Empower Your Security Practitioners with Elastic SIEM

•

3 likes•6,357 views

Learn how Elastic SIEM’s latest capabilities enable interactive exploration and automated analysis — all at the speed and scale your security practitioners need to defend your organization. See the video: https://www.elastic.co/elasticon/tour/2019/washington-dc/empower-your-security-practitioners-with-elastic-siem

Technology

15 OCT 19
Kevin Keeney
Cyber Security Advocate
Empower Your Security Practitioners
with Elastic SIEM

Introduction
Kevin Keeney
Cyber Security
Advocate
@kevinkeeneyjr
linkedin.com/in/kevinkeeney

4
● A common, extensible set of ﬁelds to
ingest data into Elasticsearch
● Ability to correlate data across
diﬀerent data sources
● Ability to re-use analysis content
across solutions in Kibana
● An ever-expanding community of
vendors & experts contributing to ECS
Elastic Common Schema (ECS)
Normalize data to streamline analysis

7
Commercial
Adoption
Corelight
From the makers of Zeek/Bro
Palo Alto Networks
All the feeds that come from
NGFW versions 8.0-9.0
Cloudﬂare
Where CDN meets security

8
Elastic SIEM (beta)
A SIEM for Elastic Stack users everywhere
Elastic SIEM app
Elastic Common
Schema (ECS)
Network & host
data integrations
Visualize your Elasticsearch
data and navigate the
Elastic Stack
A distributed, RESTful
search and analytics engine
Elastic &
community
security
content
Beats Logstash
Elastic
Endpoint

9
Response Prevention
Detection
Iterative

10
No Compromises:
Speed Scale Relevance

1212
Auditbeat
● System module (Linux, macOS, Win.): packages,
processes, logins, sockets, users and groups
● Auditd module (Linux Kernel Audit info)
● File integrity monitoring (Linux, macOS, Win.)
Filebeat
● System logs (auth logs) (Linux)
● Santa (macOS)
Winlogbeat
● Windows event logs
● Sysmon
Curated integrations
Host
data

1313
Packetbeat
● Flows
● DNS
● Other protocols
Filebeat
● IDS/IPS/NMS modules: Zeek NMS, Suricata IDS
● NetFlow, CEF
● Firewall modules: Cisco ASA, FTD, Palo Alto
Networks, Ubiquiti IPTables
● Kubernetes modules: CoreDNS, Envoy proxy
● Google VPC ﬂow logs, PubSub Input
Curated integrations
Network
data

25
Automated Detection
Machine Learning jobs for Security Analytics
v.7.3
Three security ML jobs included:
rare_process_by_host_windows_ecs
rare_process_by_host_linux_ecs
suspicious _login_actvity_ecs

27
Automated Detection
Machine Learning jobs for Security Analytics
v.7.4
Thirteen more security ML jobs added:
linux-anomalous-network-activity
linux-anomalous-network-port-activity
linux-anomalous-network-service
linux-anomalous-process-all-hosts
linux-anomalous-network-URL-activity
linux-anomalous-user-name
linux-anomalous-path-activity
windows-anomalous-path-activity
windows-anomalous-process-all-hosts
windows-anomalous-process-creation
windows-anomalous-service
windows-anomalous-script
windows-anomalous-network-activity

28
Even more for security analysts to love

29
Elastic SIEM Bottom-up Vision
Elastic Confidential Information - Roadmap information provided on this slide is an overview of overall direction and nothing is committed.
5 Deep Community Ecosystem
3 Rich Visualizations, Easy Workﬂow
1 Fast Scalable Search Engine
4Eﬀective Detection Library
2Multiple Detection Engines

Endgame Integration Strengthens Protection
Elastic Endpoint & SIEM
Prevention
Prevention starts with Elastic
Endpoint, blocking adversary
attacks at the source.
Detection
When prevention is not enough,
detection is critical. Detection
gains context in Elastic SIEM.
Response
Detection is made actionable with
response. Endpoint and SIEM
together speed remediation.
Elastic Endpoint
Prevent, Detect, Collect
Elastic SIEM
Detect, Add Context, Respond
Elastic Security - Integrated Endpoint Security and SIEM

Thank You!
15 OCT 19
Kevin Keeney
Cyber Security Advocate

Video: https://www.youtube.com/watch?v=v69kyU5XMFI A talk I gave at the Philly Security Shell meetup 2019-02-21 on how the Elastic Stack works and how you can use it for indexing and searching security logs. Tools I mentioned: Github repo with script and demo data - https://github.com/SecHubb/SecShell_Demo Cerebro - https://github.com/lmenezes/cerebro Elastalert - https://github.com/Yelp/elastalert For info on my SANS teaching schedule visit: https://www.sans.org/instructors/john... Twitter: https://twitter.com/SecHubb

Elastic SIEM (Endpoint Security)

Kangaroot

What is SIEM

Patten John

ELK in Security Analytics

nullowaspmumbai

McAfee SIEM solution

hashnees

Beginner's Guide to SIEM

AlienVault

SEIM-Microsoft Sentinel.pptx

AmrMousa51

Security Information and Event Management (SIEM)

k33a

You own a SIEM, but to be secure, you need a Security Operations Center! How do you cross the chasm? Do you hire staff or outsource? And what skills are needed? Mike Ostrowski, a cybersecurity industry veteran, will review common pitfalls experienced through the journey from SIEM to SOC, the pros and cons of an all in-house SOC vs. outsourcing, and the benefits of a hybrid SOC model. Learning Objectives: 1: You own a SIEM, but to be secure, you need a SOC. How do you cross the chasm? 2: What are the pros and cons of in-house, fully managed and hybrid security? 3: What considerations go into deciding whether to employ a hybrid strategy? (Source: RSA Conference USA 2018)

Keynote: Elastic Security evolution and vision

Elasticsearch

QRadar, ArcSight and Splunk

M sharifi

Security Information and Event Management (SIEM)

hardik soni

SOC, Amore Mio! | Security Webinar

Splunk

.italo operates an Essential Service by connecting more than 100 million people annually across Italy with its super fast and secure railway. And CISO Enrico Maresca has been on a whirlwind journey of his own. Formerly a Cyber Security Engineer, Enrico started at .italo as an IT Security Manager. One year later, he was promoted to CISO and tasked with building out – and significantly increasing the maturity level – of the SOC. The result was a huge step forward for .italo. So how did he successfully achieve this ambitious ask? Join Enrico as he reveals the key insights and lessons learned in his SOC journey, including: Top challenges faced in improving security posture Key KPIs implemented in order to measure success Strategies and approaches applied in the SOC How MITRE ATT&CK and Splunk Enterprise Security were utilised Next steps in their maturity journey ahead

SIEM - Activating Defense through Response by Ankur Vats

OWASP Delhi

SOC Architecture Workshop - Part 1

Priyanka Aash

OSSIM Overview

n|u - The Open Security Community

Siem ppt

kmehul

SIEM presentation finalRizwan S

Fleet and elastic agent

Ismaeel Enjreny

7 Steps to Build a SOC with Limited Resources

LogRhythm

Most organizations don't have the resources to staff a 24x7 security operations center (SOC). This results in events that aren't monitored around the clock, major delays in detecting and responding to incidents, and the inability for the team to proactively hunt for threats. It's a dangerous situation. But there is a solution. By using the Threat Lifecycle Management framework to combine people, process, and technology to automate manual tasks, your team can rapidly detect and respond to threats—without adding resources. Read on to learn 7 steps to building your SOC, even when your resources are limited.

Learn how to use an Analytics-Driven SIEM for your Security Operations

Splunk

Join our Security Experts and learn about our Analytics-Driven SIEM, Splunk Enterprise Security (ES) in a live, hands-on session. You will start off with a hands-on tour of Splunk's award-winning SIEM, Splunk Enterprise Security and understand its key frameworks and its unique capabilities. Then, you will work on hands-on exercises that involve threat detection, incident investigation and how to take rapid responses using data from a range of sources such as threat list intelligence feeds, endpoint activity logs, e-mail logs, and web logs. This session is a must session for all security practitioners.

Splunk Enterprise Security

Splunk

Splunk Enterprise Security (ES) ist eine SIEM-Lösung, die Einblicke in von Sicherheitstechnologien erzeugte Maschinendaten wie Angaben über Netzwerke, Endpunkte, Zugriffe, Schadsoftware, Schwachstellen sowie Identitätsdaten liefert. Sicherheitsteams können damit interne und externe Angriffe schnell erkennen und abwehren und somit das Threat Management vereinfachen, Risiken minimieren und Ihr Unternehmen schützen. Splunk Enterprise Security strafft sämtliche Aspekte von Sicherheitsprozessen und eignet sich für Unternehmen jeder Größe und Expertise.

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Vaticle

⚛️ Building a cyber threat intelligence knowledge management system using Grakn Knowledge of cyber threats is a key focus in many areas of cybersecurity. Adapting intrusion detection systems, building relevant red team scenarios, guiding incident response activities, providing a more effective risk assessment through better knowledge of threat agents: all of these require a deep understanding of the issues related to the relevant cyber threats and its associated human and technical elements. During this talk, we will describe how we are using the hyper-relational data model, the logical inferences and the core features of Grakn to build an application (openCTI) allowing organizations to manage their cyber threat intelligence knowledge and technical observables. We will go through the data model, the implementation of nested relations and give you an overview on how you can create powerful applications using Grakn. Don't forget to check out the openCTI project here --> www.opencti.io

Best Practices for Configuring Your OSSIM Installation

AlienVault

Because every network environment is different, OSSIM offers flexibile configuration options to adapt to the needs of different environments. Whether you are just getting started with OSSIM, or have been using it for years, thinking through the configuration options availble will help you get the most out of your installation. Join us for this customer training webcast where our OSSIM experts will walk through: How to deploy & configure OSSEC agents Best practices for configuring syslog and enabling plugins Scanning your network for assets and vulnerabilities

IBM QRadar Security Intelligence Overview

Camilo Fandiño Gómez

Top Cybersecurity Threats and How SIEM Protects Against Them

SBWebinars

Everyone has become increasingly aware of the danger hackers pose—they can steal data, dismantle systems, and cause damage that can take years to recover from. However, organizations often have a false sense of safety when it comes to their security environments. There are countless ways that businesses are making it easier for a threat actor to find their way in undetected. Join cybersecurity expert Bob Erdman, senior security product manager, as he outlines the most common ways organizations unintentionally put themselves at risk against threats like: Insider attacks Alert and console fatigue Shortage of security staff Misconfigurations Excessive access By better understanding what and where the challenges are, organizations can be better equipped to find solutions. This webinar will also highlight different strategies for mitigating risk, from specific Security Information and Event Management (SIEM) tools to employee education.

SIEM Primer:

Anton Chuvakin

DEVNET-1123 CSTA - Cisco Security Technical Alliances, New Program for Ecosys...

Cisco DevNet

The Sysdig Secure DevOps Platform

Ashnikbiz

What's hot

What is SIEM? A Brilliant Guide to the Basics

Sagar Joshi

From SIEM to SOC: Crossing the Cybersecurity Chasm

Priyanka Aash

Keynote: Elastic Security evolution and vision

Elasticsearch

QRadar, ArcSight and Splunk

M sharifi

Security Information and Event Management (SIEM)

hardik soni

SOC, Amore Mio! | Security Webinar

Splunk

SIEM - Activating Defense through Response by Ankur Vats

OWASP Delhi

SOC Architecture Workshop - Part 1

Priyanka Aash

OSSIM Overview

n|u - The Open Security Community

Siem ppt

kmehul

SIEM presentation finalRizwan S

Fleet and elastic agent

Ismaeel Enjreny

7 Steps to Build a SOC with Limited Resources

LogRhythm

Learn how to use an Analytics-Driven SIEM for your Security Operations

Splunk

Splunk Enterprise Security

Splunk

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Vaticle

Best Practices for Configuring Your OSSIM Installation

AlienVault

IBM QRadar Security Intelligence Overview

Camilo Fandiño Gómez

Top Cybersecurity Threats and How SIEM Protects Against Them

SBWebinars

SIEM Primer:

Anton Chuvakin

What's hot (20)

What is SIEM? A Brilliant Guide to the Basics

From SIEM to SOC: Crossing the Cybersecurity Chasm

Keynote: Elastic Security evolution and vision

QRadar, ArcSight and Splunk

Security Information and Event Management (SIEM)

SOC, Amore Mio! | Security Webinar

SIEM - Activating Defense through Response by Ankur Vats

SOC Architecture Workshop - Part 1

OSSIM Overview

Siem ppt

SIEM presentation final

Fleet and elastic agent

7 Steps to Build a SOC with Limited Resources

Learn how to use an Analytics-Driven SIEM for your Security Operations

Splunk Enterprise Security

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Best Practices for Configuring Your OSSIM Installation

IBM QRadar Security Intelligence Overview

Top Cybersecurity Threats and How SIEM Protects Against Them

SIEM Primer:

Similar to Empower Your Security Practitioners with Elastic SIEM

DEVNET-1123 CSTA - Cisco Security Technical Alliances, New Program for Ecosys...

Cisco DevNet

The Sysdig Secure DevOps Platform

Ashnikbiz

Getting Started with Runtime Security on Azure Kubernetes Service (AKS)

DevOps.com

As containers and Kubernetes are adopted in production, security is a critical concern and DevOps teams need to go beyond image scanning. Use cases such as runtime security, network visibility and segmentation, incident response and compliance become priorities as your Kubernetes security framework matures. In this talk, we’ll share an overview of runtime security, discuss approaches used by open source and commercial tools, and hear how users are getting started quickly without impacting developer productivity.

Biznet GIO National Seminar on Digital Forensics

Yusuf Hadiwinata Sutandar

Enabling Innovative Business Opportunities Through Secure Cloud Adoption - Se...

Amazon Web Services

Innovation is at the heart of the collaboration between Intel, Intel Security and AWS. As cloud adoption is fueling the next industrial revolution, this session will explore the new opportunities offered to you through cloud adoption. You will hear from Intel about the latest technologies that will help accelerate the adoption in the cloud in big data, HPC and IoT. As critical business workloads are rapidly deployed, Security needs to be a core component of this cloud adoption, not an afterthought. It should not prevent you from realizing the benefits of moving to cloud infrastructure. In this session Intel Security will also explore core security capabilities to enable automated visibility, security control and compliance in your AWS cloud environment. Speaker: Andrew Hurren, Senior Regional Solution Architect, Intel Security, ANZ & Peter Kerney, Enterprise Solutions Architect, Intel

PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadków

PROIDEA

Logicalis Security Conference

Paul Dutot IEng MIET MBCS CITP OSCP CSTM

Cisco Security Technical Alliance

Cisco DevNet

Cisco Security Technical Alliances

Cisco DevNet

CSTA - Cisco Security Technical Alliances, New Ecosystem Program Built on the...

Cisco DevNet

A session in the DevNet Zone at Cisco Live, Berlin. Cisco Security is committed to an extensible product porfolio that enables integration with many best of breed technology partners. Through the Cisco Security Technical Alliance program (CSTA) customers can leverage more than a dozen APIs and integration points to share data with SIEM, MDM, EDM, IR, Vulnerability Management and many other critical security technologies found in the enterprise. Integration with nearly 100 partner solutions powers automation, provides additional context that speeds the resolution of critical events and increases overall security effectiveness.

Using Tetration for application security and policy enforcement in multi-vend...

Joel W. King

Network engineers increasingly must view the network as one big software system, which streams telemetry data from software sensors and network devices to an analytics engine. To implement the whitelist-based segmentation and zero-trust policy model generated from the data analysis, automation is a requirement when dealing with tens of thousands of workloads and complex rules. This session examines how Cisco Tetration Analytics combined with automation can be used to implement a zero-trust policy model on multi-vendor network fabrics, firewalls and application delivery controllers.

Tips to Remediate your Vulnerability Management Program

BeyondTrust

In this presentation from her webinar, renowned cybersecurity expert Paula Januszkiewicz delves into what a truly holistic vulnerability management program should look like. When all parts are correctly established and working together, organizations can dramatically dial down their risk exposure. This presentation covers: - The key phases and activities of the vulnerability management lifecycle - The tools you need for an effective vulnerability management program - How to prioritize your VM needs - How an effective VM program can help you measurably reduce risk and meet compliance objectives You can watch the full webinar here: https://www.beyondtrust.com/resources/webinar/tips-remediate-vulnerability-management-program

McAfee - Enterprise Security Manager (ESM) - SIEM

Iftikhar Ali Iqbal

The presentation provides the following: - McAfee Company Overview - McAfee Strategy - McAfee Security Operations Overview - Security Operations Challenges - ESM Overview - ESM Components - ESM Architecture - ESM Architecture - Large Customer Sample - ESM Integrations - ESM Use Cases - Sample - ESM Incident Scenario - Sample - ESM - Security Operations Please note all the information is based prior to Jan 2020.

Enterprise Cloud Security

MongoDB

Cloud computing transforms the way we can store, process and share our data. New applications and workloads are growing rapidly, which brings every day more sensitive data into the conversation about risk and what constitutes natural targets for bad actors. This presentation reflects on current best practices to address the most significant security concerns for sensitive data in the cloud, and offers participants a list of steps to achieve enterprise-grade safety with MongoDB deployments among the expanding service provider options.

ScaleFocus Security Conference Part 2

ScaleFocus

EASING THE COMPLIANCE BURDEN SAGAN SOLUTION & PCI COMPLIANCEAlex Himmelberg

Research Assignment For Active Directory

Jessica Myers

MeetUp: Kerberos - Protocol for Authentication & Authorization @Criteo

Gilles Legoux

Using Splunk or ELK for Auditing AWS/GCP/Azure Security posture

CloudVillage

Speaker 1: Rod Soto Speaker 2: Jose Hernandez This presentation shows how to use Splunk to provide the analyst with a comprehensive vision of AWS/GCP/Azure security posture. Presenters will outline how to ingest the audit data provided by open source tool Cloud Security Suite into Splunk to analyze cloud vulnerability, harden multi-cloud deployments and visualize multi-cloud threat surface. Presenters will also demonstrate use cases based on Splunk knowledge objects (Tables, Dashboards, Alerts, Field extractions, Lookups, etc), in order to take advantage of the information provided by various supporting tools like Scout2 and G-Scout projects for cloud API auditing.

Using Splunk/ELK for auditing AWS/GCP/Azure security posture

Jose Hernandez

Similar to Empower Your Security Practitioners with Elastic SIEM (20)

DEVNET-1123 CSTA - Cisco Security Technical Alliances, New Program for Ecosys...

The Sysdig Secure DevOps Platform

Getting Started with Runtime Security on Azure Kubernetes Service (AKS)

Biznet GIO National Seminar on Digital Forensics

Enabling Innovative Business Opportunities Through Secure Cloud Adoption - Se...

PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadków

Logicalis Security Conference

Cisco Security Technical Alliance

Cisco Security Technical Alliances

CSTA - Cisco Security Technical Alliances, New Ecosystem Program Built on the...

Using Tetration for application security and policy enforcement in multi-vend...

Tips to Remediate your Vulnerability Management Program

McAfee - Enterprise Security Manager (ESM) - SIEM

Enterprise Cloud Security

ScaleFocus Security Conference Part 2

EASING THE COMPLIANCE BURDEN SAGAN SOLUTION & PCI COMPLIANCE

Research Assignment For Active Directory

MeetUp: Kerberos - Protocol for Authentication & Authorization @Criteo

Using Splunk or ELK for Auditing AWS/GCP/Azure Security posture

Using Splunk/ELK for auditing AWS/GCP/Azure security posture

More from Elasticsearch

An introduction to Elasticsearch's advanced relevance ranking toolbox

Elasticsearch

The hallmark of a great search experience is always delivering the most relevant results, quickly, to every user. The difficulty lies behind the scenes in making that happen elegantly and at a scale. From App Search’s intuitive drag and drop interface to the advanced relevance capabilities built into the core of Elasticsearch — Elastic offers a range of tools for developers to tune relevance ranking and create incredible search experiences. In this session, we’ll explore some of Elasticsearch’s advanced relevance ranking features, such as dense vector fields, BM25F, ranking evaluation, and more. Plus we’ll give you some ideas for how these features are being used by other Elastic users to create world-class, category defining search experiences.

From MSP to MSSP using Elastic

Elasticsearch

Eze Castle Integration is a managed service provider (MSP), cloud service provider (CSP), and internet service provider (ISP) that delivers services to more than 1,000 clients around the world. Different departments within Eze Castle have devised their own log aggregation solutions in order to provide visibility, meet regulatory compliance requirements, conduct cybersecurity investigations, and help engineers with troubleshooting infrastructure issues. In 2019, they partnered with Elastic to consolidate the data generated from different systems into a single pane of glass. And thanks to the ease of deployment on Elastic Cloud, professional consultation services from Elastic engineers, and on-demand training courses available on Elastic Learning, Eze Castle was able to go from proof-of-concept to a fully functioning ""Eze Managed SIEM"" product within a month! Learn about Eze Castle's journey with Elastic and how they grew Eze Managed SIEM from zero to 100 customers In less than 14 months.

Cómo crear excelentes experiencias de búsqueda en sitios web

Elasticsearch

Descubre lo fácil que es crear búsquedas relevantes y enriquecidas en sitios web de cara al público para impulsar las conversiones, incrementar el consumo de contenido y ayudar a los visitantes a encontrar lo que necesitan. Realiza un recorrido por las herramientas de Elastic a las que puedes sacar partido para transformar con facilidad tu sitio web, lo que incluye nuestro nuevo y potente rastreador web.

Te damos la bienvenida a una nueva forma de realizar búsquedas

Elasticsearch

Al igual que la mayoría de las organizaciones modernas, tus equipos probablemente usan más de 10 aplicaciones basadas en la nube a diario, pero dedican demasiado tiempo a buscar la información que necesitan en todas estas. Gracias a las características integradas de Elastic Workplace Search, podrás comprobar lo sencillo que resulta poner el contenido relevante al alcance de tus equipos gracias a la búsqueda unificada para todas las aplicaciones que usan para llevar a cabo su trabajo.

Tirez pleinement parti d'Elastic grâce à Elastic Cloud

Elasticsearch

Découvrez pourquoi Elastic Cloud est la solution idéale pour exploiter toutes les offres d'Elastic. Bénéficiez d'une flexibilité d'achat et de déploiement au sein de Google Cloud, de Microsoft Azure, d'Amazon Web Services ou des trois à la fois. Apprenez quels avantages vous apporte une offre de service géré et déterminez la solution qui vous permet de la gérer par vous-même grâce à des outils intégrés d'automatisation et d'orchestration. Et ce n'est pas tout ! Familiarisez-vous avec les fonctionnalités qui peuvent vous aider à scaler vos opérations au fur et à mesure de l'évolution de votre déploiement, à stocker vos données d'une manière rentable et à optimiser vos recherches. Ainsi, vous n'aurez plus à abandonner de données et obtiendrez les informations exploitables dont vous avez besoin pour assurer le fonctionnement de votre entreprise.

Comment transformer vos données en informations exploitables

Elasticsearch

Plongez au cœur de la recherche dans tous ses états.

Elasticsearch

À l'instar de la plupart des entreprises modernes, vos équipes utilisent probablement plus de 10 applications hébergées dans le cloud chaque jour, mais passent aussi bien trop de temps à chercher les informations dont elles ont besoin dans ces outils. Grâce aux fonctionnalités prêtes à l'emploi d'Elastic Workplace Search, découvrez combien il est facile de mettre le contenu pertinent à portée de la main de vos équipes grâce à une recherche unifiée sur l'ensemble des applications qu'elles utilisent pour faire leur travail.

Modernising One Legal Se@rch with Elastic Enterprise Search [Customer Story]

Elasticsearch

An introduction to Elasticsearch's advanced relevance ranking toolbox

Elasticsearch

Welcome to a new state of find

Elasticsearch

Like most modern organizations, your teams are likely using upwards of 10 cloud-based applications on a daily basis, but spending far too many hours a day searching for the information they need across all of them. With the out-of-the-box capabilities of Elastic Workplace Search, see how easy it is to put relevant content right at your teams’ fingertips with unified search across all the apps they rely on to get work done.

Building great website search experiences

Elasticsearch

Keynote: Harnessing the power of Elasticsearch for simplified search

Elasticsearch

Cómo transformar los datos en análisis con los que tomar decisiones

Elasticsearch

Explore relève les défis Big Data avec Elastic Cloud

Elasticsearch

Spécialisée dans le développement et la gestion de solutions de veille documentaire et commerciale, Explore offre à ses clients une lecture précise et organisée de l’actualités des marchés et projets sur leurs territoires d'intervention. Afin de rendre leur offre plus agile et performante, Explore a choisi l’offre Elastic Cloud hébergée sur Microsoft Azure. Découvrez comment les équipes de production et de développement sont désormais en mesure de mieux exploiter les données pour les clients d’Explore et gagnent du temps sur la gestion de leur infrastructure.

Comment transformer vos données en informations exploitables

Elasticsearch

Transforming data into actionable insights

Elasticsearch

Opening Keynote: Why Elastic?

Elasticsearch

"Elastic enables the world’s leading organization to exceed their business objectives and power their mission-critical systems by eliminating data silos, connecting the dots, and transforming data of all types into actionable insights. Come learn how the power of search can help you quickly surface relevant insights at scale. Whether you are an executive looking to reduce operational costs, a department head striving to do more with fewer tools, or engineer monitoring and protecting your IT environment, this session is for you. "

Empowering agencies using Elastic as a Service inside Government

Elasticsearch

It has now been four years since the beta release of Elastic Cloud Enterprise which kicked off a wave of the Elastic public sector community running Elastic as a service within Government rather than utilizing purely hosted solutions. Fast forward to 2021 and we have multiple options for multiple mission needs. Learn top tips from Elastic architects and their experience enabling their teams with the automation and provisioning of Elastic tech to change the game in how government delivers solutions.

The opportunities and challenges of data for public good

Elasticsearch

Enterprise search and unstructured data with CGI and Elastic

Elasticsearch

More from Elasticsearch (20)

An introduction to Elasticsearch's advanced relevance ranking toolbox

From MSP to MSSP using Elastic

Cómo crear excelentes experiencias de búsqueda en sitios web

Te damos la bienvenida a una nueva forma de realizar búsquedas

Tirez pleinement parti d'Elastic grâce à Elastic Cloud

Comment transformer vos données en informations exploitables

Plongez au cœur de la recherche dans tous ses états.

Modernising One Legal Se@rch with Elastic Enterprise Search [Customer Story]

An introduction to Elasticsearch's advanced relevance ranking toolbox

Welcome to a new state of find

Building great website search experiences

Keynote: Harnessing the power of Elasticsearch for simplified search

Cómo transformar los datos en análisis con los que tomar decisiones

Explore relève les défis Big Data avec Elastic Cloud

Comment transformer vos données en informations exploitables

Transforming data into actionable insights

Opening Keynote: Why Elastic?

Empowering agencies using Elastic as a Service inside Government

The opportunities and challenges of data for public good

Enterprise search and unstructured data with CGI and Elastic

Recently uploaded

zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs

Alex Pruden

This paper presents Reef, a system for generating publicly verifiable succinct non-interactive zero-knowledge proofs that a committed document matches or does not match a regular expression. We describe applications such as proving the strength of passwords, the provenance of email despite redactions, the validity of oblivious DNS queries, and the existence of mutations in DNA. Reef supports the Perl Compatible Regular Expression syntax, including wildcards, alternation, ranges, capture groups, Kleene star, negations, and lookarounds. Reef introduces a new type of automata, Skipping Alternating Finite Automata (SAFA), that skips irrelevant parts of a document when producing proofs without undermining soundness, and instantiates SAFA with a lookup argument. Our experimental evaluation confirms that Reef can generate proofs for documents with 32M characters; the proofs are small and cheap to verify (under a second). Paper: https://eprint.iacr.org/2023/1886

Pushing the limits of ePRTC: 100ns holdover for 100 days

Adtran

DevOps and Testing slides at DASA Connect

Kari Kakkonen

RESUME BUILDER APPLICATION Project for students

KAMESHS29

GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...

Neo4j

Sudheer Mechineni, Head of Application Frameworks, Standard Chartered Bank Discover how Standard Chartered Bank harnessed the power of Neo4j to transform complex data access challenges into a dynamic, scalable graph database solution. This keynote will cover their journey from initial adoption to deploying a fully automated, enterprise-grade causal cluster, highlighting key strategies for modelling organisational changes and ensuring robust disaster recovery. Learn how these innovations have not only enhanced Standard Chartered Bank’s data infrastructure but also positioned them as pioneers in the banking sector’s adoption of graph technology.

Microsoft - Power Platform_G.Aspiotis.pdf

Uni Systems S.M.S.A.

GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024

Neo4j

GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024

Neo4j

National Security Agency - NSA mobile device best practices

Quotidiano Piemontese

Essentials of Automations: The Art of Triggers and Actions in FME

Safe Software

In this second installment of our Essentials of Automations webinar series, we’ll explore the landscape of triggers and actions, guiding you through the nuances of authoring and adapting workspaces for seamless automations. Gain an understanding of the full spectrum of triggers and actions available in FME, empowering you to enhance your workspaces for efficient automation. We’ll kick things off by showcasing the most commonly used event-based triggers, introducing you to various automation workflows like manual triggers, schedules, directory watchers, and more. Plus, see how these elements play out in real scenarios. Whether you’re tweaking your current setup or building from the ground up, this session will arm you with the tools and insights needed to transform your FME usage into a powerhouse of productivity. Join us to discover effective strategies that simplify complex processes, enhancing your productivity and transforming your data management practices with FME. Let’s turn complexity into clarity and make your workspaces work wonders!

みなさんこんにちはこれ何文字まで入るの？40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの？えこ...

名前です男

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Albert Hoitingh

Large Language Model (LLM) and it’s Geospatial Applications

Rohit Gautam

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf

FIDO Alliance

The Art of the Pitch: WordPress Relationships and Sales

Laura Byrne

Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes? All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.

Climate Impact of Software Testing at Nordic Testing Days

Kari Kakkonen

My slides at Nordic Testing Days 6.6.2024 Climate impact / sustainability of software testing discussed on the talk. ICT and testing must carry their part of global responsibility to help with the climat warming. We can minimize the carbon footprint but we can also have a carbon handprint, a positive impact on the climate. Quality characteristics can be added with sustainability, and then measured continuously. Test environments can be used less, and in smaller scale and on demand. Test techniques can be used in optimizing or minimizing number of tests. Test automation can be used to speed up testing.

Uni Systems Copilot event_05062024_C.Vlachos.pdf

Uni Systems S.M.S.A.

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...

James Anderson

Artificial Intelligence for XMLDevelopment

Octavian Nadolu

In the rapidly evolving landscape of technologies, XML continues to play a vital role in structuring, storing, and transporting data across diverse systems. The recent advancements in artificial intelligence (AI) present new methodologies for enhancing XML development workflows, introducing efficiency, automation, and intelligent capabilities. This presentation will outline the scope and perspective of utilizing AI in XML development. The potential benefits and the possible pitfalls will be highlighted, providing a balanced view of the subject. We will explore the capabilities of AI in understanding XML markup languages and autonomously creating structured XML content. Additionally, we will examine the capacity of AI to enrich plain text with appropriate XML markup. Practical examples and methodological guidelines will be provided to elucidate how AI can be effectively prompted to interpret and generate accurate XML markup. Further emphasis will be placed on the role of AI in developing XSLT, or schemas such as XSD and Schematron. We will address the techniques and strategies adopted to create prompts for generating code, explaining code, or refactoring the code, and the results achieved. The discussion will extend to how AI can be used to transform XML content. In particular, the focus will be on the use of AI XPath extension functions in XSLT, Schematron, Schematron Quick Fixes, or for XML content refactoring. The presentation aims to deliver a comprehensive overview of AI usage in XML development, providing attendees with the necessary knowledge to make informed decisions. Whether you’re at the early stages of adopting AI or considering integrating it in advanced XML development, this presentation will cover all levels of expertise. By highlighting the potential advantages and challenges of integrating AI with XML development tools and languages, the presentation seeks to inspire thoughtful conversation around the future of XML development. We’ll not only delve into the technical aspects of AI-powered XML development but also discuss practical implications and possible future directions.

Recently uploaded (20)

zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs

Pushing the limits of ePRTC: 100ns holdover for 100 days

DevOps and Testing slides at DASA Connect

RESUME BUILDER APPLICATION Project for students

GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...

Microsoft - Power Platform_G.Aspiotis.pdf

GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024

GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024

National Security Agency - NSA mobile device best practices

Essentials of Automations: The Art of Triggers and Actions in FME

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Large Language Model (LLM) and it’s Geospatial Applications

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf

The Art of the Pitch: WordPress Relationships and Sales

Climate Impact of Software Testing at Nordic Testing Days

Uni Systems Copilot event_05062024_C.Vlachos.pdf

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...

Artificial Intelligence for XMLDevelopment

Empower Your Security Practitioners with Elastic SIEM

1. 15 OCT 19 Kevin Keeney Cyber Security Advocate Empower Your Security Practitioners with Elastic SIEM

2. Introduction Kevin Keeney Cyber Security Advocate @kevinkeeneyjr linkedin.com/in/kevinkeeney

3. 3 Empower your team

4. 4 ● A common, extensible set of ﬁelds to ingest data into Elasticsearch ● Ability to correlate data across diﬀerent data sources ● Ability to re-use analysis content across solutions in Kibana ● An ever-expanding community of vendors & experts contributing to ECS Elastic Common Schema (ECS) Normalize data to streamline analysis

6. 6 Elastic SIEM Ecosystem These are just some of our partners and community members. The presence of a vendor logo doesn’t imply a business relationship with Elastic. Community ● Endpoint sources ● Cloud platforms & applications ● Network sources ● User activity sources ● SIEMs & centralized security data stores Security orchestration, automation, response Security incident response General ticket & case management Consulting Education & training Internal context External context

7. 7 Commercial Adoption Corelight From the makers of Zeek/Bro Palo Alto Networks All the feeds that come from NGFW versions 8.0-9.0 Cloudﬂare Where CDN meets security

8. 8 Elastic SIEM (beta) A SIEM for Elastic Stack users everywhere Elastic SIEM app Elastic Common Schema (ECS) Network & host data integrations Visualize your Elasticsearch data and navigate the Elastic Stack A distributed, RESTful search and analytics engine Elastic & community security content Beats Logstash Elastic Endpoint

9. 9 Response Prevention Detection Iterative

10. 10 No Compromises: Speed Scale Relevance

11. 1111 Introducing Elastic SIEM

12. 1212 Auditbeat ● System module (Linux, macOS, Win.): packages, processes, logins, sockets, users and groups ● Auditd module (Linux Kernel Audit info) ● File integrity monitoring (Linux, macOS, Win.) Filebeat ● System logs (auth logs) (Linux) ● Santa (macOS) Winlogbeat ● Windows event logs ● Sysmon Curated integrations Host data

13. 1313 Packetbeat ● Flows ● DNS ● Other protocols Filebeat ● IDS/IPS/NMS modules: Zeek NMS, Suricata IDS ● NetFlow, CEF ● Firewall modules: Cisco ASA, FTD, Palo Alto Networks, Ubiquiti IPTables ● Kubernetes modules: CoreDNS, Envoy proxy ● Google VPC ﬂow logs, PubSub Input Curated integrations Network data

14. 1414

15. 1515

16. 1616

17. 1717

18. 1818

19. 1919

20. 2020

21. 2121

22. 2222

23. 2323

24. 2424

25. 25 Automated Detection Machine Learning jobs for Security Analytics v.7.3 Three security ML jobs included: rare_process_by_host_windows_ecs rare_process_by_host_linux_ecs suspicious _login_actvity_ecs

26. 26

27. 27 Automated Detection Machine Learning jobs for Security Analytics v.7.4 Thirteen more security ML jobs added: linux-anomalous-network-activity linux-anomalous-network-port-activity linux-anomalous-network-service linux-anomalous-process-all-hosts linux-anomalous-network-URL-activity linux-anomalous-user-name linux-anomalous-path-activity windows-anomalous-path-activity windows-anomalous-process-all-hosts windows-anomalous-process-creation windows-anomalous-service windows-anomalous-script windows-anomalous-network-activity

28. 28 Even more for security analysts to love

29. 29 Elastic SIEM Bottom-up Vision Elastic Confidential Information - Roadmap information provided on this slide is an overview of overall direction and nothing is committed. 5 Deep Community Ecosystem 3 Rich Visualizations, Easy Workﬂow 1 Fast Scalable Search Engine 4Eﬀective Detection Library 2Multiple Detection Engines

30. Endgame Integration Strengthens Protection Elastic Endpoint & SIEM Prevention Prevention starts with Elastic Endpoint, blocking adversary attacks at the source. Detection When prevention is not enough, detection is critical. Detection gains context in Elastic SIEM. Response Detection is made actionable with response. Endpoint and SIEM together speed remediation. Elastic Endpoint Prevent, Detect, Collect Elastic SIEM Detect, Add Context, Respond Elastic Security - Integrated Endpoint Security and SIEM

31. Thank You! 15 OCT 19 Kevin Keeney Cyber Security Advocate

Empower Your Security Practitioners with Elastic SIEM

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Empower Your Security Practitioners with Elastic SIEM

Similar to Empower Your Security Practitioners with Elastic SIEM (20)

More from Elasticsearch

More from Elasticsearch (20)

Recently uploaded

Recently uploaded (20)

Empower Your Security Practitioners with Elastic SIEM