lets talk about - wordpress.com · lets talk about selks ….. lets do some hands on ... –alerts...

13
1

Upload: others

Post on 24-Jul-2020

2 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

1

Page 2: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

Lets talk about

SELKS

• Myself

– Stamus Networks co-founder

– Suricata core team - QA Lead

– OISF Suricata instructor

• StamusN

– Bring professional grade products and services through

the Suricata IDPS eco-system

2

Page 3: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

Lets talk about

SELKS

• S - Suricata IDPS • E - Elasticsearch• L - Logstash• K - Kibana• S - Scirius

3

Page 4: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

SELKS –

Suricata

• Suricata– Supercalifragilisticexpialidocious IDPS/NSM– Native Multithreading – Multitenancy – High Performance – Modular and flexible– Lua scripting– Awesome core teammates– The crown jewel of this conference (if you didnt get the drift)

4

Page 5: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

SELKS –

The ELK stack• Elasticsearch

– Distributed, scalable, and highly available– Real-time search and analytics capabilities– Sophisticated RESTful API– Schema free, Apache Lucene™

• Logstash– Centralize data processing of all types– Log collector

• Kibana 3(4)– Flexible analytics and visualization platform– Real-time summary and charting of streaming data– Intuitive interface for a variety of users– Instant sharing and embedding of dashboards

5

Page 6: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

SELKS –

Scirius• Suricata graphic rule set manager

6

Page 7: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

Why SELKS

• Entirely Open Source– The only graphic Suricata’s rule manager– Standard Debian Jessie 64 bit live and installable distro

• Scalable• Modular• Flexible• Correlate

7

Page 8: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

SELKS

Lets talk about SELKS …..

Lets do some hands on…

8

Page 9: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

Visualization &

Filtering

• Filter and visualize on over 360 metadata fields• GeoIP Maps

9

Page 10: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

Dashboards

• 12 ready to use out of the box dashboards– ALL– ALERTS– DNS– FILE-Transactions – FLOW– HTTP– HTTP-Extended-Custom– PRIVACY– SMTP– TLS– SSH– VLAN

10

Page 11: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

Correlate

• Correlate – Events– Alerts– Logs– Rules

11

Page 12: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

Rule set manager

• Suricata’s graphic rule set management – Rules to alerts direct mapping– Suricata performance indicators

12

Page 13: Lets talk about - WordPress.com · Lets talk about SELKS ….. Lets do some hands on ... –ALERTS –DNS –FILE-Transactions –FLOW –HTTP –HTTP-Extended-Custom –PRIVACY –SMTP

THANK YOU

13