SlideShare a Scribd company logo

Level Up Your Security Skills in Splunk Enterprise

Splunk, profile picture
Splunk

The document discusses leveraging Splunk for enhancing security skills and automating threat detection through various scenarios such as command and control detection, statistical anomaly detection, and behavioral analysis. It emphasizes the importance of visibility, analysis, and automated actions in responding to security events, while also providing insights into using threat intelligence and data correlation. Legal disclaimers regarding forward-looking statements and product roadmap changes are also included.

Technology
1 of 59
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
Copyright © 2015 Splunk Inc. Level Up Your Security Skills in Splunk Enterprise
Legal Notices During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward-looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. 2
Today’s Speakers 3 Niklas Blomquist – Security Lead EMEA North – Splunk
Visibility—Analysis—Action in Four Scenarios 1. Automated threat intelligence response 2. Statistical Anomaly detection leads to opening a ticket 3. Statistical Profiling leads to manager confirmation 4. Visual correlation to track an attack against the “kill chain” Agenda 4
● Niklas Blomquist – Security Lead EMEA North ● nblomquist@splunk.com ● 18 years security experience ● 3 years @ splunk ● Love tech deep dives ● My favorite search command is stats! Who Am I? 5
● Framework for evaluating data and responding Splunk ● Applies to all existing frameworks, as it’s the Splunk side of the loop. ● For example, Let’s look at the lateral movement section of the kill chain. (Not familiar with the kill chain? It’s a great way to understand the phases of an attack. Check the URL below.) ● Visibility: What data will let you detect Lateral Movement? ● Analysis: What will you do to that data to come to a decision? ● Action: What will you do in response to that decision? – Can we automate all of this? Kill Chain: http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf Visibility – Analysis – Action
Scenario One C&C Detection and Blocking
● New threat list intel available for command and control (C&C) ● Changing firewall policy manually is too slow ● Goal: Take in the firewall logs, leverage intelligence to detect C&C behavior, and block the destinations in near real time ● Visibility: Firewall logs, threat intel sources ● Analysis: Intersection (lookup) of the two ● Action: Apply dynamic firewall blocks Command and Control Detection and Blocking 8
● A feed of known bad IPs/DNS names/MD5s/URLs/etc. from a vendor or non- profit that specializes in discovering Indicators of Compromise ● Great sources of open source threat intel include: – Emerging Threats: http://rules.emergingthreats.net/ – I-Blocklist: https://www.iblocklist.com/lists.php – MalwareDomains: http://www.malwaredomains.com/ – Zeus Tracker: https://zeustracker.abuse.ch/ ● Many great commercial entities, too (generally better ranking / quality) – iSight Partners, Verizon iDefense, commercial versions of most of the above, and many many more What / Where is Threat Intelligence 9
Palo Alto Networks Firewall Log Sep 15 19:02:06 1,2014/09/15 19:02:06,0004C104559,TRAFFIC,end,1,2014/09/15 19:02:05,10.2.2.14,206.16.215.101,206.16.216.158,214.34.245.101,Internet Traffic,,, salesforce- base,vsys1,Trust,Untrust,ethernet1/8,ethernet1/2,MyLogForwarding,2014/09/15 19:02:05,24238,1,61845,443,57339,443,0x400000,tcp,allow,1275,761,514,14,2014/09/ 15 19:01:31,5,any,0,358477769,0x0, 10.0.0.0-10.255.255.255, United States,0,8,6 Traffic Machine Data 10 Src and Dest IPs Threat Intel Lookup: dest,threat_intel_source 115.29.46.99/32,zeus_c2s 61.155.30.0/24,cymru_http
1. First, we want to pull out all firewall traffic coming from inside our network, going outside our network 2. Then, we want to cross-reference that data with our threat intel list. This is accomplished in the Splunk world via a lookup 3. Finally, we want to pull just the logs that have threat intel Analysis 11 index=pan_logs sourcetype=pan_traffic src=“10.*” dest!=“10.*” | lookup ThreatIntel dest | search threat_intel_source=* Name of our lookup, and the key field Data held in Lookup Table
● Panblock! (or other network response) Block a User or System 12
Add panblock 13
Demo 14
● Have a Palo Alto device and like this particular feature? Visit – Docs: https://live.paloaltonetworks.com/docs/DOC-6593 – App Page: http://apps.splunk.com/app/491/ ● Want to automate other firewalls? Ask your SE about: – Expect scripts for Cisco, Juniper, etc. – Threat intel integration with Check Point – How to integrate with your particular brand of firewall Where to Learn More About PAN Blocking 15
● Multiple Threat Lists—Deprioritize open source threat list vs. premium threat list – Solution: the Splunk App for Enterprise Security has this fixed with deduping and prioritizing – Alternate Solution: | inputlookup Premium| append [|inputlookup OpenSource] | munge | outputlookup MyList ● Performance—you get lots of traffic, maybe you have lots of threat intel entries – Solution: the Splunk App for Enterprise Security – Alternate Solution: data models help substantially Analysis—Challenges 16
Scenario Two Statistical Anomaly Detection Essentials
● Process monitoring are good practice, and is easy with Splunk ● It becomes harder at scale, but data model acceleration helps ● Ultimately, by conquering statistical anomaly detection, you can more effectively find the difficult to detect in your systems ● Visibility: Carbon Black Logs ● Analysis: System distribution, accelerated via data models ● Action: Security incident creation Statistical Anomaly Detection Essentials 18
● A measure of the variance for a series of numbers ● One file is opened on 100, 123, 79, and 145 hosts per day – average of 111.75 and a standard deviation of 28.53 ● Another file is opened on 100, 342, 3 and 2 hosts per day – average of 111.75, but a standard deviation of 160.23 What is Standard Deviation? 19
Endpoint Machine Data 20 {"action": "write", "timestamp": 1410911994, "path": "c:Program FilesSplunkbinsplunk-perfmon.exe", "type": "filemod", "process_guid": 36661217281} Visibility Analysis Action
• Acceleration facilitates better and broader analysis • Splunk has a few ways of accelerating content: • Report Acceleration • Data Model Acceleration • Summary Indexing • Pre-Processing of logs • Search pipeline parallelization How To Accelerate 21
Create a data model and accelerate Create Data Model 22 Visibility Analysis Action
• Create a baseline pivot search and open in search • In this case, split dc(host) by path • Add a filter for critical paths Create Pivot Search 23 Visibility Analysis Action
Add additional stats command on top of accelerated Pivot search. Create Additional Statistics 24 Visibility Analysis Action
Only Show Suspect Entries 25 Visibility Analysis Action
● E-mail ● Script ● Alert Action Create a New Incident 26 Visibility Analysis Action
Demo 28
● 29 security related data models ● Normalize the data to get the searches easier to create ● Use’s TA’s to get the data in ● Available for free at Splunkbase ● https://splunkbase.splunk.com/app/1621/ CIM
Shameless plug
● .CONF Session: http://splk.it/e68 ● .CONF Session PDF: http://splk.it/g7m ● .CONF Session Recording: http://splk.it/b6m Visibility Analysis Action
Scenario Three Statistical Behavioral Anomaly Detection
● Detecting known bad is great, but leaves you vulnerable ● Augment with synthetic checks of sensitive systems ● Statistics can consume all your time ● In this scenario, we are a hospital tracking patient chart opens ● Visibility: Charting system logs ● Analysis: Frequency analysis by user, role, etc. ● Action: Email the employees’ managers to investigate Statistical Behavioral Anomaly Detection 33
● A measure of the variance for a series of numbers ● Jane opens 100, 123, 79, and 145 charts per day – average of 111.75 and a standard deviation of 28.53 ● Jack opens 100, 342, 3 and 2 charts per day – average of 111.75, but a standard deviation of 160.23 ● Jack and Jane both open 500 records one day, Jane’s Z score will be 13.6, but Jack’s will only be 2.42 ● Z score = number of standard deviations away from average What is Standard Deviation? 34
<audit_list><audit_version>1</audit_version> <event_dt_tm>2014-09-06 23:59:59.52</event_dt_tm> <outcome_ind>0</outcome_ind> <user_name>AHARVEY</user_name> <prsnl_id>117499</prsnl_id> <prsnl_name>Angel Harvey</prsnl_name> <role>DBA</role> <role_cd>24209801</role_cd><enterprise_site>HNAM</enterprise_site><audit_source>Test/Domain</audit_source><audit_source_ty pe>600005</audit_source_type><network_acc_type>1</network_acc_type><network_acc_id>MTYVQ- ACTX03</network_acc_id><application>HNA: Powerchart</application><task>RUN PowerView Preferences</task><request>cps_ens_ppa</request><appl_ctx>346793285</appl_ctx><perform_cnt>69</perform_cnt><event_list><e vent_name>Maintain Person</ event_name> <event_type>Chart Access Log</event_type> […….]</audit_list> File Access Log Examples 35 Visibility Analysis Action
● Core Metric: chart opens per day, per employee ● Dimensions to compare: – Over time for the same user – Others with same title – Others in same city, etc. ● Why multiple dimensions? Analysis 36 Visibility Analysis Action
index=cerner | eval EmployeeID=spath(_raw, "audit_list.prsnl_id") | eval EmployeeName = […] | eval RecordNum= […] | bucket _time span=1d | stats dc(RecordNum) as NumRecords by EmployeeName, EmployeeID, _time | stats first(NumRecords) avg(NumRecords) stdev(NumRecords) by EmployeeName, EmployeeID | where ‘first(NumRecords)’ > ‘avg(NumRecords)’ + ‘stdev(NumRecords)’ * 6 Dimensions to compare—Basic 37 Visibility Analysis Action
Demo 38 30 minutes later…
Two options Use accelerationLarge mug of Coffee!
• Acceleration facilitates better and broader analysis • Splunk has a few ways of accelerating content: • Report Acceleration • Data Model Acceleration • Summary Indexing • Pre-Processing of logs • Search pipeline parallelization How To Accelerate 40
index=cerner | eval Role=spath(_raw, "audit_list.role") | eval RoleID = […] | eval EmployeeID= […] | eval EmployeeName = […] | eval PatientNum= […] | bucket _time span=1d | stats dc(PatientNum) as NumRecords by EmployeeName, EmployeeID, Role, RoleID _time | lookup HR_IS.csv EmployeeID | tscollect retain_events=t Cerner Dimensions to compare—Acceleration 41 Visibility Analysis Action
| tstats local=t first(NumCharts) as Recent_NumCharts avg(NumCharts) as Avg_NumCharts stdev(NumCharts) as Stdev_NumCharts from Cerner groupby EmployeeName, EmployeeID, Username, Role, RoleID, City, YearsAtCompany | join type=outer RoleID [| tstats local=t avg(NumCharts) as Role_Avg_NumCharts stdev(NumCharts) as Role_Stdev_NumCharts from Cerner groupby Role, RoleID ] Find Statistical Outliers Pt 1 42 Visibility Analysis Action
[… continued from previous slide …] | eval Personal_Z = abs(Recent_NumCharts-Avg_NumCharts)/Stdev_NumCharts | eval Role_Z = abs(Recent_NumCharts- Role_Avg_NumCharts)/Role_Stdev_NumCharts | eval Z_Min = min(Role_Z, Personal_Z) | where Z_Min > 6 Find Statistical Outliers Pt 2 43 Visibility Analysis Action
● Email the manager ● This option is mostly just formatting. Join to the HR / LDAP database and utilize sendemail + map ● Could also escalate big violations to the SOC or GRC | lookup LDAPSearch sAMAccountManager as username OUTPUT manager | lookup LDAPSearch dn as manager OUTPUT mail as ManagerEmail “ Send custom E-Mail 44 | map maxsearches=100 search=“ | stats count | eval ManagerEmail=$ManagerEmail$ | eval EmployeeName=$EmployeeName$ | eval ZAvg = $Z_Avg$ | sendemail to=ManagerEmail sendresults=f subject=EmployeeName . “ excess Chart Opens” message=EmployeeName . “ has opened more charts than normal (“ . ZAvg . “ stdev). _._Please Follow Up.” Visibility Analysis Action
Demo 45
Scenario Four Visual Event Correlation
● Analytics are key, but not everything can be correlated ● Human eye can detect all manner of subtlety – Progress through Cyber Kill Chain – Movement toward critical assets – Etc. ● Easiest with the Splunk App for Enterprise Security, but possible without Visual Event Correlation 47
Example of visualization
Dashboard Example App
Dashboard Example App
361+ security appsSplunk App for Enterprise Security Splunk Security Intelligence Platform Palo Alto Networks NetFlow Logic FireEye Blue Coat Proxy SG OSSECCisco Security Suite Active Directory F5 Security Juniper Sourcefire
Build vs Buy Most customer use a combination of build/buy BuyBuild ● Knowledge – what to look for ● Time/money – create the content ● IT-Security Analysts and Researchers are rare on the market. ● Customized to your specific organizational needs ● Out of the box content ● Requires no tuning ● Excessive analytics ● Quick time to value
Demo—Separate Product Lines (ES) 53
Demo—Kill Chain Swimlanes (ES) 54
User & Entity Behavior Analytic Unsupervised machine learning with “out of the box” content
● Anything. This should encompass all of your log sources, correlation rules, alerts, etc. ● Include operational data here too (e.g., website response time change) Log Examples 56
● Need more information? The Splunk App for Enterprise Security (ES) has many built-in work flow actions to go pull more data ● Go pull more information from your Endpoint Threat Detection and Response app: – Tanium: http://apps.splunk.com/app/1862/ – Tripwire / nCircle ip360: Ask your SE – Bit9 / Carbon Black: https://www.bit9.com/solutions/splunk/ – Many others also exist ● File a ticket with your ticketing system – Remedy: http://answers.splunk.com/answers/122019 ● Open a new Notable Event in the Splunk App for ES Action 57
Go Play With Data 58 App with data gens and documentation http://splk.it/uo
Q&A
Thank You

More Related Content

PDF
SplunkSummit 2015 - ES Hands On Workshop
Splunk
 
PPTX
Using Splunk for Information Security
Shannon Cuthbertson
 
PPTX
Splunk Enterprise for InfoSec Hands-On Breakout Session
Splunk
 
PDF
SplunkSummit 2015 - Splunk User Behavioral Analytics
Splunk
 
PPTX
SplunkLive! - Splunk for Security
Splunk
 
PPTX
Gov & Education Day 2015 - User Behavior Analytics
Splunk
 
PPTX
Enterprise Sec + User Bahavior Analytics
Splunk
 
PPTX
SplunkLive! - Splunk for IT Operations
Splunk
 
SplunkSummit 2015 - ES Hands On Workshop
Splunk
 
Using Splunk for Information Security
Shannon Cuthbertson
 
Splunk Enterprise for InfoSec Hands-On Breakout Session
Splunk
 
SplunkSummit 2015 - Splunk User Behavioral Analytics
Splunk
 
SplunkLive! - Splunk for Security
Splunk
 
Gov & Education Day 2015 - User Behavior Analytics
Splunk
 
Enterprise Sec + User Bahavior Analytics
Splunk
 
SplunkLive! - Splunk for IT Operations
Splunk
 

What's hot (20)

PPTX
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
PDF
Splunk conf2014 - Dashboard Fun - Creating an Interactive Transaction Profiler
Splunk
 
PDF
SplunkLive! Stockholm 2015 breakout - Analytics based security
Splunk
 
PPTX
Splunk for Security-Hands On
Splunk
 
PPTX
Splunk for Security: Background & Customer Case Study
Andrew Gerber
 
PPTX
Getting Started with Splunk Enterprise Hands-On
Splunk
 
PPTX
Operational Security Intelligence Breakout Session
Splunk
 
PPTX
Drive more value through data source and use case optimization
Splunk
 
PPTX
Hands-On Security Breakout Session- ES Guided Tour
Splunk
 
PDF
Enterprise Security Guided Tour
Splunk
 
PDF
Splunk Discovery: Warsaw 2018 - Intro to Security Analytics Methods
Splunk
 
PPTX
Building a Security Information and Event Management platform at Travis Per...
Splunk
 
PDF
Splunk for Security
Gabrielle Knowles
 
PDF
SplunkLive! München 2016 - Splunk für Security
Splunk
 
PPTX
Splunk for Security - Hands-On
Splunk
 
PPTX
SplunkLive! Splunk App for VMware
Splunk
 
PPTX
Splunk Enterpise for Information Security Hands-On
Splunk
 
PPTX
Splunk for Enterprise Security Featuring User Behavior Analytics
Splunk
 
PDF
Conf2014_SplunkSecurityNinjutsu
Splunk
 
PPTX
SplunkLive! Milano 2016 - Splunk Plenary Session
Splunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
Splunk conf2014 - Dashboard Fun - Creating an Interactive Transaction Profiler
Splunk
 
SplunkLive! Stockholm 2015 breakout - Analytics based security
Splunk
 
Splunk for Security-Hands On
Splunk
 
Splunk for Security: Background & Customer Case Study
Andrew Gerber
 
Getting Started with Splunk Enterprise Hands-On
Splunk
 
Operational Security Intelligence Breakout Session
Splunk
 
Drive more value through data source and use case optimization
Splunk
 
Hands-On Security Breakout Session- ES Guided Tour
Splunk
 
Enterprise Security Guided Tour
Splunk
 
Splunk Discovery: Warsaw 2018 - Intro to Security Analytics Methods
Splunk
 
Building a Security Information and Event Management platform at Travis Per...
Splunk
 
Splunk for Security
Gabrielle Knowles
 
SplunkLive! München 2016 - Splunk für Security
Splunk
 
Splunk for Security - Hands-On
Splunk
 
SplunkLive! Splunk App for VMware
Splunk
 
Splunk Enterpise for Information Security Hands-On
Splunk
 
Splunk for Enterprise Security Featuring User Behavior Analytics
Splunk
 
Conf2014_SplunkSecurityNinjutsu
Splunk
 
SplunkLive! Milano 2016 - Splunk Plenary Session
Splunk
 
Ad

Similar to Level Up Your Security Skills in Splunk Enterprise (20)

PPTX
Security Automation & Orchestration
Splunk
 
PDF
Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...
Splunk
 
PPTX
Splunk for Enterprise Security and User Behavior Analytics
Splunk
 
PPTX
SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...
Splunk
 
PPTX
PPT-Splunk-LegacySIEM-101_FINAL
Risi Avila
 
PPTX
SplunkLive! Zurich 2018: Intro to Security Analytics Methods
Splunk
 
PPTX
SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
Splunk
 
PDF
Splunk Discovery: Warsaw 2018 - Solve Your Security Challenges with Splunk En...
Splunk
 
PPTX
SplunkLive! Paris 2018: Legacy SIEM to Splunk
Splunk
 
PPTX
SplunkLive! Munich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
Splunk
 
PPTX
Taking Splunk to the Next Level - Management Breakout Session
Splunk
 
PPTX
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
PPTX
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
PPTX
Getting Started with Splunk (Hands-On)
Splunk
 
PPTX
Getting Started with Splunk Enterprise
Splunk
 
PPTX
Splunk Webinar: Webinar: Die Effizienz Ihres SOC verbessern mit neuen Funktio...
Splunk
 
PPTX
Endpoint Modeling 101 - A New Approach to Endpoint Security
Observable Networks
 
PPTX
Getting Started with Splunk Enterprise
Splunk
 
PPTX
Splunk for Enterprise Security Featuring UBA
Splunk
 
PDF
PSUG 5 - 2025-01-20 - Splunk Observability And Digital Resilience
Tomas Moser
 
Security Automation & Orchestration
Splunk
 
Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...
Splunk
 
Splunk for Enterprise Security and User Behavior Analytics
Splunk
 
SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...
Splunk
 
PPT-Splunk-LegacySIEM-101_FINAL
Risi Avila
 
SplunkLive! Zurich 2018: Intro to Security Analytics Methods
Splunk
 
SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
Splunk
 
Splunk Discovery: Warsaw 2018 - Solve Your Security Challenges with Splunk En...
Splunk
 
SplunkLive! Paris 2018: Legacy SIEM to Splunk
Splunk
 
SplunkLive! Munich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
Splunk
 
Taking Splunk to the Next Level - Management Breakout Session
Splunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk
 
Getting Started with Splunk (Hands-On)
Splunk
 
Getting Started with Splunk Enterprise
Splunk
 
Splunk Webinar: Webinar: Die Effizienz Ihres SOC verbessern mit neuen Funktio...
Splunk
 
Endpoint Modeling 101 - A New Approach to Endpoint Security
Observable Networks
 
Getting Started with Splunk Enterprise
Splunk
 
Splunk for Enterprise Security Featuring UBA
Splunk
 
PSUG 5 - 2025-01-20 - Splunk Observability And Digital Resilience
Tomas Moser
 
Ad

More from Splunk (20)

PDF
Splunk Leadership Forum Wien - 20.05.2025
Splunk
 
PDF
Splunk Security Update | Public Sector Summit Germany 2025
Splunk
 
PDF
Building Resilience with Energy Management for the Public Sector
Splunk
 
PDF
IT-Lagebild: Observability for Resilience (SVA)
Splunk
 
PDF
Nach dem SOC-Aufbau ist vor der Automatisierung (OFD Baden-Württemberg)
Splunk
 
PDF
Monitoring einer Sicheren Inter-Netzwerk Architektur (SINA)
Splunk
 
PDF
Praktische Erfahrungen mit dem Attack Analyser (gematik)
Splunk
 
PDF
Cisco XDR & Splunk SIEM - stronger together (DATAGROUP Cyber Security)
Splunk
 
PDF
Security - Mit Sicherheit zum Erfolg (Telekom)
Splunk
 
PDF
One Cisco - Splunk Public Sector Summit Germany April 2025
Splunk
 
PDF
.conf Go 2023 - Data analysis as a routine
Splunk
 
PDF
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
Splunk
 
PDF
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
Splunk
 
PDF
.conf Go 2023 - Raiffeisen Bank International
Splunk
 
PDF
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
Splunk
 
PDF
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
Splunk
 
PDF
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
Splunk
 
PDF
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
Splunk
 
PDF
.conf go 2023 - De NOC a CSIRT (Cellnex)
Splunk
 
PDF
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
Splunk
 
Splunk Leadership Forum Wien - 20.05.2025
Splunk
 
Splunk Security Update | Public Sector Summit Germany 2025
Splunk
 
Building Resilience with Energy Management for the Public Sector
Splunk
 
IT-Lagebild: Observability for Resilience (SVA)
Splunk
 
Nach dem SOC-Aufbau ist vor der Automatisierung (OFD Baden-Württemberg)
Splunk
 
Monitoring einer Sicheren Inter-Netzwerk Architektur (SINA)
Splunk
 
Praktische Erfahrungen mit dem Attack Analyser (gematik)
Splunk
 
Cisco XDR & Splunk SIEM - stronger together (DATAGROUP Cyber Security)
Splunk
 
Security - Mit Sicherheit zum Erfolg (Telekom)
Splunk
 
One Cisco - Splunk Public Sector Summit Germany April 2025
Splunk
 
.conf Go 2023 - Data analysis as a routine
Splunk
 
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
Splunk
 
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
Splunk
 
.conf Go 2023 - Raiffeisen Bank International
Splunk
 
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
Splunk
 
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
Splunk
 
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
Splunk
 
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
Splunk
 
.conf go 2023 - De NOC a CSIRT (Cellnex)
Splunk
 
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
Splunk
 

Recently uploaded (20)

PDF
KodekX | Application Modernization Development
KodekX
 
PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
solutions_manual_-_materials___processing_in_manufacturing__demargo_.pdf
AbdullahSani29
 
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
PDF
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PDF
NewMind AI Weekly Chronicles - August'25 Week I
NewMind AI
 
PPT
“AI and Expert System Decision Support & Business Intelligence Systems”
ZubinRadhakrishnan
 
PPT
Teaching material agriculture food technology
LiaRayya
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PPTX
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
PDF
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
PDF
Advanced Soft Computing BINUS July 2025.pdf
University of Hertfordshire
 
KodekX | Application Modernization Development
KodekX
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
Approach and Philosophy of On baking technology
30anthuong17
 
solutions_manual_-_materials___processing_in_manufacturing__demargo_.pdf
AbdullahSani29
 
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
NewMind AI Weekly Chronicles - August'25 Week I
NewMind AI
 
“AI and Expert System Decision Support & Business Intelligence Systems”
ZubinRadhakrishnan
 
Teaching material agriculture food technology
LiaRayya
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
Advanced Soft Computing BINUS July 2025.pdf
University of Hertfordshire
 

Level Up Your Security Skills in Splunk Enterprise

  • 1. Copyright © 2015 Splunk Inc. Level Up Your Security Skills in Splunk Enterprise
  • 2. Legal Notices During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward-looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. 2
  • 3. Today’s Speakers 3 Niklas Blomquist – Security Lead EMEA North – Splunk
  • 4. Visibility—Analysis—Action in Four Scenarios 1. Automated threat intelligence response 2. Statistical Anomaly detection leads to opening a ticket 3. Statistical Profiling leads to manager confirmation 4. Visual correlation to track an attack against the “kill chain” Agenda 4
  • 5. ● Niklas Blomquist – Security Lead EMEA North ● nblomquist@splunk.com ● 18 years security experience ● 3 years @ splunk ● Love tech deep dives ● My favorite search command is stats! Who Am I? 5
  • 6. ● Framework for evaluating data and responding Splunk ● Applies to all existing frameworks, as it’s the Splunk side of the loop. ● For example, Let’s look at the lateral movement section of the kill chain. (Not familiar with the kill chain? It’s a great way to understand the phases of an attack. Check the URL below.) ● Visibility: What data will let you detect Lateral Movement? ● Analysis: What will you do to that data to come to a decision? ● Action: What will you do in response to that decision? – Can we automate all of this? Kill Chain: http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf Visibility – Analysis – Action
  • 8. ● New threat list intel available for command and control (C&C) ● Changing firewall policy manually is too slow ● Goal: Take in the firewall logs, leverage intelligence to detect C&C behavior, and block the destinations in near real time ● Visibility: Firewall logs, threat intel sources ● Analysis: Intersection (lookup) of the two ● Action: Apply dynamic firewall blocks Command and Control Detection and Blocking 8
  • 9. ● A feed of known bad IPs/DNS names/MD5s/URLs/etc. from a vendor or non- profit that specializes in discovering Indicators of Compromise ● Great sources of open source threat intel include: – Emerging Threats: http://rules.emergingthreats.net/ – I-Blocklist: https://www.iblocklist.com/lists.php – MalwareDomains: http://www.malwaredomains.com/ – Zeus Tracker: https://zeustracker.abuse.ch/ ● Many great commercial entities, too (generally better ranking / quality) – iSight Partners, Verizon iDefense, commercial versions of most of the above, and many many more What / Where is Threat Intelligence 9
  • 10. Palo Alto Networks Firewall Log Sep 15 19:02:06 1,2014/09/15 19:02:06,0004C104559,TRAFFIC,end,1,2014/09/15 19:02:05,10.2.2.14,206.16.215.101,206.16.216.158,214.34.245.101,Internet Traffic,,, salesforce- base,vsys1,Trust,Untrust,ethernet1/8,ethernet1/2,MyLogForwarding,2014/09/15 19:02:05,24238,1,61845,443,57339,443,0x400000,tcp,allow,1275,761,514,14,2014/09/ 15 19:01:31,5,any,0,358477769,0x0, 10.0.0.0-10.255.255.255, United States,0,8,6 Traffic Machine Data 10 Src and Dest IPs Threat Intel Lookup: dest,threat_intel_source 115.29.46.99/32,zeus_c2s 61.155.30.0/24,cymru_http
  • 11. 1. First, we want to pull out all firewall traffic coming from inside our network, going outside our network 2. Then, we want to cross-reference that data with our threat intel list. This is accomplished in the Splunk world via a lookup 3. Finally, we want to pull just the logs that have threat intel Analysis 11 index=pan_logs sourcetype=pan_traffic src=“10.*” dest!=“10.*” | lookup ThreatIntel dest | search threat_intel_source=* Name of our lookup, and the key field Data held in Lookup Table
  • 12. ● Panblock! (or other network response) Block a User or System 12
  • 15. ● Have a Palo Alto device and like this particular feature? Visit – Docs: https://live.paloaltonetworks.com/docs/DOC-6593 – App Page: http://apps.splunk.com/app/491/ ● Want to automate other firewalls? Ask your SE about: – Expect scripts for Cisco, Juniper, etc. – Threat intel integration with Check Point – How to integrate with your particular brand of firewall Where to Learn More About PAN Blocking 15
  • 16. ● Multiple Threat Lists—Deprioritize open source threat list vs. premium threat list – Solution: the Splunk App for Enterprise Security has this fixed with deduping and prioritizing – Alternate Solution: | inputlookup Premium| append [|inputlookup OpenSource] | munge | outputlookup MyList ● Performance—you get lots of traffic, maybe you have lots of threat intel entries – Solution: the Splunk App for Enterprise Security – Alternate Solution: data models help substantially Analysis—Challenges 16
  • 18. ● Process monitoring are good practice, and is easy with Splunk ● It becomes harder at scale, but data model acceleration helps ● Ultimately, by conquering statistical anomaly detection, you can more effectively find the difficult to detect in your systems ● Visibility: Carbon Black Logs ● Analysis: System distribution, accelerated via data models ● Action: Security incident creation Statistical Anomaly Detection Essentials 18
  • 19. ● A measure of the variance for a series of numbers ● One file is opened on 100, 123, 79, and 145 hosts per day – average of 111.75 and a standard deviation of 28.53 ● Another file is opened on 100, 342, 3 and 2 hosts per day – average of 111.75, but a standard deviation of 160.23 What is Standard Deviation? 19
  • 20. Endpoint Machine Data 20 {"action": "write", "timestamp": 1410911994, "path": "c:Program FilesSplunkbinsplunk-perfmon.exe", "type": "filemod", "process_guid": 36661217281} Visibility Analysis Action
  • 21. • Acceleration facilitates better and broader analysis • Splunk has a few ways of accelerating content: • Report Acceleration • Data Model Acceleration • Summary Indexing • Pre-Processing of logs • Search pipeline parallelization How To Accelerate 21
  • 22. Create a data model and accelerate Create Data Model 22 Visibility Analysis Action
  • 23. • Create a baseline pivot search and open in search • In this case, split dc(host) by path • Add a filter for critical paths Create Pivot Search 23 Visibility Analysis Action
  • 24. Add additional stats command on top of accelerated Pivot search. Create Additional Statistics 24 Visibility Analysis Action
  • 25. Only Show Suspect Entries 25 Visibility Analysis Action
  • 26. ● E-mail ● Script ● Alert Action Create a New Incident 26 Visibility Analysis Action
  • 28. ● 29 security related data models ● Normalize the data to get the searches easier to create ● Use’s TA’s to get the data in ● Available for free at Splunkbase ● https://splunkbase.splunk.com/app/1621/ CIM
  • 30. ● .CONF Session: http://splk.it/e68 ● .CONF Session PDF: http://splk.it/g7m ● .CONF Session Recording: http://splk.it/b6m Visibility Analysis Action
  • 32. ● Detecting known bad is great, but leaves you vulnerable ● Augment with synthetic checks of sensitive systems ● Statistics can consume all your time ● In this scenario, we are a hospital tracking patient chart opens ● Visibility: Charting system logs ● Analysis: Frequency analysis by user, role, etc. ● Action: Email the employees’ managers to investigate Statistical Behavioral Anomaly Detection 33
  • 33. ● A measure of the variance for a series of numbers ● Jane opens 100, 123, 79, and 145 charts per day – average of 111.75 and a standard deviation of 28.53 ● Jack opens 100, 342, 3 and 2 charts per day – average of 111.75, but a standard deviation of 160.23 ● Jack and Jane both open 500 records one day, Jane’s Z score will be 13.6, but Jack’s will only be 2.42 ● Z score = number of standard deviations away from average What is Standard Deviation? 34
  • 34. <audit_list><audit_version>1</audit_version> <event_dt_tm>2014-09-06 23:59:59.52</event_dt_tm> <outcome_ind>0</outcome_ind> <user_name>AHARVEY</user_name> <prsnl_id>117499</prsnl_id> <prsnl_name>Angel Harvey</prsnl_name> <role>DBA</role> <role_cd>24209801</role_cd><enterprise_site>HNAM</enterprise_site><audit_source>Test/Domain</audit_source><audit_source_ty pe>600005</audit_source_type><network_acc_type>1</network_acc_type><network_acc_id>MTYVQ- ACTX03</network_acc_id><application>HNA: Powerchart</application><task>RUN PowerView Preferences</task><request>cps_ens_ppa</request><appl_ctx>346793285</appl_ctx><perform_cnt>69</perform_cnt><event_list><e vent_name>Maintain Person</ event_name> <event_type>Chart Access Log</event_type> […….]</audit_list> File Access Log Examples 35 Visibility Analysis Action
  • 35. ● Core Metric: chart opens per day, per employee ● Dimensions to compare: – Over time for the same user – Others with same title – Others in same city, etc. ● Why multiple dimensions? Analysis 36 Visibility Analysis Action
  • 36. index=cerner | eval EmployeeID=spath(_raw, "audit_list.prsnl_id") | eval EmployeeName = […] | eval RecordNum= […] | bucket _time span=1d | stats dc(RecordNum) as NumRecords by EmployeeName, EmployeeID, _time | stats first(NumRecords) avg(NumRecords) stdev(NumRecords) by EmployeeName, EmployeeID | where ‘first(NumRecords)’ > ‘avg(NumRecords)’ + ‘stdev(NumRecords)’ * 6 Dimensions to compare—Basic 37 Visibility Analysis Action
  • 39. • Acceleration facilitates better and broader analysis • Splunk has a few ways of accelerating content: • Report Acceleration • Data Model Acceleration • Summary Indexing • Pre-Processing of logs • Search pipeline parallelization How To Accelerate 40
  • 40. index=cerner | eval Role=spath(_raw, "audit_list.role") | eval RoleID = […] | eval EmployeeID= […] | eval EmployeeName = […] | eval PatientNum= […] | bucket _time span=1d | stats dc(PatientNum) as NumRecords by EmployeeName, EmployeeID, Role, RoleID _time | lookup HR_IS.csv EmployeeID | tscollect retain_events=t Cerner Dimensions to compare—Acceleration 41 Visibility Analysis Action
  • 41. | tstats local=t first(NumCharts) as Recent_NumCharts avg(NumCharts) as Avg_NumCharts stdev(NumCharts) as Stdev_NumCharts from Cerner groupby EmployeeName, EmployeeID, Username, Role, RoleID, City, YearsAtCompany | join type=outer RoleID [| tstats local=t avg(NumCharts) as Role_Avg_NumCharts stdev(NumCharts) as Role_Stdev_NumCharts from Cerner groupby Role, RoleID ] Find Statistical Outliers Pt 1 42 Visibility Analysis Action
  • 42. [… continued from previous slide …] | eval Personal_Z = abs(Recent_NumCharts-Avg_NumCharts)/Stdev_NumCharts | eval Role_Z = abs(Recent_NumCharts- Role_Avg_NumCharts)/Role_Stdev_NumCharts | eval Z_Min = min(Role_Z, Personal_Z) | where Z_Min > 6 Find Statistical Outliers Pt 2 43 Visibility Analysis Action
  • 43. ● Email the manager ● This option is mostly just formatting. Join to the HR / LDAP database and utilize sendemail + map ● Could also escalate big violations to the SOC or GRC | lookup LDAPSearch sAMAccountManager as username OUTPUT manager | lookup LDAPSearch dn as manager OUTPUT mail as ManagerEmail “ Send custom E-Mail 44 | map maxsearches=100 search=“ | stats count | eval ManagerEmail=$ManagerEmail$ | eval EmployeeName=$EmployeeName$ | eval ZAvg = $Z_Avg$ | sendemail to=ManagerEmail sendresults=f subject=EmployeeName . “ excess Chart Opens” message=EmployeeName . “ has opened more charts than normal (“ . ZAvg . “ stdev). _._Please Follow Up.” Visibility Analysis Action
  • 46. ● Analytics are key, but not everything can be correlated ● Human eye can detect all manner of subtlety – Progress through Cyber Kill Chain – Movement toward critical assets – Etc. ● Easiest with the Splunk App for Enterprise Security, but possible without Visual Event Correlation 47
  • 50. 361+ security appsSplunk App for Enterprise Security Splunk Security Intelligence Platform Palo Alto Networks NetFlow Logic FireEye Blue Coat Proxy SG OSSECCisco Security Suite Active Directory F5 Security Juniper Sourcefire
  • 51. Build vs Buy Most customer use a combination of build/buy BuyBuild ● Knowledge – what to look for ● Time/money – create the content ● IT-Security Analysts and Researchers are rare on the market. ● Customized to your specific organizational needs ● Out of the box content ● Requires no tuning ● Excessive analytics ● Quick time to value
  • 54. User & Entity Behavior Analytic Unsupervised machine learning with “out of the box” content
  • 55. ● Anything. This should encompass all of your log sources, correlation rules, alerts, etc. ● Include operational data here too (e.g., website response time change) Log Examples 56
  • 56. ● Need more information? The Splunk App for Enterprise Security (ES) has many built-in work flow actions to go pull more data ● Go pull more information from your Endpoint Threat Detection and Response app: – Tanium: http://apps.splunk.com/app/1862/ – Tripwire / nCircle ip360: Ask your SE – Bit9 / Carbon Black: https://www.bit9.com/solutions/splunk/ – Many others also exist ● File a ticket with your ticketing system – Remedy: http://answers.splunk.com/answers/122019 ● Open a new Notable Event in the Splunk App for ES Action 57
  • 57. Go Play With Data 58 App with data gens and documentation http://splk.it/uo
  • 58. Q&A

Editor's Notes

  • #5: Why should we do this. AFI
  • #52: 1 solution for Splunk for Security, but 3 offerings. At bottom is Splunk Enterprise, our core product. Every Splunk deployment includes this as this is where the core indexing and searching resides. Many customers build their own searches/reports/dashboards on top of it. On top of it, optional Apps can be installed. Apps are basically a collection of reports, dashboards, and searches purpose-built for a specific use case or product. Can be built by Splunk, customer, partners and all but a few are free on Splunkbase. Apps are great for customers who want out-of-the-box content and do want to have to build it themselves, and want to extend point solutions. One key App is the Splunk-built Enterprise Security app with the arrow pointing at it. It is basically an out-of-the-box SIEM with reports, dashboards, correlation rules, and workflow for security use cases. (It does have a cost though) Besides this app there are over 80 security-centric free Apps on Splunkbase. These are offering 3. The majority of Splunk security customers do Splunk Enterprise and the free apps. Also customers do leverage the API and SDKs that come with Splunk to further extend the platform.