Azure, d'Amazon Web Services ou des trois à la fois. Apprenez quels avantages vous apporte une offre de service géré et déterminez la solution qui vous permet de la gérer par vous-même grâce à des outils intégrés d'automatisation et d'orchestration. Et ce n'est pas tout ! Familiarisez-vous avec les fonctionnalités qui peuvent vous aider à scaler vos opérations au fur et à mesure de l'évolution de votre déploiement, à stocker vos données d'une manière rentable et à optimiser vos recherches. Ainsi, vous n'aurez plus à abandonner de données et obtiendrez les informations exploitables dont vous avez besoin pour assurer le fonctionnement de votre entreprise.

Comment transformer vos données en informations exploitables

Elasticsearch

Plongez au cœur de la recherche dans tous ses états.

Elasticsearch

À l'instar de la plupart des entreprises modernes, vos équipes utilisent probablement plus de 10 applications hébergées dans le cloud chaque jour, mais passent aussi bien trop de temps à chercher les informations dont elles ont besoin dans ces outils. Grâce aux fonctionnalités prêtes à l'emploi d'Elastic Workplace Search, découvrez combien il est facile de mettre le contenu pertinent à portée de la main de vos équipes grâce à une recherche unifiée sur l'ensemble des applications qu'elles utilisent pour faire leur travail.

Modernising One Legal Se@rch with Elastic Enterprise Search [Customer Story]

Elasticsearch

An introduction to Elasticsearch's advanced relevance ranking toolbox

Elasticsearch

Welcome to a new state of find

Elasticsearch

Like most modern organizations, your teams are likely using upwards of 10 cloud-based applications on a daily basis, but spending far too many hours a day searching for the information they need across all of them. With the out-of-the-box capabilities of Elastic Workplace Search, see how easy it is to put relevant content right at your teams’ fingertips with unified search across all the apps they rely on to get work done.

Building great website search experiences

Elasticsearch

Keynote: Harnessing the power of Elasticsearch for simplified search

Elasticsearch

Cómo transformar los datos en análisis con los que tomar decisiones

Elasticsearch

Explore relève les défis Big Data avec Elastic Cloud

Elasticsearch

Spécialisée dans le développement et la gestion de solutions de veille documentaire et commerciale, Explore offre à ses clients une lecture précise et organisée de l’actualités des marchés et projets sur leurs territoires d'intervention. Afin de rendre leur offre plus agile et performante, Explore a choisi l’offre Elastic Cloud hébergée sur Microsoft Azure. Découvrez comment les équipes de production et de développement sont désormais en mesure de mieux exploiter les données pour les clients d’Explore et gagnent du temps sur la gestion de leur infrastructure.

Comment transformer vos données en informations exploitables

Elasticsearch

Transforming data into actionable insights

Elasticsearch

Opening Keynote: Why Elastic?

Elasticsearch

"Elastic enables the world’s leading organization to exceed their business objectives and power their mission-critical systems by eliminating data silos, connecting the dots, and transforming data of all types into actionable insights. Come learn how the power of search can help you quickly surface relevant insights at scale. Whether you are an executive looking to reduce operational costs, a department head striving to do more with fewer tools, or engineer monitoring and protecting your IT environment, this session is for you. "

Empowering agencies using Elastic as a Service inside Government

Elasticsearch

It has now been four years since the beta release of Elastic Cloud Enterprise which kicked off a wave of the Elastic public sector community running Elastic as a service within Government rather than utilizing purely hosted solutions. Fast forward to 2021 and we have multiple options for multiple mission needs. Learn top tips from Elastic architects and their experience enabling their teams with the automation and provisioning of Elastic tech to change the game in how government delivers solutions.

The opportunities and challenges of data for public good

Elasticsearch

Enterprise search and unstructured data with CGI and Elastic

Elasticsearch

More from Elasticsearch (20)

An introduction to Elasticsearch's advanced relevance ranking toolbox

From MSP to MSSP using Elastic

Cómo crear excelentes experiencias de búsqueda en sitios web

Te damos la bienvenida a una nueva forma de realizar búsquedas

Tirez pleinement parti d'Elastic grâce à Elastic Cloud

Comment transformer vos données en informations exploitables

Plongez au cœur de la recherche dans tous ses états.

Modernising One Legal Se@rch with Elastic Enterprise Search [Customer Story]

An introduction to Elasticsearch's advanced relevance ranking toolbox

Welcome to a new state of find

Building great website search experiences

Keynote: Harnessing the power of Elasticsearch for simplified search

Cómo transformar los datos en análisis con los que tomar decisiones

Explore relève les défis Big Data avec Elastic Cloud

Comment transformer vos données en informations exploitables

Transforming data into actionable insights

Opening Keynote: Why Elastic?

Empowering agencies using Elastic as a Service inside Government

The opportunities and challenges of data for public good

Enterprise search and unstructured data with CGI and Elastic

Recently uploaded

Epistemic Interaction - tuning interfaces to provide information for AI support

Alan Dix

Paper presented at SYNERGY workshop at AVI 2024, Genoa, Italy. 3rd June 2024 https://alandix.com/academic/papers/synergy2024-epistemic/ As machine learning integrates deeper into human-computer interactions, the concept of epistemic interaction emerges, aiming to refine these interactions to enhance system adaptability. This approach encourages minor, intentional adjustments in user behaviour to enrich the data available for system learning. This paper introduces epistemic interaction within the context of human-system communication, illustrating how deliberate interaction design can improve system understanding and adaptation. Through concrete examples, we demonstrate the potential of epistemic interaction to significantly advance human-computer interaction by leveraging intuitive human communication strategies to inform system design and functionality, offering a novel pathway for enriching user-system engagements.

The Future of Platform Engineering

Jemma Hussein Allen

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Albert Hoitingh

Introduction to CHERI technology - Cybersecurity

mikeeftimakis1

DevOps and Testing slides at DASA Connect

Kari Kakkonen

UiPath Test Automation using UiPath Test Suite series, part 3

DianaGray10

SAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdf

Peter Spielvogel

Building better applications for business users with SAP Fiori. • What is SAP Fiori and why it matters to you • How a better user experience drives measurable business benefits • How to get started with SAP Fiori today • How SAP Fiori elements accelerates application development • How SAP Build Code includes SAP Fiori tools and other generative artificial intelligence capabilities • How SAP Fiori paves the way for using AI in SAP apps

Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...

Ramesh Iyer

In today's fast-changing business world, Companies that adapt and embrace new ideas often need help to keep up with the competition. However, fostering a culture of innovation takes much work. It takes vision, leadership and willingness to take risks in the right proportion. Sachin Dev Duggal, co-founder of Builder.ai, has perfected the art of this balance, creating a company culture where creativity and growth are nurtured at each stage.

Leading Change strategies and insights for effective change management pdf 1.pdf

OnBoard

GraphRAG is All You need? LLM & Knowledge Graph

Guy Korland

Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs. 1. Unifying Large Language Models and Knowledge Graphs: A Roadmap. https://arxiv.org/abs/2306.08302 2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs: https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/

Quantum Computing: Current Landscape and the Future Role of APIs

Vlad Stirbu

Assure Contact Center Experiences for Your Customers With ThousandEyes

ThousandEyes

Welocme to ViralQR, your best QR code generator.

ViralQR

Welcome to ViralQR, your best QR code generator available on the market! At ViralQR, we design static and dynamic QR codes. Our mission is to make business operations easier and customer engagement more powerful through the use of QR technology. Be it a small-scale business or a huge enterprise, our easy-to-use platform provides multiple choices that can be tailored according to your company's branding and marketing strategies. Our Vision We are here to make the process of creating QR codes easy and smooth, thus enhancing customer interaction and making business more fluid. We very strongly believe in the ability of QR codes to change the world for businesses in their interaction with customers and are set on making that technology accessible and usable far and wide. Our Achievements Ever since its inception, we have successfully served many clients by offering QR codes in their marketing, service delivery, and collection of feedback across various industries. Our platform has been recognized for its ease of use and amazing features, which helped a business to make QR codes. Our Services At ViralQR, here is a comprehensive suite of services that caters to your very needs: Static QR Codes: Create free static QR codes. These QR codes are able to store significant information such as URLs, vCards, plain text, emails and SMS, Wi-Fi credentials, and Bitcoin addresses. Dynamic QR codes: These also have all the advanced features but are subscription-based. They can directly link to PDF files, images, micro-landing pages, social accounts, review forms, business pages, and applications. In addition, they can be branded with CTAs, frames, patterns, colors, and logos to enhance your branding. Pricing and Packages Additionally, there is a 14-day free offer to ViralQR, which is an exceptional opportunity for new users to take a feel of this platform. One can easily subscribe from there and experience the full dynamic of using QR codes. The subscription plans are not only meant for business; they are priced very flexibly so that literally every business could afford to benefit from our service. Why choose us? ViralQR will provide services for marketing, advertising, catering, retail, and the like. The QR codes can be posted on fliers, packaging, merchandise, and banners, as well as to substitute for cash and cards in a restaurant or coffee shop. With QR codes integrated into your business, improve customer engagement and streamline operations. Comprehensive Analytics Subscribers of ViralQR receive detailed analytics and tracking tools in light of having a view of the core values of QR code performance. Our analytics dashboard shows aggregate views and unique views, as well as detailed information about each impression, including time, device, browser, and estimated location by city and country. So, thank you for choosing ViralQR; we have an offer of nothing but the best in terms of QR code services to meet business diversity!

The Art of the Pitch: WordPress Relationships and Sales

Laura Byrne

Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes? All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.

Monitoring Java Application Security with JDK Tools and JFR Events

Ana-Maria Mihalceanu

Elevating Tactical DDD Patterns Through Object Calisthenics

Dorra BARTAGUIZ

After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

DanBrown980551

Do you want to learn how to model and simulate an electrical network from scratch in under an hour? Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)! During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook. PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides: - A fully editable and extendable library for grid component modelling; - Visualization tools to display your network; - Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses; The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well. What you will learn during the webinar: - For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills; - For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.

Bits & Pixels using AI for Good.........

Alison B. Lowndes

Transcript: Selling digital books in 2024: Insights from industry leaders - T...

BookNet Canada

The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more. Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/ Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.

Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...

Product School

Recently uploaded (20)

Epistemic Interaction - tuning interfaces to provide information for AI support

The Future of Platform Engineering

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Introduction to CHERI technology - Cybersecurity

DevOps and Testing slides at DASA Connect

UiPath Test Automation using UiPath Test Suite series, part 3

SAP Sapphire 2024 - ASUG301 building better apps with SAP Fiori.pdf

Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...

Leading Change strategies and insights for effective change management pdf 1.pdf

GraphRAG is All You need? LLM & Knowledge Graph

Quantum Computing: Current Landscape and the Future Role of APIs

Assure Contact Center Experiences for Your Customers With ThousandEyes

Welocme to ViralQR, your best QR code generator.

The Art of the Pitch: WordPress Relationships and Sales

Monitoring Java Application Security with JDK Tools and JFR Events

Elevating Tactical DDD Patterns Through Object Calisthenics

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

Bits & Pixels using AI for Good.........

Transcript: Selling digital books in 2024: Insights from industry leaders - T...

Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...

使用 Elastic Stack 进行端对端安全分析

4. Challenge accepted.

5. Response Prevention DetectionRetrospection

7. Collect Normalize & Enrich Index Index Automated Detection Interactive Analysis Respond Security Analytics for Detection & Response

8. Collect Normalize & Enrich Index Index Automated Detection Interactive Analysis Respond

9. Domain Data Sources Timing Collection Methods Network NetFlow, PCAP, Zeek Real-time, Packet-based Filebeat, Packetbeat, Logstash NetFlow module Application Log Real-time, Event-based Filebeat Logstash Cloud API, Log Real-time, Event-based Beats Logstash Host Signature Alert, System State Real-time, Asynchronous Auditbeat, Winlogbeat, Filebeat Osquery module Active Scanning User-driven, Asynchronous Vulnerability scanners Collect Data

10. Filebeat Log Files Metricbeat Metrics Packetbeat Network Data Winlogbeat Window Events Plus, a growing set of community Beats Heartbeat Uptime Monitoring Auditbeat Audit Data Functionbeat Serverless Shipper Collect Data with Beats

11. Collect Normalize & Enrich Index Index Automated Detection Interactive Analysis Respond

12. Normalize Data 10.42.42.42 - - [07/Dec/2018:11:05:07 +0100] "GET /blog HTTP/1.1" 200 2571 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36"

13. Normalize Data with Elastic Common Schema (ECS) Searching without ECS Searching with ECS src:10.42.42.42 OR client_ip:10.42.42.42 OR apache2.access.remote_ip: 10.42.42.42 OR context.user.ip:10.42.42. 42 OR src_ip:10.42.42.42 source.ip:10.42.42.42

14. Normalize Data to Streamline Analysis

15. • Physical location • Country, State • Postal code • Geo fence Geographical Information • Network model • Identity details • Org chart • DNS resolution Other Context • Vulnerabilities • IoCs • Reputation • TTPs Threat Intelligence Enrich Data

16. Collect Normalize & Enrich Index Index Automated Detection Interactive Analysis Respond

17. Logstash Inputs Beats … … JDBC … … TCP UDP HTTP Filters Extract Fields Geo Enrich Lookup Enrich DNS Lookups Pattern Matching ArcSight Codec … Network / Security Data Syslog Servers Infra / App Data IoT / Sensors Persistent Disk Based Queues Beats Outputs Elasticsearch … … … … … Kafka RabbitMQ RDBMS Centralized Configuration Management Elasticsearch Ingest Nodes (X) Index Data

18. Collect Normalize & Enrich Index Index Automated Detection Interactive Analysis Respond

19. Detection via Manual Correlation

20. 20 Reduce False Positives Avoid Manual Threshold Revision Identify Areas of Focus Understand Seasonality Detection via Dynamic Correlation

21. When something behaves like itself Monday Tuesday Wednesday Thursday When something behaves like its peers Entity Proﬁling with Machine Learning Behavior Analytics

22.

23. Get Started with Machine Learning

24. Collect Normalize & Enrich Index Index Automated Detection Interactive Analysis Respond

25. SCALE Distributed by design SPEED Find matches in milliseconds RELEVANCE Get highly relevant results

26.

27. Collect Normalize & Enrich Index Index Automated Detection Interactive Analysis Respond

28. Integrating Alerts with Other Systems Robotic Process Automation Security Applications SDN Switches Messaging Services Issue Tracking Services Elasticsearch

29. Alerting with Slack

30. Power to the Practitioners

31. www.elastic.co

使用 Elastic Stack 进行端对端安全分析

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to 使用 Elastic Stack 进行端对端安全分析

Similar to 使用 Elastic Stack 进行端对端安全分析 (20)

More from Elasticsearch

More from Elasticsearch (20)

Recently uploaded

Recently uploaded (20)

使用 Elastic Stack 进行端对端安全分析