Elastic{ON} Tour D.C. - Cyber Hunting at Perched with the Elastic Stack & X-Pack

Elastic{ON} Tour D.C. - October 26, 2017

Perched is using Elastic's X-Pack to analyze intrusions as they progress through a campaign and exploring methods to push them back through the kill-chain.

Andrew Pease | Chief Intelligence Officer | Perched

1. Andrew D. Pease October 26, 2017, Chief Intelligence Officer, Perched This Hunt Is On The Chain Hunting with ELK & X-Pack
2. THIS HUNT IS ON THE CHAIN HUNTING WITH ELK & X-PACK Andrew D. Pease, Chief Intelligence Officer, Perched
3. KILL CHAIN • What is it? • Why all the hate? • Different things for different people • At the end of the day
4. A BIT ABOUT ME • 17th year in NG • 10-years full-time DOD tech • Private sector 2011 • ROCK 2014, CAPES 2017 • Perched
5. KILL CHAIN
6. A TALE FAR TOO COMMON
7. A TALE FAR TOO COMMON
8. BREAKING THE CHAIN • Traditional IR response • Intelligence loss/gain • Leverage network forensics • Leverage X-Pack Alerting
9. LEVERAGE NETWORK FORENSICS • Bro Intel framework to notice.log • Works great, until it doesn’t
10. ELASTIC’S X-PACK ALERTING • Less fragile • Actually alerts you • Visual tracking of alerts
11. Andrew D. Pease peasead@github andrew@perched.io andrewdpease