これが Cloud Native な セキュリティログ分析だ (仮)

Cookpad techconf 2018のLTで講演した資料です

1. ਫ୩ਖ਼ܚ ΠϯϑϥετϥΫνϟʔ෦ ͜Ε͕ Cloud Native ͳ ηΩϡϦςΟϩά෼ੳͩ (Ծ) Cookpad Inc 2018.2.10
2. ηΩϡϦςΟ؂ࢹ ΍ͬͯ·͔͢ʁ 2
3. CookpadͰ΋ؤு͍ͬͯ·͕͢ 3 ηΩϡϦςΟ୲౰͸ؾʹͳΔ͜ͱ͕ͨ͘͞Μ ϥϯαϜ΢ΣΞ 42-
   *OKFUJPO EBZ
   "UUBDL 944 όϥϚΩܕϝʔϧ߈ܸ $43' %SJWF
   CZ
   %PXOMPBE߈ܸ ඪతܕ߈ܸ ηΩϡϦςΟઃఆϛε ύεϫʔυϦετܕ߈ܸ Ϋϥ΢υ্ͷΠϯελϯε 1BB4 ࣾһ͕ར༻͢Δ1$ ΦϑΟεωοτϫʔΫ ֎෦ͱͷϝʔϧ ۀ຿γεςϜ "DUJWF%JSFDUPSZ ΦϯϥΠϯετϨʔδ कΒͳ͚Ε͹ͳΒͳ͍෺ͨͪ ߈ܸͯ͘͠Δऀͨͪ Ϣʔβͷ৘ใ
4. 4 SIEM ʢηΩϡϦςΟؔ࿈ͷϩάɾσʔλΛ͔͖ूΊͯ෼ੳ͢ΔϓϩμΫτʣ Security Information and Event Manager ͦ͜Ͱ Ͱ͢Α
6. SIEMΛஔ͚͹શ෦ղܾͩͱࢥͬͯͨʁ ࢒೦ʂ ɾ؂ࢹର৅ͷ؀ڥͷߏ੒มߋʹऑ͍ ɾ ϩάૹ৴ݩͷ؅ཧ͕େมɺύʔαͱ͔࡞Δඞཁ༗ ɾࣗ਎ͷߏ੒มߋ΋ۤख ɾ HAઃఆɺεέʔϧΞ΢τɺϥΠηϯεܗଶɺetc ɾϧʔϧͷมߋ؅ཧ΍ςετ͕ۤख ɾ ಠࣗUIɺϚχϡΞϧૢ࡞ 6 Ϋϥ΢υ؀ڥ΍ؔ࿈πʔϧͱ૬ੑ͕͋·ΓΑ͘ͳ͍
8. ͦ΋ͦ΋Կ͕͍ͨ͠ͷ͔ʁ 8 SIEMͷػೳ͔ΒৼΓฦΓ
9. SIEMͷػೳ (1) 9 ϩάͷऩूͱਖ਼نԽ SIEM ɾϩάΛूΊͯॲཧ͠΍͍͢ܗࣜʹม׵͢Δ
   ɾڞ௨͢Δϩάͷଐੑ஋ʢ࣌ࠁɺ*1ΞυϨεͳͲʣΛͦΖ͑Δ ϩά ϩά ϩά
10. SIEMͷػೳ (2) 10 ϩάͷ෼ੳΤϯδϯ SIEM ɾूΊͨϩά͔ΒΞϥʔτʹͳΔ΋ͷΛݟ͚ͭΔ
    ɾύλʔϯϚον΍ϩάͷ਺্͑͛ͳͲ ϩά ϩά ϩά
11. SIEMͷػೳ (3) 11 ϩάͷอ؅ɾݕࡧ SIEM ϩά ϩά ɾूΊͨϩάΛద੾ʹอ؅͢Δ
    ɾूΊͨϩά͔Βඞཁͳ৘ใΛݕࡧͰ͖Δ ηΩϡϦςΟ୲౰
12. SIEMͷػೳ (4) 12 Ξϥʔτͷൃใ͓Αͼ؅ཧ SIEM ɾΞϥʔτ͕ൃੜͨ͠৔߹ɺ୲౰ऀʹ௨஌͢Δ
    ɾ௨஌ͨ͠Ξϥʔτ͕ͲͷΑ͏ʹରԠ͞Ε͔ͨه࿥͢Δ ηΩϡϦςΟ୲౰
13. ·ͱΊΔͱ 13
14. SIEMΛ࠶ߟ͢Δ 1. ϩάͷऩूͱਖ਼نԽ 2. ϩάͷ෼ੳΤϯδϯ 3. ϩάͷอ؅ɾݕࡧ 4. Ξϥʔτͷൃใ͓Αͼ؅ཧ 14 SIEMͷػೳ
15. Cloud NativeͰ ྑ͍ײ͡ʹ͍ͨ͠ 15
16. SIEMΛ࠶ߟ͢Δ 1. ϩάͷऩूͱਖ਼نԽ 2. ϩάͷ෼ੳΤϯδϯ 3. ϩάͷอ؅ɾݕࡧ 4. Ξϥʔτͷൃใ͓Αͼ؅ཧ 16 AWSͷαʔϏε + α Ͱ୅ସͯ͠ΈΔ → CloudWatch + Fluentd + S3 + Lambdaແ → Lambdaແ → S3 + Graylog + AWS Athenaແ → PagerDuty + GHEແ
17. ͜͏ͳͬͨ 17 ͜Ε͕ Cloud Native ͳηΩϡϦςΟϩά෼ੳͩ (Ծ) ϩάϑΝΠϧઃஔͷ
    ΠϕϯτΛݕग़ ʜ ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ
    Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ
    ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ
    ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ
18. AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟ؂ࢹΞʔΩςΫνϟ (1/4) ϩάϑΝΠϧઃஔͷ
    ΠϕϯτΛݕग़ ʜ ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ
    Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ
    ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ
    ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷऩूͱਖ਼نԽ 18 w ͱʹ͔͘ϩά͸·ͣ4ʹ౤͛ࠐΉ
    w ॲཧͷલஈͰ·ͣอଘ͢Δ͜ͱͰϩά ଛࣦͷࣄނΛ๷͙
    w ϑϧϚωʔδυ͔ͭεέʔϥϒϧͳ4 Λ࢖͏͜ͱͰӡ༻ෛՙΛԼ͛Δ
    w ϩάͷਖ਼نԽ͸-BNCEBΛ࢖ͬͯίʔ υ؅ཧˍςετΛॻ͍ͯ$*
19. AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟ؂ࢹΞʔΩςΫνϟ (2/4) ϩάϑΝΠϧઃஔͷ
    ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ
    Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ
    ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ
    ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷ෼ੳΤϯδϯ 19 w 4ʹϑΝΠϧ͕อଘ͞ΕͨΠϕϯτΛ͏͚ ͱͬͨ
    -BNCEB
    'VODUJPO
    ͕ϩάΛಡΈ ग़ͯ͠෼ੳ
    w ෼ੳΤϯδϯΛૄ݁߹ʹઃܭ͢Δ͜ͱͰɺ ༰қʹεέʔϧΞ΢τ
    w ݕ஌ΤϯδϯͷBUUBDIEFUBDI΋ࣗ༝ࣗࡏ
    w ΋ͪΖΜϧʔϧ΋ίʔυ؅ཧˍςετ
20. AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟ؂ࢹΞʔΩςΫνϟ (3/4) ϩάϑΝΠϧઃஔͷ
    ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ
    Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ
    ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ
    ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ ϩάͷอ؅ɾݕࡧ 20 w ࠷ॳʹΞϥʔτ͕ൃใ͞Εͨࡍ ͷॳಈ૞ࠪ͸
    (SBZMPH
    Ͱࣗ༝ ʹݕࡧ
    
    ඞཁͳϩάͷநग़
    w Ξϥʔτ͕௕ظؒʹ౉͍ͬͯΔ ͜ͱ͕Θ͔ͬͨ৔߹ɺ"UIFOB Λ࢖ͬͯେྔͷϩάΛݕࡧͯ͠ աڈʹḪͬͨਝ଎ͳௐ͕ࠪՄೳ
21. AWSαʔϏεʴαͰ࡞ΔηΩϡϦςΟ؂ࢹΞʔΩςΫνϟ (4/4) ϩάϑΝΠϧઃஔͷ
    ΠϕϯτΛݕग़ ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ
    Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ
    ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ
    ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ 21 Ξϥʔτͷൃใ͓Αͼ؅ཧ w ΦϖϨʔλ΁ͷ௨஌͸
    1BHFS%VUZ
    
    4MBDLΛར༻
    w ൃใͱಉ࣌ʹ
    (JUIVC
    &OUFSQSJTF
    ʹ
    JTTVF
    Λν έοτͱͯ͠࡞੒͠ɺΞϥʔτͷௐࠪʹؔ͢Δ৘ใΛ ूத؅ཧ
    w ͞Βʹࣗಈతʹ
    -BNCEB
    ͕Ξϥʔτͷؔ࿈৘ใΛ֎ ෦αΠτ͔Βݕࡧ͠νέοτʹ͓·ͱΊ͢Δ
22. ʢ࠶ܝʣ 22 ͜Ε͕ Cloud Native ͳηΩϡϦςΟϩά෼ੳͩ (Ծ) ϩάϑΝΠϧઃஔͷ
    ΠϕϯτΛݕग़ ʜ ʜ Lambda Lambda Lambda Kinesis Stream Kinesis Stream S3 S3 S3 S3 Athena ϧʔϧΛ༻͍ͨ
    Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ
    ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ
    ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Kinesis Stream Ξϥʔτͷௐࠪ CloudWatch Logs/Event EC2 instances ͦͷଞϓϩμΫτ
23. 23 ࣮ࡍͷΦϖϨʔγϣϯͷ༷ࢠ
24. Cloud Nativeʹ ηΩϡϦςΟ؂ࢹΛߏங͢ΔϝϦοτ 24 (1) ϚωʔδυαʔϏεͷར༻ʹΑΓӡ༻ͷফ໣Λ๷͛Δ (2) طଘαʔϏεͷ͍͍ͱ͜औΓ͕Ͱ͖Δ (3) ίʔυมߋ؅ཧˍςετʴCIͱ૬ੑ͕ྑ͍
25. Thank you 25