• Home

  • Documents

  • stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk...
38
stoQ’ing your Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

  • Upload
    hadung

  • View
    240

  • Download
    3

Embed Size (px)

Citation preview

Page 1: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

stoQ’ing your SplunkRyan Kovar, Splunk

Marcus LaFerrera, PUNCH

SANS DFIR 2016

Page 2: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Ryan Kovar

• Staff Security

Strategist @Splunk

• Does Security things

and then talks about

them

• 17+ years defending

networks private

sector

Marcus LaFerrera

• Director of

Development

@PUNCH

• Lead stoQ Developer

• 18+ years supporting

the government

Page 3: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Agenda

• Overview of stoQ

• Overview of Splunk

• A DFIR use case walk

through

• Questions

Page 4: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

TOOL * N == :(

NOTHING COMMUNICATES

AND MOST TOOLS

REQUIRE MANUAL INTERACTION

Page 5: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

HOW’S THE WEATHER OUT THERE

OLLIE?

IT’S

CYBER

Page 6: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

stoQ

Page 7: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

STOQ IS A FRAMEWORK

THAT ENABLES

EVERYONE TO AUTOMATE

PROCESSES, ANALYTICS,

AND JUST ABOUT ANYTHING

ELSE

Page 8: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

AUTOMATE AND REDUCE

THE MAJORITY

OF YOUR MOST

MUNDANE ANALYTIC TASKS

Page 9: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

LEVERAGE ALL OF YOUR

TOOLS SIMULTANEOUSLY,

AND SAVE THOSE RESULTS

FOR LATER

Page 10: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

IT’S A FORCE MULTIPLIER

Page 11: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

LOOK AT YOUR DATA, RATHER THAN

SEEKING WAYS TO CAPTURE OR

PRODUCE IT

Page 12: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

COMMAND LINE,

INTERACTIVE SHELL,

OR FULLY AUTOMATED

Page 13: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

EVERYTHING IS A PLUGIN, FROM INPUT

TO OUTPUT AND EVERYTHING IN

BETWEEN

Page 14: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Tell me more about Plugins…

• Very simple and easy to write

• Lots of documentation and examples

• stoQ does most of the heavy lifting

Page 15: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Over 40 stoQ Plugins Available• E-mail Parser• VTMIS• TotalHash• Yara• Censys• Fireeye• IOC Extract• Pastebin• PassiveTotal• ClamAV

• Opswat• TRiD• RabbitMQ• Suricata• Tika• PEinfo• Excel• XOR• Base64• Bit Rotation

• Bro Intel• Fluentd• Google Cloud Storage• Amazon S3• Slack• ThreatCrowd• MongoDB• ElasticSearch• Exif• And many more…

Page 16: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

IT’S OPENSOURCED

Page 17: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016
Page 18: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016
Page 19: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016
Page 20: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016
Page 21: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Monitor & Alert

Search & Investigate

Custom Dashboards &

Reports

Analytics &Visualization

Meets Key Needs of SOC Personnel

Splunk Can Ingest ALL THE DATA

Real-timeMachine Data

Cloud Apps

Servers

Email

Web

NetworkFlows

DHCP/ DNS

Custom Apps

Badges

Intrusion Detection

Firewall

Data Loss Prevention

Anti-Malware

VulnerabilityScans

Authentication

Storage

Industrial Control

Mobile Security Intelligence Platform

ThreatFeeds

Asset Info

EmployeeInfo

DataStores

NetworkSegments

External Lookups / Enrichment

Page 22: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Then Build Security Dashboards

Incident Investigations & ManagementDashboards and Reports

Statistical Outliers Asset and Identity Aware

22

Page 23: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016
Page 24: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

The Splunk App for stoQ

Page 25: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

THE STOQ DFIR APP FOR

SPLUNK!

• ALLOWS YOU TO VISUALIZE

STOQ RESULTS

• MAKE CONNECTIONS THAT

WERE DIFFICULT TO SEE

BEFORE

• QUICKLY PIVOT TO NEW

DATA SOURCES

• APPLY THREAT

INTELLIGENCE TO STOQ

DATA

Page 26: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

A DFIR Scenario

Page 27: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

You are an analyst at a Fortune

100 company

Page 28: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

A user reports an email

with a suspicious

attachment

Page 29: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

We need to quickly

identify if the file is good

or bad

Page 30: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

SPLUNK PLACEHOLDER

Page 31: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

SPLUNK PLACEHOLDER

Page 32: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

SPLUNK PLACEHOLDER

Page 33: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

SPLUNK PLACEHOLDER

Page 34: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

SPLUNK PLACEHOLDER

Page 35: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

SPLUNK PLACEHOLDER

Page 36: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

SPLUNK PLACEHOLDER

Page 37: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

WHERE DO I GET ALL OF THIS

INCREDIBLENESS???

https://splunkbase.splunk.com/app/3196/ http://stoq.punchcyber.com

Page 38: stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Questions? Try it out instead

Ryan Kovar

[email protected]

@meansec

Marcus LaFerrera

[email protected]

@mlaferrera

https://demo.stoq.io

Username: dfir2016

Password: stoqingyoursplunk

https://demo.stoq.io/

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Documents
Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Documents
Fortscale Splunk Integrationinfo.fortscale.com/hubfs/UEBA Content/Fortscale Splunk Integration.pdf · Fortscale Splunk Integration ... Fortscale digests access and authentication

Fortscale Splunk Integrationinfo.fortscale.com/hubfs/UEBA Content/Fortscale Splunk Integration.pdf · Fortscale Splunk Integration ... Fortscale digests access and authentication

Documents
Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Documents
Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

Documents
Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Documents
Splunk Conf2010: Corporate Express presents Splunk with SAP

Splunk Conf2010: Corporate Express presents Splunk with SAP

Technology
Splunk conf2014 - Onboarding Data Into Splunk

Splunk conf2014 - Onboarding Data Into Splunk

Technology
データ分析プラットフォーム「Splunk」 - Panasonicdl.it-sol.jpn.panasonic.com/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

データ分析プラットフォーム「Splunk」 - Panasonicdl.it-sol.jpn.panasonic.com/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Documents
Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Documents
Splunk user group - automating Splunk with Ansible

Splunk user group - automating Splunk with Ansible

Technology
インストールマニュアル Splunk Enterprise 6.2docs.splunk.com/images/8/8b/Splunk-6.2.0-ja_JP-Installation.pdf · Splunk Enterprise インストールマニュアルによう

インストールマニュアル Splunk Enterprise 6.2docs.splunk.com/images/8/8b/Splunk-6.2.0-ja_JP-Installation.pdf · Splunk Enterprise インストールマニュアルによう

Documents
ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Documents
SPLUNK Capabilities Overview - GTRI · Overview GTRI is the only ELITE Splunk integrator with certified Splunk architects and engineers on staff. In addition to ... SPLUNK-Overview

SPLUNK Capabilities Overview - GTRI · Overview GTRI is the only ELITE Splunk integrator with certified Splunk architects and engineers on staff. In addition to ... SPLUNK-Overview

Documents
Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Documents
Splunk conf2014 - Splunk for Data Science

Splunk conf2014 - Splunk for Data Science

Technology
Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Technology
SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Documents
Splunk 教學 - Splunk Documentationdocs.splunk.com/images/d/db/Tutorial_zh_TW_502.pdf · 簡介 歡迎使用 Splunk 教學！ Splunk 是什麼？ Splunk 是一個可從構成您

Splunk 教學 - Splunk Documentationdocs.splunk.com/images/d/db/Tutorial_zh_TW_502.pdf · 簡介 歡迎使用 Splunk 教學！ Splunk 是什麼？ Splunk 是一個可從構成您

Documents
Splunk Enterprise 6.5.0 Splunk Enterprise 보안

Splunk Enterprise 6.5.0 Splunk Enterprise 보안

Documents
Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier

Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier

Documents
Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Documents
Splunk Cloud Product Briefwinncom.com.ua/wp-content/uploads/2018/07/splunk-Log_Flow.pdf · Extend Benefits With Splunk Apps Splunk Cloud includes support for premium solutions such

Splunk Cloud Product Briefwinncom.com.ua/wp-content/uploads/2018/07/splunk-Log_Flow.pdf · Extend Benefits With Splunk Apps Splunk Cloud includes support for premium solutions such

Documents
Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Documents
FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Documents
Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Documents
Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers

Documents
データ分析プラットフォーム「Splunk」eww.gp-club.panasonic.co.jp/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

データ分析プラットフォーム「Splunk」eww.gp-club.panasonic.co.jp/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Documents
Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Documents
stoQ’ing your Splunk - SANS Information Security … · •MongoDB •ElasticSearch • ... Mobile Security Intelligence Platform Threat Feeds Asset Info Employee Info Data Stores

stoQ’ing your Splunk - SANS Information Security … · •MongoDB •ElasticSearch • ... Mobile Security Intelligence Platform Threat Feeds Asset Info Employee Info Data Stores

Documents