SplunkLive! Zurich 2018: Splunk for Security at Swisscom CSIRT
1 like1,982 views
The document discusses the use of Splunk by the Swisscom CSIRT for various security applications, detailing their data insights platform and the technical infrastructure behind it. It highlights several specific use cases such as typosquatting domain monitoring and automated binary triage using Sysmon and VirusTotal. The Swisscom CSIRT utilizes Splunk to enhance their incident response capabilities and improve overall security operations through efficient data analysis and visualization.
SplunkLive! Zurich 2018: Splunk for Security at Swisscom CSIRT
- 1. Splunk for Security Use Cases of the Swisscom CSIRT Florian Leibenzeder, 08.05.2018
- 2. 2 About me >Working in IT Security for 18 years >Senior role & deputy head in the Swisscom CSIRT >Management tasks & duties but also still on the techie side >Fun fact: We don't have time for a fun fact J
- 3. Swisscom Facts & Figures 2017 400 Enterprise customers with oursourcing services 2,047 Mio Fixed access lines 1,467 Mio TV access lines 2,449 Mio Broadband access lines >Revenue: 11.66 Mrd >EBITDA: 4.3 Mrd >Employees: 20,500 >Net Profit: 1.57 Mrd 6,637 Mio Mobile access lines
- 4. > Splunking since 2006! Several independant platforms have evolved into the central Splunk Data Insights platform > Three-tier, data center redundant platform – total net storage: 1.8 Peta Byte > Indexer cluster: – 96 cluster nodes (each 56 CPU cores, 512 GB RAM) > 20 Intermediate/heavy forwarders (Linux VMs on ESX) > Main search head cluster: – 8 cluster nodes (each 80 CPU cores, 1 TB RAM, 500 GB storage) > Number of Splunk users: ca. 1400 > Number of services on the platform: ca. 170 > Data volume per day: ca. 6 TB Splunk@Swisscom Facts & Figures 2018
- 5. Data Insights Platform powered by Splunk Enterprise Center of Competence DevOps Approach DevOps – Delivery Model Intelligent IT Operations Security & Compliance Industrial Data & IoT Sample Use-Cases Building Blocks Analytics Platform Service Data Sources • DevOps Process Mon. • Application Mon. • Container Mon. • Capacity Planning • Infrastructure / OS • Network Wire(less) • Messaging • IAM / Security • Security Analytics • SOC / CSIRT • Compliance • Fraud • Diagnostic & Mon. • Predictive Mainten. • Asset Performance • Device Security Business Analytics • Product Analytics • Business Process • Customer Experience • Digital Marketing Splunk@Swisscom – the Data Insights Platform ProvidedasaservicebyourSplunkDevOpssquad Cloud Services Database ApplicationsNetwork Services FirewallWeb Services Endpoint Messaging SecurityServers Threat IntelAnti Malware IAM
- 6. Customer Need > Acquire Data > Aggregate > Analyse, normalize > Pattern & triggers > Visualisation > Optimize > Steer > Automate Customer Success Acquire AnalyseAct > Reactive to proactive > Optimized analytics > Trend analysis > Increase quality > Customer experience > Significance The Swisscom Data Insights Method Fromdatatovalue–providedSwisscominternallyandtoEnterprisecustomers
- 7. Swisscom Computer Security Incident Response Team Duties and areas of expertise How we use Splunk Swisscom CSIRT Threat Intelligence Vulnerability Management Abuse Management Project Support Incident Response Threat Hunting Goal: > Build meaningful, actionable Splunk content that enables efficient CSIRT operations Let's see some examples!
- 8. Use Case Typosquatting Domain Monitoring
- 9. Need: > Monitor the use of typosquatted Swisscom domains for mail and proxy traffic and be able to analyze them quickly Prerequisites: > Generate typosquatting domain lists (using tools urlcrazy, dnstwist and manual tuning) -> list of ca. 6300 domains Challenge: > Proxy Logs: up to 200 Mio events per day -> up to 5000 EPS peaks -> lookup against 6'300 typo domains – Dashboard with ad-hoc searches would take ages to populate Approach > Summarize domains first and use those summaries for typo-domain matching and further analysis content Result and benefit > Extremely fast monitoring and analysis dashboard > Summaries support several other use cases Typosquatting Domain Monitoring Or:issomeonetryingtophishus?
- 10. Typosquatting Domain Monitoring Buildingthesummaries 1. Parse aggregated domains with the help of URL Toolbox App 2. Write summary -> 500-600K events per day (compared to 200 Mio raw events). The parsed domain summaries enables various statistics and high-perfomance search use cases on domains 3. Now match against our typo-domain lookup -> results in 0-30 hits per search run 4. Use map command to pull raw events for typo-domain matches 5. Summarize them -> 300-500 events a day > Here comes the SPL slide of the presentation. And a rather basic one J
- 11. > Based on the summaries > Loads within seconds Typosquatting Domain Monitoring AnalysisDashboard
- 12. Use Case: Sysmon and Virustotal for automated binary triage …and subsequent analysis workflows
- 13. What‘s needed to get started? > Good understanding of Sysmon capabilities AND tuned Sysmon configuration – How to go from Responding to hunting with Sysinternals Sysmon (Marc Russinovic, RSA Conf 2017) Intro to Sysmon and its use for Security by the author of Sysmon. – Advanced Incident Detection and Threat Hunting using Sysmon (Tom Ueltschi (Swiss Post), 29th FIRST Conf 2017) Lots of resources, use cases and technical deep dives – SwiftOnSecurity Symon-Config Very good starting point to build your own Sysmon config > Sysmon event collection from workplace systems in Splunk – We use native Windows Event Forwarding to 2 Windows VMs with Splunk UF to collect Sysmon events from > 25'000 clients à about 80-100 Mio events a day. > Some Sysmon summary indexing or a custom data model for performance – We use two summaries with decreasing information detail Yet another Sysmon Use Case Plentyofexcellentmaterialandusecasesforsysmonavailableonline
- 14. > Around 10'000 unique binaries run daily in our workplace environment. Several hundred of them for the first time. -> We wanted an automated first triage for all of them which also supports our threat hunting and incident response with very fast analysis capabilities > Use Case Foundation: Distinct Binaries List (DBL) Initially created and now daily incremented summary of unique binaries (md5 hashes) run in our workplace environment, enriched with first_seen & last_seen timestamps and Virustotal data (private VT API license needed) > Harness the power of Splunk SPL: One single nightly Splunk scheduled search Result & Benefit: > CISRT Incident Manager on Duty gets a quick overview of potential threats and unwanted binaries in our environment and can start or assign further investigations. Sysmon and Virustotal for automated binary triage Usecaseneedandapproach Read DBL Search all unique binaries from yesterday Update DBL: append new binaries and update last_seen timestamps for known ones Virustotal Lookup for new binaries Enrich DBL with VT info for new binaries Generate HipChat notification to CSIRT
- 15. Sysmon and Virustotal for automated binary triage TheHipChatnotification > Sysmon Daily Stats send as HipChat notification (HipChat Room Notification Alert App) Links to Splunk Analsyis Dashboard
- 16. Sysmon and Virustotal for automated binary triage SysmonHashHuntingDashboard > Full list of first seen binaries from daily distinct binary summary > Dashboard also used for hunting & threat response (e.g. APT binary checks) > Extremely fast due to summaries > Drill-down capabilities
- 17. Sysmon and Virustotal for automated binary triage SysmonHashHuntingDashboard Link to Virustotal Search Results of md5 hash > Full list of first seen binaries from daily distinct binary summary > Dashboard also used for hunting & threat response (e.g. APT binary checks) > Extremely fast due to summaries > Drill-down capabilities
- 18. Open inline drill-down panel with event details Sysmon and Virustotal for automated binary triage SysmonHashHuntingDashboard Open inline drill-down panel with event details > Full list of first seen binaries from daily distinct binary summary > Dashboard also used for hunting & threat response (e.g. APT binary checks) > Extremely fast due to summaries > Drill-down capabilities Drill-down to Process Hierarchy Analysis dashboard
- 19. Sysmon and Virustotal for automated binary triage Drill-downtoProcessHierarchyAnalyisDashboard-Top > Gets host, filename and event timestamp +/- 5min from Hash Hunting Dashboard > Sankey visualization of process hierachies related to the binary OnMouseOver shows parent process -> child process each with complete command line