セキュリティログ分析基盤の構築 on AWS

セキュリティログ分析基盤の構築 on AWS

2018.5.16 Security JAWS での発表資料です

2ca9e6e68b43a796a8add2bcb9bbad2e?s=128

Masayoshi Mizutani

May 16, 2018
Tweet

Transcript

  1. ηΩϡϦςΟϩά෼ੳج൫ͷߏங PO"84 ΫοΫύουגࣜձࣾΠϯϑϥετϥΫνϟʔ෦ ਫ୩ਖ਼ܚ  8FE

  2. ࣗݾ঺հˍൃද֓ཁ wਫ୩ਖ਼ܚ !N@NJ[VUBOJ  w ೔ຊ*#.ೖࣾ w ౦ژجૅݚڀॴ w ηΩϡϦςΟࣄۀ෦5PLZP40$

    w ΫοΫύουגࣜձࣾೖࣾ w ΠϯϑϥετϥΫνϟʔ෦ηΩϡϦςΟνʔϜ wࠓ೔ͷൃද   ݄ʹฐࣾ5FDI$POGͷ-5Ͱ࿩ͨ͠಺༰ͷ࠷৽൛Ͱ͢
  3. ηΩϡϦςΟϩά෼ੳͱ͍͑͹4*&.ɺ͔͠͠Ϋϥ΢υ্ͩͱʜ wϩάͷૹ৴ݩΛಈతʹ੍ޚͰ͖ͳ͍ w ૹ৴ݩʴϩάͷܗࣜͷΤϯτϦΛ؅ཧ͢Δ"1*͕ͳ͍ w Χλϩά্͸ࣗಈొ࿥͢Δͱݴ͍ͬͯΔ͕͏·͘௥Ճ͞Εͳ͍ w ΠϯελϯεɾαʔϏεͷ௥Ճɾ࡟আʹରԠ͢Δͷ͕େม wશମߏ੒Λؾܰʹ͍͡Εͳ͍ w

    ߏ଄্εέʔϧΞ΢τ͢Δ͕खಈˍࣦഊ͢Δͱഁ໓ w εέʔϧΞ΢τͨ͠΋ͷͷதʹϩά͕࢒ΔͷͰεέʔϧΠϯෆՄ w ϩά͕όʔετͨ͠ͱ͖ͷରԠ͕େม wϧʔϧͷςετ͕೉͍͠ w ςετͷͨΊʹෳ਺ߏ੒༻ҙ͢ΔPS࣮؀ڥͰ΍Δ w "1*ͳͲͳ͍ͷͰɺ౰વਓखͰؤுΔ w ΫΠοΫʹϧʔϧͷௐ੔͕Ͱ͖ͳ͍มߋʹΑΔαΠυΤϑΣΫτͰۤ࿑͢Δ   ˞ҰൠԽ͞Εͨ࿩Ͱ͸ͳ͘ɺͱ͋Δ੡඼ͷܦݧʹج͍ͮͨ૝ఆͰ͢
  4. ઃܭཁ݅ wো֐΁ͷ଱ੑ wੑೳɿ਺ඦ(#೔ͷྲྀྔˍ༰қͳεέʔϧΞ΢τ͕Մೳ wมߋཤྺ؅ཧ w؇͍ϦΞϧλΠϜੑɿ਺෼ఔ౓ͷ஗Ԇ͸ڐ༰ wঢ়گʹԠͨ͡ηΩϡϦςΟ෼ੳ w ύλʔϯ ೔ৗతʹൃੜ͢ΔΞϥʔτͷ෼ੳ w

    ύλʔϯ Πϯγσϯτൃੜ࣌ͷ௕ظ෼ੳ w ύλʔϯ ௕ظؒͷ౷ܭ৘ใऔಘ w෼ੳɾରԠͷࣗಈԽ  
  5. ΞʔΩςΫνϟ֓ཁ ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ Lambda Lambda Lambda Kinesis Stream S3 S3

    Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Ξϥʔτͷௐࠪ CloudWatch Logs/Event, GuardDuty, CloudTrail EC2 instances ͦͷଞϓϩμΫτ Kinesis Stream Kinesis Stream ˞ࡉ͔͍ͱ͜Ζ͸ͪΐͬͱ୺ંͬͯ·͢
  6. ΞʔΩςΫνϟ֓ཁ ύʔτ෼͚ ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ Lambda Lambda Lambda Kinesis Stream S3

    S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Ξϥʔτͷௐࠪ EC2 instances ͦͷଞϓϩμΫτ Kinesis Stream Kinesis Stream ϩάऩूύʔτ ϩάॲཧύʔτ Ξϥʔτॲཧύʔτ CloudWatch Logs/Event, GuardDuty, CloudTrail
  7. ϩάॲཧύʔτ  wϑΝΠϧੜ੒Πϕϯτͷॲཧ
  4ˠ-BNCEBˠ,JOFTJT4USFBN  w 4ͷ$SFBUF0CKFDUΠϕϯτΛ-BNCEBͰड͚ͯ,JOFTJT4USFBNʹྲྀ͢ w -BNCEBʹ͸௚઀ϩά͸ྲྀͣ͞ʹ4্ͷϑΝΠϧͷΩʔͳͲ࠷௿ݶͷ

    ৘ใ͚ͩΛྲྀ͢ w ,JOFTJT4USFBNͰΠϕϯτ৘ใΛड͚औͬͨޙଓͷ-BNCEB͕4಺ͷ ϑΝΠϧΛಡΈࠐΈϩάσʔλΛऔಘ͢Δ   ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ Lambda Lambda Kinesis Stream ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ ϩάͷม׵ Kinesis Stream
  8. ϩάॲཧύʔτ  wϩάͷม׵UP(SBZMPH w ,JOFTJT4USFBN͔ΒϩάϑΝΠϧઃஔͷΠϕϯτΛड͚औͬͨޙɺ ϑΝΠϧΛ4͔ΒಡΈऔΔˠϩάͷύʔεˠ(SBZMPH΁సૹ w ύʔα͸ࣗલͰ༻ҙ4ͷόέοτʴύεͰϑΥʔϚοτΛ൑ผ w (SBZMPHͷ(&-'ܗࣜʹม׵ͨ͠ޙ5$1Ͱసૹ

    wϩάͷม׵UP"UIFOB w -BNCEBͰ"UIFOBʹରԠͨ͠+40/ܗࣜʹม׵ w (MVFΛ࢖ͬͨม׵ʹͰ͖ͳ͍͔ݕ౼த   ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ Lambda Lambda Kinesis Stream ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ ϩάͷม׵ Kinesis Stream
  9. Ξϥʔτॲཧύʔτ w(JU)VC&OUFSQSJTF ()& Λ৘ใू໿ͷج఺ʹ w Ξϥʔτ͕ݕ஌͞ΕͨΒ()&ʹ*TTVFΛͨͯͯɺͦ͜ʹؔ࿈৘ใΛί ϝϯτͱͯ͠௥ه͠ूதͤ͞Δ wؔ࿈৘ใͷࣗಈऩू w 7JSVT5PUBMͰͷݕࡧɺ(SBZMPHͰͷؔ࿈ϩάͷݕࡧͳͲ͸ఆܗ࡞ۀͳ

    ͷͰࣗಈͰ()&ʹίϝϯτͤ͞Δ w௨஌͸ϝʔϧ 4MBDL w ηΩϡϦςΟάϧʔϓ಺Ͱϩʔςʔγϣϯ   Ξϥʔτͷൃใ GHE PagerDuty Slack Ξϥʔτͷௐࠪ Kinesis Stream
  10. ӡ༻ͷ༷ࢠ  

  11. 1BHFS%VUZ͕ൃใ ʢϝʔϧ4MBDLʣ  

  12.   Ξϥʔτ͸()&ͷ *TTVFͱͯ͠ىථ

  13.   7JSVT5PUBMͷ ৘ใ΋ࣗಈͰ௥ه

  14.   (SBZMPH͔ΒϩάΛநग़ ˍ ৽ͨͳϩά΋ࢀরͰ͖ΔΑ ͏ʹΫΤϦ63-Λίϝϯτ

  15.   ඞཁʹԠͯ͡(SBZMPH ͰΞϥʔτͷৄࡉௐࠪ ·ͨ͸ *OEJDBUPS͕ྲྀΕ͖ͯͨ ͱ͖ʹΫΠοΫʹௐࠪ

  16.   ௐࠪɾ෼ੳ݁ՌΛ ίϝϯτͱͯ͠ ॻ͖࢒͢͜ͱͰ ஌ݟΛڞ༗

  17. Thank you