Visualize Your Threats

Knowing what is going on in your environment is an important part of staying on top of security issues. But how do you capture relevant metrics and visualize them? One widely-used, open source tool for that job is the Elastic Stack, formerly known as the ELK stack. This talk shows how to ingest relevant metrics from your network and hosts as well as how to easily visualize them to find suspicious patterns and behaviors.

Transcript

1. Visualize your threats Philipp Krenn̴̴̴̴@xeraa
2. Infrastructure | Developer Advocate
3. ViennaDB Papers We Love Vienna
4. You Know, for Search
7. ELK Stack
12. Elastic Stack
14. What about security?
15. Once upon a time...
17. Dataset https://github.com/tcrug/marx_data
18. Condensed into one day 2016-01-12
19. Enriched Port numbers, unique attack types, individual attacks, GeoIP
20. Metrics Generated
21. Discover
24. Visualize
25. Attacks by host and time
27. CPU over time
29. CPU over time by host
31. Geolocation of attacks
33. Dashboard
34. Putting it together
37. Timelion
38. Compare honey data and metrics
40. Compare honey data and metrics for Tokyo
42. Conclusion
43. Visualize all the things
45. But wait, there is more
47. Prelert is coming
49. Try it https://github.com/xeraa/vagrant-elastic-stack
50. Questions? Philipp Krenn̴̴̴̴̴@xeraa PS: Sticker