Security Jiujitsu

More documents

Recommendations

Info

Privileged User Monitoring 1. Start by detecEng something bad 2. Focus on highly visible or highly privileged users. Visibility: AuthenEcaEon Data Model (OR auth events) Analysis: stats + lookup + eval AcEon: CreaEng notable with appropriate severity and risk 30
Visibility AuthenEcaEon Data Model – could be any auth data you wish, but the auth data model is available to everyone (even if you don’t have ES) and gives us a common language to speak 31
Page 1 and 2: Copyright © 2015 Splunk Inc.
Page 3 and 4: Personal IntroducEon David Veuve
Page 5 and 6: For Each Scenario • Focus on
Page 7 and 8: Who Are You? 1. Security Engine
Page 9 and 10: Security CorrelaEon In Splunk
Page 11 and 12: Splunk CorrelaEon Rules Easy in
Page 13 and 14: Visibility, Analysis, AND AcEon
Page 15 and 16: CorrelaEon Across MulEple Source
Page 17 and 18: Search Example Raw Search 71 S
Page 19 and 20: Techniques - Expand Base Search
Page 21 and 22: Techniques - The Other Stats S
Page 23 and 24: Techniques - Higher Confidence
Page 25 and 26: How Does it Scale? Tstats vers
Page 27 and 28: About Endpoint Logs Curious abo
Page 29: Privileged User Monitoring
Page 33 and 34: Analysis Alert when users who
Page 35 and 36: Analysis - Part Two -‐ Exa
Page 37 and 38: Analysis - Part Three (ES Spec
Page 39 and 40: Conquering Alert FaEgue
Page 41 and 42: Visibility A typical Eer one a
Page 43 and 44: Analysis Technique - StaEsEcal
Page 45 and 46: Analysis Technique - StaEsEcal
Page 47 and 48: Analysis Technique - Combine Mu
Page 49 and 50: Analysis Techniques - Machine L
Page 51 and 52: Threat Feeds
Page 53 and 54: Great Threat Feed Tools Enterpr
Page 55 and 56: But That’s Not all for Threa
Page 57 and 58: We Looked at a Lot of Things
Page 59 and 60: Give Me Feedback! Rate it in
Page 61 and 62: Appendix Network HunEng
Page 63 and 64: Techniques -‐ Frequency Unde
Page 65 and 66: Techniques -‐ Coherence Cohe
Page 67: Analysis | tstats prestats=t su

Security Jiujitsu

Create successful ePaper yourself

Delete template?

Save as template?