Recommended
More Related Content
What's hot
What's hot (20)
Similar to Threat hunting with Elastic APM
Similar to Threat hunting with Elastic APM (20)
More from FaithWestdorp
More from FaithWestdorp (18)
Recently uploaded
Recently uploaded (20)
Threat hunting with Elastic APM
- 1. Threat Hunting with APM Search. Observe. Protect. Ruben Perez (Sr. Solutions Architect @ Elastic) May 28, 2020 sled@elastic.co
- 2. Distributed Workforce, the New Norm
- 3. - Monitor software services and applications in real time to make it easier to pinpoint and remedy performance problems, quickly. - Automatically collect unhandled errors and exceptions. - Automatically retrieve basic host-level and agent specific metrics. Application Performance Monitoring
- 4. Elastic Enterprise Search Elastic SecurityElastic Observability Kibana Elasticsearch Beats Logstash 3 solutions powered by 1 stack Elastic Stack
- 5. Business Deployment Abstract Applications VMs/Containers Other DBs, Services & Middleware Orchestration InfrastructureAPM Metrics Logs Uptime Uptime APM Metrics APM Logs APM APM Metrics Logs Uptime Metrics Logs Uptime APM
- 7. Combine autonomous monitoring with alerts of unknown & defined events. Correlate ML & Watcher with APM view from same screen Reduces the need to toggle between tabs to generate ML jobs or Watcher alerts on events of APM monitored services. Apply APM metadata as filters in different solution views The Elastic solutions all have a variant view of the dataset, but can share APM metadata as filters to cull the view Event Detection
- 8. Decrease MTTR by sequencing ML and APM analysis APM service(s) driving anomalous event(s) Observe how ML triggered events are influenced by APM services. Analyze in ML & APM views ML anomalies can contain a hyperlink to the APM analysis view of the service(s) that influenced the event. ML + APM Analysis
- 9. Server & service information can assist in securing the network APM Server information can be shared in SIEM Leveraging the same dataset as APM, SIEM can be used to track and identify potential threats to the business Tagging can help reduce MTTR APM data can be tagged for use in the various Elastic solutions, especially SIEM, as a filtration mechanism Highlight unexpected processes Rogue processes or unauthorized access requests can be quickly identified with APM & SIEM monitoring Threat Hunting with APM
- 10. APM data can be used by SIEM to perform signal detections Customize signal detection rules for APM data Apply target influencer(s) of the signal detection leveraging APM metadata Select any MITRE attack models to apply to the signal rule Each MITRE attack model has collection techniques that can be applied Schedule the signal for continued threat hunting Flexibility to select signal detection frequency APM Driven Threat Hunting https://www.elastic.co/campaigns/mitre-attack
- 11. Show Me Something Search. Observe. Protect.
- 12. SLED Virtual Group ● Are you interested in learning more about Elastic? ● Do you want to represent your community at the next Elastic Virtual Group? ● Come check out your opportunity to be a leader and have your voice heard: ○ https://community.elastic.co/state-and-local-government-and- education-sled-virtual/ At our next Virtual Group, led by Jenny Morris, we will be learning more about how to Leverage Elastic machine learning features to enhance your security posture.
- 13. Training Subscriptions Annual pass Year-round learning solution for a named user Training on the go Flexible options include live, virtual and On-Demand training Immersive learning Hands-on, solution-based training Extensive curriculum Classes span the Elastic Stack with new content added regularly Explore all benefits
- 14. Elastic Use Cases Elastic Enterprise Search Elastic SecurityElastic Observability https://www.elastic.co/customers/
- 15. Elastic is a Search Company. www.elastic.co Thank you, any questions? Search. Observe. Protect.