Knowing what is going on in your environment is an important part of staying on top of security issues. But how do you capture relevant metrics and visualize them? One widely-used tool for that job is the Elastic Stack, formerly known as the ELK stack. This talk shows how to ingest relevant metrics from your network and hosts as well as how to easily visualize them to find suspicious patterns and behaviors. We will be also using the latest tool named SIEM.

1. Visualizeyourthreats
withElasticSIEM
David Pilato @dadoonet

2. Security incidents come in three levels
FYI,WTF,andOMG

3. Learn about a breach
Fromthepressorusers

4. Learn about a breach
Attackersaskingforaransom

5. Learn about a breach
Cloudprovider'sbill

6. Learn about a breach
Yourselfafterthefact

7. Learn about a breach
Yourself&youcanprovenoharm

8. uditdhttps://github.com/linux-audit

9. Demo

11. Problem
Howtocentralize?

12. Developer | Evangelist
!

14. FilebeatModule:Auditd

15. Demo

16. Auditbeat

17. Demo

18. SystemModule
host, process, package,
socket, login, user

19. Demo

20. FileIntegrityModule
inotify (Linux)
fsevents (macOS)
ReadDirectoryChangesW (Windows)

21. Demo

23. ElasticCommonSchema
https://github.com/elastic/ecs

24. ---
- name: base
root: true
title: Base
group: 1
short: All fields defined directly at the top level
description: >
The `base` field set contains all fields which are on the top level.
These fields are common across all types of events.
type: group
fields:
- name: "@timestamp"
type: date
level: core
required: true
example: "2016-05-23T08:05:34.853Z"
short: Date/time when the event originated.
description: >
Date/time when the event originated.
This is the date/time extracted from the event, typically representing
when the event was generated by the source.
If the event source has no original timestamp, this value is typically
populated by the first time the event was received by the pipeline.
Required field for all events.

25. ElasticSIEMSecurity Information and Event Management

26. Demo

28. Code
https://github.com/xeraa/
auditbeat-in-action

29. Visualizeyourthreats
withElasticSIEM
David Pilato @dadoonet