Downloaded 35 times
Uploaded bySplunk
SplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods
Splunk Security Essentials provides concise summaries in 3 sentences or less that provide the high level and essential information from the document. The document discusses an introductory presentation on security analytics methods. It includes an agenda that covers an introduction to analytics methods, an example scenario, and next steps. It also discusses common security challenges, different analytics methods and types of use cases, and how analytics can be applied to different stages of an attack.
More Related Content
Similar to SplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods
![Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]](https://cdn.slidesharecdn.com/ss_thumbnails/codedagentsdeck-251215155422-5497c599-thumbnail.jpg?width=640&height=640&fit=bounds)
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
SplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods
- 1. Intro to SecurityAnalytics Methods
- 2. During the courseof this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. ©2018 Splunk Inc. All rights reserved. Forward-Looking Statements
- 3. © 2018 SPLUNKINC. 1. Intro to Analytics Methods 2. Example Scenario 3. Next Steps Agenda 3
- 4.
- 5. First Time Seen poweredby stats Time Series Analysis with Standard Deviation General Security Analytics Searches Analytics Methods Types of Use Cases
- 6. Applying to Stagesof an Attack HTTP (web) session to command & control server Remote control, Steal data, Persist in company, Rent as botnet WEB .pdf .pdf executes & unpacks malware overwriting and running “allowed” programs Svchost.exeCalc.exe Attacker hacks website Steals .pdf files Web Portal Attacker creates malware, embed in .pdf, Emails to the target MAIL Read email, open attachment Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Security
- 7. Detection of SuspiciousEmail Activity
- 8. Applying to Stagesof an Attack HTTP (web) session to command & control server Remote control, Steal data, Persist in company, Rent as botnet WEB .pdf .pdf executes & unpacks malware overwriting and running “allowed” programs Svchost.exeCalc.exe Attacker hacks website Steals .pdf files Web Portal Attacker creates malware, embed in .pdf, Emails to the target MAIL Read email, open attachment Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Security
- 9.
- 10. Applying to Stagesof an Attack HTTP (web) session to command & control server Remote control, Steal data, Persist in company, Rent as botnet WEB .pdf .pdf executes & unpacks malware overwriting and running “allowed” programs Svchost.exeCalc.exe Attacker hacks website Steals .pdf files Web Portal Attacker creates malware, embed in .pdf, Emails to the target MAIL Read email, open attachment Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Security
- 11. Identifying Exfiltration and/orCommand and Control
- 12. Implementation Approach forSecurity Analytics Alert Aggregation AlertCreation Investigation Investigative Platform • Analyst flexibility • Provide access to data analysis solutions • Record historical context for everything Simpler Detection • Rules and statistics • Quick development • Easy for analysts ML Based Detection • Detect unknown • New vectors • Heavy data science Threat Detection • Manage high volume • Track entity relationships • Combination ML + Rules
- 13. The Splunk Portfolio RichEcosystem of Apps & Add-Ons Splunk Premium Solutions Mainframe Data Relational Databases MobileForwarders Syslog/ TCP IoT Devices Network Wire Data Hadoop Platform for Operational Intelligence
- 14. Slow Response from BasicAlerts Fast Response from Advanced Alerts Managing Alert Volume vs Value Use Low Volume Searches Splunk ES Risk Framework Splunk UBA Threat Models UBA + ES Adaptive Response
- 15. Use Low Volume Searches Splunk ES Risk Framework SplunkUBA Threat Models UBA + ES Adaptive Response Managing Alert Volume vs Value Everyone starts here, and spends most of their time here
- 16. ▶ Enterprise Securityhas a Risk Framework designed for aggregating low severity indicators Aggregate Alerting with ES Risk
- 17. ▶ High Confidencealerts from UBA fed into ES ▶ Take actions like • Box: “Change Permissions” • AD: “Reset Password” or “Disable Account” • PAN: Isolate Host ▶ 40+ partners! Respond With ES Adaptive Response
- 18. ▶ Splunk UBAThreat Models leverage Data Science, Machine Learning ▶ Finds important, inter-related anomalies that analysts should actually view ▶ Support more advanced anomaly detections! Apply Machine Learning With Splunk UBA
- 19.
- 20. Download Splunk SecurityEssentials
- 21. Where Can IInstall Splunk Security Essentials? Survey Results: Have You Tried to Install the App? Tried and Failed Installed in Dev Installed in Production Installed in Distributed Environment Installed in a SHC Environment Your Laptop! Your Production Environtment! All Kinds of Production Environtments! Your Dev Environment!
- 22. ▶ You canthink about operational maturity in terms of data ▶ Start with the basics – get your data into a single location ▶ Then work your way up the stack ▶ Not sure how to start? Yes, there is an app for that Looking at Security in Terms of Data
- 23. ▶ Identify badguys: • 300+ security analytics methods • Target external and insider threats • Scales from small to massive companies • Save from app, send hits to ES/UBA Splunk Security Essentials https://splunkbase.splunk.com/app/3435/ Solve use cases you can today for free, then use Splunk UBA for advanced ML detection.
- 24. • Access • Data •Endpoint • Network • Threat • Any Host Logs • Electronic Medical Record System • Email Logs • Firewall • Netflow • Print Server Logs • Very Low • Low • Medium • High • Very High Splunk Security Essentials App Inventory “Say, aren’t those all recommended data sources for Splunk Security in general?” DOMAINS DATA SOURCES ALERT VOLUME • Salesforce Event Log File • Source Code Repository Logs • Splunk Notable Events
- 25.
- 26. ▶ Download fromapps.splunk.com ▶ Browse use cases that match your needs ▶ Data Source Check shows other use cases for your existing data ▶ Evaluate free tools to meet gaps, such as Microsoft Sysmon • (links inside the app) Getting Started with Splunk Security Essentials
- 27. Open the SplunkSecurity Essentials App First Open Splunk Security Essentials Then Open Use Cases
- 28. ▶ Read througha few of the use cases ▶ Filter for use cases you care about Take a Minute to Review Use Cases
- 29. Let’s Start Witha Simple Example Click on “Concentration of Hacker Tools by Filename”
- 30. ▶ A searchyou might not think of, but is easy to use ▶ Input: CSV file with suspicious filenames ▶ Input: Process launch logs (Windows, Sysmon, Carbon Black, etc.) ▶ Looks for those file names concentrated in a short period of time Concentration of Hacker Tools by Filename
- 31. Applying to LiveData Click Live Data See a Live Search
- 32. ▶ Phishing isa big risk ▶ Many approaches to mitigating with Splunk An Advanced Splunk Search From Data Sources, Filter to Email Logs Click on ‘Emails with Lookalike Domains’ From Journey Select Stage 4
- 33. ▶ A verylong search you don’t have to run ▶ Detects typos, like company.com → campany.com ▶ Supports subdomains for typo detection ▶ Detects suspicious subdomains, like company.com → company.yourithelpdesk.com A Phishing Search Larger Than Your Pond
- 34.
- 35. ▶ Actor: Malicious Insider(because it’s hardest) ▶ Motivation: Going to work for competitor ▶ Target: Accounts, Opportunities, Contacts in Salesforce ▶ Additional Target: Sales Proposals in Box ▶ Exfiltration: Upload to a remote server Apply Splunk to Real Life Scenario Malicious Insider Chris Geremy Director of Finance * Photo of Splunker, I promise she is not a malicious insider
- 36. ▶ No proxy ▶No standard file servers ▶ No agents on laptop ▶ Cloud Services with their own APIs How would you detect that? Monitoring Challenges
- 37. ▶ Ingest SalesforceEvent Log File • https://splunkbase.splunk.com/app/1931/ ▶ Ingest Box Data • https://splunkbase.splunk.com/app/2679/ ▶ Install Splunk Security Essentials • https://splunkbase.splunk.com/app/3435/ ▶ Schedule Salesforce use cases ▶ Build a custom Box use case Set Up Monitoring About 1 Hour of Work
- 38. ▶ Do youwant to build your own detections like this? ▶ What if your environment is totally custom? ▶ No product has ever worked out of the box, and that’s why you like Splunk, right? We’ve got you. But My Company Is So Custom Click Assistants, then “Detect Spikes”
- 39. © 2018 SPLUNKINC. Use Case Our Malicious Insider, Jane Smith, also downloaded some proposals from Box Finding Box downloads spikes is easy, but we want focus on the Proposal Folder We will use the Detect Spikes assistant to help us Use Case
- 40. ▶ | inputlookupanonymized_box_logs.csv | search folder="PROPOSALS” | bucket _time span=1d | stats count by user _time ▶ Looking for “count” by “user” with “6” standard deviations
- 41. ▶ | inputlookupanonymized_box_logs.csv | search folder="PROPOSALS” | bucket _time span=1d | stats count by user _time ▶ Looking for “count” by “user” with “6” standard deviations Got Her!
- 42.
- 43.
- 44. © 2018 SPLUNKINC. 1. Splunk Security Essentials shows you new detection use cases 2. Ultimately it just uses Splunk Enterprise – power of the platform! 3. You can build your own use cases easily! 4. As you advance, look to ES or UBA to improve threat detection What Did We Cover?
- 45. Splunk Security Portfolio SplunkEnterprise Detection Human-driven • Log Aggregation • Splunk Security Essentials • Rules, statistics, correlation Realm of Known Enterprise Security Response • OOB key security metrics • Incident response workflow • Adaptive response Splunk UBA Detection ML-driven • Risky behavior detection • Entity profiling, scoring • Kill chain, graph analysis Realm of Unknown
- 46. ▶ Download fromapps.splunk.com ▶ Find use cases that match your needs ▶ Data Source Check shows other use cases for your existing data ▶ Evaluate free tools to meet gaps, such as Microsoft Sysmon • (links inside the app) Go Get Started With Splunk Security Essentials!