Hunting for Evil with the Elastic Stack
1 like1,601 views
The document discusses threat hunting using the Elastic Stack, emphasizing its evolution and adoption since 2011. It highlights the methodologies for threat detection, the integration of machine learning in hunting tactics, and the increasing complexity in modern architectures. The text also notes the growing standardization of the Elastic Stack among various organizations and the tools that support it.
Hunting for Evil with the Elastic Stack
- 1. Kent Brake Solutions Architect, Elastic U.S. Federal Team October 2019 Hunting for Evil with the Elastic Stack
- 2. What is Threat Hunting ? • Starts with a question / hypothesis • Requires Searching, Filtering and Pivoting through large datasets • Focuses on both outside and inside threats
- 3. Threat Hunting Example - TLS “Are attackers using TLS to hide their command-and-control or exfiltrate data?” Search: Aggregate all TLS connections, sort by rare organization names, filter for suspicious names. Pivot: host data, evaluate processes and users generating SSL traffic
- 4. Search, Filter and Pivot
- 5. Search, Filter and Pivot
- 6. Search, Filter and Pivot
- 7. The Elastic Stack Security Journey 2013 2016 2018 2017 2019 ELK Stack is born Logstash and Kibana released, forming an OSS Threat Hunting platform 2011-12
- 8. The Elastic Stack Security Journey 2013 2016 2018 2017 2019 ELK Stack is born Logstash and Kibana released, forming an OSS Threat Hunting platform 2011-12 Commercial and Federal Threat hunting early adopters start hunting with the Elastic Stack.
- 9. The Elastic Stack Security Journey 2013 2016 2018 2017 2019 ELK Stack is born Logstash and Kibana released, forming an OSS Threat Hunting platform 2011-12 Commercial and Federal Threat hunting early adopters start hunting with the Elastic Stack. Elastic 5.0 - Beats Elastic Unifies all release cycles of ELK, renames it “Elastic Stack”, adoption increases
- 10. The Elastic Stack Security Journey 2013 2016 2018 2017 2019 ELK Stack is born Logstash and Kibana released, forming an OSS Threat Hunting platform 2011-12 Commercial and Federal Threat hunting early adopters start hunting with the Elastic Stack. Elastic 5.0 - Beats Elastic Unifies all release cycles of ELK, renames it “Elastic Stack”, adoption increases Threat Hunting in the Elastic Stack From Palo Alto Networks to Novetta, hunters start to standardize on Elastic
- 11. The Elastic Stack Security Journey 2013 2016 2018 2017 2019 ELK Stack is born Logstash and Kibana released, forming an OSS Threat Hunting platform 2011-12 Commercial and Federal Threat hunting early adopters start hunting with the Elastic Stack. Elastic 5.0 - Beats Elastic Unifies all release cycles of ELK, renames it “Elastic Stack”, adoption increases Threat Hunting in the Elastic Stack From Palo Alto Networks to Novetta, hunters start to standardize on Elastic Mitre Att&ck - RockNSM - HELK Threat hunting embraces Att&ck, RockNSM and HELK projects go mainstream
- 12. The Elastic Stack Security Journey 2013 2016 2018 2017 2019 ELK Stack is born Logstash and Kibana released, forming an OSS Threat Hunting platform 2011-12 Commercial and Federal Threat hunting early adopters start hunting with the Elastic Stack. Elastic 5.0 - Beats Elastic Unifies all release cycles of ELK, renames it “Elastic Stack”, adoption increases Threat Hunting in the Elastic Stack From Palo Alto Networks to Novetta, hunters start to standardize on Elastic Mitre Att&ck - RockNSM - HELK Threat hunting embraces Att&ck, RockNSM and HELK projects go mainstream Elastic 7.0 ML for Threat Hunting matures, entity analysis and ECS make hunting easier
- 13. Threat Hunting Complexity Threat hunting questions are getting harder to ask Evolving Architectures ~↑ Hunting Complexity ● Core Infrastructure is in a state of change ● K8s and Docker create new optimizations but also new challenges ● Attack surface increases with new API’s and multi-tenant compute ● Ephemeral compute, automatic scaling and reallocation, third- party infrastructure packages
- 14. Threat Hunting Example - Today - Machine Learning “Are attackers abusing built-in system tools to hide malicious actions?” Search: Use ML to power Search for rare commands being ran from a shell Pivot: sort by time-of-day, admin user, network activity
- 15. Search, Filter and Pivot
- 16. SANS "After seeing Elasticsearch continue to pop up in SANS courses across the curriculum, I have noticed students are consistently curious and excited by the search features the open-source Elastic Stack provides. Numerous security tools, projects, and even commercial SIEMs have moved to using the lightning-fast distributed search tool as the cornerstone of their functionality.” https://www.sans.org/course/siem-design-and-implementation/course/desc/summit
- 17. Come to the AMA booth! Questions?