July 2021 Virtual PNW Splunk User Group Slides

© 2021 SPLUNK INC.
Splunk Pacific
Northwest
Usergroup
28 July, 2021

© 2021 SPLUNK INC.
Thank you to Arcus Data
for sponsoring lunch!
Please enter checkout code provided in
the zoom chat to complete your Grubhub
order.
● Your Grubhub account must be associated with
the email address you use for the usergroup
● Checkout code expires 11:59pm today in your
timezone
● Secondary payment method needed for orders
exceeding $25

© 2021 SPLUNK INC.
WHAT
WE DO
Arcus incorporates a unique process fusing creativity and
business aptitude with the expertise gained through hundreds
of deployments. Consultants possess extensive cross-platform
training and certifications, including: Splunk, AWS, Azure, etc.
Arcus designs, builds, and operates a diverse suite of
analytics solutions customized to industry needs. Our
expertise ranges from energy & utilities to retail
industries and beyond.
Arcus Data has the training and expertise required to
complement your Cloud strategy. Whether it’s AWS,
Azure, or Google, Arcus can help migrate, assure and
manage Cloud workloads.
PROFESSIONAL & MANAGED SERVICES
INDUSTRY SOLUTIONS
PLATFORMS & APPLICATIONS
2021 | © Arcus Data
Arcus Data designs,
deploys, operates and
optimizes analytics
solutions through a mix of
custom and managed
services offerings.
Thank you to Arcus Data for Lunch!

© 2021 SPLUNK INC.
Agenda
The 4-1-1
11:30 AM Welcome and
Introductions
11:45 AM RBA with Matt
Snyder
Matt will discuss Risk-Based Alerting (RBA) in a large environment to drastically reduce alert
noise, streamline their SOC around higher-fidelity, actionable alerts on insider threat.
12:05 PM Splunk IT
Essentials with
Thomas Booth
Thomas will introduce Splunk IT Essentials and help you leverage it to replace Splunk App for
Infrastructure and several legacy apps.
12:25 PM Efficient Security
w/ Splunk and
Phantom with
Larry Becker
12:45 PM News and
Updates

Confidential │ ©2019 VMware, Inc.
RBA & Insider
Threats
Proactive Monitoring and Response
Matt Snyder
Program Lead – Advanced Security Analytics
July 2021

Confidential │ ©2019 VMware, Inc. 6
▪ DLP Tools:
▪ Too many false positives
▪ Limited detection capabilities
▪ Don’t add new tools
▪ Need for comprehensive coverage we could define and control
▪ Make use of vast EDR data we had in Splunk
▪ Could not increase SOC workload with unactionable events
Problems we needed to solve ASAP…
Building an Insider Threat Program

Advanced Analytics
ES Correlation Rule
Framework
ES Asset
Framework
ES RBA
Datamodel
ES Identity
Framework
Enterprise Security
Framework
ES Datamodels
ES Risk
Framework
Risk Rules
Risk Attributions
ES Notable
Framework
ES Incident
Management
framework
Risk Notables
ES Correlation Rule
Framework
Alert Rules
Risk Macros
Analysis
Dashboard
Source: http://deck.rbaallday.com/

RBA Features in Correlation Searches

Define what we want to detect
Knowing is half the battle…
o Built an Insider Threat matrix to help identify
possible events of interest
o Identify what was most important, then build
detections to populate Risk index
o Identify what we could not detect, work to get
logs or accept risk
o Link: https://github.com/Insider-Threat/Insider-
Threat

Risk Workflow
• Many correlation
searches running
to populate the
Risk index
• Risk Modifiers are
created to either
increase or
decrease the
users risk score
• Finally, a couple
correlation
searches with a
notable event are
used to notify the
SOC

High Risk File – key word-based list to help find files that might be sensitive
SPL:
• if(match(file, "CONFIDENTIAL, Sensitive, Important_Stuff_In_Here"), "1”, "0")
• 1 = true and 0 = false
Competitors List– key word-based list to help find files related to Competitors
SPL:
• if(match(file, ”Other_Company, Not_as_Good, Product_Stinks"), "1”, "0")
• 1 = true and 0 = false
More Info:
https://docs.splunk.com/Documentation/Splunk/8.2.0/Knowledge/CreatecalculatedfieldswithSplunkWeb
Calculated Fields

High Risk User – this is used for users that either have been identified as:
• Behaving suspiciously
• Part of a reduction in force (RIF)
• Working on a sensitive project
Fields:
• Username
• Date added
• Status – active or not_active
• Notes
SPL:
• index=risk | lookup high_risk_user.csv user as user OUTPUT hru_status notes date_added | search
hru_status=”active”
Pro Tip - keep list access to the lookup limited!
Lookups

eventstats - Generates summary statistics from fields in your events and saves those statistics in
a new field.
SPL:
• | eventstats avg(risk_score) as avg_risk stdev(risk_score) as stdev_risk
Get average risk scores and see how they compare with other users.
High Risk scores are great but don’t always capture everything
More Info:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Eventstats
eventstats

eval – one of the most powerful Splunk commands.
SPL:
• | eval risk_score=if(in(user_prop, "CEO", "CFO", "COO", "Executive Vice President"),
risk_mod_count+20,risk_score)
• | eval risk_score=if(total_hvf >=1 AND total_hvf <=50, risk_mod_count+10,risk_score)
Great way to apply dynamic scores based on your needs.
More Info: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Eval
eval

where – The where command uses eval-expressions to filter search results. These eval-
expressions must be Boolean expressions, where the expression returns either true or false.
SPL:
• | where (risk_score>=55 AND total_hvf>=10 AND (tactic_exfil_value >=100 OR
tactic_delete_value>=100))
Awesome way to help set your threshold and filter out noise
More Info: https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Where
where

Risk Notable – A correlation search with a Notable Event attached.
SPL:
• index=risk
| lookup high_risk_user.csv user as user OUTPUT hru_status notes date_added
| search hru_status=”active”
| eval risk_score=if(in(user_prop, "CEO", "CFO", "COO", "Executive Vice President"), risk_mod_count+20,risk_score)
| eval risk_score=if(total_hvf >=1 AND total_hvf <=50, risk_mod_count+10,risk_score)
| eval aa_tactic_exfil_value=case(aa_tactic == "Exfiltration", "1", aa_tactic == "Collection", "0", aa_tech == "Data_Destruction", "0")
| eval aa_tactic_delete_value=case(aa_tactic == "Exfiltration", "0", aa_tactic == "Collection", "0", aa_tech == "Data_Destruction",
"1")
| eventstats avg(risk_score) as avg_risk stdev(risk_score) as stdev_risk
| stats dc(file) as file_count sum(hvf) as total_hvf values( aa_tactic) as aa _tactic values(aa_tech) as aa_tech by user
| where (risk_score>=55 AND total_hvf>=10 AND (tactic_exfil_value >=100 OR tactic_delete_value>=100))
Risk Notable

RBA Stats
Average
Investigation Time
Time to setup
Program
Number of
Detections
10
Minutes
3 Weeks 52

18
Check out my 2021 .conf Talk:
Proactive Risk Based Alerting for
Insider Threats

Thank You
Q and A

PSE Cybersecurity
Past-Present-Future

21
About Puget Sound Energy
• 1.1 M Electric Customers
• 790 K Gas Customers
• 6,000 square mile area
• Deliver 5 GW of Electricity
• Produce 3.6 GW
• Jackson Prairie Gas Storage
• 25 Billion Cubic Feet Working
Capacity
• 14th Largest in the Country

22
About Me
• Pacific Northwest National Laboratory for 13 years + 3 years as an intern before moving
to PSE.
• Computer Forensics
• Cyber Intelligence
• Cyber Counterintelligence
• Cyber Law Enforcement Support
• Critical Infrastructure Protection Projects
• + more stuff
• PSE: 4 years and counting
• Cybersecurity Incident Response Manager
• Cyber Defense Center Lead

23
• Present – Where are we today
• Future – Where are we going
Topics

24
Splunk ES Build with Mitre Att&ck
• Clean Slate to build from…Mitre Att&ck Framework
• Methodology and Organization to event detections
• Use Case: Identity and Access Monitoring

25
Phishing Scorecard
• Insert text here

28
• Present – Where are we today
• Future – Where are we going
TEMPLATE
Topics

29
Idealistic “End State”
• Defensive Operations
• SIEM + NTA/NDR + EDR + SOAR
• Threat Intelligence Driven
• Threat Hunting Focused (not alarm driven)
• Threat/Incident Response are bored

30
Threat Intelligence Driven
• Threat Model
• Stix (v2.1 or newer)
• Mitre Att&ck Techniques
• Threat Actors
• Targeting & Observables
• 🡪Risk Model
• 🡪 Threat Detections and Threat Hunts
• Result = Cybersecurity Operations Threat Model

31
Incident Response err SOAR
• Splunk Phantom - Automation does Threat/Incident Response
• Risk Scoring
• Ticketing – Opening, Updating, Closing
• Get Info – Host & User & Application(s) if server
• Enrichment – URL, Domain, User, Email, IP, etc
• Related Information – Threat Intel Links
• Lock AD Accounts – User and System
• FW Blocks – IP, Domain, URL
• Quarantine – Email or File
• Isolate a System
• EDR Isolate or Network Segment Isolate via SDN
• And More…

© 2021 SPLUNK INC.
Join us for a hybrid experience featuring dozens of engaging
sessions and innumerable opportunities to learn how to turn data
into doing.
October 18–21
Impressive and very interesting conference. I learned so
much about the technology and what Splunk can do, it
was mesmerizing! Loved the atmosphere, diversity —
great minds and amazing work!”
https://conf.splunk.com/

© 2021 SPLUNK INC.
What is it?
● One day competition, August 5, 2021
● Special recognition for winning teams
Prerequisites
● Basic experience with Splunk
● Basic security investigation knowledge
● A computer running a supported web browser and a solid
Internet connection
Format
● BOTS Competition Platform - Bots.splunk.com
● Teams up to four
● 4 hour competition
BOTS
August 5 Timezone Kickoff Competition Begins Competition Ends
Pacific Time Zone 12:00pm 12:30pm 4:30pm
Mountain Time Zone 1:00pm 1:30pm 5:30pm
Central Time Zone 2:00pm 2:30pm 6:30pm
Eastern Time Zone 3:00pm 3:30pm 7:30pm

© 2021 SPLUNK INC.
Getting Started with Splunk for Security
New on-demand security workshop delivery platform
https://bots.splunk.com

© 2021 SPLUNK INC.
Ever get stuck and have to break out of your Splunk workflow to answer a crucial question?
● How do I get started?
● What data can / should I add?
● What search do I run?
● What do I do next?
● How do I monitor my network data?
Splunk Product Guidance provides robust guidance for numerous use cases and tasks without navigating away from the product. SPG is for all
Splunk users, regardless of role or expertise level, who are looking for timely, contextually-appropriate guidance to help answer questions.
The content provided by SPG is powered by the Splunk Lantern Resource Hub. Splunk Lantern provides clear and actionable guidance from Splunk
experts including step-by-step procedures for tasks like monitoring IT systems, investigating user activity, and monitoring network connections.
SPG on Splunkbase

© 2021 SPLUNK INC.
● Splunk’s “new features app”
● Updated for all major and minor releases
● Not an in-depth tutorial
○ guide to help users understand each
version’s new features
○ contains sample reports, dashboards
and visualizations

© 2021 SPLUNK INC.
IT Workshop Wednesdays
Virtual. Interactive. Hands-On.
Sign up for
a single
workshop or
the whole
series

© 2021 SPLUNK INC.
Go-Forward Discussion
Looking ahead to in-person meetings (Delta variant notwithstanding) . . .
● Every other month on a rotating basis between SEA and PDX?
● Hybrid model to allow for virtual attendees and those with health concerns?
● Other ideas/concerns?
We merged, we’re vaccinated, now what??

July 2021 Virtual PNW Splunk User Group Slides

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to July 2021 Virtual PNW Splunk User Group Slides

Similar to July 2021 Virtual PNW Splunk User Group Slides (20)

Recently uploaded

Recently uploaded (20)

July 2021 Virtual PNW Splunk User Group Slides