Hamza OUADIÂ presented on how Elastic Security meets the needs of Security Operations Centers (SOCs). The presentation covered how Elastic integrates data from various host, network, and custom sources. It then processes and normalizes the data using techniques like parsing, enrichment, and the Elastic Common Schema. Finally, it analyzed the data through detection rules, correlations, alerts, and machine learning to identify threats and anomalies. A demo of the Elastic Security product was also provided.

1. 04 February 2021 @ 16:00 UTC+1
Elastic Morocco User Group
How Elastic Security Meets SOC Needs
Hamza OUADIÂ
Cyber Security Analyst

3. Store, Search, &
Analyze
Visualize &
Manage
Ingest
Elastic Stack
Kibana
Elasticsearch
Beats Logstash
Elastic Stack
Reliably and securely take data from any source, in any format, then search,
analyze, and visualize it in real time.

4. Elastic est une société de recherche
Nous mettons l'accent sur la valeur pour les
utilisateurs en produisant des résultats rapides
qui fonctionnent à grande échelle et qui sont
pertinents. C'est notre ADN. Nous pensons que
la recherche est une expérience. C'est ce qui
nous définit et nous rend uniques
Vitesse, Scalabilité,
Pertinence

5. 3 Solutions
Elastic Enterprise Search
(Recherche en entreprise)
Elastic Security
(Sécurité à 360°)
Elastic Observability
(Observabilité à 360°)

6. Endpoint SIEM
How Elastic Security
Meets SOC Needs

7. Agenda
Introduction
Data Integration
Data Processing
Data Analytics
1
2
3
4
Demo : Elastic Security
5
Questions & Answers
6

8. SOC : Security Operations Center
Introduction
Image Source : https://bit.ly/3ac9lyK

9. SOC : Security Operations Center
Introduction
SIEM
Logs
Logs
Logs
Analyst

10. Event Lifecycle
Introduction
Data
Integration
Data Processing Data Analytics

11. Data Integration

12. Host & Network Telemetry
Data Integrations

13. Network
Data
Packetbeat :
• Flows
• DNS
• TLS
• HTTP
Filebeat :
• IDS/IPS/NMS modules: Zeek NMS, Suricata IDS
• NetFlow, CEF
• Firewall modules: Cisco ASA, FTD, Palo Alto Networks,
Ubiquiti IPTables
• Kubernetes modules: CoreDNS, Envoy proxy
• Google VPC flow logs, PubSub Input
elastic.co/integrations

14. Host
Data
Winlogbeat :
• Windows event logs
• Sysmon
• PowerShell
Filebeat :
• System logs (auth logs) (Linux)
• Multiline Event logs
Auditbeat :
• System module (Linux, macOS, Win.): packages, processes,
logins, sockets, users and groups
• Auditd module (Linux Kernel Audit info)
• File integrity monitoring (Linux, macOS, Win.)
Elastic Agent :
• One agent for all: logs, metrics and security
• 1-click integrations with Fleet
• Detection & Response

15. Custom
Data
Community Beats :
• Community driven Beats agents

16. Data Processing
“If I had nine hours to chop down a tree, I’d spend the
first six sharpening my ax.” – Abraham Lincoln

17. Event Normalization
Elastic Common Schema (ECS)
Data Processing
Benefits
• Correlate data from different sources
• Ability to re-use analysis content
• Ability to re-use Elastic-provided content
Status
• Version v1.7 published : github.com/elastic/ecs
• Supported in Beats and APM
• Community feedback welcome

18. Event Parsing & Enrichment
Data Processing
• Input: Syslog, File, TCP/UDP, Beats
• Filter: GROK, DNS, TLD, Geo IP, Date, JSON
• Output: Elasticsearch, Email

19. Data Analytics

20. Detection Rules
Data Analysis
• Event-Centric Correlation (KQL Query)
• Sequence-Based Correlation (EQL Query)
• Threshold-Based Alerting
• Indicator-Based Alerting
• Machine Learning Jobs

22. Elastic Security
Detection, Prevention and Response for Unified Protection

23. Endpoint + SIEM
Elastic Security
+

24. DEMO
Elastic Security

25. Elastic is a Search Company
Search. Observe. Protect.
www.elastic.co
Thank you | Questions ?