Spliunk Discovery Köln - 17-01-2020 - Intro to Security Analytics Methods
Download as PPTX, PDF2 likes238 views
The document is an introduction presentation for security analytics methods using Splunk. It discusses forward-looking statements and outlines the agenda which includes an overview of Splunk Security Essentials, a demo/walkthrough of the app, and an end-to-end scenario example. It also summarizes key analytics methods like general security searches, time series analysis using standard deviation, and first time seen events.
Spliunk Discovery Köln - 17-01-2020 - Intro to Security Analytics Methods
- 1. © 2019 SPLUNK INC. Intro to Security Analytics Methods Start: 13:30 Udo Götzen Staff Sales Engineer | CISSP Security SME
- 2. During the course of this presentation, we may make forward‐looking statements regarding future events or plans of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results may differ materially. The forward-looking statements made in the this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, it may not contain current or accurate information. We do not assume any obligation to update any forward‐looking statements made herein. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionalities described or to include any such feature or functionality in a future release. Splunk, Splunk>, Turn Data Into Doing, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2019 Splunk Inc. All rights reserved. Forward- Looking Statements © 2019 SPLUNK INC.
- 3. © 2019 SPLUNK INC. Who Are You? • Maybe a user of Splunk Security Essentials? • All Levels of Splunk Experience • You probably like security Technical Business New to Splunk Years of Splunk YOU
- 4. © 2019 SPLUNK INC. Key Takeaways from This Session 1) Improved ability to detect potentially suspicious activity 2) Free, powerful out-of-the-box security analytics methods
- 5. © 2019 SPLUNK INC. Agenda 1) Security Analytics 101 2) Splunk Security Essentials (SSE) Overview 3) SSE Demo/Walk Through 4) End-to-End Scenario 5) Wrap Up
- 6. © 2019 SPLUNK INC. Splunk Security Pillars and Portfolio • Universal indexing • Petabyte scale • Multi-schema • Search, alert, report, visualize • Broad support Machine Learning Toolkit (MLTK) Data Analytics Operations ES CONTENT UPDATE ADAPTIVE RESPONSE ADAPTIVE OPERATIONS FRAMEWORK
- 7. © 2019 SPLUNK INC. Common Security Challenges Malicious Insiders Commodity Malware Advanced External Attackers
- 8. © 2019 SPLUNK INC. Analytics Methods General Security Analytics Searches Time Series Analysis with Standard Deviation First Time Seen Powered by Stats Types of Use Cases
- 9. © 2019 SPLUNK INC. Analytics Methods General Security Analytics Searches Time Series Analysis with Standard Deviation First Time Seen Powered by Stats Types of Use Cases
- 10. © 2019 SPLUNK INC. Analytics Methods General Security Analytics Searches Time Series Analysis with Standard Deviation First Time Seen Powered by Stats Types of Use Cases
- 11. © 2019 SPLUNK INC. Implementation Approach for Security Analytics Alert Aggregation Threat Detection • Manage high volume • Track entity relationships • Combination ML + Rules Alert Creation Simpler Detection • Rules and statistics • Quick development • Easy for analysts ML Based Detection • Detect unknown • New vectors • Heavy data science Investigation Investigative Platform • Analyst flexibility • Provide access to data analysis solutions • Record historical context for everything
- 12. © 2019 SPLUNK INC. Implementation Approach for Security Analytics Alert Aggregation Threat Detection • Manage high volume • Track entity relationships • Combination ML + Rules Alert Creation Simpler Detection • Rules and statistics • Quick development • Easy for analysts ML Based Detection • Detect unknown • New vectors • Heavy data science Investigation Investigative Platform • Analyst flexibility • Provide access to data analysis solutions • Record historical context for everything
- 13. © 2019 SPLUNK INC. Implementation Approach for Security Analytics Alert Aggregation Threat Detection • Manage high volume • Track entity relationships • Combination ML + Rules Alert Creation Simpler Detection • Rules and statistics • Quick development • Easy for analysts ML Based Detection • Detect unknown • New vectors • Heavy data science Investigation Investigative Platform • Analyst flexibility • Provide access to data analysis solutions • Record historical context for everything
- 14. © 2019 SPLUNK INC. Splunk Security Essentials Overview
- 15. © 2019 SPLUNK INC. Splunk Security Essentials Identify Bad Guys: • 450+ security analytics methods • Free on Splunkbase – use on Splunk Enterprise • Target external and insider threats • Advanced threat detection, compliance, and more • Scales from small to massive companies • Data source onboarding guidance • MITRE ATT&CK and Kill Chain mappings • Save from app, send hits to ES / UBA Solve use cases you can today for free, then use Splunk UBA for advanced ML detection. https://splunkbase.splunk.com/app/3435/
- 16. © 2019 SPLUNK INC.
- 17. © 2019 SPLUNK INC. Splunk Security Essentials App — Runs on Splunk Enterprise QUICK EASY FREE
- 18. © 2019 SPLUNK INC. Security Journey — Data-Driven Approach Stage 6 Stage 5 Stage 4 Stage 3 Stage 2 Stage 1 Advanced Detection Apply sophisticated detection mechanisms including machine learning Automation & Orchestration Establish a consistent and repeatable security operation capability Enrichment Augment security data with intelligence sources to better understand the context and impact of an event Expansion Collect additional high fidelity data sources like endpoint activity and network metadata to drive advanced attack detection Normalization Apply a standard security taxonomy and add asset and identity data Collection Collect basic security logs and other machine data from your environment
- 19. © 2019 SPLUNK INC. Data Onboarding Guides • AWS CloudTrail + VPC Flow • Cisco ASA • Linux Security Logs • Microsoft Sysmon • Microsoft Office 365 • Palo Alto Networks • Stream DNS • Symantec AV • Windows Security
- 20. © 2019 SPLUNK INC. SSE Demo
- 21. © 2019 SPLUNK INC. Getting Started with Splunk Security Essentials • Download from apps.splunk.com • Install on your Search Head, standalone Splunk server, or even a laptop • Browse use cases that match your needs • Data Source Check shows other use cases for your existing data • Evaluate free tools to meet gaps, such as Microsoft Sysmon – (links inside the app)
- 22. © 2019 SPLUNK INC. Open the Splunk Security Essentials App First Open Splunk Security Essentials Then Open Use Cases
- 23. © 2019 SPLUNK INC. Pre-requisite Checks • For those just starting out, it can be hard to know what data you need • Every use case comes with pre-req checks to show if you have the data • If you don’t, follow the links
- 24. © 2019 SPLUNK INC. Or Check EVERYTHING • Data Source Check tells you what’s possible • Runs all pre-req checks Click “Start Searches”
- 25. © 2019 SPLUNK INC. Create Posture Dashboards Run the data source check first Allow it to complete the check Then click “Create Posture Dashboards” button
- 26. © 2019 SPLUNK INC. Posture Dashboards (cont’d) If You Don’t Have Live Data Yet, Click “Demo Datasets” Number of Available Visualizations will Update Accordingly
- 27. © 2019 SPLUNK INC. Posture Dashboards (cont’d) Select Desired Visualization Category (or Categories) Select Non-Default Searches if Desired Generate Selected Dashboards!
- 28. © 2019 SPLUNK INC. Posture Dashboards (cont’d) • Essential Account Security – Data sources include General Authentication, Windows 10, and Active Directory • Essential Host Security – Data sources include Windows Endpoint, Anti-virus • Essential Network Security – Data sources include Firewall, Next- Gen Firewall, and Web Proxy
- 29. © 2019 SPLUNK INC. Take a Minute to Review Use Cases • Read through a few of the use cases • Filter for use cases you care about
- 30. © 2019 SPLUNK INC. Let’s Start With a Simple Example Click on “Concentration of Hacker Tools by Filename”
- 31. © 2019 SPLUNK INC. Concentration of Hacker Tools by Filename • A search you might not think of, but is easy to use • Input: CSV file with suspicious filenames • Input: Process launch logs (Windows, Sysmon, Carbon Black, etc.) • Looks for those file names concentrated in a short period of time
- 32. © 2019 SPLUNK INC. Applying to Live Data Click Live Data See a Live Search
- 33. © 2019 SPLUNK INC. An Advanced Splunk Search • Phishing is a big risk • Many approaches to mitigating with Splunk Click on ‘Emails with Lookalike Domains’ From Journey Select Stage 4 From Data Sources, Filter to Email Logs
- 34. © 2019 SPLUNK INC. A Phishing Search Larger Than Your Pond • A very long search you don’t have to run • Detects typos, like company.com → campany.com • Supports subdomains for typo detection • Detects suspicious subdomains, like company.com → company.yourithelpdesk.com
- 35. © 2019 SPLUNK INC. What About Baselines Splunk can also build baselines easily Let’s look at a Time Series Spike This detects anomalies via Standard Deviation From Data Sources, Filter to Print Server Logs Then, Increase in Pages Printed
- 36. © 2019 SPLUNK INC. What is Standard Deviation? • A measure of the variance for a series of numbers User Day One Day Two Day Three Day Four Avg Stdev Jane 100 123 79 145 111.75 28.53 Jack 100 342 3 2 111.75 160.23 User Day Five # StDev from Average … aka How Unusual? Jane 500 13.6 Jack 500 2.42
- 37. © 2019 SPLUNK INC. Increase in Pages Printed • Our search looks for printer logs • Sums per day, per user • Note the tooltips everywhere! Click “Detect Spikes” to find outliers
- 38. © 2019 SPLUNK INC. Want to Learn That SPL for Yourself? • Just click Show SPL to see how the search works • Learn this once… it applies to all time series spikes! • (Or just use the app)
- 39. © 2019 SPLUNK INC. Want to Schedule That Search? • Want to use that search? • Just click Schedule Alert • Searches will auto send to ES Risk or UBA if you have either • Or just email to yourself
- 40. © 2019 SPLUNK INC. What Else Do You Have For Me? • We can use baseline to find new combinations too • This can help with any noisy search you have today Then, Authentication Against a New Domain Controller
- 41. © 2019 SPLUNK INC. Authentication Against a New DC • This search uses stats earliest() and latest() per User, DC • If the earliest() is recent, it’s anomalous • This works for any combination! Click “Detect New Values” for outliers
- 42. © 2019 SPLUNK INC. Example Scenario
- 43. © 2019 SPLUNK INC. Apply Splunk to Real Life Scenario • Actor: – Malicious Insider (because it’s hardest) • Motivation: – Going to work for competitor • Target: – Accounts, Opportunities, Contacts in Salesforce • Additional Target: – Sales Proposals in Box • Exfiltration: – Upload to a remote server Malicious Insider • Jane Smith, Director of Finance – * Photo of Splunker, not an actual malicious insider
- 44. © 2019 SPLUNK INC. Monitoring Challenges • No proxy • No standard file servers • No agents on laptop • Cloud Services with their own APIs • How would you detect that?
- 45. © 2019 SPLUNK INC. Set Up Collect Relevant Logs • Ingest Salesforce Event Log File – https://splunkbase.splunk.com/app/1931/ • Ingest Box Data – https://splunkbase.splunk.com/app/2679/ Install Splunk Security Essentials • https://splunkbase.splunk.com/app/3435/ Configure Analytics • e.g., schedule Salesforce.com searches • e.g., build a custom Box use case About 1 Hour of Work
- 46. © 2019 SPLUNK INC. Example Salesforce.com Searches • New clients accessing SFDC API • High-risk activity • 1st-time peer group query of sensitive data • New sensitive tables being queried • Other searches indicating potential exfil
- 47. © 2019 SPLUNK INC. Targeting Our Search • Our Malicious Insider, Jane Smith, also downloaded some proposals from Box • Finding Box downloads spikes is easy, but we want focus on the Proposal Folder • We will use the Detect Spikes assistant to help us
- 48. © 2019 SPLUNK INC. “My Environment is So Custom” • Do you want to build your own detections like this? • What if your environment is totally custom? • No product has ever worked out of the box, and that’s why you like Splunk, right? • We’ve got you covered. Click Advanced, then “Detect Spikes”
- 49. © 2019 SPLUNK INC. • | inputlookup anonymized_box_logs.csv | search folder="PROPOSALS” | bucket _time span=1d | stats count by user _time • Looking for “count” by “user” with “6” standard deviations
- 50. © 2019 SPLUNK INC. • | inputlookup anonymized_box_logs.csv | search folder="PROPOSALS” | bucket _time span=1d | stats count by user _time • Looking for “count” by “user” with “6” standard deviations Got Her!
- 51. © 2019 SPLUNK INC. Operationalize! • Save / schedule the alert – send to Splunk Enterprise Security or UBA – Or send via email to analyst
- 52. © 2019 SPLUNK INC. Wrap Up
- 53. © 2019 SPLUNK INC. What Did We Cover? 1) Splunk Security Essentials teaches you new detection use cases 2) Easy to operationalize – standalone or with Splunk Enterprise Security and UBA 3) Makes it easy to customize use cases 4) As you advance, look to ES or UBA to improve threat detection, and ES and Phantom to accelerate containment, investigation, and response
- 54. © 2019 SPLUNK INC. What Is Enterprise Security? Mainframe Data Relational Databases MobileForwarders Syslog/ TCP IoT Devices Network Wire Data Hadoop Platform for Operational Intelligence Notable Events Asset & Identity Risk Analysis Threat Intelligence Use Case Library Adaptive Response
- 55. © 2019 SPLUNK INC. Go Get Started With Splunk Security Essentials! • Download from apps.splunk.com • Find use cases that match your needs • Data Source Check shows other use cases for your existing data • Evaluate free tools to meet gaps, such as Microsoft Sysmon – (links inside the app)
- 56. © 2019 SPLUNK INC. The Splunk Platform
- 57. © 2019 SPLUNK INC. Agenda Splunk Discovery Köln 17. Januar 2020 09:00–10:30 Keynote und Demo – Die Data-to-Everything Plattform 10:30–11:00 Pause Tech Track (Jupiter I+II) Business Track (Saturn I+II) 11:00–11:45 Mit der Splunk Plattform Daten in Mehrwert umwandeln ROI in Datenprojekten (in English) 11:45–12:30 Abenteuer bei Monitoring und Troubleshooting Kunden Use Cases 12:30–13:30 Mittagessen 13:30–14:15 Security Analytics Methoden Die Zukunft von Security Operations 14:15–15:00 Splunk Incident Response, Orchestrierung und Automation Die Zukunft von ITOA – von Monitoring zu Observability 15:00–15:30 Pause 15:30–16:15 Kunden Use Case: TÜV Trust IT 16:15–17:00 Networking Drinks
- 58. Thank You © 2019 SPLUNK INC.