Security Jiujitsu
conf2015_DVeuve_Splunk_SecurityCompliance_SecurityJiujitsuBuildingCorrelation
conf2015_DVeuve_Splunk_SecurityCompliance_SecurityJiujitsuBuildingCorrelation
- No tags were found...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Privileged User Monitoring <br />
1. Start by detecEng something bad <br />
2. Focus on highly visible or highly privileged users. <br />
Visibility: AuthenEcaEon Data Model (OR auth events) <br />
Analysis: stats + lookup + eval <br />
AcEon: CreaEng notable with appropriate severity and risk <br />
30