Proactive Monitoring: Playing Offense for the Win

•

2 likes•487 views

Everyone knows the adage, that the best defense is a good offense. This statement holds true for monitoring as well. In current monitoring solutions and environments, the modus operandi is based on reacting to events as they happen, drilling down to the raw data, and looking for anomalies. This is a tedious task that can take a lot of time, and tends to be done while there is a business affecting failure. Just because monitoring is defensive, does not mean that we can’t take an offensive/proactive approach. By using AI, Loom Systems mimics the actions taken by a DevOps engineer to find the root cause of the problem quickly and effectively.

Software

Proactive Monitoring: Playing Offense for the Win
Dror Mann | CO-Founder, VP Product

Confidential and Proprietary
Dror Mann
VP Product & Co-Founder
Loom Systems
Head of Product
Voyager Labs
Head of Operations
IDF elite Intelligence unit
dror@loomsystems.com
Hi!

Confidential and Proprietary
• Intro – The Digital Era
• Today’s Monitoring
• What can we expect from AI
• Proactive Monitoring, 3 types of Predictions
• Live Demo
• Q&A
Agenda

Confidential and Proprietary
We get you!

Confidential and Proprietary
Detect issues using Metrics (Thresholds)
Monitoring Today

Confidential and Proprietary
Monitoring Today
Drill down using Logs

Confidential and Proprietary
• Reactive – Detecting issues after they happened - see #oncallselfie
• Extracting metrics and maintaining thresholds takes time
• Metrics tell you (only) part of the story
• You monitor (only) what you know
Problems

Confidential and Proprietary
Pattern Recognition
Strict Methodology
Large Dimensionality
HUMANS
Good at top-down, open-ended tasks
BOTS
Superior at defined, bottom-up tasks
Deep reasoning
Contextual thinking
(Hungry)
(Get tired)

Confidential and Proprietary
• Proactive – Tell me about issues before they affect my business
• Monitor everything! Detect Unknowns and Knowns
• Automatic as possible - without defining thresholds
• Yes, also logs, they have better answers:
Desired Solution
Credit:XKCD

Confidential and Proprietary
“I’ve been hearing this for 20 years”
Total Recall, a movie based on a book from 1966, featuring a
self-driving car as science fiction.
If Artificial-Intelligence has matured enough to drive your car,
it can probably also help with your IT.
Skeptic?!

Collect + Parse Learn Baselines and
Predict failures
Correlate & Trace Enrich with
Insight/Action
Proactive Monitoring using AI

Confidential and Proprietary
• Behavioral
• Probabilistic
• Semantic
3 Types of Predictions

Confidential and Proprietary
Behavioral
Vector analysis
Rate of change
Threshold

Confidential and Proprietary
Probabilistic
Extrapolation

Confidential and Proprietary
Semantic
Certificate for local system with Thumbprint 7e 2f ce f9 7e 33 fb 1a 59 16
f5 0f a5 d3 fc a2 ed 18 21 2f is about to expire or already expired.
Source: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Date: 22/06/2012 2:43:56 PM
Data
Meta Data 2017-07-21 04:23:35 app web.1 WARN : Detected yajl-ruby version 1.1.0 which
can cause segfaults with newrelic_rpm's thread profiling features. We
strongly recommend you upgrade to the latest yajl-ruby version available.
2017-07-21 04:22:17 app web.1 WARN : Detected yajl-ruby version 1.1.0 which
can cause segfaults with newrelic_rpm's thread profiling features. We
strongly recommend you upgrade to the latest yajl-ruby version available.
2017-07-21 04:21:17 app web.1 WARN : Detected yajl-ruby version 1.1.0 which
can cause segfaults with newrelic_rpm's thread profiling features. We
strongly recommend you upgrade to the latest yajl-ruby version available.

Confidential and Proprietary
Past vs. Future
Past:
ITUSED
DASHBOARDS
TO DO MONITORING
Future:
AIDOES THE
MONITORINGFOR IT

From MITRE ATT&CKcon Power Hour December 2020 By Katie Nickels, Director of Intelligence, Red Canary Good analysts (and good human beings) change their minds based on new information. In this presentation, Katie will share how her perspectives on ATT&CK have changed since moving from ATT&CK team member to ATT&CK end-user. She will discuss how her ideas about coverage, procedures, and detection creation have evolved and why those perspectives matter. Katie will also share practical examples from observed threats to help explain the nuances of her perspectives. Attendees should expect to leave this presentation with a better understanding of how to handle challenges they’re likely to face when navigating their own ATT&CK journey.

Resistance Isn't Futile: A Practical Approach to Threat Modeling

Katie Nickels

There are hundreds (if not thousands) of adversary groups out there, and it’s understandable if defenders sometimes feel like resistance is futile. Good news: you don’t have to defend against all of them! Even better news: there’s a simple way you can prioritize what adversaries you focus on and how you defend against them–threat modeling. This presentation will present a simple, practical threat modeling approach that any analyst or defender can use to get started figuring out what threats matter to their organization. The presentation will start by acknowledging the many approaches to threat modeling that others have created, and then discuss why there’s confusion around it. The presentation will then explain four simple steps and practical actions that anyone can take to get started with threat modeling: know your organization, know your adversaries, match those up, and take action. The audience will leave with an understanding of how threat modeling can help any team prioritize what threats they care about and use that to improve their organization’s defenses.

Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...

Alex Pinto

Implementing an appropriate data processing pipeline to make good use of your indicators of compromise is a problem that has been successfully addressed over the last few years. Even with all the push of automation and orchestration, a fundamental question remains: WHICH data should I be ingesting in my detection pipelines? There is no lack of data available, shared or not, paid or not. But how to keep my CTI IR team from spinning their wheels on a pile of CTI mud? This talk will discuss statistical analysis you can do with the CTI indicators you collect and your own network telemetry to define: - FIT: How appropriate does the CTI data apply to your own traffic. CTI vendors always talk about vertical specific threats, but is that measurable and verifiable? - IMPACT: How much was your true positive detections assisted by matches and link analysis derived from those CTI feeds - COVERAGE: Is your current mix of CTI feeds providing "intelligence" on the current threats that you should actually be concerned with? Those concepts will be introduced and explained with minimal math background needed, and pseudo-code (and real-code!) will be provided to assist organizations to perform those experiments on their own environment. We hope those tools will help attendees to better evaluate the quality of the CTI feeds they ingest from their open sources, paid providers and sharing communities.

Towards a Threat Hunting Automation Maturity Model

Alex Pinto

Threat Hunting has been commonly definable as a series of investigative actions that should be performed by analyst teams to cover detection gaps where automated tools fail. However, as those techniques become more and more widespread and standardized, wouldn’t it be the case that we can automate a large part of those threat hunting activities, creating a definition oxymoron? In this session, we will demonstrate how some threat hunting techniques can be automated or constructed to augment human activity by encoding analyst intuition into repeatable data extraction and processing technologies. Those techniques can be used to simplify the triage stage and get actionable information from potential threats with minimal human interaction. We then present a Hunting Automation Maturity Model (HAMM) that organizes these techniques around capability milestones, including internal and external context and analytical tooling.

From MITRE ATT&CKcon Power Hour January 2021 By Daniel Wyleczuk-Stern, Senior Security Engineer, Snowflake Cyber security is inherently a function of risk management. Risk management is the identification, evaluation, and prioritization of risks followed by the effort to reduce those risks in a coordinated and economical manner (thanks wikipedia!). In this talk, Daniel will be going over some strategies for measuring and prioritizing your cyber risks using MITRE ATT&CK. He'll discuss some lessons learned in atomic testing of techniques vs attack chaining as well as what to measure and how to make decisions with that data.

MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...

MITRE - ATT&CKcon

Avoid Rolling a Critical Fail

DomainTools

MITRE ATTACKcon Power Hour - October

MITRE - ATT&CKcon

ATTACKers Think in Graphs: Building Graphs for Threat Intelligence

MITRE - ATT&CKcon

From MITRE ATT&CKcon Power Hour January 2021 By Valentine Mairet, Security Researcher, McAfee The MITRE ATT&CK framework is the industry standard to dissect cyberattacks into used techniques. At McAfee, all attack information is disseminated into different categories, including ATT&CK techniques. What results from this exercise is an extensive repository of techniques used in cyberattacks that goes back many years. Much can be learned from looking at historical attack data, but how can we piece all this information together to identify new relationships between threats and attacks? In her recent efforts, Valentine has embraced analyzing ATT&CK data in graphical representations. One lesson learned is that it is not just about merely mapping out attacks and techniques used into graphs, but the strength lies in applying different algorithms to answer specific questions. In this presentation, Valentine will showcase the results and techniques obtained from her research journey using graph and graph algorithms.

Negative Unemployment and Great Job Satisfaction? Why infosec is AWESEOMEjeffmcjunkin

Beyond Matching: Applying Data Science Techniques to IOC-based Detection

Alex Pinto

There is no doubt that indicators of compromise (IOCs) are here to stay. However, even the most mature incident response (IR) teams are currently mainly focused on matching known indicators to their captured traffic or logs. The real “eureka” moments of using threat intelligence mostly come out of analyst intuition. You know, the ones that are almost impossible to hire. In this session, we show you how you can apply descriptive statistics, graph theory, and non-linear scoring techniques on the relationships of known network IOCs to log data. Learn how to use those techniques to empower IR teams to encode analyst intuition into repeatable data techniques that can be used to simplify the triage stage and get actionable information with minimal human interaction. With these results, we can make IR teams more productive as soon as the initial triage stages, by providing them data products that provide a “sixth sense” on what events are the ones worth analyst time. They also make painfully evident which IOC feeds an organization consume that are being helpful to their detection process and which ones are not.

CSA Raleigh application security and deception in the cloud

Phillip Maddux

Presented on January 17, 2019 at Raleigh/Durham/RTP - Cloud Security Alliance Chapter (https://www.meetup.com/Raleigh-Durham-RTP-Cloud-Security-Alliance-Chapter/). Over the last several years there has been a steady and increasing march towards shifting applications to the cloud. To keep pace with this cloud adoption, in some cases multi-cloud adoption, security teams need consistent real-time threat visibility over their web applications production. In this talk, we'll discuss some of the foundational concepts that comprise a practical approach to threat visibility and securing applications in the cloud. In addition, extending visibility to breaches in progress, deception can be a valuable layer in your defense in depth strategy. We'll discuss the concept of deception and how it can be deployed in the cloud. Overall, the audience will gain a greater insight into application security and deception for the cloud. As we head into 2019, we need to prepare for a year that will prove these concepts are critical for defending deployments in the cloud.

MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...

MITRE - ATT&CKcon

ATT&CK is an incredibly valuable framework for describing and analyzing what’s happening in your environment. Sometimes security professionals not only need a way to understand, but also need a way to clearly articulate to non-security leadership to gain support and investment in needed resourcing. Using UX design methods, CrowdStrike came up with a mental model and more conversational terms to help anyone quickly parse the big picture.

Amy DeMartine - 7 Habits of Rugged DevOps

SeniorStoryteller

Shift Left. Wait, what? No, Shift Right!!!

Phillip Maddux

Democratizing AI with Apache Spark

Spark Summit

Machine Learning & IT Service Intelligence for the Enterprise: The Future is ...

Precisely

Enterprises with mainframes and Cloud/server architectures face unique issues and challenges and if your enterprise delivers a service whose operation spans mainframe and distributed and/or Cloud infrastructures (e.g. a mobile banking/customer app), this webinar is for you. See how you can gain unique business and service-relevant context using your own machine data, including that from your z/OS mainframe. Implicitly learn patterns, eliminate costly false alerts, identify anomalies, and baseline normal operations by employing advanced analytics driven by machine learning. You’ll also see and learn about: • Accelerating root-cause analysis and getting ahead of customer-impacting outages and slow-downs for your service • “Glass Table” view for clickable visualization of the entire service-relevant infrastructure • Machine Learning in IT Service Intelligence • The Machine Learning Toolkit available today

Technical track chris calvert-1 30 pm-issa conference-calvert

ISSA LA

20160000 Cloud Discovery Event - Cloud Access Security Brokers

Robin Vermeirsch

Motion based security alarm

Akshay Surve

Visualization in the Age of Big Data

Raffael Marty

The extent and impact of recent security breaches is showing that current security approaches are just not working. But what can we do to protect our business? We have been advocating monitoring for a long time as a way to detect subtle, advanced attacks that are still making it through our defenses. However, products have failed to deliver on this promise. Current solutions don't scale in both data volume and analytical insights. In this presentation we will explore what security monitoring is. Specifically, we are going to explore the question of how to visualize a billion log records. A number of security visualization examples will illustrate some of the challenges with big data visualization. They will also help illustrate how data mining and user experience design help us get a handle on the security visualization challenges - enabling us to gain deep insight for a number of security use-cases.

AI for Manufacturing (Machine Vision, Edge AI, Federated Learning)

byteLAKE

This is the extended presentation about byteLAKE's and Lenovo's Artificial Intelligence solutions for Manufacturing. Topics covered: AI strategy for manufacturing, Edge AI, Federated Learning and Machine Vision. It's the first publication in the upcoming series: AI for Manufacturing. Highlights: AI-assisted quality monitoring automation, AI-assisted production line monitoring and issues detection, AI-assisted measurements, Intelligent Cameras and many more. Reach out to us to learn more: welcome@byteLAKE.com. Presented during the world's first Federated Learning conference (Jun'20). Recording: https://youtu.be/IMqRIi45dDA Related articles: - Revolution in factories: Industry 4.0. https://medium.com/@marcrojek/revolution-in-factories-industry-4-0-conference-made-in-wroclaw-2020-translation-ae96e5e14d55 - Cognitive Automation helps where RPAs fall short. https://medium.com/@marcrojek/cognitive-automation-helps-where-rpas-fall-short-a1c5a01a66f8 - Machine Vision, how AI brings value to industries. https://medium.com/@marcrojek/machine-vision-how-ai-brings-value-to-industries-e6a4f8e56f42 Learn more: - https://www.bytelake.com/en/cognitive-services/ - https://www.lenovo.com/ai - https://federatedlearningconference.com/

AI in the Enterprise at Scale

Ganesan Narayanasamy

As the adoption of AI technologies increases and matures, the focus will shift from exploration to time to market, productivity and integration with existing workflows. Governing Enterprise data, scaling AI model development, selecting a complete, collaborative hybrid platform and tools for rapid solution deployments are key focus areas for growing data scientist teams tasked to respond to business challenges. This talk will cover the challenges and innovations for AI at scale for the Enterprise focusing on the modernization of data analytics, the AI ladder and AI life cycle and infrastructure architecture considerations. We will conclude by viewing the benefits and innovation of running your modern AI and Data Analytics applications such as SAS Viya and SAP HANA on IBM Power Systems and IBM Storage in hybrid cloud environments.

Security Breakout Session

Splunk

Privacy Preserved Data Augmentation using Enterprise Data Fabric

Atif Shaikh

Enterprises hold data that has potential value outside their own firewalls. We have been trying to figure out how to share such data at a level of detail with others in a secure, safe, legal and risk mitigated manner that ensure high level of privacy while adding tangible economic and social value. Enterprises are facing numerous roadblocks, failed projects, inadequate business cases, and issues of scale that needs newer techniques, technology and approach. In this talk, we will be setup the groundwork for scalable data augmentation for organisations and visualising technical architectures and solutions around emerging technologies of data fabrics, edge computing and a second coming of data virtualisation.

Innovate Better Through Machine data Analytics

Hal Rottenberg

What's hot

Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...

MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...

MITRE - ATT&CKcon

Avoid Rolling a Critical Fail

DomainTools

MITRE ATTACKcon Power Hour - October

MITRE - ATT&CKcon

ATTACKers Think in Graphs: Building Graphs for Threat Intelligence

MITRE - ATT&CKcon

Negative Unemployment and Great Job Satisfaction? Why infosec is AWESEOMEjeffmcjunkin

Beyond Matching: Applying Data Science Techniques to IOC-based Detection

Alex Pinto

CSA Raleigh application security and deception in the cloud

Phillip Maddux

MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...

MITRE - ATT&CKcon

Amy DeMartine - 7 Habits of Rugged DevOps

SeniorStoryteller

Shift Left. Wait, what? No, Shift Right!!!

Phillip Maddux

What's hot (11)

Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...

MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...

Avoid Rolling a Critical Fail

MITRE ATTACKcon Power Hour - October

ATTACKers Think in Graphs: Building Graphs for Threat Intelligence

Negative Unemployment and Great Job Satisfaction? Why infosec is AWESEOME

Beyond Matching: Applying Data Science Techniques to IOC-based Detection

CSA Raleigh application security and deception in the cloud

MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...

Amy DeMartine - 7 Habits of Rugged DevOps

Shift Left. Wait, what? No, Shift Right!!!

Similar to Proactive Monitoring: Playing Offense for the Win

Democratizing AI with Apache Spark

Spark Summit

Machine Learning & IT Service Intelligence for the Enterprise: The Future is ...

Precisely

Technical track chris calvert-1 30 pm-issa conference-calvert

ISSA LA

20160000 Cloud Discovery Event - Cloud Access Security Brokers

Robin Vermeirsch

Motion based security alarm

Akshay Surve

Visualization in the Age of Big Data

Raffael Marty

AI for Manufacturing (Machine Vision, Edge AI, Federated Learning)

byteLAKE

AI in the Enterprise at Scale

Ganesan Narayanasamy

Security Breakout Session

Splunk

Privacy Preserved Data Augmentation using Enterprise Data Fabric

Atif Shaikh

Innovate Better Through Machine data Analytics

Hal Rottenberg

Dev and Ops Collaboration and Awareness at Etsy and Flickr

John Allspaw

Defcon 21-pinto-defending-networks-machine-learning by pseudor00t

pseudor00t overflow

Bridging the Gap: Analyzing Data in and Below the Cloud

Inside Analysis

The Briefing Room with Dean Abbott and Tableau Software Live Webcast July 23, 2013 http://www.insideanalysis.com Today’s desire for analytics extends well beyond the traditional domain of Business Intelligence. That’s partly because business users are realizing the value of mixing and matching all kinds of data, from all kinds of sources. One emerging market driver is Cloud-based data, and the desire companies have to analyze this data cohesively with their on-premise data sets. Register for this episode of The Briefing Room to learn from Analyst Dean Abbott, who will explain how the ability to access data in the cloud can play a critical role for generating business value from analytics. He’ll be briefed by Ellie Fields of Tableau Software who will tout Tableau’s latest release, which includes native connectors to cloud-based applications like Salesforce.com, Amazon Redshift, Google Analytics and BigQuery. She’ll also demonstrate how Tableau can combine cloud data with other data sources, including spreadsheets, databases, cubes and even Big Data.

High time to add machine learning to your information security stack

Minhaz A V

Machine learning might never be the silver bullet for cybersecurity compared to areas where it is thriving. There will always be a person who tries to find issues in our systems and bypass them. They may even use it to assist the attacks. But adding it to our general information security stack can surely help us be more prepared while defending. Different categories like regression, classification, clustering, recommendations & reinforcement learning can be leveraged to build efficient & faster monitoring, threat response, network traffic analysis and more. Along with introduction to different aspects and how it can be leveraged - I'd like to present a case study on how ML/AI can be used in distinguishing between benign and Malicious traffic data by means of anomaly detection techniques with 100% True Positive Rate with live demo.

Troubleshooting: A High-Value Asset For The Service-Provider Discipline

Sagi Brody

As standardized offerings for hosting and cloud providers become more complex and interdependent, so too do the requirements to properly manage and troubleshoot them. The ability for technical teams to quickly localize bottlenecks, capacity limits, application issues, and other problems is now a key success factor. Troubleshooting, once considered a soft skill, now needs to be acknowledged and cultivated as an important corporate skill and asset.

Linkurious Enterprise: graph visualization platform neo4jLinkurious

Virtual Data : Eliminating the data constraint in Application Development

Kyle Hailey

2016 Cybersecurity Analytics State of the Union

Cloudera, Inc.

AI & AWS DeepComposerAmazon Web Services

Similar to Proactive Monitoring: Playing Offense for the Win (20)

Democratizing AI with Apache Spark

Machine Learning & IT Service Intelligence for the Enterprise: The Future is ...

Technical track chris calvert-1 30 pm-issa conference-calvert

20160000 Cloud Discovery Event - Cloud Access Security Brokers

Motion based security alarm

Visualization in the Age of Big Data

AI for Manufacturing (Machine Vision, Edge AI, Federated Learning)

AI in the Enterprise at Scale

Security Breakout Session

Privacy Preserved Data Augmentation using Enterprise Data Fabric

Innovate Better Through Machine data Analytics

Dev and Ops Collaboration and Awareness at Etsy and Flickr

Defcon 21-pinto-defending-networks-machine-learning by pseudor00t

Bridging the Gap: Analyzing Data in and Below the Cloud

High time to add machine learning to your information security stack

Troubleshooting: A High-Value Asset For The Service-Provider Discipline

Linkurious Enterprise: graph visualization platform neo4j

Virtual Data : Eliminating the data constraint in Application Development

2016 Cybersecurity Analytics State of the Union

AI & AWS DeepComposer

More from Deborah Schalm

Exploring Prometheus: Combining Metrics and Alerting to Improve Incident Mana...

Proactive Monitoring: Playing Offense for the Win

Recommended

Recommended

More Related Content

What's hot

What's hot (11)

Similar to Proactive Monitoring: Playing Offense for the Win

Similar to Proactive Monitoring: Playing Offense for the Win (20)

More from Deborah Schalm

More from Deborah Schalm (20)

Recently uploaded

Recently uploaded (20)

Proactive Monitoring: Playing Offense for the Win