stoQing your Splunk
•
0 likes•382 views
1) stoQ is an open source framework that enables automating processes, analytics, and tasks to reduce manual work. It uses plugins to leverage multiple tools simultaneously. 2) The presentation provides an overview of stoQ and its capabilities. It also demonstrates how stoQ can be used in conjunction with Splunk for a digital forensics investigation use case. 3) A Splunk app for stoQ is available to visualize stoQ results in Splunk and allow quick pivoting between data sources.
Report
Share
Report
Share
Download to read offline
Recommended
SIG-NOC Tools Survey 2019 Results
Presentació a càrrec de Maria Isabel Gandia, cap de Comunicacions del CSUC, duta a terme al 10è SIG-NOC Meeting, celebrat els dies 13 i 14 de novembre de 2019 a Praga.
SplunkLive! London 2016 - John Lewis
Presentation on how John Lewis uses Splunk Enterprise and Splunk Enterprise Security as a security platform.
City of San Diego Customer Presentation
Gary Hayslip is the Deputy Director and CISO of the City of San Diego. Before implementing Splunk, the city lacked visibility and coordination across its IT systems. Splunk has provided the city with end-to-end visibility across its 24 networks and 40,000 endpoints. It uses Splunk for security reporting, threat detection, application management, analytics, and dashboards. Splunk has helped the city detect threats faster, improve operations, and protect critical data. The city plans to continue expanding its use of Splunk across departments to improve security and operations.
Splunk for Enterprise Security and User Behavior Analytics
This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Customer Presentation, FirstSolar
First Solar is a global leader in solar energy solutions with over 10 GW installed worldwide. They chose Splunk as their security information and event management (SIEM) solution after their previous solution provided cryptic, unusable alerts that wasted analysts' time. Splunk has provided First Solar with clarity into their environment, allowing them to distinguish real threats from false positives in under 30 minutes and improving security. They use Splunk for dashboards, malware detection, and accurate searches to quickly respond to incidents. First Solar now has complete visibility and faster response times with Splunk.
SplunkLive! Austin Customer Presentation - Baylor
- Baylor University is a private Christian university in Waco, Texas with over 17,000 students. The CISO, Jon Allen, built the university's security program from the ground up over 17 years.
- Before Splunk, it was difficult and inefficient for the security team to search logs and get the information they needed across different systems in a timely manner.
- Splunk provided a single platform to integrate and search all their log data, allowing the security team to quickly gain visibility, troubleshoot issues, and meet compliance requirements. It also helped break down silos between different IT teams.
- Splunk has improved operational efficiency by reducing the time to find information from hours to minutes. It also fosters
SplunkLive! Milano 2016 - Splunk Plenary Session
The document provides an agenda for the SplunkLiveMilano2016 event taking place on April 5th, 2016 in Milan. The agenda includes welcome and overview sessions in the morning, followed by use case presentations from Unicredit, Saipem, and Yoox-Net-a-Porter. There will be breakout sessions after lunch on various topics, and a happy hour with sponsors. The document also lists the dedicated Splunk team for Italy and provides information on upcoming Splunk events.
Splunk @ HomeAway
This document summarizes René X. Parra's presentation on Splunk usage at HomeAway. It discusses how HomeAway has grown from simple log aggregation to supporting high data volumes and near real-time analysis. HomeAway now ingests over 1TB of data per day across multiple indexers and search heads. The presentation demonstrates how Splunk supports both batch and real-time analytics and concludes with key takeaways around proper Splunk sizing, optimization, and engaging the Splunk community.
Recommended
SIG-NOC Tools Survey 2019 Results
Presentació a càrrec de Maria Isabel Gandia, cap de Comunicacions del CSUC, duta a terme al 10è SIG-NOC Meeting, celebrat els dies 13 i 14 de novembre de 2019 a Praga.
SplunkLive! London 2016 - John Lewis
Presentation on how John Lewis uses Splunk Enterprise and Splunk Enterprise Security as a security platform.
City of San Diego Customer Presentation
Gary Hayslip is the Deputy Director and CISO of the City of San Diego. Before implementing Splunk, the city lacked visibility and coordination across its IT systems. Splunk has provided the city with end-to-end visibility across its 24 networks and 40,000 endpoints. It uses Splunk for security reporting, threat detection, application management, analytics, and dashboards. Splunk has helped the city detect threats faster, improve operations, and protect critical data. The city plans to continue expanding its use of Splunk across departments to improve security and operations.
Splunk for Enterprise Security and User Behavior Analytics
This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Customer Presentation, FirstSolar
First Solar is a global leader in solar energy solutions with over 10 GW installed worldwide. They chose Splunk as their security information and event management (SIEM) solution after their previous solution provided cryptic, unusable alerts that wasted analysts' time. Splunk has provided First Solar with clarity into their environment, allowing them to distinguish real threats from false positives in under 30 minutes and improving security. They use Splunk for dashboards, malware detection, and accurate searches to quickly respond to incidents. First Solar now has complete visibility and faster response times with Splunk.
SplunkLive! Austin Customer Presentation - Baylor
- Baylor University is a private Christian university in Waco, Texas with over 17,000 students. The CISO, Jon Allen, built the university's security program from the ground up over 17 years.
- Before Splunk, it was difficult and inefficient for the security team to search logs and get the information they needed across different systems in a timely manner.
- Splunk provided a single platform to integrate and search all their log data, allowing the security team to quickly gain visibility, troubleshoot issues, and meet compliance requirements. It also helped break down silos between different IT teams.
- Splunk has improved operational efficiency by reducing the time to find information from hours to minutes. It also fosters
SplunkLive! Milano 2016 - Splunk Plenary Session
The document provides an agenda for the SplunkLiveMilano2016 event taking place on April 5th, 2016 in Milan. The agenda includes welcome and overview sessions in the morning, followed by use case presentations from Unicredit, Saipem, and Yoox-Net-a-Porter. There will be breakout sessions after lunch on various topics, and a happy hour with sponsors. The document also lists the dedicated Splunk team for Italy and provides information on upcoming Splunk events.
Splunk @ HomeAway
This document summarizes René X. Parra's presentation on Splunk usage at HomeAway. It discusses how HomeAway has grown from simple log aggregation to supporting high data volumes and near real-time analysis. HomeAway now ingests over 1TB of data per day across multiple indexers and search heads. The presentation demonstrates how Splunk supports both batch and real-time analytics and concludes with key takeaways around proper Splunk sizing, optimization, and engaging the Splunk community.
Splunk Enterprise for InfoSec Hands-On Breakout Session
This document provides an agenda and overview of a Splunk Enterprise security workshop focusing on web attacks, lateral movement, and DNS exfiltration. The agenda includes introductions, demonstrations of SQL injection detection using regular expressions, detecting lateral movement through abnormal network traffic patterns, and using Shannon entropy and subdomain length to identify DNS exfiltration. Hands-on exercises are provided to allow attendees to search pre-loaded machine data and gain experience detecting these common security incidents.
Splunk for Enterprise Security featuring User Behavior Analytics
This session will review Splunk’s two premium solutions - Splunk Enterprise Security (ES) is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and
incident response environments. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams.
2016 virus bulletin
Endpoint threats have entered a new era, and the security industry has been rushing to catch up. The result is a highly fragmented and confusing market that has doubled in size to over 70 vendors in the last four years. We're in the midst of the second great endpoint security consolidation and will discuss precisely what that means. We'll discuss six progressive stages endpoint security will work through as this market continues to mature over the next five years or so.
Splunk for Enterprise Security Featuring UBA
This document provides an overview and summary of Splunk's security products, including Enterprise Security and User Behavior Analytics. It discusses the key capabilities and features of these products, such as detecting advanced cyberattacks, identifying insider threats through machine learning, and integrating UBA with SIEM for improved threat detection. New features in recent versions are highlighted, like custom threat modeling and enhanced visibility into user, device, application, and protocol activity. Customer testimonials praise Splunk UBA's data-science approach to finding hidden threats.
Splunk for Enterprise Security and User Behavior Analytics
This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Splunk at Sabre
- John Bland is a senior software developer at Sabre who is responsible for Splunk implementation and uses it extensively in his work.
- Before Splunk, Sabre struggled to view logs from different locations and applications in a centralized way and had to manually search through logs.
- Sabre now uses Splunk across multiple environments to gain visibility into applications, monitor performance, streamline development processes, and improve support capabilities.
- Splunk has helped Sabre improve uptime, reduce troubleshooting time, and provide better support to internal teams and customers. Sabre continues expanding their use of Splunk across more processes.
Splunk for Enterprise Security featuring User Behavior Analytics
This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Splunk for Enterprise Security featuring UBA Breakout Session
This document provides an overview of a presentation given by Dave Herrald, a security architect at Splunk, on Splunk's Enterprise Security and User Behavior Analytics solutions. The presentation covered new features in Splunk Enterprise Security 4.1, including enhanced threat intelligence integration, risk-based searching and incident review, and integration with Splunk User Behavior Analytics. It also reviewed capabilities in Splunk User Behavior Analytics 2.2 like custom threat modeling, expanded attack coverage, and context enrichment.
Splunk Security Session - .conf Go Köln
The document is a presentation on cyber security trends and Splunk security products from Matthias Maier, Product Marketing Director for Security at Splunk. The presentation covers trends in security operations like the evolution of SOCs, new security roles, and data-centric security approaches. It also provides updates on Splunk's security portfolio including recognition as a leader in SIEM by Gartner and growth in the SIEM market. Maier highlights some breakout sessions from the conference on topics like asset defense, machine learning, and building detections.
Getting Started with Splunk Enterprise
Splunk Enterprise is a software platform for searching, monitoring, and analyzing machine-generated big data, such as logs, metrics, and mobile data. The presentation provided an overview of Splunk Enterprise capabilities including: live demonstrations of installing Splunk, searching data, creating dashboards and alerts. It also covered Splunk deployment architectures for scaling from single instances to distributed environments supporting hundreds of terabytes per day.
Getting Started with Splunk Enterprise
This document provides an overview and demonstration of Splunk Enterprise. It discusses Splunk's capabilities for indexing, searching, and analyzing machine data from various sources. The live demonstration shows how to install Splunk, import sample data, perform searches, create dashboards and alerts. It also covers Splunk's deployment architecture and scalability options. Attendees are encouraged to ask questions on Splunk's online communities and support channels.
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
This document summarizes a presentation on leveraging big data in cybersecurity. It discusses how current security challenges include breaches occurring within minutes while most go undiscovered for months or years. Inside-out security is proposed to detect both known and unknown threats using deep endpoint visibility and activity correlation. This allows proactive detection, assessment of sensitive data and risks, automated incident response, and recovery to reduce breach discovery times.
SplunkLive! Paris 2016 - Plenary session
Splunk provides a platform for operational intelligence that allows users to analyze machine data from any source. The document discusses Splunk products and solutions for IT service management, security intelligence, and Internet of Things applications. Splunk has over 11,000 customers across various industries.
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk User Behavior Analytics (UBA) 2.2 provides enhanced security analytics and detection capabilities. It uses machine learning to establish baseline behaviors and detect anomalies. UBA analyzes activities across users, hosts, networks, applications and data to identify potential threats. The latest version features expanded visibility metrics, custom threat modeling capabilities, and improved context enrichment through integrations with additional security technologies.
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
We’ll be exploring some of the more advanced capabilities of Phantom and also discussing the security framework from MITRE “ATT&CK” and it’s valued use when integrating it with Splunk Enterprise! We’ll also have two SplunkTrust members available for some general Q&A in our own ‘Meet the Experts’.
- Splunk Phantom Workbook Automation - SOAR (Security Orchestration, Automation & Response)
-- Tom Wise (Phantom Security Solutions Engineer & Trainer)
- Threat Hunting, Or: How I Learned to Stop Worrying & Love ATT&CK
-- Cian Heasley / Fraser Dumayne (Security Engineers)
- Meet the Experts with SplunkTrust
-- Harry McLaren (Senior Splunk Consultant)
-- Tom Wise (Splunk Consultant, Phantom Security Solutions Engineer & Trainer)
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
This document provides an agenda and summaries for a Splunk User Group meeting in Edinburgh in April 2017. The meeting will include presentations and demos on building Splunk apps, development paths and certification, and Splunk User Behavior Analytics. The introductory presentation will be given by Harry McLaren from ECS and will provide background on ECS and the Splunk User Group. Additional presentations will cover building custom Splunk apps using both the web interface and direct XML editing, and paths for Splunk certification. The final presentation will demo Splunk UBA for detecting insider threats and advanced adversaries. Attendees are encouraged to discuss in-house developed apps and get involved in the Splunk community.
Getting Started with Splunk Breakout Session
Splunk is a software platform that allows users to search, monitor, and analyze machine-generated big data via a web-style interface. It collects and indexes data from various sources like servers, networks, sensors, and applications. Splunk is used by over 9,000 customers across various industries for security intelligence, IT operations, and business analytics. It offers role-based access controls, multi-tenancy, and secure data transmission. Splunk components include universal forwarders for data collection, indexers for data storage, and search heads for data presentation.
Taking Splunk to the Next Level - Manager
Splunk can help customers document business value by providing deliverables like business cases, value realization studies, and adoption roadmaps. It has helped over 700 customers worldwide since 2013. Key value drivers reported by customers include IT operations, application delivery, security, and compliance. Common challenges to documenting value include lack of tools, benchmarks, and time. The document outlines best practices for positioning value at Splunk, including quantifying business value, qualifying pain points, aligning with objectives, and measuring success. It provides examples of value drivers achieved in areas like infrastructure optimization, revenue growth, and risk reduction.
WhiteSource Webinar-New Research Reveals Key Strategy to Manage Open Source S...
In our joint webinar with 451 Research, we discussed the key strategies to manage your open source security
Taking Splunk to the Next Level - Manager
This document provides an overview of how Splunk can help customers document business value. It discusses key value drivers in IT operations, application delivery, and security and compliance. It also outlines best practices for positioning value, including aligning with objectives, qualifying pain points, and quantifying business value. Common data sources, use cases, and benchmarks from over 700 customer engagements are presented for each value area.
The Hidden Empires of Malware with TLS Certified Hypotheses and Machine Learning
The “threat hunting” landscape has drastically changed due to the increase in encrypted transport layer security (TLS) Internet traffic. The days of adversaries registering domains with their given names are gone, and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered tactics, techniques, and procedures, adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks. This talk focuses on expanding on techniques that have been researched and presented at various conferences by Mark Parsons, and specifically on his methods for using TLS certificates to find malicious malware infrastructure. We will build on Parsons’ body of work and show how his approach to malware certificate hunting can be expanded to detect instances of PowerShell Empire servers that have self-generated SSL certifications on port 443 and 8080. These certificates have a unique fingerprint that can be detected by leveraging tools like zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future. Finally, we will discuss our creation of hypotheses, codes and techniques, and methods of validation for verification. We’ll then release our tools and methodology for use by the community to explore other potential “hidden empires” of malware
Hidden empires of malware
The landscape of "threat hunting" has drastically changed due to the increase in TLS encrypted Internet traffic. The days of adversaries registering domains with their given names are gone and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered TTPs, the adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks.
Our talk focuses on expanding upon techniques that have been researched and presented on at various conferences by Mark Parsons, specifically, his methods for using TLS certificates to find malicious malware infrastructure. We will build upon Parsons' corpus of work and show how his approach to malware certificate hunting can be expanded upon to detect instances of PowerShell Empire servers that have self-generated SSL certs on port 443 and 8080. These certificates have a unique finger print that can be detected by leveraging tools like zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future. Finally, we will discuss our hypotheses creation, our code and techniques, methods of validation for verification, and release our tools and methodology for use by the community to explore other "hidden empires" of malware that may exist.
More Related Content
Similar to stoQing your Splunk
Splunk Enterprise for InfoSec Hands-On Breakout Session
This document provides an agenda and overview of a Splunk Enterprise security workshop focusing on web attacks, lateral movement, and DNS exfiltration. The agenda includes introductions, demonstrations of SQL injection detection using regular expressions, detecting lateral movement through abnormal network traffic patterns, and using Shannon entropy and subdomain length to identify DNS exfiltration. Hands-on exercises are provided to allow attendees to search pre-loaded machine data and gain experience detecting these common security incidents.
Splunk for Enterprise Security featuring User Behavior Analytics
This session will review Splunk’s two premium solutions - Splunk Enterprise Security (ES) is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and
incident response environments. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams.
2016 virus bulletin
Endpoint threats have entered a new era, and the security industry has been rushing to catch up. The result is a highly fragmented and confusing market that has doubled in size to over 70 vendors in the last four years. We're in the midst of the second great endpoint security consolidation and will discuss precisely what that means. We'll discuss six progressive stages endpoint security will work through as this market continues to mature over the next five years or so.
Splunk for Enterprise Security Featuring UBA
This document provides an overview and summary of Splunk's security products, including Enterprise Security and User Behavior Analytics. It discusses the key capabilities and features of these products, such as detecting advanced cyberattacks, identifying insider threats through machine learning, and integrating UBA with SIEM for improved threat detection. New features in recent versions are highlighted, like custom threat modeling and enhanced visibility into user, device, application, and protocol activity. Customer testimonials praise Splunk UBA's data-science approach to finding hidden threats.
Splunk for Enterprise Security and User Behavior Analytics
This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Splunk at Sabre
- John Bland is a senior software developer at Sabre who is responsible for Splunk implementation and uses it extensively in his work.
- Before Splunk, Sabre struggled to view logs from different locations and applications in a centralized way and had to manually search through logs.
- Sabre now uses Splunk across multiple environments to gain visibility into applications, monitor performance, streamline development processes, and improve support capabilities.
- Splunk has helped Sabre improve uptime, reduce troubleshooting time, and provide better support to internal teams and customers. Sabre continues expanding their use of Splunk across more processes.
Splunk for Enterprise Security featuring User Behavior Analytics
This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.
Splunk for Enterprise Security featuring UBA Breakout Session
This document provides an overview of a presentation given by Dave Herrald, a security architect at Splunk, on Splunk's Enterprise Security and User Behavior Analytics solutions. The presentation covered new features in Splunk Enterprise Security 4.1, including enhanced threat intelligence integration, risk-based searching and incident review, and integration with Splunk User Behavior Analytics. It also reviewed capabilities in Splunk User Behavior Analytics 2.2 like custom threat modeling, expanded attack coverage, and context enrichment.
Splunk Security Session - .conf Go Köln
The document is a presentation on cyber security trends and Splunk security products from Matthias Maier, Product Marketing Director for Security at Splunk. The presentation covers trends in security operations like the evolution of SOCs, new security roles, and data-centric security approaches. It also provides updates on Splunk's security portfolio including recognition as a leader in SIEM by Gartner and growth in the SIEM market. Maier highlights some breakout sessions from the conference on topics like asset defense, machine learning, and building detections.
Getting Started with Splunk Enterprise
Splunk Enterprise is a software platform for searching, monitoring, and analyzing machine-generated big data, such as logs, metrics, and mobile data. The presentation provided an overview of Splunk Enterprise capabilities including: live demonstrations of installing Splunk, searching data, creating dashboards and alerts. It also covered Splunk deployment architectures for scaling from single instances to distributed environments supporting hundreds of terabytes per day.
Getting Started with Splunk Enterprise
This document provides an overview and demonstration of Splunk Enterprise. It discusses Splunk's capabilities for indexing, searching, and analyzing machine data from various sources. The live demonstration shows how to install Splunk, import sample data, perform searches, create dashboards and alerts. It also covers Splunk's deployment architecture and scalability options. Attendees are encouraged to ask questions on Splunk's online communities and support channels.
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
This document summarizes a presentation on leveraging big data in cybersecurity. It discusses how current security challenges include breaches occurring within minutes while most go undiscovered for months or years. Inside-out security is proposed to detect both known and unknown threats using deep endpoint visibility and activity correlation. This allows proactive detection, assessment of sensitive data and risks, automated incident response, and recovery to reduce breach discovery times.
SplunkLive! Paris 2016 - Plenary session
Splunk provides a platform for operational intelligence that allows users to analyze machine data from any source. The document discusses Splunk products and solutions for IT service management, security intelligence, and Internet of Things applications. Splunk has over 11,000 customers across various industries.
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk User Behavior Analytics (UBA) 2.2 provides enhanced security analytics and detection capabilities. It uses machine learning to establish baseline behaviors and detect anomalies. UBA analyzes activities across users, hosts, networks, applications and data to identify potential threats. The latest version features expanded visibility metrics, custom threat modeling capabilities, and improved context enrichment through integrations with additional security technologies.
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
We’ll be exploring some of the more advanced capabilities of Phantom and also discussing the security framework from MITRE “ATT&CK” and it’s valued use when integrating it with Splunk Enterprise! We’ll also have two SplunkTrust members available for some general Q&A in our own ‘Meet the Experts’.
- Splunk Phantom Workbook Automation - SOAR (Security Orchestration, Automation & Response)
-- Tom Wise (Phantom Security Solutions Engineer & Trainer)
- Threat Hunting, Or: How I Learned to Stop Worrying & Love ATT&CK
-- Cian Heasley / Fraser Dumayne (Security Engineers)
- Meet the Experts with SplunkTrust
-- Harry McLaren (Senior Splunk Consultant)
-- Tom Wise (Splunk Consultant, Phantom Security Solutions Engineer & Trainer)
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
This document provides an agenda and summaries for a Splunk User Group meeting in Edinburgh in April 2017. The meeting will include presentations and demos on building Splunk apps, development paths and certification, and Splunk User Behavior Analytics. The introductory presentation will be given by Harry McLaren from ECS and will provide background on ECS and the Splunk User Group. Additional presentations will cover building custom Splunk apps using both the web interface and direct XML editing, and paths for Splunk certification. The final presentation will demo Splunk UBA for detecting insider threats and advanced adversaries. Attendees are encouraged to discuss in-house developed apps and get involved in the Splunk community.
Getting Started with Splunk Breakout Session
Splunk is a software platform that allows users to search, monitor, and analyze machine-generated big data via a web-style interface. It collects and indexes data from various sources like servers, networks, sensors, and applications. Splunk is used by over 9,000 customers across various industries for security intelligence, IT operations, and business analytics. It offers role-based access controls, multi-tenancy, and secure data transmission. Splunk components include universal forwarders for data collection, indexers for data storage, and search heads for data presentation.
Taking Splunk to the Next Level - Manager
Splunk can help customers document business value by providing deliverables like business cases, value realization studies, and adoption roadmaps. It has helped over 700 customers worldwide since 2013. Key value drivers reported by customers include IT operations, application delivery, security, and compliance. Common challenges to documenting value include lack of tools, benchmarks, and time. The document outlines best practices for positioning value at Splunk, including quantifying business value, qualifying pain points, aligning with objectives, and measuring success. It provides examples of value drivers achieved in areas like infrastructure optimization, revenue growth, and risk reduction.
WhiteSource Webinar-New Research Reveals Key Strategy to Manage Open Source S...
In our joint webinar with 451 Research, we discussed the key strategies to manage your open source security
Taking Splunk to the Next Level - Manager
This document provides an overview of how Splunk can help customers document business value. It discusses key value drivers in IT operations, application delivery, and security and compliance. It also outlines best practices for positioning value, including aligning with objectives, qualifying pain points, and quantifying business value. Common data sources, use cases, and benchmarks from over 700 customer engagements are presented for each value area.
Similar to stoQing your Splunk (20)
Splunk Enterprise for InfoSec Hands-On Breakout Session
Splunk Enterprise for InfoSec Hands-On Breakout Session
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk for Enterprise Security featuring UBA Breakout Session
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk for Enterprise Security featuring UBA Breakout Session
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
WhiteSource Webinar-New Research Reveals Key Strategy to Manage Open Source S...
WhiteSource Webinar-New Research Reveals Key Strategy to Manage Open Source S...
More from Ryan Kovar
The Hidden Empires of Malware with TLS Certified Hypotheses and Machine Learning
The “threat hunting” landscape has drastically changed due to the increase in encrypted transport layer security (TLS) Internet traffic. The days of adversaries registering domains with their given names are gone, and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered tactics, techniques, and procedures, adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks. This talk focuses on expanding on techniques that have been researched and presented at various conferences by Mark Parsons, and specifically on his methods for using TLS certificates to find malicious malware infrastructure. We will build on Parsons’ body of work and show how his approach to malware certificate hunting can be expanded to detect instances of PowerShell Empire servers that have self-generated SSL certifications on port 443 and 8080. These certificates have a unique fingerprint that can be detected by leveraging tools like zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future. Finally, we will discuss our creation of hypotheses, codes and techniques, and methods of validation for verification. We’ll then release our tools and methodology for use by the community to explore other potential “hidden empires” of malware
Hidden empires of malware
The landscape of "threat hunting" has drastically changed due to the increase in TLS encrypted Internet traffic. The days of adversaries registering domains with their given names are gone and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered TTPs, the adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks.
Our talk focuses on expanding upon techniques that have been researched and presented on at various conferences by Mark Parsons, specifically, his methods for using TLS certificates to find malicious malware infrastructure. We will build upon Parsons' corpus of work and show how his approach to malware certificate hunting can be expanded upon to detect instances of PowerShell Empire servers that have self-generated SSL certs on port 443 and 8080. These certificates have a unique finger print that can be detected by leveraging tools like zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future. Finally, we will discuss our hypotheses creation, our code and techniques, methods of validation for verification, and release our tools and methodology for use by the community to explore other "hidden empires" of malware that may exist.
10(?) holiday gifts for the SOC who has everything
Automating your organization’s security operations is no longer optional. It’s essential. Increasing analyst productivity and decreasing response time can mean the difference between successfully containing an attack, and suffering a devastating breach. This talk will focus on
ten practical automation techniques—each implemented in either Python or PowerShell—
that extend the functionality of a popular commercial SIEM. Each technique will demonstrate how to automatically gather additional context on an alert, make configuration changes in an operational environment, or retrieve and analyze forensic evidence. Proof of concept code samples and live/recorded demonstrations will be provided.
SOCs for the rest of us
In this talk we will discuss key traits of some of the largest and most successful security operations centers we’ve visited over the last two years. From automating tier-1 to integrating investigations into Slack channels, from curating toolchains to cutting out threat feeds, we’ll cover what’s working well and what challenges remain. Many industry verticals will be represented including financial services, multi-national conglomerates, entertainment, healthcare, energy, defense, technology, and dynamic internet startups.
How to be employed at the SOC of tomorrow... today.
For years’ information security professionals have become used to 0% unemployment. However, machine learning is beginning to radically change the information security landscape. How do we deal with these upcoming shifts in technologies and skillsets? This talk focuses on what those changes are and how employees and employers can prepare for the SOC of tomorrow.
Threat Intelligence Victory Garden
- The document discusses threat intelligence and provides an agenda for the presentation. It includes a disclaimer stating that any statements about future plans are subject to change and the names and examples are fictional.
- The presentation covers an overview of threat intelligence, why it's important, what threat intelligence is, how to implement it, and concludes with examples of done.
- The document contains instructions and suggestions for how to leverage internal security awareness data, decoy documents, passive DNS, and other free threat intelligence sources to build your own threat intelligence program.
More from Ryan Kovar (6)
The Hidden Empires of Malware with TLS Certified Hypotheses and Machine Learning
The Hidden Empires of Malware with TLS Certified Hypotheses and Machine Learning
10(?) holiday gifts for the SOC who has everything
10(?) holiday gifts for the SOC who has everything
How to be employed at the SOC of tomorrow... today.
How to be employed at the SOC of tomorrow... today.
Recently uploaded
Boost Your Savings with These Money Management Apps
A money management app can transform your financial life by tracking expenses, creating budgets, and setting financial goals. These apps offer features like real-time expense tracking, bill reminders, and personalized insights to help you save and manage money effectively. With a user-friendly interface, they simplify financial planning, making it easier to stay on top of your finances and achieve long-term financial stability.
🏎️Tech Transformation: DevOps Insights from the Experts 👩💻
Connect with fellow Trailblazers, learn from industry experts Glenda Thomson (Salesforce, Principal Technical Architect) and Will Dinn (Judo Bank, Salesforce Development Lead), and discover how to harness DevOps tools with Salesforce.
Orca: Nocode Graphical Editor for Container Orchestration
Tool demo on CEDI/SISTEDES/JISBD2024 at A Coruña, Spain. 2024.06.18
"Orca: Nocode Graphical Editor for Container Orchestration"
by Pedro J. Molina PhD. from Metadev
Modelling Up - DDDEurope 2024 - Amsterdam
What to do when you have a perfect model for your software but you are constrained by an imperfect business model?
This talk explores the challenges of bringing modelling rigour to the business and strategy levels, and talking to your non-technical counterparts in the process.
Voxxed Days Trieste 2024 - Unleashing the Power of Vector Search and Semantic...
Vector databases are redefining data handling, enabling semantic searches across text, images, and audio encoded as vectors.
Redis OM for Java simplifies this innovative approach, making it accessible even for those new to vector data.
This presentation explores the cutting-edge features of vector search and semantic caching in Java, highlighting the Redis OM library through a demonstration application.
Redis OM has evolved to embrace the transformative world of vector database technology, now supporting Redis vector search and seamless integration with OpenAI, Hugging Face, LangChain, and LlamaIndex. This talk highlights the latest advancements in Redis OM, focusing on how it simplifies the complex process of vector indexing, data modeling, and querying for AI-powered applications. We will explore the new capabilities of Redis OM, including intuitive vector search interfaces and semantic caching, which reduce the overhead of large language model (LLM) calls.
ppt on the brain chip neuralink.pptx
A neural network is a machine learning program, or model, that makes decisions in a manner similar to the human brain, by using processes that mimic the way biological neurons work together to identify phenomena, weigh options and arrive at conclusions.
How Can Hiring A Mobile App Development Company Help Your Business Grow?
ToXSL Technologies is an award-winning Mobile App Development Company in Dubai that helps businesses reshape their digital possibilities with custom app services. As a top app development company in Dubai, we offer highly engaging iOS & Android app solutions. https://rb.gy/necdnt
What is Continuous Testing in DevOps - A Definitive Guide.pdf
Once an overlooked aspect, continuous testing has become indispensable for enterprises striving to accelerate application delivery and reduce business impacts. According to a Statista report, 31.3% of global enterprises have embraced continuous integration and deployment within their DevOps, signaling a pervasive trend toward hastening release cycles.
Going AOT: Everything you need to know about GraalVM for Java applications
Going AOT: Everything you need to know about GraalVM for Java applications
42 Ways to Generate Real Estate Leads - Sellxpert
Generate hot real estate leads with these simple strategies. 42 innovative ways to attract clients in the real estate industry.
一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理
UMN硕士毕业证成绩单【微信95270640】购买（明尼苏达大学毕业证成绩单硕士学历）Q微信95270640代办UMN学历认证留信网伪造明尼苏达大学学位证书精仿明尼苏达大学本科/硕士文凭证书补办明尼苏达大学 diplomaoffer,Transcript购买明尼苏达大学毕业证成绩单购买UMN假毕业证学位证书购买伪造明尼苏达大学文凭证书学位证书,专业办理雅思、托福成绩单，学生ID卡，在读证明，海外各大学offer录取通知书，毕业证书，成绩单，文凭等材料:1:1完美还原毕业证、offer录取通知书、学生卡等各种在读或毕业材料的防伪工艺（包括 烫金、烫银、钢印、底纹、凹凸版、水印、防伪光标、热敏防伪、文字图案浮雕，激光镭射，紫外荧光，温感光标）学校原版上有的工艺我们一样不会少，不论是老版本还是最新版本，都能保证最高程度还原，力争完美以求让所有同学都能享受到完美的品质服务。
#毕业证成绩单 #毕业証 #成绩单 #學生卡 #OFFER录取通知书 #雅思#托福等……
国外大学明尼苏达大学明尼苏达大学毕业证offer制作方法（一对一专业服务）
1客户提供办理信息：姓名生日专业学位毕业时间等（如信息不确定可以咨询顾问：我们有专业老师帮你查询）；
2开始安排制作毕业证成绩单电子图；
3毕业证成绩单电子版做好以后发送给您确认；
4毕业证成绩单电子版您确认信息无误之后安排制作成品；
5成品做好拍照或者视频给您确认；
6快递给客户（国内顺丰国外DHLUPS等快读邮寄）
— — 制作工艺 【高仿真】— —
凭借多年的制作经验本公司制作明尼苏达大学明尼苏达大学毕业证offer《激光》《水印》《钢印》《烫金》《紫外线》凹凸版uv版等防伪技术一流高精仿度几乎跟学校100%相同！让您绝对满意。
— — -公司理念 【诚信为主】— — —
我們以質量求生存.以服务求发展有雄厚的实力专业的团队咨询顾问为您细心解答可详谈是真是假眼见为实让您真正放心平凡人生,尽我所能助您一臂之力让我們携手圆您梦想!
此贴长年有效【贴心专线/微-信: 95270640】敬请保留此联系方式以备用！如有不在线请给我们留言！我们将在第一时间给您回复!上散发着一抹抹的光晕而这每处自然形成的细节融合在一起浑然天成的美实在令人心生愉悦小道的周边无秩序的生长着几株艳丽的野花红的粉的紫的虽混乱无章却给这幅美景更增添一份性感夹杂着一份纯洁的妖娆毫无违和感实在给人带来一份悠然幸福的心情如果说现在的审美已经断然拒绝了无声的话那么在树林间飞掠而过的小鸟叽叽咋咋的叫声是否就是这最后的点睛之笔悠然走在林间的小路上宁静与清香一丝丝的盛夏气息吸入身体昔日生活里的繁忙多
ACE - Team 24 Wrapup event at ahmedabad.
Atlassian Team 24 event wrap-up Ahmedabad. Recap of Atlassian team24 event.
如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样
原版定制【微信:bwp0011】《(hull学位证书)英国赫尔大学毕业证硕士文凭》【微信:bwp0011】成绩单 、雅思、外壳、留信学历认证永久存档查询，采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
【业务选择办理准则】
一、工作未确定，回国需先给父母、亲戚朋友看下文凭的情况，办理一份就读学校的毕业证【微信bwp0011】文凭即可
二、回国进私企、外企、自己做生意的情况，这些单位是不查询毕业证真伪的，而且国内没有渠道去查询国外文凭的真假，也不需要提供真实教育部认证。鉴于此，办理一份毕业证【微信bwp0011】即可
三、进国企，银行，事业单位，考公务员等等，这些单位是必需要提供真实教育部认证的，办理教育部认证所需资料众多且烦琐，所有材料您都必须提供原件，我们凭借丰富的经验，快捷的绿色通道帮您快速整合材料，让您少走弯路。
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
【关于价格问题（保证一手价格）】
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
Manyata Tech Park Bangalore_ Infrastructure, Facilities and More
Located in the bustling city of Bangalore, Manyata Tech Park stands as one of India’s largest and most prominent tech parks, playing a pivotal role in shaping the city’s reputation as the Silicon Valley of India. Established to cater to the burgeoning IT and technology sectors
How GenAI Can Improve Supplier Performance Management.pdf
Data Collection and Analysis with GenAI enables organizations to gather, analyze, and visualize vast amounts of supplier data, identifying key performance indicators and trends. Predictive analytics forecast future supplier performance, mitigating risks and seizing opportunities. Supplier segmentation allows for tailored management strategies, optimizing resource allocation. Automated scorecards and reporting provide real-time insights, enhancing transparency and tracking progress. Collaboration is fostered through GenAI-powered platforms, driving continuous improvement. NLP analyzes unstructured feedback, uncovering deeper insights into supplier relationships. Simulation and scenario planning tools anticipate supply chain disruptions, supporting informed decision-making. Integration with existing systems enhances data accuracy and consistency. McKinsey estimates GenAI could deliver $2.6 trillion to $4.4 trillion in economic benefits annually across industries, revolutionizing procurement processes and delivering significant ROI.
Upturn India Technologies - Web development company in Nashik
Nashik's top web development company, Upturn India Technologies, crafts innovative digital solutions for your success. Partner with us and achieve your goals
14 th Edition of International conference on computer vision
About the event
14th Edition of International conference on computer vision
Computer conferences organized by ScienceFather group. ScienceFather takes the privilege to invite speakers participants students delegates and exhibitors from across the globe to its International Conference on computer conferences to be held in the Various Beautiful cites of the world. computer conferences are a discussion of common Inventions-related issues and additionally trade information share proof thoughts and insight into advanced developments in the science inventions service system. New technology may create many materials and devices with a vast range of applications such as in Science medicine electronics biomaterials energy production and consumer products.
Nomination are Open!! Don't Miss it
Visit: computer.scifat.com
Award Nomination: https://x-i.me/ishnom
Conference Submission: https://x-i.me/anicon
For Enquiry: Computer@scifat.com
TMU毕业证书精仿办理
多伦多都会大学毕业证成绩单(留信网认证)【176555708微信】不能毕业办理假文凭回国找工作
【多伦多都会大学毕业证成绩单仿制】（176555708微信☀️）伪造研究生学位证书TMU毕业证文凭,多伦多都会大学文凭证书学籍信息入库,多伦多都会大学学位证书留学高校学位证书补办
【TMU毕业证【微信176555708】多伦多都会大学文凭学历】【微信176555708】【多伦多都会大学文凭学历证书】【多伦多都会大学毕业证书与成绩单样本图片】毕业证书补办 Fake Degree做学费单【毕业证明信-推荐信】成绩单，录取通知书，Offer，在读证明，雅思托福成绩单，真实大使馆教育部认证，回国人员证明，留信网认证。网上存档永久可查！
Enhanced Screen Flows UI/UX using SLDS with Tom Kitt
Join us for an engaging session led by Flow Champion, Tom Kitt. This session will dive into a technique of enhancing the user interfaces and user experiences within Screen Flows using the Salesforce Lightning Design System (SLDS). This technique uses Native functionality, with No Apex Code, No Custom Components and No Managed Packages required.
Recently uploaded (20)
Boost Your Savings with These Money Management Apps
Boost Your Savings with These Money Management Apps
🏎️Tech Transformation: DevOps Insights from the Experts 👩💻
🏎️Tech Transformation: DevOps Insights from the Experts 👩💻
Orca: Nocode Graphical Editor for Container Orchestration
Orca: Nocode Graphical Editor for Container Orchestration
Voxxed Days Trieste 2024 - Unleashing the Power of Vector Search and Semantic...
Voxxed Days Trieste 2024 - Unleashing the Power of Vector Search and Semantic...
How Can Hiring A Mobile App Development Company Help Your Business Grow?
How Can Hiring A Mobile App Development Company Help Your Business Grow?
What is Continuous Testing in DevOps - A Definitive Guide.pdf
What is Continuous Testing in DevOps - A Definitive Guide.pdf
Migration From CH 1.0 to CH 2.0 and Mule 4.6 & Java 17 Upgrade.pptx
Migration From CH 1.0 to CH 2.0 and Mule 4.6 & Java 17 Upgrade.pptx
Going AOT: Everything you need to know about GraalVM for Java applications
Going AOT: Everything you need to know about GraalVM for Java applications
Manyata Tech Park Bangalore_ Infrastructure, Facilities and More
Manyata Tech Park Bangalore_ Infrastructure, Facilities and More
How GenAI Can Improve Supplier Performance Management.pdf
How GenAI Can Improve Supplier Performance Management.pdf
Upturn India Technologies - Web development company in Nashik
Upturn India Technologies - Web development company in Nashik
14 th Edition of International conference on computer vision
14 th Edition of International conference on computer vision
Enhanced Screen Flows UI/UX using SLDS with Tom Kitt
Enhanced Screen Flows UI/UX using SLDS with Tom Kitt
stoQing your Splunk
- 1. stoQ’ing your Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016
- 2. Ryan Kovar • Staff Security Strategist @Splunk • Does Security things and then talks about them • 17+ years defending networks private sector Marcus LaFerrera • Director of Development @PUNCH • Lead stoQ Developer • 18+ years supporting the government
- 3. Agenda • Overview of stoQ • Overview of Splunk • A DFIR use case walk through • Questions
- 4. TOOL * N == :( NOTHING COMMUNICATES " AND MOST TOOLS REQUIRE MANUAL INTERACTION"
- 5. HOW’S THE WEATHER OUT THERE OLLIE? IT’S CYBER
- 6. stoQ
- 7. STOQ IS A FRAMEWORK THAT ENABLES EVERYONE TO AUTOMATE PROCESSES, ANALYTICS, AND JUST ABOUT ANYTHING ELSE
- 8. AUTOMATE AND REDUCE THE MAJORITY OF YOUR MOST MUNDANE ANALYTIC TASKS
- 9. LEVERAGE ALL OF YOUR TOOLS SIMULTANEOUSLY, AND SAVE THOSE RESULTS FOR LATER
- 10. IT’S A FORCE MULTIPLIER
- 11. LOOK AT YOUR DATA, RATHER THAN SEEKING WAYS TO CAPTURE OR PRODUCE IT
- 12. COMMAND LINE, INTERACTIVE SHELL, OR FULLY AUTOMATED
- 13. EVERYTHING IS A PLUGIN, FROM INPUT TO OUTPUT AND EVERYTHING IN BETWEEN
- 14. Tell me more about Plugins… • Very simple and easy to write • Lots of documentation and examples • stoQ does most of the heavy lifting
- 15. Over 40 stoQ Plugins Available • E-mail Parser • VTMIS • TotalHash • Yara • Censys • Fireeye • IOC Extract • Pastebin • PassiveTotal • ClamAV • Opswat • TRiD • RabbitMQ • Suricata • Tika • PEinfo • Excel • XOR • Base64 • Bit RotaKon • Bro Intel • Fluentd • Google Cloud Storage • Amazon S3 • Slack • ThreatCrowd • MongoDB • ElasKcSearch • Exif • And many more…
- 16. IT’S OPENSOURCED
- 21. Monitor & Alert Search & InvesCgate Custom Dashboards & Reports AnalyCcs & VisualizaCon Meets Key Needs of SOC Personnel Splunk Can Ingest ALL THE DATA Real-Cme Machine Data Cloud Apps Servers Email Web Network Flows DHCP/ DNS Custom Apps Badges Intrusion DetecKon Firewall Data Loss PrevenKon AnK-Malware Vulnerability Scans AuthenKcaKon Storage Industrial Control Mobile Security Intelligence PlaOorm Threat Feeds Asset Info Employee Info Data Stores Network Segments External Lookups / Enrichment
- 22. Then Build Security Dashboards Incident InvesCgaCons & Management Dashboards and Reports StaCsCcal Outliers Asset and IdenCty Aware 22
- 24. The Splunk App for stoQ
- 25. THE STOQ DFIR APP FOR SPLUNK! • ALLOWS YOU TO VISUALIZE STOQ RESULTS • MAKE CONNECTIONS THAT WERE DIFFICULT TO SEE BEFORE • QUICKLY PIVOT TO NEW DATA SOURCES • APPLY THREAT INTELLIGENCE TO STOQ DATA
- 26. A DFIR Scenario
- 27. You are an analyst at a Fortune 100 company
- 28. A user reports an email with a suspicious attachment
- 29. We need to quickly identify if the file is good or bad
- 37. WHERE DO I GET ALL OF THIS INCREDIBLENESS??? https://splunkbase.splunk.com/app/3196/ http://stoq.punchcyber.com