security log analysis - ideals analysis & splunk.pdfwe thank the national science foundation...

16
Security Log Analysis

Upload: others

Post on 22-May-2020

2 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Security Log Analysis

Page 2: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Background

Page 3: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Why log analysis?

Page 4: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Defining “logs” and “log analysis”

Page 5: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Log collection sources

Page 6: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Log collection sources, cont.

Page 7: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Artwork: http://hyperboleandahalf.blogspot.com/2010/06/this-is-why-ill-never-be-adult.html

Page 8: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Event Management - Questions

Page 9: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Event Management - Guidelines

Page 10: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Analysis and Response

Page 11: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Getting Started

Page 12: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Blue Waters Supercomputer https://bluewaters.ncsa.illinois.edu/

Page 13: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Apache Log Format

Page 14: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

Basic Command Pattern

http://blog.ferplast.com/en/how-to-raise-a-hamster/

Page 15: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

One Last Note

○ ☺

Page 16: Security Log Analysis - IDEALS Analysis & Splunk.pdfWe thank the National Science Foundation (grant 1547272) for supporting our work. The views and conclusions contained herein are

We thank the National Science Foundation (grant 1547272) for supporting our work.

The views and conclusions contained herein are those of the author and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the NSF.