Upload File

splunk - the*security*looking*glass:** …...whatdid*we*do?** 1....

  • Home
  • Documents
  • Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*
24
Copyright © 2016 Splunk Inc. Peter Hefley Manager, InformaAon Security Republic Services Inc. The Security Looking Glass: OperaAonalizing Cloud Enterprise Security – An AdapAve Response Approach Nate Smalley SoluAons Engineer, Splunk

Upload: others

Post on 08-Jul-2020

0 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Copyright  ©  2016  Splunk  Inc.  

Peter  Hefley  Manager,  InformaAon  Security  Republic  Services  Inc.  

The  Security  Looking  Glass:    OperaAonalizing  Cloud  Enterprise  Security  –    An  AdapAve  Response  Approach  

Nate  Smalley  SoluAons  Engineer,  Splunk  

Page 2: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Disclaimer  

2  

During  the  course  of  this  presentaAon,  we  may  make  forward  looking  statements  regarding  future  events  or  the  expected  performance  of  the  company.  We  cauAon  you  that  such  statements  reflect  our  current  expectaAons  and  esAmates  based  on  factors  currently  known  to  us  and  that  actual  events  or  results  could  differ  materially.  For  important  factors  that  may  cause  actual  results  to  differ  from  those  contained  in  our  forward-­‐looking  statements,  please  review  our  filings  with  the  SEC.  The  forward-­‐looking  statements  made  in  the  this  presentaAon  are  being  made  as  of  the  Ame  and  date  of  its  live  presentaAon.  If  reviewed  aYer  its  live  presentaAon,  this  presentaAon  may  not  contain  current  or  

accurate  informaAon.  We  do  not  assume  any  obligaAon  to  update  any  forward  looking  statements  we  may  make.  In  addiAon,  any  informaAon  about  our  roadmap  outlines  our  general  product  direcAon  and  is  

subject  to  change  at  any  Ame  without  noAce.  It  is  for  informaAonal  purposes  only  and  shall  not,  be  incorporated  into  any  contract  or  other  commitment.  Splunk  undertakes  no  obligaAon  either  to  develop  the  features  or  funcAonality  described  or  to  include  any  such  feature  or  funcAonality  in  a  future  release.  

Page 3: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Who  Is  This  Nate  Smalley  Guy  

3  

•  IT  OperaAons  Technologist  (Reformed  Security  Guy)  •  Former  Technical  Director  of  Security  &  Monitoring  

Tools  Team  –  Apollo  Group  (University  of  Phoenix)  •  Currently  Splunk  Staff  Sales  Engineer  supporAng  

Republic  Services  

Page 4: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Peter  Hefley  

4  

•  Hands-­‐on  experience  with  nuclear  weapons,  satellite  communicaAons,  and  cryptography  

•  Monitored  and  maintained  physical  security  of  an  area  twice  the  size  of  New  Hampshire  

•  Built  and  managed  a  Cisco  centric  MSSP  NOC/SOC  for  the  financial  industry  

•  Consultant,  penetraAon  tester,  architect,  and  technical  assessor  for  Fortune  500  

•  Manager  of  InformaAon  Security  at  RSI  

Page 5: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Security’s  Biggest  Problem  

5  

PEOPLE  

Page 6: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Security’s  Biggest  Problem  

6  

Qualified  People  

Page 7: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Our  SoluAon!  

7  

Page 8: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Agenda  

8  

  What  Is  AdapAve  Response?      How  Does  This  Fit  Into  The  Kill  Chain?    What  We  Did  To  Address  The  Risks?    Why  Did  We  Do  It?    How  You  Can  Do  It,  Too!    

Page 9: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

AdapAve  Response  –  Market  ValidaAon  

9  

Carbon  Black,  CyberArk,  ForAnet,  Palo  Alto  Networks,  Phantom,  Splunk,  Tanium,  

ThreatConnect,  and  ZiYen  Demonstrated  Splunk  AdapAve  Response  at  RSA  Conference  2016  

Page 10: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Kill  Chain  Example  

10  

Page 11: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Decision  Loop  

11  

Command  &  Control  Process  

Observe   Orient  

Act   Decide  

Page 12: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

The  Flow  “It  Is  BidirecAonal”  

12  

datacenter  

search  head  

Infected  laptop  

Aqacker  Carbon  Black  server  

CorrelaAon  Search    Alert  Fired  Analyst  Determined  

Page 13: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

What  Did  We  Do?    1.  Using  the  extenAonable  nature  of  Splunk,  specifically  HEC  (HTTP  Event  Collector)  and  

the  Splunk  alert  acAons  capability  

2.  Created  a  capability  for  Analysts  to  invoke  acAons  specifically  around:  1.  Carbon  Black  –  Host  Based  Firewalling  2.  Symantec  –  Deep  Scanning  

3.  Empower  Security  Analysts  to  decide  how  and  when  to  execute  acAons  along  the  kill  chain  path  through  a  click  of  a  buqon  in  Splunk  Enterprise  Security  

4.  Validate  Security  Analyst  acAons  had  the  desired  effects  5.  Reduce  the  risk  for  the  organizaAon  and  provide  end  to  end  tracking  of  a  new  capability  

within  RSI  Splunk  Enterprise  Security    

13  

Page 14: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

The  Work  -­‐  HTTP  Event  Collector    

14  

Configure  HEC  REST  point  in  Environment  •  Create  a  HEC  Input  •  Enable  Global  Serngs  

–  SSL  Is  a  plus  •  Note  the  Token  (you’ll  use  it  later)  

Screenshot  here  

Page 15: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

The  Work  -­‐  Create  An  Alert  AcAon  

15  

The  Magic  of  CreaAng  your  own  •  Start  with  a  template  •  Splunk  has  a  HipChat  example  that  

is  AWESOME!  •  hqps://docs.splunk.com/

DocumentaAon/Splunk/6.4.2/AdvancedDev/ModAlertsAdvancedExample    

Screenshot  here  

Page 16: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

The  Work  -­‐  Create  An  Alert  AcAon    

16  

Carbon  Black  Rest  API  Call  

Page 17: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

The  Work  –  Install  The  Alert  AcAon    

17  

Install  the  alert  acAon  on  to  Splunk  HEC  receiver  •  Build  it  in  an  App    •  Need  THREE  parts  

–  Python  Script  (in  <app>/bin/  –  Alert_acAons.conf  (in  <app>/default/)  –  App.conf  (in  <app>/default/)  –  OpAonal  png  File  to  make  it  preqy  

ê  Located  <app>/appserver/staAc/  

Page 18: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

Why  Did  We  Do  It  •  Reduce  the  Ame  to  interrupt  the  kill  chain  •  Drive  towards  automaAon  and  security  

orchestraAon  

•  Empower  security  analysts  and  supporAng  MSSP  •  BECAUSE  IT  WAS  COOL  TO  DO  

18  

Engineer  

Analyst  

MSSP  

Page 19: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

MSSP  /  Security  Analyst  Work  Flow    

19  

•  Analysts  will  see  these  in  the  Notable  Events  Overview  Dashboard  

Splunk  Enterprise  Security  –  Notable  Security  Events    

Page 20: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

MSSP  /  Security  Analyst  Work  Flow    

20  

•  Analysts  will  Click  on  Notable  Events  like:  –  Host  with  MulAple  InfecAons  –  Using  the  AcAon  for  Host  the  

Analyst  now  has  “QuaranAne  CB  Sensor  at:  $Host$”  

Splunk  Enterprise  Security  –  Notable  Security  Events    

Page 21: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

MSSP  /  Security  Analyst  Work  Flow  

21  

Splunk  Enterprise  Security  –  Notable  Security  Events  •  Analysts  will  receive  ConfirmaAon    •  ValidaAon  of  the  EnAty  •  History  of  Incident  Details    

Page 22: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

How  You  Can  Do  It,  Too!  

1.  IdenAfy  your  technology  that  can  be  leveraged  similarly  (e.g.,  MacAfee  IPS/FW,  Symantec  FW,  Carbon  Black  -­‐  because  we  have  the  Bytes  for  you,  or  others).    

2.  Download  the  app  we  have  created  using  Splunk  HEC  and  follow  the  instrucAons  to  leverage  it  yourself.  

3.  Share  your  story.    1.  Splunk  blogs,  YouTube  or  anywhere  else  someone  can  learn  about  your  experience  2.  Leverage  hosted  events  -­‐  User  groups,  SplunkLive,  .Conf  etc.  

22  

Page 23: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

What’s  Next?    

23  

Taking  the  Same  Approach  with  Other  technologies  

Page 24: Splunk - The*Security*Looking*Glass:** …...WhatDid*We*Do?** 1. Using*the*extenAonable*nature*of*Splunk,*specifically*HEC*(HTTP*EventCollector)*and* the*Splunk*alertacAons*capability*

THANK  YOU  


Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Our experiences throughout the 3 year journey · Splunk – Hardware is now available for Splunk expansion • Splunk begins to fill monitoring gaps, acts as “glue” • Splunk

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Splunk in Rakuten: Splunk as a Service for all

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Splunk presentation

Splunk conf2014 - Splunk for Data Science

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Splunk bsides

Splunk App for StreamMany Solutions, One Goal. Some history •Splunk acquires Cloudmeter, December 2013 •Renamed Splunk App for Stream •Released with Splunk 6.0 (August, 2014)

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Splunk Cloud Product Briefwinncom.com.ua/wp-content/uploads/2018/07/splunk-Log_Flow.pdf · Extend Benefits With Splunk Apps Splunk Cloud includes support for premium solutions such

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

Splunk hunkbeta

Splunk conf2014 - Onboarding Data Into Splunk

Splunk Live

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Splunk Siem

Splunk conf2014 - Using Selenium and Splunk for Transaction Monitoring Insight

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Islands*of*Splunk* - .conf2017 | The 8th Annual Splunk ... · Background*! Splunk*administrators*are*increasingly*required*to*provision*Splunk* as*aservice*offering*to*mulJple*customers*

Splunk demo

Redapt @ splunk .conf 2013 splunk in the hyperscale private cloud

データ分析プラットフォーム「Splunk」 - Panasonicdl.it-sol.jpn.panasonic.com/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk Search

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Splunk user group - automating Splunk with Ansible

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing