Slide 1
Slide 1 text
@ken5scal, 2024/09/05
ࣄۀϦεΫͱ
Detection Engineering
~Eventual DE~
Slide 2
Slide 2 text
- ηΩϡϦςΟͷࢹج൫ʹ͓͚Δ՝
- ܧଓతͳऔΓΈΛ͢ΔͨΊͷʮ࠷ॳͷࢹʯ
- ٕज़࣮ͷભҠ
- Eventual Detection Engineering
- ݱ࣌Ͱͷ՝
ࠓͷ͓
Slide 3
Slide 3 text
- ݐલ
- Detection EngineeringͱσʔλۦಈͳηΩϡϦςΟɺָ͍͠Α٩( 'ω')٩و('ω' )و
- ຊԻ
- ੲ͔ΒSIEMಋೖ͠·ͨ͠ఔͷΤϯτϦ͔͠ͳ͍
- ͬͱӡ༻ʹ͏ཁૉٕज़ฉ͖͍ͨ
- ใग़ͯ͘͠Ε·ͤΜ͔|шƅ)ŧŽŕ
- ※ग़ͨ͠ͱ͜ΖͰͦ͜·ͰϦεΫ͋ΔͰ͔͢ʁ
ࠓͷΰʔϧ
Slide 4
Slide 4 text
- ॴଐ
- ࡾҪ࢈σδλϧɾΞηοτϚωδϝϯτ
- ίʔϙϨʔτγεςϜ෦: DevSecOps, Corp Eng
- LayerX Fintechࣄۀ෦ʢˢʹग़ʣ
- ݸਓ׆ಈ
- िؒχϡʔεϨʔλʔɺPodCastɺಉਓࢽ
- དྷྺ
- ۚ༥ܥSIer > ࢿ࢈ཧɾՈܭɾձܭSP > ূ݊ձࣾ > ݱ৬
- ͳΜ͔ͩΜͩFintech/ূ݊ܥʹ͍Δ
- ࠷ۙσʔλΤϯδχΞϦϯάΛཤमத
@ken5scal
χϡʔεϨλʔ: https://ken5scal.notion.site/54bda4932da14add9e9911ab3e9a6e5c
podcast: https://open.spotify.com/show/73sFeKzUIkSYfCZWVBNO70
Slide 5
Slide 5 text
- Ϧετ
- Ϧετ
- Ϧετ
- Ϧετͷڧௐจࣈ
- Ϧετ
ݟग़͠
https://speakerdeck.com/layerx/company-deck
Slide 6
Slide 6 text
No content
Slide 7
Slide 7 text
No content
Slide 8
Slide 8 text
~݄̐·Ͱ: SIEMಋೖ
ͱΓ͋͑ͣೖΕ͚ͨͩ
Slide 9
Slide 9 text
- σʔλιʔεͷಛੑʹ͓͚ΔඇҰ؏ੑ
- σʔλίωΫλͷ੍ݶɾඇ֦ுੑ
- ϦεΫɾڴҖΤϯϦονϝϯτͷࠔ͞
՝
Slide 10
Slide 10 text
- σʔλιʔεͷಛੑʹ͓͚ΔඇҰ؏ੑ
- Ұఆظؒʹ͓͚Δσʔλྔͷҧ͍
- ϑΥʔϚοτͷҧ͍
- ࣝผੑͷҧ͍
- ػඍੑͷҧ͍
- σʔλίωΫλͷ੍ݶɾඇ֦ுੑ
- ϦεΫɾڴҖΤϯϦονϝϯτͷࠔ͞
՝
Slide 11
Slide 11 text
- σʔλιʔεͷಛੑʹ͓͚ΔඇҰ؏ੑ
- σʔλίωΫλͷ੍ݶɾ֦ுੑ
- ίωΫλ͕ͳ͍
- औಘܦ࿏ɾखஈ͕ϑοΫ͚ͩͰͳ͘ɺΫϩʔϦ
ϯάखಈͳͷ͋Δ
- ෆཁͳσʔλɾϑΟʔϧυͷϑΟϧλ͕͍͠
- ϦεΫɾڴҖΤϯϦονϝϯτͷࠔ͞
՝
Slide 12
Slide 12 text
- σʔλιʔεͷಛੑʹ͓͚ΔඇҰ؏ੑ
- σʔλίωΫλͷ੍ݶɾඇ֦ுੑ
- ϦεΫɾڴҖΤϯϦονϝϯτͷࠔ͞
- ΫΤϦݴޠ͕αʔϏε͝ͱʹҟͳΔ
- Πϕϯτʹඥͮ͘ίϯςΫετͷऔಘʹผσʔλιʔε
Λ׆༻ඞཁ͕͋Δ
- ੬ऑͳঢ়ଶ͔அ͢Δඞཁ͕͋Δ
՝
Slide 13
Slide 13 text
- σʔλιʔεͷಛੑʹ͓͚ΔඇҰ؏ੑ
- σʔλίωΫλͷ੍ݶɾඇ֦ுੑ
- ϦεΫɾڴҖΤϯϦονϝϯτͷࠔ͞
՝
Slide 14
Slide 14 text
ʮken5͞Μɺ͜ͷίετ͚ͩͲ͞…ʯ
Slide 15
Slide 15 text
ग़ͨ͠ϒϩά
https://tech.layerx.co.jp/entry/2024/03/29/093647
Slide 16
Slide 16 text
- ҰݩతʹऩूɾอɾੳͰ͖Δ
- ౷Ұతͳϩάඪ४Λ͋ͯΊ͍ͨ
- ΫΤϦݴޠ౷Ұ͍ͨ͠
- ੳͨ͘͠ͳ͍ͷΛআ֎͍ͨ͠
- ಈతΠϕϯτɾϩάͱɺ੩తͳσʔλϕʔεΛಥ߹͍ͨ͠
- ༻్ʹԠͯ͡σʔλΛܗɾΤϯϦον͍ͨ͠
- ༻్ʹԠͨ͡৽͍͠σʔλϕʔεΛ࡞Γ͍ͨ
- ίετΛ࠷దԽ͍ͨ͠
ཉ͢Δͷ
Slide 17
Slide 17 text
- ҰݩతʹऩूɾอɾੳͰ͖Δ
- ౷Ұతͳϩάඪ४Λ͋ͯΊ͍ͨ
- ੳͨ͘͠ͳ͍ͷΛআ֎͍ͨ͠
- ΫΤϦݴޠ౷Ұ͍ͨ͠
- ಈతΠϕϯτɾϩάͱɺ੩తͳσʔλϕʔεΛಥ߹͍ͨ͠
- ༻్ʹԠͯ͡σʔλΛܗɾΤϯϦον͍ͨ͠
- ༻్ʹԠͨ͡৽͍͠σʔλϕʔεΛ࡞Γ͍ͨ
- ίετΛ࠷దԽ͍ͨ͠
ཉ͢Δͷ
ٻΊΒΕΔѹతίϯτϩʔϥϏϦςΟ
Slide 18
Slide 18 text
- Ϧετ
- Ϧετ
- Ϧετ
- Ϧετͷڧௐจࣈ
- Ϧετ
σʔλΤϯδχΞϦϯάͷγϑτ
Slide 19
Slide 19 text
݄̐ʙ݄̓
https://tech.layerx.co.jp/entry/siem2datalake-seclake
Slide 20
Slide 20 text
- طଘͷAWSܥηΩϡϦςΟΠϕϯτɾϩάͷಥ߹
- ಛఆظؒϩάΠϯ͍ͯ͠ͳ͍Ϣʔβʔͷચग़͠
- ಛఆͷೝূϝιουʹΑΔϢʔβʔঢ়ଶΛΈ߹Θͤͨ৽͍͠Φϒ
δΣΫτ
- signInLog + ϢʔβʔΦϒδΣΫτ
- ϑΟογϯάੑͷ͋ΔύεΩʔೝূସͷࠜڌɾਪਐঢ়ଶͱͯ͠
׆༂
࣮Ͱ͖ͨϢʔεέʔεʢݕূฤʣ
Slide 21
Slide 21 text
՝ͱղܾ - σʔλͷແԽɾԾ໊ԽɾҰఆͷඪ४Խ
https://tech.layerx.co.jp/entry/siem2datalake-seclake
✔σʔλιʔεͷಛੑʹ͓͚ΔඇҰ؏ੑ
Slide 22
Slide 22 text
՝ͱղܾ - σʔλίωΫλαʔϏεͷԽɾϙʔϦϯά
https://tech.layerx.co.jp/entry/siem2datalake-seclake
✔σʔλίωΫλͷ੍ݶɾඇ֦ுੑ
Slide 23
Slide 23 text
՝ͱղܾ - ΤϯϦονϝϯτɾΫΤϦͷ౷Ұ
https://tech.layerx.co.jp/entry/siem2datalake-seclake
✔ϦεΫɾڴҖΤϯϦονϝϯτͷࠔ͞
Slide 24
Slide 24 text
No content
Slide 25
Slide 25 text
- ϧʔϧϓϩηεͷϓϩάϥϜԽ
- VCSͷར༻
- CI/CDϫʔΫϑϩʔʹΑΔมߋ
- ςετυϦϒϯ
σʔλΤϯδχΞϦϯάΛΓཱͨͤͨཁૉ
Slide 26
Slide 26 text
- ϧʔϧϓϩηεͷϓϩάϥϜԽ
- VCSͷར༻
- CI/CDϫʔΫϑϩʔʹΑΔมߋ
- ςετυϦϒϯ…·ͩͳ͍͕
σʔλΤϯδχΞϦϯάΛΓཱͨͤͨཁૉ
Slide 27
Slide 27 text
݁ՌతʹDetection EngineeringΛ͍ͯͨ͠
https://engineering.mercari.com/en/blog/entry/20220513-detection-engineering-and-soar-at-mercari/
Slide 28
Slide 28 text
݁ՌతʹDetection EngineeringΛ͍ͯͨ͠
https://engineering.mercari.com/en/blog/entry/20220513-detection-engineering-and-soar-at-mercari/
͕ɺ͜Ε·ͩݕূͷΈ
Slide 29
Slide 29 text
- ݁ͳΒͳ͍ɻઓज़ɾHow͕มΘΓɺͦΕʹ͋Θ
ͤͨ৫ӡӦ͕มΘΔ͚ͩɻ
- ܇࿅ɺ࠾༻ɺମ੍ؚΉ
- ߴͭ͘͘Մೳੑ͢Β͋Δ
※ࠓͷͱ͜Ζैྔ՝ۚϕʔεͰ͍҆Ͱ͢
ίετ҆͘ͳΔ͔ʁ
Slide 30
Slide 30 text
ʮken5͞Μɺ͜ͷίετ͚ͩͲ͞…ʯ
Slide 31
Slide 31 text
- ελʔτΞοϓࡒঢ়گ͕γϏΞ
- มԽʹΑΔϘϥ͕Ͱ͔͍
- Ϙϥͷ͋ΔڥͰɺ҆ఆతʹʮDEʯͷՁΛೝΊ
ͯΒΘͳ͍ͱɺϔουΧϯτҾ͖కΊʹͳΔ
Մೳੑ͕͋Δ
αεςφϒϧʹܧଓ͢Δʹ
Slide 32
Slide 32 text
- ελʔτΞοϓࡒঢ়گ͕γϏΞ
- มԽʹΑΔϘϥ͕Ͱ͔͍
- Ϙϥͷ͋ΔڥͰɺ҆ఆతʹʮDEʯͷՁΛೝΊ
ͯΒΘͳ͍ͱɺϔουΧϯτҾ͖కΊʹͳΔ
Մೳੑ͕͋Δ
αεςφϒϧʹܧଓ͢Δʹ
ࣄۀϦεΫʹඥ͍ͮͨ֬ݻͨΔγφϦΦ͕ඞཁ
Slide 33
Slide 33 text
γφϦΦ: ͓٬༷ʢࢿՈʣͷࢿۚอޢ
Slide 34
Slide 34 text
ҎԼͷޮՌ͕ݟࠐΊΔ
- ΑΓʮࣗ৴ʯAssuranceΛߴΊΒΕΔ
- ผͷ͕ೖΓɺΑΓࠪੑ͕͕͋Δ
- ࠪͷੜ࢈ੑ্
Slide 35
Slide 35 text
No content
Slide 36
Slide 36 text
- ϝλσʔλཧ
- σʔλιʔεͷॆ࣮
- ࢹج൫ͷࢹ
- ϕʔεϥΠϯͷॆ࣮
- ࣮ࡍͷςετ
- Who watches the watchmen
ࠓޙͷ՝
Slide 37
Slide 37 text
←Ԡื
໘ஊˠ
←ࡶஊ
DM (X): @ken5scal