SlideShare a Scribd company logo

A Risk Based Approach to Security Detection and Investigation by Kelby Shelton

J
John Billings CISSP

The document outlines a risk-based approach to security detection and investigation, highlighting challenges faced by organizations in handling security alerts and proposing solutions to improve efficiency and accuracy. It details the implementation of a risk index and correlation searches to better attribute risk to assets and identities, ultimately enhancing the detection of security threats. Customer testimonials indicate significant improvements in detection rates and operational efficiency after adopting this approach.

Technology
1 of 38
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
© 2020 SPLUNK INC. A Risk Based Approach to Security Detection and Investigation April 2020 Kelby Shelton - Consulting Solutions Engineer kelbys@splunk.com
During the course of this presentation, we may make forward‐looking statements regarding future events or plans of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results may differ materially. The forward-looking statements made in the this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, it may not contain current or accurate information. We do not assume any obligation to update any forward‐looking statements made herein. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionalities described or to include any such feature or functionality in a future release. Splunk, Splunk>, Data-to-Everything, D2E and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names or trademarks belong to their respective owners. © 2020 Splunk Inc. All rights reserved Forward- Looking Statements © 2020 SPLUNK INC.
© 2020 SPLUNK INC. Agenda 1) Define the Problem 2) Define the Solution 3) RBA In Action 4) Customer Success 5) Road to Adoption Text Placeholders: See slide 46 for more information on how to format multiple levels of text.
© 2020 SPLUNK INC. Define the Problem
© 2020 SPLUNK INC. Correlation Searches Notable Queue Typical Enterprise Security Strategy ● Vendor Alert: Anomalous Login ● Malware Detection ● Suspicious Powershell ● Low: Anomalous Login ● Critical: Malware Detection ● High: Suspicious Powershell
© 2020 SPLUNK INC.
© 2020 SPLUNK INC. What about these? ML/AI EDR UBA NDR Palo Cisco AWS Microsoft
© 2020 SPLUNK INC. Manual Correlation Visibility Gaps Requires Many Analysts High Noise Huge Whitelists Slow time to deploy new use-cases
© 2020 SPLUNK INC. The Ideal Solution Decrease tuning time Deploy use-cases faster Scaleable with Analysts Improved Fidelity Built-in Correlation Standard Framework A better strategy
© 2020 SPLUNK INC. Define the Solution
© 2020 SPLUNK INC. A New Enriched Data Set Security Datasets Correlation Searches Risk Index
© 2020 SPLUNK INC. Risk Index Filled with security related data A New Kind of Notable Raw Logs Azure ATP NDREDR Accelerated Data Models
© 2020 SPLUNK INC. Align Correlation Searches to MITRE Attribute Risk to Assets and/or Identities The Risk Based Approach Send to Risk Index Step 1 Step 2 Step 3 Alert on Anomalies Step 4
© 2020 SPLUNK INC. RBA in Action
© 2020 SPLUNK INC. Align Correlation Search to Mitre Excessive Failed Logins | from datamodel:"Authentication"."Failed_Authentication" | stats values(tag) as "tag",dc(user) as "user_count",dc(dest) as "dest_count",count by "app","src" | where 'count'>=6 Step 1
© 2020 SPLUNK INC. Do Your Research - MITRE TACTIC - Brute Force Also opens up new possibilities T1003 - Credential Dumping T1075 - Pass the Hash T1110 - Password Spraying
© 2020 SPLUNK INC. Align Correlation Search to Mitre Map it to Mitre | eval mitre_id="T1110" Appending multiple (optional): | eval mitre_id=mvappend("T1110","T1003") ...continued
© 2020 SPLUNK INC. Attribute Risk to Asset or Identity Risk Framework accepts a “risk_object” of type “system”,”user”,”other” | eval risk_object=src, risk_object_type="system" | appendpipe [| eval risk_object=user, risk_object_type="user"] Add an analyst message | eval risk_message=count." authentication failures from ".user_count." unique users originating from "".risk_object Attribution
© 2020 SPLUNK INC. Attribute Risk to Asset or Identity Static | eval risk_score=30 Dynamic (using a lookup and an equation) | eval risk_score = <score> * ( <risk_object_priority> * 0.25) + 1 ) *Where <score> is a number 0-100 and <risk_object_priority> is a number 0-4 Scoring
© 2020 SPLUNK INC. Send to Risk Index Pros ● Supports Throttling Cons ● Must be blank to support multiple risk objects | sendalert risk Pros ● Easy to understand ● Supports multiple risk objects Cons ● No throttling ● Requires non-overlapping searches (example: earliest=1h@h latest=@h | collect index=risk Pros ● Simplest ● Easy to understand ● Supports multiple risk objects Cons ● No throttling ● Requires non-overlapping searches (example: earliest=1h@h latest=@h Three Methods
© 2020 SPLUNK INC. Put It Together | from datamodel:"Authentication"."Failed_Authentication" | stats values(tag) as "tag",dc(user) as "user_count",dc(dest) as "dest_count",count by "app","src" | where 'count'>=6 | eval risk_object=src, risk_object_type="system" | eval risk_message=count." authentication failures from ".user_count." unique users from "".risk_object | sendalert risk param._risk_score=50
© 2020 SPLUNK INC. John Doe - Suspicious Email: 25 Jane Smith - Possible C2 Traffic: 30 WORKSTATION1 - Anomalous Login: 35 John Doe - Malware Detection: 50 DC1 - Malware Detection: 125 Jane Smith - Suspicious Email: 25 WORKSTATION1 - Suspicious Powershell: 70 Jane Smith - Suspicious Powershell: 55 | from datamodel:Risk | stats sum(risk_score) as total values(*) as * by risk_object | where total>100 Alert on Anomalies A change on perspective Risk Index RiskNotable - Greater than 100 within 24 hours
© 2020 SPLUNK INC. Alert on Anomalies ...continued Jane Smith WORKSTATION1 DC1 ● Jane Smith received a suspicious email from phishy.com ● Suspicious powershell executed on Jane Smith’s computer ● Possible C2 Traffic from Jane Smith’s computer to abcdefghi1234.ru ● Suspicious powershell executed on WORKSTATION1 ● Multiple login failures on WORKSTATION1 ● Malware Detection Total Risk Score: 110 Total Risk Score: 105 Total Risk Score: 125
© 2020 SPLUNK INC. Demo Environment 1) FruitFly Mac Malware 2) Advanced Persistent Threat Two Scenarios
© 2020 SPLUNK INC. Customer Success
© 2020 SPLUNK INC. “RBA has changed how we fundamentally operate, raising visibility into the cumulative risk related to behaviors and allowing us to focus on the most impactful events” Brandon Cass Cyber Defense Operations Manager Texas Instruments
© 2020 SPLUNK INC. “As an early contributor of the RBA process and as a Threat Hunter in a mid-sized enterprise, we increased our detections by 300%, reduced our security alerts by 50%, aligned with MITRE ATT&CK, and achieved a 60% true positive rate in the SOC in less than a year without increasing the size of the security team by leveraging a risk based approach” Stuart McIntosh CTO Outpost Security
© 2020 SPLUNK INC. “Before implementing RBA, we saw a 7.07% True Positive Rate. In quarter two of 2019 we were able to maintain a 33% True Positive Rate using the RBA system while also onboarding 29 new correlation searches. RBA has empowered our small security operations team to scale with evolving threats.” Cybersecurity Incident Response Team Children’s Mercy
© 2020 SPLUNK INC. Road to Adoption
© 2020 SPLUNK INC. Resources SANS SIEM Summit SANS Content: We Need to Talk about the Elephant in the SOC Splunk .Conf 2018 SEC 1479 - Say Goodbye to Your big Alert Pipeline , and Say Hello to Your New Risk-Based Approach Splunk .Conf 2019 SEC 1556 – Building Behavioral Detections: Cross-Correlating Suspicious Activity with the MITRE ATT&CK Framework SEC 1803 – Modernize and Mature Your SOC with Risk-Based Alerting SEC 1538 - Getting started with Risk-Based Alerting and MITRE SEC 1908 – Tales from a Threat Team: Lessons and Strategies for Succeeding with a Risk-Based Approach Talks and Presentations
© 2020 SPLUNK INC. RBA App https://github.com/apger/ SA-RBA
© 2020 SPLUNK INC. Risk Rule Home Dashboard
© 2020 SPLUNK INC. Risk Adoption Timeline Key Milestones Start First RR Home Dash First RN Full RBA Typical Alerting Add Mitre Convert Multiple RR Continue Convert RR All RR Converted Add Risk Attribution Build Dashboard Build Analyst View SOC Trained Play with Scores SOC Training Tuning Dashboard Triage Risk Notable Tuning Process Red Teaming! 1 - 2 Months 3 Months 4-6+ Months Current 1 - 2 Weeks
Thank You © 2020 SPLUNK INC.
© 2020 SPLUNK INC. Appendix
© 2020 SPLUNK INC. `risk_score(risk_object_priority,risk_rule_impact,risk_rule_confidence)` | eval risk_rule_impact =if(like($risk_rule_impact $,"%"),$risk_rule_impact $,"$risk_rule_impact$" ), risk_rule_confidence =if(like($risk_rule_confidence $,"%"),$risk_rule_confidence $,"$risk_rule_confide nce$") | eval temp_impact_num =case(risk_rule_impact =="info",20,risk_rule_impact =="low",40,risk_rule_impact =="medi um",60,risk_rule_impact =="high",80,risk_rule_impact =="critical",100) | eval temp_confidence_num =case(risk_rule_confidence =="low",0.30,risk_rule_confidence =="medium",0.60,risk_ rule_confidence =="high",1.00) | eval risk_score=(temp_impact_num * temp_confidence_num) *(($risk_object_priority $*.25)+1) | fields - temp_impact_num ,temp_confidence_num
© 2020 SPLUNK INC. `risk_object_priority(risk_object)` | lookup asset_lookup_by_str asset AS $risk_object$ OUTPUT priority as asset_priority nt_host as temp_nt_host | eval $risk_object$=case((risk_object_type="system" AND like(temp_nt_host,"%")),temp_nt_host,true(),risk_object) | lookup identity_lookup_expanded identity AS $risk_object$ OUTPUT priority as identity_priority watchlist as watchlist | fillnull value="false" watchlist | eval risk_object_priority=case(risk_object_type="system" AND like(asset_priority,"%"),asset_priority,risk_object_type="system","unknown", risk_object_type="user" AND like(identity_priority,"%"),identity_priority,risk_object_type="user","unknown") | fields - asset_priority identity_priority temp_nt_host | eval risk_object_priority_num=case(watchlist="true",4,risk_object_priority=="low",1,risk_object_priority=="medium",2,risk_o bject_priority=="high",3,risk_object_priority=="critical",4,true(),0.5)
© 2020 SPLUNK INC. Risk Rule Home Dashboard <form> <label>Risk Index Overview</label> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <title>Risk Score by Object</title> <search> <query>| tstats values(source) as source sum(All_Risk.risk_score) as score from datamodel=Risk.All_Risk by All_Risk.risk_object _time span=24h | `drop_dm_object_name("All_Risk")` | table risk_object source score</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="score"> <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax"></scale> </format> </table> </panel> </row> <row> <panel> <table> <title>Risk Score by Source</title> <search> <query>| tstats values(All_Risk.risk_object) as risk_object sum(All_Risk.risk_score) as score from datamodel=Risk.All_Risk by source _time span=24h | fields - _time</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="score"> <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax"></scale> </format> </table> </panel> </row> </form>

More Related Content

PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
PDF
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
PPTX
Threat Hunting with Splunk
Splunk
 
PDF
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
PPS
ISO 27001 2013 isms final overview
Naresh Rao
 
PPTX
Threat hunting - Every day is hunting season
Ben Boyd
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
Threat Hunting with Splunk
Splunk
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
ISO 27001 2013 isms final overview
Naresh Rao
 
Threat hunting - Every day is hunting season
Ben Boyd
 

What's hot (20)

PDF
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
PDF
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
PPTX
Adversary Emulation using CALDERA
Erik Van Buggenhout
 
PDF
Threat Hunting with Splunk Hands-on
Splunk
 
PPTX
Splunk Enterprise Security
Splunk
 
PDF
A Threat Hunter Himself
Teymur Kheirkhabarov
 
PDF
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
MITRE ATT&CK
 
PPTX
Penetration testing reporting and methodology
Rashad Aliyev
 
PDF
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
PDF
ATT&CKcon Intro
MITRE ATT&CK
 
PDF
Threat Hunting
Splunk
 
PDF
Starting Over with Sub-Techniques
MITRE - ATT&CKcon
 
PDF
Red Team Framework
👀 Joe Gray
 
PPTX
SIEM - Activating Defense through Response by Ankur Vats
OWASP Delhi
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK
 
PPTX
Threat Hunting Web Shells Using Splunk
jamesmbower
 
PDF
ISO 27005:2022 Overview 221028.pdf
Andrey Prozorov, CISM, CIPP/E, CDPSE. LA 27001
 
PDF
How To Present Cyber Security To Senior Management Complete Deck
SlideTeam
 
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
Adversary Emulation using CALDERA
Erik Van Buggenhout
 
Threat Hunting with Splunk Hands-on
Splunk
 
Splunk Enterprise Security
Splunk
 
A Threat Hunter Himself
Teymur Kheirkhabarov
 
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
MITRE ATT&CK
 
Penetration testing reporting and methodology
Rashad Aliyev
 
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
ATT&CKcon Intro
MITRE ATT&CK
 
Threat Hunting
Splunk
 
Starting Over with Sub-Techniques
MITRE - ATT&CKcon
 
Red Team Framework
👀 Joe Gray
 
SIEM - Activating Defense through Response by Ankur Vats
OWASP Delhi
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK
 
Threat Hunting Web Shells Using Splunk
jamesmbower
 
ISO 27005:2022 Overview 221028.pdf
Andrey Prozorov, CISM, CIPP/E, CDPSE. LA 27001
 
How To Present Cyber Security To Senior Management Complete Deck
SlideTeam
 
Ad

Similar to A Risk Based Approach to Security Detection and Investigation by Kelby Shelton (20)

PDF
Splunk-Presentation
PrasadThorat23
 
PDF
Splunk Solution overview testing versi 1
yulitasarahhh
 
PDF
Power the SOC of the Future with scale, speed and choice - Splunk Public Sect...
Splunk EMEA
 
PPTX
SplunkLive! Zurich 2018: Use Splunk for Incident Response, Orchestration and ...
Splunk
 
PPTX
.conf Go Zurich 2022 - Security Session
Splunk
 
PDF
March 2023 PNW User Group
Amanda Richardson
 
PDF
Webinar: Neues zur Splunk App for Enterprise Security
Georg Knon
 
PPTX
SplunkLive! Munich 2018: Use Splunk for incident Response, Orchestration and ...
Splunk
 
PPTX
Accelerate Incident Response with Orchestration & Automation
Splunk
 
PPTX
July 2021 Virtual PNW Splunk User Group Slides
Amanda Richardson
 
PDF
December Bengaluru Splunk User Group Meetup
kamlesh2410
 
PPTX
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk
 
PDF
PSUG 7 - 2025-06-03 - David Bianco on Splunk SURGe
Tomas Moser
 
PPTX
Security Analytics & Security Intelligence-as-a-Service
Marco Casassa Mont
 
PPTX
The Splunk AISecOps Initiative - Splunk Security Roundtable: Zurich 2018
Splunk
 
PPTX
SplunkLive! Frankfurt 2018 - Use Splunk for Incident Response, Orchestration ...
Splunk
 
PPTX
Splunk for Enterprise Security Featuring UBA
Splunk
 
PPTX
Splunk EMEA Webinar: Scoping infections and disrupting breaches
Splunk
 
PPTX
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
PDF
Splunk Discovery: Warsaw 2018 - Solve Your Security Challenges with Splunk En...
Splunk
 
Splunk-Presentation
PrasadThorat23
 
Splunk Solution overview testing versi 1
yulitasarahhh
 
Power the SOC of the Future with scale, speed and choice - Splunk Public Sect...
Splunk EMEA
 
SplunkLive! Zurich 2018: Use Splunk for Incident Response, Orchestration and ...
Splunk
 
.conf Go Zurich 2022 - Security Session
Splunk
 
March 2023 PNW User Group
Amanda Richardson
 
Webinar: Neues zur Splunk App for Enterprise Security
Georg Knon
 
SplunkLive! Munich 2018: Use Splunk for incident Response, Orchestration and ...
Splunk
 
Accelerate Incident Response with Orchestration & Automation
Splunk
 
July 2021 Virtual PNW Splunk User Group Slides
Amanda Richardson
 
December Bengaluru Splunk User Group Meetup
kamlesh2410
 
Splunk for Enterprise Security featuring UBA Breakout Session
Splunk
 
PSUG 7 - 2025-06-03 - David Bianco on Splunk SURGe
Tomas Moser
 
Security Analytics & Security Intelligence-as-a-Service
Marco Casassa Mont
 
The Splunk AISecOps Initiative - Splunk Security Roundtable: Zurich 2018
Splunk
 
SplunkLive! Frankfurt 2018 - Use Splunk for Incident Response, Orchestration ...
Splunk
 
Splunk for Enterprise Security Featuring UBA
Splunk
 
Splunk EMEA Webinar: Scoping infections and disrupting breaches
Splunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
Splunk Discovery: Warsaw 2018 - Solve Your Security Challenges with Splunk En...
Splunk
 
Ad

Recently uploaded (20)

PPTX
A Presentation on Touch Screen Technology
memembruh336
 
PDF
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
PDF
Hindi spoken digit analysis for native and non-native speakers
IAESIJAI
 
PPTX
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Accuracy of neural networks in brain wave diagnosis of schizophrenia
IAESIJAI
 
PDF
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
PDF
Getting Started with Data Integration: FME Form 101
Safe Software
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
A novel scalable deep ensemble learning framework for big data classification...
IAESIJAI
 
PDF
Zenith AI: Advanced Artificial Intelligence
Biz Preneurs
 
PDF
DP Operators-handbook-extract for the Mautical Institute
LeonelMejiaLarios
 
PPTX
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
PDF
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
PDF
A comparative analysis of optical character recognition models for extracting...
IAESIJAI
 
PPTX
1. Introduction to Computer Programming.pptx
bonakiduza1024
 
PDF
DASA ADMISSION 2024_FirstRound_FirstRank_LastRank.pdf
rameswartudu05
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PDF
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
A Presentation on Touch Screen Technology
memembruh336
 
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
Hindi spoken digit analysis for native and non-native speakers
IAESIJAI
 
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
Approach and Philosophy of On baking technology
30anthuong17
 
Accuracy of neural networks in brain wave diagnosis of schizophrenia
IAESIJAI
 
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
Getting Started with Data Integration: FME Form 101
Safe Software
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
A novel scalable deep ensemble learning framework for big data classification...
IAESIJAI
 
Zenith AI: Advanced Artificial Intelligence
Biz Preneurs
 
DP Operators-handbook-extract for the Mautical Institute
LeonelMejiaLarios
 
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
A comparative analysis of optical character recognition models for extracting...
IAESIJAI
 
1. Introduction to Computer Programming.pptx
bonakiduza1024
 
DASA ADMISSION 2024_FirstRound_FirstRank_LastRank.pdf
rameswartudu05
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 

A Risk Based Approach to Security Detection and Investigation by Kelby Shelton

  • 1. © 2020 SPLUNK INC. A Risk Based Approach to Security Detection and Investigation April 2020 Kelby Shelton - Consulting Solutions Engineer kelbys@splunk.com
  • 2. During the course of this presentation, we may make forward‐looking statements regarding future events or plans of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results may differ materially. The forward-looking statements made in the this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, it may not contain current or accurate information. We do not assume any obligation to update any forward‐looking statements made herein. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionalities described or to include any such feature or functionality in a future release. Splunk, Splunk>, Data-to-Everything, D2E and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names or trademarks belong to their respective owners. © 2020 Splunk Inc. All rights reserved Forward- Looking Statements © 2020 SPLUNK INC.
  • 3. © 2020 SPLUNK INC. Agenda 1) Define the Problem 2) Define the Solution 3) RBA In Action 4) Customer Success 5) Road to Adoption Text Placeholders: See slide 46 for more information on how to format multiple levels of text.
  • 4. © 2020 SPLUNK INC. Define the Problem
  • 5. © 2020 SPLUNK INC. Correlation Searches Notable Queue Typical Enterprise Security Strategy ● Vendor Alert: Anomalous Login ● Malware Detection ● Suspicious Powershell ● Low: Anomalous Login ● Critical: Malware Detection ● High: Suspicious Powershell
  • 7. © 2020 SPLUNK INC. What about these? ML/AI EDR UBA NDR Palo Cisco AWS Microsoft
  • 8. © 2020 SPLUNK INC. Manual Correlation Visibility Gaps Requires Many Analysts High Noise Huge Whitelists Slow time to deploy new use-cases
  • 9. © 2020 SPLUNK INC. The Ideal Solution Decrease tuning time Deploy use-cases faster Scaleable with Analysts Improved Fidelity Built-in Correlation Standard Framework A better strategy
  • 10. © 2020 SPLUNK INC. Define the Solution
  • 11. © 2020 SPLUNK INC. A New Enriched Data Set Security Datasets Correlation Searches Risk Index
  • 12. © 2020 SPLUNK INC. Risk Index Filled with security related data A New Kind of Notable Raw Logs Azure ATP NDREDR Accelerated Data Models
  • 13. © 2020 SPLUNK INC. Align Correlation Searches to MITRE Attribute Risk to Assets and/or Identities The Risk Based Approach Send to Risk Index Step 1 Step 2 Step 3 Alert on Anomalies Step 4
  • 14. © 2020 SPLUNK INC. RBA in Action
  • 15. © 2020 SPLUNK INC. Align Correlation Search to Mitre Excessive Failed Logins | from datamodel:"Authentication"."Failed_Authentication" | stats values(tag) as "tag",dc(user) as "user_count",dc(dest) as "dest_count",count by "app","src" | where 'count'>=6 Step 1
  • 16. © 2020 SPLUNK INC. Do Your Research - MITRE TACTIC - Brute Force Also opens up new possibilities T1003 - Credential Dumping T1075 - Pass the Hash T1110 - Password Spraying
  • 17. © 2020 SPLUNK INC. Align Correlation Search to Mitre Map it to Mitre | eval mitre_id="T1110" Appending multiple (optional): | eval mitre_id=mvappend("T1110","T1003") ...continued
  • 18. © 2020 SPLUNK INC. Attribute Risk to Asset or Identity Risk Framework accepts a “risk_object” of type “system”,”user”,”other” | eval risk_object=src, risk_object_type="system" | appendpipe [| eval risk_object=user, risk_object_type="user"] Add an analyst message | eval risk_message=count." authentication failures from ".user_count." unique users originating from "".risk_object Attribution
  • 19. © 2020 SPLUNK INC. Attribute Risk to Asset or Identity Static | eval risk_score=30 Dynamic (using a lookup and an equation) | eval risk_score = <score> * ( <risk_object_priority> * 0.25) + 1 ) *Where <score> is a number 0-100 and <risk_object_priority> is a number 0-4 Scoring
  • 20. © 2020 SPLUNK INC. Send to Risk Index Pros ● Supports Throttling Cons ● Must be blank to support multiple risk objects | sendalert risk Pros ● Easy to understand ● Supports multiple risk objects Cons ● No throttling ● Requires non-overlapping searches (example: earliest=1h@h latest=@h | collect index=risk Pros ● Simplest ● Easy to understand ● Supports multiple risk objects Cons ● No throttling ● Requires non-overlapping searches (example: earliest=1h@h latest=@h Three Methods
  • 21. © 2020 SPLUNK INC. Put It Together | from datamodel:"Authentication"."Failed_Authentication" | stats values(tag) as "tag",dc(user) as "user_count",dc(dest) as "dest_count",count by "app","src" | where 'count'>=6 | eval risk_object=src, risk_object_type="system" | eval risk_message=count." authentication failures from ".user_count." unique users from "".risk_object | sendalert risk param._risk_score=50
  • 22. © 2020 SPLUNK INC. John Doe - Suspicious Email: 25 Jane Smith - Possible C2 Traffic: 30 WORKSTATION1 - Anomalous Login: 35 John Doe - Malware Detection: 50 DC1 - Malware Detection: 125 Jane Smith - Suspicious Email: 25 WORKSTATION1 - Suspicious Powershell: 70 Jane Smith - Suspicious Powershell: 55 | from datamodel:Risk | stats sum(risk_score) as total values(*) as * by risk_object | where total>100 Alert on Anomalies A change on perspective Risk Index RiskNotable - Greater than 100 within 24 hours
  • 23. © 2020 SPLUNK INC. Alert on Anomalies ...continued Jane Smith WORKSTATION1 DC1 ● Jane Smith received a suspicious email from phishy.com ● Suspicious powershell executed on Jane Smith’s computer ● Possible C2 Traffic from Jane Smith’s computer to abcdefghi1234.ru ● Suspicious powershell executed on WORKSTATION1 ● Multiple login failures on WORKSTATION1 ● Malware Detection Total Risk Score: 110 Total Risk Score: 105 Total Risk Score: 125
  • 24. © 2020 SPLUNK INC. Demo Environment 1) FruitFly Mac Malware 2) Advanced Persistent Threat Two Scenarios
  • 25. © 2020 SPLUNK INC. Customer Success
  • 26. © 2020 SPLUNK INC. “RBA has changed how we fundamentally operate, raising visibility into the cumulative risk related to behaviors and allowing us to focus on the most impactful events” Brandon Cass Cyber Defense Operations Manager Texas Instruments
  • 27. © 2020 SPLUNK INC. “As an early contributor of the RBA process and as a Threat Hunter in a mid-sized enterprise, we increased our detections by 300%, reduced our security alerts by 50%, aligned with MITRE ATT&CK, and achieved a 60% true positive rate in the SOC in less than a year without increasing the size of the security team by leveraging a risk based approach” Stuart McIntosh CTO Outpost Security
  • 28. © 2020 SPLUNK INC. “Before implementing RBA, we saw a 7.07% True Positive Rate. In quarter two of 2019 we were able to maintain a 33% True Positive Rate using the RBA system while also onboarding 29 new correlation searches. RBA has empowered our small security operations team to scale with evolving threats.” Cybersecurity Incident Response Team Children’s Mercy
  • 29. © 2020 SPLUNK INC. Road to Adoption
  • 30. © 2020 SPLUNK INC. Resources SANS SIEM Summit SANS Content: We Need to Talk about the Elephant in the SOC Splunk .Conf 2018 SEC 1479 - Say Goodbye to Your big Alert Pipeline , and Say Hello to Your New Risk-Based Approach Splunk .Conf 2019 SEC 1556 – Building Behavioral Detections: Cross-Correlating Suspicious Activity with the MITRE ATT&CK Framework SEC 1803 – Modernize and Mature Your SOC with Risk-Based Alerting SEC 1538 - Getting started with Risk-Based Alerting and MITRE SEC 1908 – Tales from a Threat Team: Lessons and Strategies for Succeeding with a Risk-Based Approach Talks and Presentations
  • 31. © 2020 SPLUNK INC. RBA App https://github.com/apger/ SA-RBA
  • 32. © 2020 SPLUNK INC. Risk Rule Home Dashboard
  • 33. © 2020 SPLUNK INC. Risk Adoption Timeline Key Milestones Start First RR Home Dash First RN Full RBA Typical Alerting Add Mitre Convert Multiple RR Continue Convert RR All RR Converted Add Risk Attribution Build Dashboard Build Analyst View SOC Trained Play with Scores SOC Training Tuning Dashboard Triage Risk Notable Tuning Process Red Teaming! 1 - 2 Months 3 Months 4-6+ Months Current 1 - 2 Weeks
  • 34. Thank You © 2020 SPLUNK INC.
  • 35. © 2020 SPLUNK INC. Appendix
  • 36. © 2020 SPLUNK INC. `risk_score(risk_object_priority,risk_rule_impact,risk_rule_confidence)` | eval risk_rule_impact =if(like($risk_rule_impact $,"%"),$risk_rule_impact $,"$risk_rule_impact$" ), risk_rule_confidence =if(like($risk_rule_confidence $,"%"),$risk_rule_confidence $,"$risk_rule_confide nce$") | eval temp_impact_num =case(risk_rule_impact =="info",20,risk_rule_impact =="low",40,risk_rule_impact =="medi um",60,risk_rule_impact =="high",80,risk_rule_impact =="critical",100) | eval temp_confidence_num =case(risk_rule_confidence =="low",0.30,risk_rule_confidence =="medium",0.60,risk_ rule_confidence =="high",1.00) | eval risk_score=(temp_impact_num * temp_confidence_num) *(($risk_object_priority $*.25)+1) | fields - temp_impact_num ,temp_confidence_num
  • 37. © 2020 SPLUNK INC. `risk_object_priority(risk_object)` | lookup asset_lookup_by_str asset AS $risk_object$ OUTPUT priority as asset_priority nt_host as temp_nt_host | eval $risk_object$=case((risk_object_type="system" AND like(temp_nt_host,"%")),temp_nt_host,true(),risk_object) | lookup identity_lookup_expanded identity AS $risk_object$ OUTPUT priority as identity_priority watchlist as watchlist | fillnull value="false" watchlist | eval risk_object_priority=case(risk_object_type="system" AND like(asset_priority,"%"),asset_priority,risk_object_type="system","unknown", risk_object_type="user" AND like(identity_priority,"%"),identity_priority,risk_object_type="user","unknown") | fields - asset_priority identity_priority temp_nt_host | eval risk_object_priority_num=case(watchlist="true",4,risk_object_priority=="low",1,risk_object_priority=="medium",2,risk_o bject_priority=="high",3,risk_object_priority=="critical",4,true(),0.5)
  • 38. © 2020 SPLUNK INC. Risk Rule Home Dashboard <form> <label>Risk Index Overview</label> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <title>Risk Score by Object</title> <search> <query>| tstats values(source) as source sum(All_Risk.risk_score) as score from datamodel=Risk.All_Risk by All_Risk.risk_object _time span=24h | `drop_dm_object_name("All_Risk")` | table risk_object source score</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="score"> <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax"></scale> </format> </table> </panel> </row> <row> <panel> <table> <title>Risk Score by Source</title> <search> <query>| tstats values(All_Risk.risk_object) as risk_object sum(All_Risk.risk_score) as score from datamodel=Risk.All_Risk by source _time span=24h | fields - _time</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="score"> <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax"></scale> </format> </table> </panel> </row> </form>