• Home

  • Documents

  • stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things...
38
stoQ’ing your Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

  • Upload
    others

  • View
    12

  • Download
    0

Embed Size (px)

Citation preview

Page 1: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

stoQ’ing your SplunkRyan Kovar, Splunk

Marcus LaFerrera, PUNCH

SANS DFIR 2016

Page 2: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

Ryan Kovar

• Staff Security

Strategist @Splunk

• Does Security things

and then talks about

them

• 17+ years defending

networks private

sector

Marcus LaFerrera

• Director of

Development

@PUNCH

• Lead stoQ Developer

• 18+ years supporting

the government

Page 3: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

Agenda

• Overview of stoQ

• Overview of Splunk

• A DFIR use case walk

through

• Questions

Page 4: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

TOOL * N == :(

NOTHING COMMUNICATES

AND MOST TOOLS

REQUIRE MANUAL INTERACTION

Page 5: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

HOW’S THE WEATHER OUT THERE

OLLIE?

IT’S

CYBER

Page 6: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

stoQ

Page 7: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

STOQ IS A FRAMEWORK

THAT ENABLES

EVERYONE TO AUTOMATE

PROCESSES, ANALYTICS,

AND JUST ABOUT ANYTHING

ELSE

Page 8: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

AUTOMATE AND REDUCE

THE MAJORITY

OF YOUR MOST

MUNDANE ANALYTIC TASKS

Page 9: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

LEVERAGE ALL OF YOUR

TOOLS SIMULTANEOUSLY,

AND SAVE THOSE RESULTS

FOR LATER

Page 10: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

IT’S A FORCE MULTIPLIER

Page 11: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

LOOK AT YOUR DATA, RATHER THAN

SEEKING WAYS TO CAPTURE OR

PRODUCE IT

Page 12: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

COMMAND LINE,

INTERACTIVE SHELL,

OR FULLY AUTOMATED

Page 13: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

EVERYTHING IS A PLUGIN, FROM INPUT

TO OUTPUT AND EVERYTHING IN

BETWEEN

Page 14: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

Tell me more about Plugins…

• Very simple and easy to write

• Lots of documentation and examples

• stoQ does most of the heavy lifting

Page 15: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

Over 40 stoQ Plugins Available• E-mail Parser• VTMIS• TotalHash• Yara• Censys• Fireeye• IOC Extract• Pastebin• PassiveTotal• ClamAV

• Opswat• TRiD• RabbitMQ• Suricata• Tika• PEinfo• Excel• XOR• Base64• Bit Rotation

• Bro Intel• Fluentd• Google Cloud Storage• Amazon S3• Slack• ThreatCrowd• MongoDB• ElasticSearch• Exif• And many more…

Page 16: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

IT’S OPENSOURCED

Page 17: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector
Page 18: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector
Page 19: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector
Page 20: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector
Page 21: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

Monitor & Alert

Search & Investigate

Custom Dashboards &

Reports

Analytics &Visualization

Meets Key Needs of SOC Personnel

Splunk Can Ingest ALL THE DATA

Real-timeMachine Data

Cloud Apps

Servers

Email

Web

NetworkFlows

DHCP/ DNS

Custom Apps

Badges

Intrusion Detection

Firewall

Data Loss Prevention

Anti-Malware

VulnerabilityScans

Authentication

Storage

Industrial Control

Mobile Security Intelligence Platform

ThreatFeeds

Asset Info

EmployeeInfo

DataStores

NetworkSegments

External Lookups / Enrichment

Page 22: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

Then Build Security Dashboards

Incident Investigations & ManagementDashboards and Reports

Statistical Outliers Asset and Identity Aware

22

Page 23: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector
Page 24: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

The Splunk App for stoQ

Page 25: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

THE STOQ DFIR APP FOR

SPLUNK!

• ALLOWS YOU TO VISUALIZE

STOQ RESULTS

• MAKE CONNECTIONS THAT

WERE DIFFICULT TO SEE

BEFORE

• QUICKLY PIVOT TO NEW

DATA SOURCES

• APPLY THREAT

INTELLIGENCE TO STOQ

DATA

Page 26: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

A DFIR Scenario

Page 27: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

You are an analyst at a Fortune

100 company

Page 28: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

A user reports an email

with a suspicious

attachment

Page 29: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

We need to quickly

identify if the file is good

or bad

Page 30: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

SPLUNK PLACEHOLDER

Page 31: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

SPLUNK PLACEHOLDER

Page 32: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

SPLUNK PLACEHOLDER

Page 33: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

SPLUNK PLACEHOLDER

Page 34: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

SPLUNK PLACEHOLDER

Page 35: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

SPLUNK PLACEHOLDER

Page 36: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

SPLUNK PLACEHOLDER

Page 37: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

WHERE DO I GET ALL OF THIS

INCREDIBLENESS???

https://splunkbase.splunk.com/app/3196/ http://stoq.punchcyber.com

Page 38: stoQ’ing your Splunk · Ryan Kovar •Staff Security Strategist @Splunk •Does Security things and then talks about them •17+ years defending networks private sector

Questions? Try it out instead

Ryan Kovar

[email protected]

@meansec

Marcus LaFerrera

[email protected]

@mlaferrera

https://demo.stoq.io

Username: dfir2016

Password: stoqingyoursplunk

https://demo.stoq.io/

Security use cases using splunk - InfoSec Resources - IT ...resources.infosecinstitute.com/.../Security-Use-Cases-using-Splunk.pdf · SECURITY USE CASES USING SPLUNK | Other Use Cases

Security use cases using splunk - InfoSec Resources - IT ...resources.infosecinstitute.com/.../Security-Use-Cases-using-Splunk.pdf · SECURITY USE CASES USING SPLUNK | Other Use Cases

Documents
SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE

SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE

Documents
Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

Documents
Microsoft Excel Mania Brian Kovar and Stacy Kovar

Microsoft Excel Mania Brian Kovar and Stacy Kovar

Documents
Security Investigation and Rapid Response Using Splunk and ... · Enter Splunk Splunk Enterprise and Splunk Cloud provide an analytics-driven approach to security on the AWS Cloud

Security Investigation and Rapid Response Using Splunk and ... · Enter Splunk Splunk Enterprise and Splunk Cloud provide an analytics-driven approach to security on the AWS Cloud

Documents
Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Documents
Splunk Security: Detecting Unknown Malware and Ransomwarenetworkdatahub.com/assets/wp/Splunk-Security-Detecting-Unknown-… · falling victim to malware attacks. This paper will take

Splunk Security: Detecting Unknown Malware and Ransomwarenetworkdatahub.com/assets/wp/Splunk-Security-Detecting-Unknown-… · falling victim to malware attacks. This paper will take

Documents
Splunk for Security: Background & Customer Case Study

Splunk for Security: Background & Customer Case Study

Technology
SplunkLive Brisbane Splunk for Operational Security Intelligence

SplunkLive Brisbane Splunk for Operational Security Intelligence

Data & Analytics
SPLUNK SECURITY USE CASE DETECTING UNKNOWN … · WHITE PAPER SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE AND RANSOMWARE Detecting unknown malware and ransomware…

SPLUNK SECURITY USE CASE DETECTING UNKNOWN … · WHITE PAPER SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE AND RANSOMWARE Detecting unknown malware and ransomware…

Documents
Security use cases using splunk · SECURITY USE CASES USING SPLUNK | Security Use Cases with Splunk This article focuses on security use cases that can be created and managed within

Security use cases using splunk · SECURITY USE CASES USING SPLUNK | Security Use Cases with Splunk This article focuses on security use cases that can be created and managed within

Documents
SplunkLive Auckland 2015 - Splunk for Security

SplunkLive Auckland 2015 - Splunk for Security

Data & Analytics
SplunkLive! Utrecht - Splunk for Security - Monzy Merza

SplunkLive! Utrecht - Splunk for Security - Monzy Merza

Technology
Security Investigation and Rapid Response Using Splunk and ...€¦ · Security Investigation and Rapid Response Using Splunk and Amaon Web Services (AWS) 2 The Need for Security

Security Investigation and Rapid Response Using Splunk and ...€¦ · Security Investigation and Rapid Response Using Splunk and Amaon Web Services (AWS) 2 The Need for Security

Documents
Beyond The Splunk App for Enterprise Security

Beyond The Splunk App for Enterprise Security

Technology
Splunk Discovery Dusseldorf: September 2017 - Security Session

Splunk Discovery Dusseldorf: September 2017 - Security Session

Technology
Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Documents
Splunk Enterpise for Information Security Hands-On

Splunk Enterpise for Information Security Hands-On

Technology
MANAGED SERVICES - NuHarbor Security · WHAT IS SPLUNK®? 1-800-917-5719 info@nuharborsecurity.com Looking for Managed Security Service Providers (MSSP)? Splunk Enterprise Security

MANAGED SERVICES - NuHarbor Security · WHAT IS SPLUNK®? 1-800-917-5719 [email protected] Looking for Managed Security Service Providers (MSSP)? Splunk Enterprise Security

Documents
Splunk Data Security Predictions 2022

Splunk Data Security Predictions 2022

Documents
SplunkLive Melbourne Splunk for Operational Security Intelligence

SplunkLive Melbourne Splunk for Operational Security Intelligence

Data & Analytics
Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

Documents
Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Documents
Zscaler and Splunk for Security · Splunk Enterprise, Enterprise Security (ES) and Splunk User Behavior Analytics (UBA) use ingested data to identify and raise security events, combines

Zscaler and Splunk for Security · Splunk Enterprise, Enterprise Security (ES) and Splunk User Behavior Analytics (UBA) use ingested data to identify and raise security events, combines

Documents
Conf2014 FredWilmot Splunk Security (2)

Conf2014 FredWilmot Splunk Security (2)

Documents
Splunk Live - Security Best Practices for AWS

Splunk Live - Security Best Practices for AWS

Technology
Splunk for Security - Hands-On

Splunk for Security - Hands-On

Technology
SplunkLive! Warsaw 2016 - Splunk for Security

SplunkLive! Warsaw 2016 - Splunk for Security

Technology
Qualys Data + Splunk Security Analytics = Finding Hidden ... · © 2018 splunk inc. © 2017 splunk inc. confidential information. do not distribute

Qualys Data + Splunk Security Analytics = Finding Hidden ... · © 2018 splunk inc. © 2017 splunk inc. confidential information. do not distribute

Documents
Splunk for Security

Splunk for Security

Data & Analytics