Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
これが Cloud Native な セキュリティログ分析だ (仮)
Search
Masayoshi Mizutani
February 11, 2018
Technology
7
3.3k
これが Cloud Native な セキュリティログ分析だ (仮)
Cookpad techconf 2018のLTで講演した資料です
Masayoshi Mizutani
February 11, 2018
Tweet
Share
More Decks by Masayoshi Mizutani
See All by Masayoshi Mizutani
汎用ポリシー言語Rego + OPAと認可・検証事例の紹介 / Introduction Rego & OPA for authorization and validation
mizutani
1
620
Ubieにおけるセキュリティ課題管理の自動化 / ubie-sec-issue-automation
mizutani
0
830
Trivy + Regoを用いたパッケージ脆弱性管理 /trivy-rego
mizutani
7
4.4k
リモートワークを支える 社内セキュリティ基盤の構築と運用 /secueiry-for-wfh
mizutani
0
700
SOARによるセキュリティ監視業務の効率化とSecOps /soar-and-secops
mizutani
1
1.1k
Amazon Athena を使った セキュリティログ検索基盤の構築 /seclog-athena
mizutani
5
2.9k
Webサービス事業会社におけるEDRの検討と導入の事例 /falcon2019
mizutani
1
750
AWS re:Inforce recap 2019
mizutani
1
4.3k
スケーラブルなセキュリティ監視基盤の作り方 /techconf2019-mizutani
mizutani
3
3.2k
Other Decks in Technology
See All in Technology
Oracle Database Technology Night #87-1 : Exadata Database Service on Exascale Infrastructure(ExaDB-XS)サービス詳細
oracle4engineer
PRO
1
180
Snowflake ML モデルを dbt データパイプラインに組み込む
estie
0
100
遷移の高速化 ヤフートップの試行錯誤
narirou
6
1.2k
実は強い 非ViTな画像認識モデル
tattaka
3
1.3k
Amazon Aurora のバージョンアップ手法について
smt7174
2
150
Share my, our lessons from the road to re:Invent
naospon
0
140
Two Blades, One Journey: Engineering While Managing
ohbarye
4
2k
OPENLOGI Company Profile for engineer
hr01
1
20k
IAMポリシーのAllow/Denyについて、改めて理解する
smt7174
2
210
ABWG2024採択者が語るエンジニアとしての自分自身の見つけ方〜発信して、つながって、世界を広げていく〜
maimyyym
1
170
技術スタックだけじゃない、業務ドメイン知識のオンボーディングも同じくらいの量が必要な話
niftycorp
PRO
0
100
OSS構成管理ツールCMDBuildを使ったAWSリソース管理の自動化
satorufunai
0
640
Featured
See All Featured
4 Signs Your Business is Dying
shpigford
182
22k
Music & Morning Musume
bryan
46
6.4k
Imperfection Machines: The Place of Print at Facebook
scottboms
267
13k
Statistics for Hackers
jakevdp
797
220k
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
356
29k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
133
33k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
46
2.3k
Rails Girls Zürich Keynote
gr2m
94
13k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
45
9.4k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
30
4.6k
The Cost Of JavaScript in 2023
addyosmani
47
7.4k
Being A Developer After 40
akosma
89
590k
Transcript
ਫ୩ਖ਼ܚ ΠϯϑϥετϥΫνϟʔ෦ ͜Ε͕ Cloud Native ͳ ηΩϡϦςΟϩάੳͩ (Ծ) Cookpad Inc
2018.2.10
ηΩϡϦςΟࢹ ͬͯ·͔͢ʁ 2
CookpadͰؤு͍ͬͯ·͕͢ 3 ηΩϡϦςΟ୲ؾʹͳΔ͜ͱ͕ͨ͘͞Μ ϥϯαϜΣΞ 42-*OKFUJPO EBZ"UUBDL 944 όϥϚΩܕϝʔϧ߈ܸ $43' %SJWFCZ%PXOMPBE߈ܸ
ඪతܕ߈ܸ ηΩϡϦςΟઃఆϛε ύεϫʔυϦετܕ߈ܸ Ϋϥυ্ͷΠϯελϯε 1BB4 ࣾһ͕ར༻͢Δ1$ ΦϑΟεωοτϫʔΫ ֎෦ͱͷϝʔϧ ۀγεςϜ "DUJWF%JSFDUPSZ ΦϯϥΠϯετϨʔδ कΒͳ͚ΕͳΒͳ͍ͨͪ ߈ܸͯ͘͠Δऀͨͪ Ϣʔβͷใ
4 SIEM ʢηΩϡϦςΟؔ࿈ͷϩάɾσʔλΛ͔͖ूΊͯੳ͢ΔϓϩμΫτʣ Security Information and Event Manager ͦ͜Ͱ Ͱ͢Α
5
SIEMΛஔ͚શ෦ղܾͩͱࢥͬͯͨʁ ೦ʂ ɾࢹରͷڥͷߏมߋʹऑ͍ ɾ ϩάૹ৴ݩͷཧ͕େมɺύʔαͱ͔࡞Δඞཁ༗ ɾࣗͷߏมߋۤख ɾ HAઃఆɺεέʔϧΞτɺϥΠηϯεܗଶɺetc ɾϧʔϧͷมߋཧςετ͕ۤख ɾ
ಠࣗUIɺϚχϡΞϧૢ࡞ 6 Ϋϥυڥؔ࿈πʔϧͱ૬ੑ͕͋·ΓΑ͘ͳ͍
7
ͦͦԿ͕͍ͨ͠ͷ͔ʁ 8 SIEMͷػೳ͔ΒৼΓฦΓ
SIEMͷػೳ (1) 9 ϩάͷऩूͱਖ਼نԽ SIEM ɾϩάΛूΊͯॲཧ͍͢͠ܗࣜʹม͢Δ ɾڞ௨͢Δϩάͷଐੑʢ࣌ࠁɺ*1ΞυϨεͳͲʣΛͦΖ͑Δ ϩά ϩά ϩά
SIEMͷػೳ (2) 10 ϩάͷੳΤϯδϯ SIEM ɾूΊͨϩά͔ΒΞϥʔτʹͳΔͷΛݟ͚ͭΔ ɾύλʔϯϚονϩάͷ্͑͛ͳͲ ϩά ϩά ϩά
SIEMͷػೳ (3) 11 ϩάͷอɾݕࡧ SIEM ϩά ϩά ɾूΊͨϩάΛదʹอ͢Δ ɾूΊͨϩά͔ΒඞཁͳใΛݕࡧͰ͖Δ ηΩϡϦςΟ୲
SIEMͷػೳ (4) 12 Ξϥʔτͷൃใ͓Αͼཧ SIEM ɾΞϥʔτ͕ൃੜͨ͠߹ɺ୲ऀʹ௨͢Δ ɾ௨ͨ͠Ξϥʔτ͕ͲͷΑ͏ʹରԠ͞Ε͔ͨه͢Δ ηΩϡϦςΟ୲
·ͱΊΔͱ 13
SIEMΛ࠶ߟ͢Δ 1. ϩάͷऩूͱਖ਼نԽ 2. ϩάͷੳΤϯδϯ 3. ϩάͷอɾݕࡧ 4. Ξϥʔτͷൃใ͓Αͼཧ 14
SIEMͷػೳ
Cloud NativeͰ ྑ͍ײ͡ʹ͍ͨ͠ 15
SIEMΛ࠶ߟ͢Δ 1. ϩάͷऩूͱਖ਼نԽ 2. ϩάͷੳΤϯδϯ 3. ϩάͷอɾݕࡧ 4. Ξϥʔτͷൃใ͓Αͼཧ 16
AWSͷαʔϏε + α Ͱସͯ͠ΈΔ → CloudWatch + Fluentd + S3 + Lambdaແ → Lambdaແ → S3 + Graylog + AWS Athenaແ → PagerDuty + GHEແ
͜͏ͳͬͨ 17 ͜Ε͕ Cloud Native ͳηΩϡϦςΟϩάੳͩ (Ծ) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ
ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ Ξϥʔτͷൃใ ϩάͷม EC2 Elasticsearch Service ߴͰΠϯλϥΫςΟϒͳ ظతϩάͷݕࡧ ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ
AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟࢹΞʔΩςΫνϟ (1/4) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ ʜ Lambda Lambda Lambda Kinesis
Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ Ξϥʔτͷൃใ ϩάͷม EC2 Elasticsearch Service ߴͰΠϯλϥΫςΟϒͳ ظతϩάͷݕࡧ ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷऩूͱਖ਼نԽ 18 w ͱʹ͔͘ϩά·ͣ4ʹ͛ࠐΉ w ॲཧͷલஈͰ·ͣอଘ͢Δ͜ͱͰϩά ଛࣦͷࣄނΛ͙ w ϑϧϚωʔδυ͔ͭεέʔϥϒϧͳ4 Λ͏͜ͱͰӡ༻ෛՙΛԼ͛Δ w ϩάͷਖ਼نԽ-BNCEBΛͬͯίʔ υཧˍςετΛॻ͍ͯ$*
AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟࢹΞʔΩςΫνϟ (2/4) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream
Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ Ξϥʔτͷൃใ ϩάͷม EC2 Elasticsearch Service ߴͰΠϯλϥΫςΟϒͳ ظతϩάͷݕࡧ ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷੳΤϯδϯ 19 w 4ʹϑΝΠϧ͕อଘ͞ΕͨΠϕϯτΛ͏͚ ͱͬͨ-BNCEB'VODUJPO͕ϩάΛಡΈ ग़ͯ͠ੳ w ੳΤϯδϯΛૄ݁߹ʹઃܭ͢Δ͜ͱͰɺ ༰қʹεέʔϧΞτ w ݕΤϯδϯͷBUUBDIEFUBDIࣗ༝ࣗࡏ w ͪΖΜϧʔϧίʔυཧˍςετ
AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟࢹΞʔΩςΫνϟ (3/4) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream
Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ Ξϥʔτͷൃใ ϩάͷม EC2 Elasticsearch Service ߴͰΠϯλϥΫςΟϒͳ ظతϩάͷݕࡧ ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷอɾݕࡧ 20 w ࠷ॳʹΞϥʔτ͕ൃใ͞Εͨࡍ ͷॳಈࠪ(SBZMPHͰࣗ༝ ʹݕࡧඞཁͳϩάͷநग़ w Ξϥʔτ͕ظؒʹ͍ͬͯΔ ͜ͱ͕Θ͔ͬͨ߹ɺ"UIFOB ΛͬͯେྔͷϩάΛݕࡧͯ͠ աڈʹḪͬͨਝͳௐ͕ࠪՄೳ
AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟࢹΞʔΩςΫνϟ (4/4) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream
Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ Ξϥʔτͷൃใ ϩάͷม EC2 Elasticsearch Service ߴͰΠϯλϥΫςΟϒͳ ظతϩάͷݕࡧ ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ 21 Ξϥʔτͷൃใ͓Αͼཧ w ΦϖϨʔλͷ௨1BHFS%VUZ 4MBDLΛར༻ w ൃใͱಉ࣌ʹ(JUIVC&OUFSQSJTFʹJTTVFΛν έοτͱͯ͠࡞͠ɺΞϥʔτͷௐࠪʹؔ͢ΔใΛ ूதཧ w ͞Βʹࣗಈతʹ-BNCEB͕Ξϥʔτͷؔ࿈ใΛ֎ ෦αΠτ͔Βݕࡧ͠νέοτʹ͓·ͱΊ͢Δ
ʢ࠶ܝʣ 22 ͜Ε͕ Cloud Native ͳηΩϡϦςΟϩάੳͩ (Ծ) ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ ʜ
ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ Ξϥʔτͷൃใ ϩάͷม EC2 Elasticsearch Service ߴͰΠϯλϥΫςΟϒͳ ظతϩάͷݕࡧ ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ
23 ࣮ࡍͷΦϖϨʔγϣϯͷ༷ࢠ
Cloud Nativeʹ ηΩϡϦςΟࢹΛߏங͢ΔϝϦοτ 24 (1) ϚωʔδυαʔϏεͷར༻ʹΑΓӡ༻ͷফΛ͛Δ (2) طଘαʔϏεͷ͍͍ͱ͜औΓ͕Ͱ͖Δ (3) ίʔυมߋཧˍςετʴCIͱ૬ੑ͕ྑ͍
Thank you 25