Upgrade to Pro — share decks privately, control downloads, hide ads and more …

SOARによるセキュリティ監視業務の効率化とSecOps /soar-and-secops

2ca9e6e68b43a796a8add2bcb9bbad2e?s=47 Masayoshi Mizutani
October 29, 2020
Technology
1
700

SOARによるセキュリティ監視業務の効率化とSecOps /soar-and-secops

CODE BLUE 2020での登壇資料です

2ca9e6e68b43a796a8add2bcb9bbad2e?s=128

Masayoshi Mizutani

October 29, 2020
Tweet

More Decks by Masayoshi Mizutani

See All by Masayoshi Mizutani
Trivy + Regoを用いたパッケージ脆弱性管理 /trivy-rego
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
6
1.7k
リモートワークを支える 社内セキュリティ基盤の構築と運用 /secueiry-for-wfh
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
0
510
Amazon Athena を使った セキュリティログ検索基盤の構築 /seclog-athena
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
5
2.3k
Webサービス事業会社におけるEDRの検討と導入の事例 /falcon2019
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
1
450
AWS re:Inforce recap 2019
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
1
4.1k
スケーラブルなセキュリティ監視基盤の作り方 /techconf2019-mizutani
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
3
2.4k
Webサービス事業会社におけるEDRの検討と導入の事例 /falconday201812
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
4
2k
クックパッドのセキュリティログ 検索基盤の紹介 /security-log-search
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
3
2.9k
システムログ書式の構造に着目した システム異常検出手法の検討 /css2018-mizutani
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
3
1.7k

Other Decks in Technology

See All in Technology
プログラミング未経験の学生をエンジニアにしてきたノウハウを公開
54699fd8ac6ee0f4a45e632ee7c77a3e?s=48 shinofumijp
0
230
Contrastive Self-Supervised Learning
4615930de72ec08f99d3227761ace0d8?s=48 yenlung
PRO
0
120
Puny to Powerful PostgreSQL Rails Apps
65e84915478a95a22dd40da712f304df?s=48 andyatkinson
PRO
0
420
CAMのサービス開発の歴史と共通基盤を使った 開発スタイルへの変遷について
62e3beb467ce4d447d1491263dcf8d46?s=48 ishikawa_pro
0
110
⚡Lightdashを試してみた
2c6a9bc003b77685330cc9359b6fbbc4?s=48 k_data_analyst
0
220
E2E自動テスト導入・運用をめぐる先入観と実際に起きたこと / Preconceptions and What Happened with E2E Testing
77fa3ebbf229a884c74c905034b1f4c2?s=48 ak1210
6
1.4k
GMO pepabo and hey 2022-05-26
4ab9c4c8dec50dc08b89981e23e111f2?s=48 katsumataryo
0
120
STORES・STORES レジを支えるチーム開発文化 / Sustaining the team culture of STORES EC Regi
76f10b1cdceff38e4c2662c6a6283954?s=48 phayacell
0
110
おじさんでもできるLINE BlockchainでNFT
61c616e83bef28a1cd2666439ebf334b?s=48 sbtechnight
0
110
Uniswapで理解するWeb3の仕組み
61c616e83bef28a1cd2666439ebf334b?s=48 sbtechnight
0
110
KubeCon Recap -Platform migration at Scale-
Ad22fcf5773b906c08330f4d57242212?s=48 inductor
0
130
Stripe Search APIを利用した、LINEとStripeの顧客情報連携/line-dc-202205
E77ca94266ffd3d69f8aee91f7468264?s=48 stripehideokamoto
0
130

Featured

See All Featured
Typedesign – Prime Four
A0517b08532aec8ab2aae3f65d40ad86?s=48 hannesfritz
33
1.3k
Stop Working from a Prison Cell
C1daf20e5c49ff910745198ef9869ac2?s=48 hatefulcrawdad
261
17k
Rails Girls Zürich Keynote
24fc194843a71f10949be18d5a692682?s=48 gr2m
86
12k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
B3ace07412a5178ea778e7eec161fc0a?s=48 jcasabona
12
900
Code Review Best Practice
3d6ace9554821d552146413bcdf874f6?s=48 trishagee
41
6.8k
Embracing the Ebb and Flow
C9b18d9dff88a9dd2393364c2b3b21bd?s=48 colly
73
3.3k
Become a Pro
828ace851b606e1206900f26459f55ad?s=48 speakerdeck
PRO
3
790
Building a Scalable Design System with Sketch
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
447
30k
The Brand Is Dead. Long Live the Brand.
A415db3ac9e9668acbc1fb36eead84ac?s=48 mthomps
45
2.7k
Product Roadmaps are Hard
7cbd3f5f922d798cc312eaf596de7ae6?s=48 iamctodd
34
6.2k
Reflections from 52 weeks, 52 projects
E43f8dfd01057f8304f5f8fb9a294d7d?s=48 jeffersonlam
337
17k
Code Reviewing Like a Champion
C7393b7ba7ec9c8890dd77d209fbb3c9?s=48 maltzj
506
37k

Transcript

  1. &GGFDUJWF4FDVSJUZ.POJUPSJOHCZ 40"3BOE4FD0QT $PPLQBE*OD 5FDI%FQBSUNFOU 4FDVSJUZ5FBN-FBEFS .BTBZPTIJ.J[VUBOJ ਫ୩ਖ਼ܚ  5IV 

    $0%&#-6&

  2. 5PEBZ`T"HFOEB w8IBUJT40"3  w40"3$BTF4UVEZ w4FDVSJUZCZ4PGUXBSF&OHJOFFSJOH 

  3. 8IPBSFZPV w1I%ʢ.FEJBBOE(PWFSOBODFʣ wʙ*#.+BQBO w 3FTFBSDIBOEEFWFMPQNFOUPGTFDVSJUZQSPEVDUTFSWJDF FH4*&.  w "OBMZTUPG40$ 4FDVSJUZ0QFSBUJPO$FOUFS

     wʙ$PPLQBE*OD w 4FDVSJUZ5FBN-FBEFS w %FWFMPQNFOUBOEPQFSBUJPOPGJOUFSOBMTFDVSJUZJOGSBTUSVDUVSF w $4*35 *OGPSNBUJPO4FDVSJUZ$PNNJUUFF  .BTBZPTIJ.J[VUBOJ ਫ୩ਖ਼ܚ

  4. #BDLHSPVOE 

  5. #BDLHSPVOEPGPVS$4*35 w-JNJUFEIVNBOSFTPVSDFT w 0OMZBDUJWFNFNCFST w 8PSLJOHGPSOPUPOMZJODJEFOUSFTQPOTFCVUBMTPDPNQBOZSJTLNBOBHFNFOU w'PDVTJOHPOl4FDVSJUZ.POJUPSJOHz w (VBSESBJM OPU(BUFLFFQFS

    w 1SFWFOUUPCSBLFCVTJOFTTBDUJWJUJFTCZTFDVSJUZSVMFT w $BQBCJMJUZPGEFUFDUJOHTFDVSJUZCSFBDIBOEJOWFTUJHBUJPO 

  6. $PNQPOFOUTPG4FDVSJUZ.POJUPSJOH  -PHHJOH "MFSUJOH "OUJ7JSVT &%3 &OEQPJOU %FUFDUJPO3FTQPOTF /FUXPSLCBTFE*%4 JOUSVTJPO%FUFDUJPO4ZTUFN

    4ZTUFN4FSWJDF-PHT 8"' 8FC"QQMJDBUJPO'JSFXBMM "VEJU-PHT /FUXPSL-PHT 4FOTPS .BOBHFS -PH.BOBHFS 4*&. 4FDVSJUZ*OGPSNBUJPO&WFOU.BOBHFS

  7. $ZDMFPG4FDVSJUZ.POJUPSJOH  0CTFSWBUJPO %FUFDUJPO 3FTQPOTF (BUIFSJOHTFDVSJUZ FWFOUTGSPNPXO TZTUFNFOWJSPONFOU %FUFDUJOHQPUFOUJBM PGTFDVSJUZCSFBDICZ

    PCTFSWFEFWFOU T +VEHJOHTFWFSJUZPG UIFEFUFDUFEBMFSUCZ JOWFTUJHBUJPO w 1SFTFSWJOHFWJEFODFT w .JUJHBUJOHEBNBHF 4FOTPST 4*&. /FFECJHNBOQPXFS 5SJBHF "TTFTTNFOU

  8. 40"3 4FDVSJUZ0SDIFTUSBUJPO "VUPNBUJPOBOE3FTQPOTF 

  9.  %FUFDUJPO  5SJBHF  3FTQPOTF 40"3 4FDVSJUZ0SDIFTUSBUJPO "VUPNBUJPOBOE3FTQPOTF 

    40"3 "MFSUJOH1SPEVDU FH4*&. 0UIFS1SPEVDUT 4FSWJDFT 0UIFS1SPEVDUT 4FSWJDFT 4FDVSJUZ "MFSU *OGPSNBUJPO SFMBUFEUIFBMFSU $IBOHF DPOpHVSBUJPO w"VUPNBUJPOGPS5SJBHFBOE3FTQPOTF1IBTFTJO4FDVSJUZ .POJUPSJOHXJUI7BSJPVT1SPEVDUTBOE4FSWJDFT w 0SJHJOBMMZDPJOFECZ(BSUOFSJOUIFJSSFQPSU /PW   w %FpOJUJPOJTTMJHIUMZEJ⒎FSFOUCZFBDITFDVSJUZWFOEPS

  10. 40"3 WFSZTJNQMF 6TF$BTF  4*&. *1BEESFTT SFQVUBUJPOTFSWJDF "84 Detect suspicious

    activities in a EC2 instance on AWS One of IP addresses is Command & Control Server!! Take snapshot and quarantine the instance Inquiry about communicated IP addresses 7BSJPVT -PHT 1MBZCPPL 3VOCPPL FUD 40"3

  11. #FOFpUPG40"3 w4BWJOH-BCPSXPSLMPBE w 'VMMBVUPNBUFEUSJBHF SFTQPOTFGPSLOPXOBMFSUT w 3FEVDJOHXPSLMPBEPGUSJBHFGPSVOLOPXOBMFSUT w"EWBOUBHFT w )FMQGVMGPSBCVTZBOBMZTUCZNBLJOHBMFSUIBOEMJOHFBTZ

    w %POPUIFTJUBUFUPBEENPOJUPSJOHPGOFXBMFSUT 

  12. 40"3$BTF4UVEZ 4FDVSJUZ.POJUPSJOH"VUPNBUJPO 

  13. 5FDIOJDBM$IBMMFOHFTPG40"3JNQMFNFOUBUJPO w'MFYJCJMJUZ w )PXDBOXFEFTDSJCFDPNQMJDBUFEXPSLqPX  w 1SPQSJFUBSZMBOHVBHFEPFT/05XPSL w &DPTZTUFN w

    .BJOUFOBODFBCJMJUZ w&YUFOTJCJMJUZ w .BOZWBSJPVTPSDIFTUSBUJPOTFSWJDFTBOEQSPEVDUT w *OUFHSBUJPOXJUIJOUFSOBMTFSWJDFTBOEQSPEVDUT w"CTUSBDUJPO w 8PSLqPXNPEFMT w %BUBNPEFMT 

  14. %FFQ"MFSU w0VSPSJHJOBM40"3 GSBNFXPSL w *NQMFNFOUXJUI"84$%, w 5ISFFNBJOTUFQT w  *OTQFDUJPO&OSJDIQBSBNFUFST

    w  3FWJFX&WBMVBUFTFWFSJUZ w  &NJU5BLFBDUJPO w 4UBSUFEEFWFMPQNFOUBUFBSMZ   IUUQTHJUIVCDPNEFFQBMFSUEFFQBMFSU

  15. %FFQ"MFSU4UBDL <4UFQ>*OTQFDUJPO&OSJDIQBSBNFUFST w'SPNFYUFSOBMEBUBTPVSDF w 3FQVUBUJPOTFSWJDFT 7JSVT5PUBM )ZCSJE"OBMZTJT VSMTDBOJP FUD 

    w'SPNJOUFSOBMEBUBTPVSDF w 4FSWJDFBOETZTUFNMPHT (4VJUF "[VSF"% "84 *OUFSOBMTFSWFST  w &OEQPJOUMPHT $SPXE4USJLF'BMDPO PTRVFSZ  4/4 /PUJpDBUJPO4FSWJDF 424 2VFVF4FSWJDF 7JSVT5PUBM 4UBDL VSMTDBOJP 4UBDL $MPVE5SBJM 4UBDL "MFSU

  16. <4UFQ>3FWJFX&WBMVBUFTFWFSJUZ w&WBMVBUJPOQPMJDZXSJUUFOJO(PPO"84-BNCEB w 4FFOPUPOMZTFDVSJUZBMFSUCVUBMTPFOSJDIFEEBUB w &WFOUVBMMZ DIPJDFTFWFSJUZGSPN4BGF 6ODMBTTJpFEBOE6SHFOU w1PMJDZJTNBOBHFEJO(JU)VC&OUFSQSJTF w

    3FWJFXBCMFDPEF w 5FTUBCMFDPEF w $IBOHFIJTUPSZNBOBHFNFOU  4FDVSJUZBT$PEF

  17. 3FWJFX1PMJDZ$IBOHFT  w$IBOHFCZ13 1VMM3FRVFTU  w 0O(JU)VC&OUFSQSJTF w 3FWJFXFECZBUFBNNFNCFS w

    $BODPNNFOUUPDPEF w $BOBQQSPWFPGDIBOHFT w $IBOHFNBOBHFNFOU *OUIFTBNFNBOOFSBT NPEFSOTPGUXBSFEFWFMPQNFOU $PNNFOU $IBOHFIJTUPSZ

  18. 5FTU1PMJDZ$IBOHFT  w5FTUCZ(FOFSBM'SBNFXPSLPG(P w 3FWJFX-BNCEB'VODUJPOJTJNQMFNFOUFE XJUITJNQMFJOQVUPVUQVU w *OQVU"MFSUBOE%BUB w 0VUQVU4FWFSJUZ

    w &BTZUPXSJUFVOJUUFTUCZTJNQMF*0 0SJHJOBM4FDVSJUZ"MFSU "OFOSJDIFEQBSBNFUFS GSPNJOUFSOBMEBUBTPVSDF "MTP *OUIFTBNFNBOOFSBT NPEFSOTPGUXBSFEFWFMPQNFOU 3VOVOJUUFTU

  19. <4UFQ>&NJU5BLFBDUJPO w/PUJpDBUJPO w 4MBDL 1BHFS%VUZ 0CTPMFUFE  w*ODJEFOU5JDLFU$SFBUJPO w (JU)VC&OUFSQSJTF

    w2VBSBOUJOFBOE&WJEFODF1SFTFSWBUJPO 0QUJPOBM  w 4IVUEPXOOFUXPSLCZFOEQPJOUTFDVSJUZTFSWJDF w 4IVUEPXOOFUXPSLBOEUBLFTOBQTIPUCZDMPVEQSPWJEFS`TGVODUJPO w 8FEPOPURVBSBOUJOFGPSOPXCFDBVTFMPXGSFRVFOU 

  20. *NQSPWF4FDVSJUZ.POJUPSJOH0QFSBUJPOCZ40"3 w3FEVDJOHBOVNCFSPGUSJBHFSFTQPOTF w 0WFSDBTFTBSFDMPTFEBVUPNBUJDBMMZ SFTVMUT  w3FEVDJOHUJNFUPUSJBHF w "OBOBMZTUTUBSUTUSJBHFQIBTFXJUIFOSJDIFEBMFSUJOGPSNBUJPO w-PXDPTU

    w "WFSBHFEBZ 

  21. 4FDVSJUZCZ 4PGUXBSF&OHJOFFSJOH 

  22. 40"3JT(PPE&YBNQMFPG4PGUXBSF&OHJOFFSJOH w4FDVSJUZNPOJUPSJOHTZTUFNNVTUCFVQEBUFEDPOUJOVPVTMZ w $IBOHJOHTUBUVTPGPSHBOJ[BUJPO w $IBOHJOHBUUBDLFS`TUSFOE w $IBOHJOHDBQBCJMJUZPGTFOTPSBOEBMFSUEFUFDUPS w'PSDPOUJOVPVTSFJOGPSDFNFOUMPPQPG40"3ʜ w

    %FWFMPQNFOUPGOFXGFBUVSFT w 6QEBUF pYBOESFJOGPSDFQPMJDJFT w $POUJOVPVT*OUFHSBUJPO w $POUJOVPVT%FMJWFSZ  .PEFSO%FW0QT UFDIOJRVFTBSFBQQMJBCMF

  23. 4FD0QT w"QQMZ%FW0QTQSJODJQMFTUP4FDVSJUZTZTUFNT w -JLF.-0QT BQQMZ%FW0QTQSJODJQMFTUP.-TZTUFNT  w %FW4FD0QTNFBOTlTFDVSJUZDIFDLJO$*QJQFMJOFzJOHFOFSBM w#VJMEBOEPQFSBUFZPVSTFDVSJUZTZTUFNCZZPVSPXO TFMG

    w 5PBSDIJWFTDBMBCJMJUZ FYUFOTJCJMJUZ BHJMJUZBOEDBQBCJMJUZ w 'PSNPOJUPSJOH DPNQMJBODF SJTLNBOBHFNFOU FUD w 1SJPSFYBNQMFT/FUqJY -JCFSUZ.VUVBM FUD 

  24. $BTF4UVEZ43& w4JUF3FMJBCJMJUZ&OHJOFFSJOH &OHJOFFS  w "EJTDJQMJOFUIBUJODPSQPSBUFTBTQFDUTPGTPGUXBSFFOHJOFFSJOHBOE BQQMJFTUIFNUPJOGSBTUSVDUVSFBOEPQFSBUJPOTQSPCMFNT GSPN8JLJQFEJB  w'SPN(PPHMF#PPL

    w lKeeping operational work (i.e., toil) below 50% of each SRE’s timez w lReducing toil and scaling up services is the ‘Engineering’ ” w 5IFZDPOUJOVPVTMZJNQSPWFTUIFJSXPSLTCZTPGUXBSFFOHJOFFSJOH "MMQSJODJQMFTPG43&BSFOPUSFRVJSFEJOTFDVSJUZ DPOUFYU CVUXFDBOMFBSONPSFGSPNUIFN 

  25. "QQSPBDIUP4FD0QT GSPNNZFYQFSJFODF w$IBOHFUIFDVMUVSF w 'VMMDPNNJUNFOUGPSPQFSBUJPOBMXPSLTJTCBE w $IBOHFEGSPNUPQ MFBEFSPSNBOBHFS  w#PUIPGEFWFMPQNFOUTLJMMTBOETFDVSJUZLOPXMFEHFT

    BSFSFRVJSFE w ,FFQZPVSNPUJWBUJPOGPSJOGPSNBUJPOTFDVSJUZ w -FBSOGSPNNPEFSOTPGUXBSFEFWFMPQNFOUUFDIOJRVFT 

  26. $PODMVTJPO w40"3JTBDPODFQUPGBVUPNBUJPOBOEPSDIFTUSBUJPOJO USJBHFBOESFTQPOTFQIBTFTJOTFDVSJUZNPOJUPSJOH w%FFQ"MFSUJT$PPLQBEPXOFE40"3GSBNFXPSLXJUI TFSWFSMFTTBSDIJUFDUVSFPO"84 w &WBMVBUFTFWFSJUZXJUIJOUFSOBMFYUFSOBMEBUBTPVSDFBOEUBLFBDUJPO w 6TFNPEFSOTPGUXBSFEFWFMPQNFOUUFDIOJRVFTUPNBOBHFQPMJDZ w4FD0QTDPODFQUNBZCFDPNFNPSFJNQPSUBOU

    w 40"3JTBHPPEFYBNQMFUIBU4FD0QTDPODFQUXPSLTXFMM w 4FD0QTDBOIFMQTPUIFSTZTUFNBUJ[BUJPO 

  27. 5IBOLZPV