Upload File

threat intelligence in splunk · 2017-10-13 · introduction threat intelligence in action ......

  • Home
  • Documents
  • Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity
27
Threat Intelligence in Splunk Do you really know my adversaries? Prove it. Tim Plona | Business Solution Architect Kyle Maxwell | Security Principal Brandt Varni | Security Consulting Senior Analyst September 27 th , 2017 | Washington, DC

Upload: others

Post on 14-Jul-2020

14 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Threat Intelligence in SplunkDo you really know my adversaries? Prove it.Tim Plona | Business Solution ArchitectKyle Maxwell | Security PrincipalBrandt Varni | Security Consulting Senior AnalystSeptember 27th, 2017 | Washington, DC

Page 2: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

THIS SLIDE IS REQUIRED FOR ALL 3 PARTY PRESENTATIONS.

Page 3: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ How credible and reliable threat intelligence can enhance the capabilities of your Security Operations Center

▶ What is Accenture iDefense▶ How to integrate iDefense Threat Intelligence into Splunk Enterprise Security

What Will Be Learned In This Presentation

Page 4: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Introduction▶ Threat Intelligence in Action▶ iDefense: CTI Provider▶ Integrating iDefense Threat Intelligence in Splunk▶ The Value Realized

Agenda

Page 5: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Introduction

Page 6: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Tim Plona, Freeport-McMoRan

▶ Business Solution Architect

▶ Kyle Maxwell, Accenture

▶ Security Principal

▶ Brandt Varni, Accenture

▶ Security Consulting Senior Analyst

Personal Introduction

Page 7: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Freeport-McMoRan is the world’s largest publicly traded copper producer, the world’s largest producer of molybdenum, and a significant gold producer. The global workforce includes over 50,000 employees and contractors worldwide. Partnered with Accenture Managed Security Services, Freeport-McMoRan has developed a Security Operations Center on Splunk to respond to their diverse and changing threat landscape.

Freeport-McMoRan Inc.

Page 8: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Threat Intelligence in Action

Page 9: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Critical Severity Notable Event for iDefense Threat Activity Detected▶ Matched a known malware command and control URL▶ Identified that the traffic was not blocked by the security tools▶ iDefense associated the command and control address with a known Russian

cyber espionage group▶ Allowed the SOC to identify an infection that would otherwise have been

unknown

Threat Intelligence in Action

Page 10: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

iDefense: CTI Provider

Page 11: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

iDefense: CTI Provider

Page 12: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Pyramid of PainA model for tactical intelligence

David Bianco

Page 13: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

IntelGraph OntologyGraph Data Model

Page 14: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

IntelGraph APISwagger / OpenAPI interface

Page 15: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Integrating iDefenseThreat Intelligence in

Splunk

Page 16: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Used the Splunk Add-on Builder to create the technology add-on▶ Indexed the Threat indicator API and the mining and energy extraction threat

intelligence from the Fundamental API for iDefense▶ Scheduled searches to correlated common indicators to weight mining and

energy extraction indicators higher and to create lookups• Utilized the ES framework to create a higher risk score for suspicious assets or identities

▶ Load the threat intelligence into Enterprise Security▶ Created an automated workflow action▶ Added context to our use cases

Technical Solution Overview

Page 17: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Use the Add-on Builder

Page 18: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Threat indicator API• All known iDefense threat indicators

▶ Fundamental API• Industry specific threat indicators• Mining and Energy extraction indicators

iDefense APIs

Page 19: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Scheduled searches to correlated common indicators between the Threat Indicator API and the Mining and Energy Extraction threat indicators• Increased the weight for Mining and Energy Extraction threat indicators. Utilizes the Enterprise

Security Threat Intelligence framework to raise the risk score of an asset or identity. This allows incident responders to quickly identify relevant threats to the Freeport-McMoRan environment.

• Output lookup to be imported into Enterprise Security

Threat Indicator Weighting

Increased Weight

Page 20: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Web UI• Enterprise Security > Configure > Data Enrichment > Threat Intelligence Downloads

▶ Inputs.conf

Load the Threat Indicators into ES

Page 21: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Created a new workflow action in workflow_actions.conf• Search for any notable event field in the iDefense Intel Graph. Allows incident responders to

quickly identify related indicators to search for in Splunk.

Workflow Action in ES

Workflow Action

Page 22: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Contextual Enrichment to Correlation Searches

Context on known

indicators

Page 23: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

The Value Realized

Page 24: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Identified unblocked malicious activity in the environment related to iDefensethreat intelligence

▶ Enhanced threat detection and response capabilities of the Freeport-McMoRan security team

▶ Increased efficiency of the SOC incident responders

Value Realized

Page 25: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

▶ Automate workflow actions leveraging Splunk’s Adaptive response capabilities▶ Integrate the Vulnerability API to correlate with Vulnerability Scan data▶ Including both the MD5 and SHA1 file hashes in the ThreatIndicator API

Roadmap for Future Development

Page 26: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

Q&ATim Plona | Business Solution Architect

Kyle Maxwell | Security PrincipalBrandt Varni | Security Consulting Senior Analyst

Page 27: Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity

© 2017 SPLUNK INC.

Don't forget to rate this session in the .conf2017 mobile app

Thank You


Using Threat Intelligence

Applying Data Mining Techniques to Identify …...•OpenSOC, ELK, RITA, Hadoop, ONI, Splunk, Sqrrl •Data Collection(host, network, application, contextual) •Threat Intelligence

Threat intelligence platforms

ThreatConnect App For Splunk Enterprise · Overview . The ThreatConnect® App for Splunk Enterprise gives Splunk users the ability to leverage customizable threat intelligence integrated

Splunk IT Service Intelligence

stoQ’ing your Splunk - SANS Information Security … · •MongoDB •ElasticSearch • ... Mobile Security Intelligence Platform Threat Feeds Asset Info Employee Info Data Stores

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model

THREAT INTELLIGENCE - CrowdStrike

BrightCloud Threat Intelligence App for Splunkdownload.webroot.com/Webroot_BrightCloudThreat... · The Webroot BrightCloud Threat Intelligence App for Splunk is a predictive threat

Getting Started With Splunk It Service Intelligence

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

The Five Essential Capabilities of an Analytics-Driven SOC · Splunk® ES includes a threat intelligence framework for gathering threat intelligence that automatically collects, aggregates

Threat Intelligence Briefing

Kaspersky Threat Intelligence Portal...Threat Intelligence Resource Subscribers to Kaspersky’s Threat Intelligence Portal enjoy a single point of entry to: Kaspersky Threat Data

Operational Intelligence and Machine Data with Splunk

Operationalizing Threat Intelligence Using Splunk

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

Threat Intelligence

Counter Threat Unit™ Threat Intelligence

Certified Threat Intelligence Analyst - EC-Council · Certified Threat Intelligence Analyst 1 Certified IA Threat Intelligence Analyst C T CERTIFIED THREAT ... It describes building

SplunkLive Brisbane Splunk for Operational Security Intelligence

Cyber Threat Intelligence

Threat Hunting with Deceptive Defense and Splunk ... · © 2017 SPLUNK INC. Threat Hunting with Deceptive Defense and Splunk Enterprise Security Satnam Singh | Chief Data Scientist

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Splunk for Business Intelligence

Mapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk

The Anomali Platform - Threat Intelligence Platform | AnomaliThreat Hunting engine ... Anomali Enterprise, Splunk App • Access premier 3rd party threat intelligence feeds • Trial

CYBERX IIoT & ICS HIGHLIGHTS THREAT MONITORING APP FOR SPLUNK · CYBERX IIoT & ICS . HIGHLIGHTS. THREAT MONITORING APP FOR SPLUNK. Deliver OT Network Visibility and . ... The Splunk

SplunkLive Melbourne Splunk for Operational Security Intelligence

Certified Threat Intelligence Analyst - Koenig Solutions · Certified Threat Intelligence Analyst Course Outline Module 01: Introduction to Threat Intelligence Understanding Intelligence

THE SPLUNK GUIDE TO OPERATIONAL …...Splunk Guide to Operational Intelligence 2 The Splunk Approach Splunk Enterprise is the first enterprise-class platform that collects and indexes

IT*Service*Intelligence* AtFiserv* - .conf19 | Splunk...Splunk*IT*Service*Intelligence* 10 ITSIis*a Splunk*premium*soluAon*thatenables*us*to*model*our*business*services*and*measure*them*

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

Splunk*for*Mobile* Intelligence*€¦ · Splunk*Mobile*Intelligence*Offerings* ProductPormolio*for*DifferentNeeds* 11 Splunk*MINT*Enterprise* Enterprise*Usage,*OmniHchannel*Analy?cs*