From Students…

…to Professionals

The Capstone Experience

Team RookRoy Barnes

Matt HammerlyWill McGeeChiyu SongMark Velez

Department of Computer Science and EngineeringMichigan State University

Spring 2017

Beta PresentationForce Platform Ingestion Tool

Project Overview

• Force platform for security alert management/analysis

• Force accepts data in one format, but clients send data in different formats

• Force PIT provides a way for clients to integrate existing monitoring tools with Force

• Suggests groups of related alerts to save Rook analysts time

The Capstone Experience Team Rook Beta Presentation 2

System Architecture

The Capstone Experience Team Rook Beta Presentation 3

Data Flow Diagram

The Capstone Experience Team Rook Beta Presentation 4

Elastic

Data Flow Diagram

The Capstone Experience Team Rook Beta Presentation 5

Brief presentation of Data Flow

API

API

APIRequest alertsSend back alerts Data

Normalizer

Machine Learning

Platform Ingestion Tool

• From clients of Rook

• Endpoints like firewall, database, etc.

• Send out logs of security events (Alerts)

Data Flow Walkthrough

The Capstone Experience Team Rook Beta Presentation

Data Normalizer

Machine Learning

Platform Ingestion Tool

Elastic Database

Data Flow Walkthrough (cont.)

The Capstone Experience Team Rook Beta Presentation

Elastic

Contains data that includes…

• Alerts, new and old

• Tickets, composed of alerts

• Suggestions created from ML

Pull data from Elastic

Push data through to Front end

Pass back analyst changes

Push changes to update data

Data Flow Walkthrough (cont.)

The Capstone Experience Team Rook Beta Presentation

Store new API configuration settings

Elastic Pull data from Elastic

Push data through to Front end

Pass back analyst changes

Push changes to update data

Data Flow Walkthrough (cont.)

The Capstone Experience Team Rook Beta Presentation

Data Flow Diagram

The Capstone Experience Team Rook Beta Presentation 10

Elastic

Login Page

The Capstone Experience Team Rook Beta Presentation 11

To the end…

Alerts Page

The Capstone Experience Team Rook Beta Presentation 12

Alerts Page – Ticket Panel

The Capstone Experience Team Rook Beta Presentation 13

Alerts - Filtered

The Capstone Experience Team Rook Beta Presentation 14

Tickets Page

The Capstone Experience Team Rook Beta Presentation 15

Tickets - Editing Ticket

The Capstone Experience Team Rook Beta Presentation 16

Jobs Page

The Capstone Experience Team Rook Beta Presentation 17

What’s left to do?

•Update color scheme to Rook’s updated colors

•Continue building out support for more types of APIs

The Capstone Experience Team Rook Beta Presentation 18

Questions?

The Capstone Experience 19

?

? ??

?

?

?

?

?

Team Rook Beta Presentation