Hortonworks Cybersecurity Platform Deep Dive
|
|
|
- Pearl Hensley
- 6 years ago
- Views:
Transcription
1 Hortonworks Cybersecurity Platform Deep Dive Powered by Apache Metron Dave Russell Global SME Cybersecurity
2 BREACH DURATION VS DATA RETENTION Average silo retention Average breach unnoticed 2 Hortonworks Inc All Rights Reserved
3 BREACH DURATION VS DATA RETENTION PoliceOne Yahoo (US) Average silo retention Average breach unnoticed Duration in months 3 Hortonworks Inc All Rights Reserved
4 Sometime in the next few years we're going to have our first category-one cyber-incident; one that will need a national response. Ian Levy Technical Director National Cyber Security Centre 4 Hortonworks Inc All Rights Reserved
5 Andhra Pradesh Police, India Aristotle University of Thessaloniki, Greece Automobile Dacia, Romania Cambrian College, Canada Chinese public security bureau CJ CGV Dalian Maritime University Deutsche Bahn Dharmais Hospital, Indonesia Faculty Hospital, Nitra, Slovakia FedEx Garena Blade and Soul Guilin University Of Aerospace Technology Guilin University Of Electronic Technology Harapan Kita Hospital[disambiguation needed], IndonesiaHezhou University Hitachi Honda Instituto Nacional de Salud, Colombia Lakeridge Health LAKS LATAM Airlines Group MegaFon Ministry of Internal Affairs of the Russian Federation Ministry of Foreign Affairs (Romania) National Health Service (England) NHS Scotland Nissan Motor Manufacturing UK O2, Germany Petrobrás PetroChina Portugal Telecom Pulse FM Q-Park Renault Russian Railways Sandvik São Paulo Court of Justice Saudi Telecom Company Sberbank Shandong University State Governments of India Government of Gujarat Government of Kerala Government of Maharashtra Government of West Bengal Suzhou Vehicle Administration Sun Yat-sen University, China Telefónica Telenor Hungary, Hungary Telkom (South Africa) Timrå Municipality, Sweden Universitas Jember, Indonesia University of Milano-Bicocca, Italy University of Montreal, Canada Vivo, Brazil 5 Hortonworks Inc All Rights Reserved
6 6 Hortonworks Inc All Rights Reserved
7 7 Hortonworks Inc All Rights Reserved
8 Problem Posed For Security Analysts Too many disparate tools Too many alerts to process Too much noise Too slow Unnecessary plumbing work 8 Hortonworks Inc All Rights Reserved
9 Timeline Sept 2014 June 2015 Dec 2015 April 2016 Feb 2017 April 2017 Jun 2017 Sept 2017 OpenSOC Beta OpenSOC Community Edition Metron enters Apache Incubator Apache Metron 0.1 Apache Metron 0.3 HCP 1.1 Apache Metron exits Apache Incubator Apache Metron 0.4 HCP 1.2 Secure Cluster Apache Metron HCP 1.3 Alerts UI 9 Hortonworks Inc All Rights Reserved
10 Hortonworks Cybersecurity Platform Powered By Apache Metron Real-Time ingestion of application and system logs Cyber Security Analytics Real-Time cyber security dashboard and cyber workbench Real-Time ingestion, correlation and enrichment of PCAP and NetFlow telemetries Real-Time integration of Cyber security feeds Cyber Security Data Ingestion Package Apache Metron Advanced statistical and machine learning models to detect cyber security attacks Integration with existing SIEMs and enterprise assets 10 Hortonworks Inc All Rights Reserved
11 Apache Metron: Overview Telemetry Data Sources Telemetry Data Collectors Real-time Processing Cyber Security Engine Modules Data Vault Security Endpoint Devices (Fireye, Palo Alto, BlueCoat, etc.) Machine Generated Logs (AD, App / Web Server, firewall, VPN, etc.) IDS (Suricata, Snort, etc.) Network Data (PCAP, Netflow, Bro, etc.) Threat Intelligence Feeds (Soltra, OpenTaxi, third-party feeds) / Other Performance Network Ingest Probes Real-time Enrich / Threat Intel Streams Telemetry Ingest Buffer Telemetry Parsers Cyber Security Stream Processing Pipeline Enrichment Threat Intelligence Profiler Alert Triage Indexers and Writer Data Services and Integration Layer Real-Time Search Evidentiary Store Threat Intelligence Platform Model as a Service Community Models Data Science Workbench PCAP Forensics 11 Hortonworks Inc All Rights Reserved
12 Profiler: User and Entity Behavior analytics Profiler Bolt Fast Cache HBase HyperLogLogPlus T-Digest Bloom filter MAD outlier Cardinality Statistics Presence Outliers How many servers connected? Average over different periods Finding small needles in big haystacks Detecting unusual events in streams Triage Scoring Model features Aggregations over Time 12 Hortonworks Inc All Rights Reserved
13 Train / Update Model as a Service Metron JSON Object Storm Enrichment Bolt Service Discovery Zookeeper YARN Metron JSON Object with added score, confidence etc. from model Real-time scoring Versioned deployment of models in any tech Service discovery REST interface Model Service HDFS Model Store HBase Historical Data Store 13 Hortonworks Inc All Rights Reserved
14 A deeper look at Hortonworks Cybersecurity Platform 14 Hortonworks Inc All Rights Reserved
15 stop blaming the users, and make the systems usable. Ian Levy Technical Director National Cyber Security Centre 15 Hortonworks Inc All Rights Reserved
16 Questions? 16 Hortonworks Inc All Rights Reserved
17 FAQ Combined or separate cybersecurity datalake? Cloud or on premise? Streaming engine, why not spark/flink/any other hotness? What ML in Model as a Service? Where can I get more information? Hot? Warm? Cold? What is supported out of the box? 17 Hortonworks Inc All Rights Reserved
18 Apache Metron Datasheet Ingest: Enrichments and threat feeds: Data science features: Apache NiFi: syslog, socket, file, web services, SQL, RDBMS, Windows Event Log, FTP, MQ, JMS High-performance DPDK Packet Capture Parsers: Cisco ASA Bluecoat Fireeye Palo Alto SourceFire WebSphere Snort Geo Whois HBase JDBC Stellar CSV Stix, Taxii threat intel feeds Analytics features: Profiler Model Services Threat Triage Spark Machine Learning Zeppelin notebooks and reporting Wide partner eco-system Forensic features: PCAP inspector PCAP query Long term data store Bro Indexing and search: YAF (Netflow, IPFIX) Grok (Custom) Elasticsearch, Kibana Solr Java (Custom) JSON Applications: DHCPD, AD HDFS Kafka 18 Hortonworks Inc All Rights Reserved
19 19 Hortonworks Inc All Rights Reserved
20 Thankyou 20 Hortonworks Inc All Rights Reserved
Hortonworks Cybersecurity Platform
Administration () docs.hortonworks.com : Administration Copyright 2012-2018 Hortonworks, Inc. Some rights reserved. (HCP) is a modern data application based on Apache Metron, powered by Apache Hadoop,
Compare Security Analytics Solutions
Compare Security Analytics Solutions Learn how Cisco Stealthwatch compares with other security analytics products. This solution scales easily, giving you visibility across the entire network. Stealthwatch
Hortonworks Cybersecurity Package
Run Book () docs.hortonworks.com Hortonworks Cybersecurity : Run Book Copyright 2012-2017 Hortonworks, Inc. Some rights reserved. Hortonworks Cybersecurity (HCP) is a modern data application based on Apache
Hortonworks Cybersecurity Platform
Upgrade Guide () docs.hortonworks.com Hortonworks Cybersecurity : Upgrade Guide Copyright 2012-2018 Hortonworks, Inc. Some rights reserved. Hortonworks Cybersecurity (HCP) is a modern data application
Hortonworks Cybersecurity Platform
Installation () docs.hortonworks.com : Installation Copyright 2012-2018 Hortonworks, Inc. Some rights reserved. (HCP) is a modern data application based on Apache Metron, powered by Apache Hadoop, Apache
Hortonworks Cybersecurity Platform
1 Hortonworks Cybersecurity Platform Date of Publish: 2018-07-15 http://docs.hortonworks.com Contents ii Contents Introduction to the... 4 Adding a New Telemetry Data Source...4 Prerequisites... 4 Stream
Increase Value from Big Data with Real-Time Data Integration and Streaming Analytics
Increase Value from Big Data with Real-Time Data Integration and Streaming Analytics Cy Erbay Senior Director Striim Executive Summary Striim is Uniquely Qualified to Solve the Challenges of Real-Time
Hortonworks Cybersecurity Platform
1 Hortonworks Cybersecurity Platform Date of Publish: 2018-07-30 http://docs.hortonworks.com Contents Introduction to Metron Dashboard... 3 Functionality of Metron Dashboard... 3 Metron Default Dashboard...
Table 1 The Elastic Stack use cases Use case Industry or vertical market Operational log analytics: Gain real-time operational insight, reduce Mean Ti
Solution Overview Cisco UCS Integrated Infrastructure for Big Data with the Elastic Stack Cisco and Elastic deliver a powerful, scalable, and programmable IT operations and security analytics platform
Adding a New Telemetry Source
1 Adding a New Telemetry Source Date of Publish: 2018-10-15 http://docs.hortonworks.com Contents...3 Telemetry Data Source Parsers Bundled with HCP... 3 Snort... 3 Bro...3 YAF (NetFlow)...3 Indexing...4
Key Technologies for Security Operations. Copyright 2014 EMC Corporation. All rights reserved.
Key Technologies for Security Operations 2 Traditional Security Is Not Working 97% of breaches led to compromise within days or less with 72% leading to data exfiltration in the same time Source: Verizon
THE RSA SUITE NETWITNESS REINVENT YOUR SIEM. Presented by: Walter Abeson
THE RSA NETWITNESS SUITE REINVENT YOUR SIEM Presented by: Walter Abeson 1 Reality Goals GOALS VERSUS REALITY OF SIEM 1.0 Single compliance & security interface Analyze & prioritize alerts across various
SOLUTION BRIEF RSA NETWITNESS EVOLVED SIEM
RSA NETWITNESS EVOLVED SIEM OVERVIEW A SIEM is technology originally intended for compliance and log management. Later, as SIEMs became the aggregation points for security alerts, they began to be more
Streaming Integration and Intelligence For Automating Time Sensitive Events
Streaming Integration and Intelligence For Automating Time Sensitive Events Ted Fish Director Sales, Midwest ted@striim.com 312-330-4929 Striim Executive Summary Delivering Data for Time Sensitive Processes
SIEM Solutions from McAfee
SIEM Solutions from McAfee Monitor. Prioritize. Investigate. Respond. Today s security information and event management (SIEM) solutions need to be able to identify and defend against attacks within an
Mothra: A Large-Scale Data Processing Platform for Network Security Analysis
Mothra: A Large-Scale Data Processing Platform for Network Security Analysis Tony Cebzanov Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 REV-03.18.2016.0 1 Agenda Introduction
QuickSpecs. Aruba IntroSpect User and Entity Behavior Analytics. Overview. Aruba IntroSpect User and Entity Behavior Analytics Product overview
Overview Product overview Aruba s User and Entity Behavior Analytics (UEBA) solution, Aruba IntroSpect, detects attacks by spotting small changes in behavior that are often indicative of attacks that have
National Cyber Security Operations Center (N-CSOC) Stakeholders' Conference
National Cyber Security Operations Center (N-CSOC) Stakeholders' Conference Benefits to the Stakeholders A Collaborative and Win-Win Strategy Lal Dias Chief Executive Officer Sri Lanka CERT CC Cyber attacks
Integrated, Intelligence driven Cyber Threat Hunting
Integrated, Intelligence driven Cyber Threat Hunting THREAT INVESTIGATION AND RESPONSE PLATFORM Zsolt Kocsis IBM Security Technical Executive, CEE zsolt.kocsis@hu.ibm.com 6th Nov 2018 Build an integrated
PNDA.io: when BGP meets Big-Data
PNDA.io: when BGP meets Big-Data Let s go back in time 26 th April 2017 The Internet is very much alive Millions of BGP events occurring every day 15 Routers Monitored 410 active peers (both IPv4 and IPv6)
Hortonworks Cybersecurity Platform
1 Hortonworks Cybersecurity Platform Date of Publish: 2018-07-15 http://docs.hortonworks.com Contents Introduction to Metron Dashboard... 3 Functionality of Metron Dashboard... 3 Metron Default Dashboard...
Overview. Prerequisites. Course Outline. Course Outline :: Apache Spark Development::
Title Duration : Apache Spark Development : 4 days Overview Spark is a fast and general cluster computing system for Big Data. It provides high-level APIs in Scala, Java, Python, and R, and an optimized
Hortonworks and The Internet of Things
Hortonworks and The Internet of Things Dr. Bernhard Walter Solutions Engineer About Hortonworks Customer Momentum ~700 customers (as of November 4, 2015) 152 customers added in Q3 2015 Publicly traded
Top 10 use cases of HP ArcSight Logger
Top 10 use cases of HP ArcSight Logger Sridhar Karnam @Sri747 Karnam@hp.com #HPSecure Big data is driving innovation The Big Data will continue to expand Collect Big Data for analytics Store Big Data for
Threat Containment and Operations. Yong Kwang Kek, Director of Presales SE, APJ
Threat Containment and Operations Yong Kwang Kek, Director of Presales SE, APJ 2018-07-19 1 1 2017 Infoblox Inc. All Rights 2013 Infoblox Inc. All Reserved. Rights Reserved. Three Aspects of Security #1
Hortonworks Cybersecurity Platform
1 Hortonworks Cybersecurity Platform Date of Publish: 2018-08-23 http://docs.hortonworks.com Contents ii Contents Introduction to Metron Dashboard... 4 Functionality of Metron Dashboard... 4 Metron Default
The Hadoop Ecosystem. EECS 4415 Big Data Systems. Tilemachos Pechlivanoglou
The Hadoop Ecosystem EECS 4415 Big Data Systems Tilemachos Pechlivanoglou tipech@eecs.yorku.ca A lot of tools designed to work with Hadoop 2 HDFS, MapReduce Hadoop Distributed File System Core Hadoop component
Big Data Technology Ecosystem. Mark Burnette Pentaho Director Sales Engineering, Hitachi Vantara
Big Data Technology Ecosystem Mark Burnette Pentaho Director Sales Engineering, Hitachi Vantara Agenda End-to-End Data Delivery Platform Ecosystem of Data Technologies Mapping an End-to-End Solution Case
Innovatus Technologies
HADOOP 2.X BIGDATA ANALYTICS 1. Java Overview of Java Classes and Objects Garbage Collection and Modifiers Inheritance, Aggregation, Polymorphism Command line argument Abstract class and Interfaces String
TRUSTED IT: REDEFINE SOCIAL, MOBILE & CLOUD INFRASTRUCTURE. Ralf Kaltenbach, Regional Director RSA Germany
TRUSTED IT: REDEFINE SOCIAL, MOBILE & CLOUD INFRASTRUCTURE Ralf Kaltenbach, Regional Director RSA Germany 1 TRUSTED IT Continuous Availability of Applications, Systems and Data Data Protection with Integrated
Hortonworks DataFlow Sam Lachterman Solutions Engineer
Hortonworks DataFlow Sam Lachterman Solutions Engineer 1 Hortonworks Inc. 2011 2017. All Rights Reserved Disclaimer This document may contain product features and technology directions that are under development,
HDP Security Overview
3 HDP Security Overview Date of Publish: 2018-07-15 http://docs.hortonworks.com Contents HDP Security Overview...3 Understanding Data Lake Security... 3 What's New in This Release: Knox... 5 What's New
HDP Security Overview
3 HDP Security Overview Date of Publish: 2018-07-15 http://docs.hortonworks.com Contents HDP Security Overview...3 Understanding Data Lake Security... 3 What's New in This Release: Knox... 5 What's New
Enriching Telemetry Events
HCP 1 Date of Publish: 2018-10-15 http://docs.hortonworks.com Contents...3 Bulk Loading Enrichment Information... 3 OPTIONAL: Create a Mock Enrichment Source... 3 Configure an Extractor Configuration File...
Big Data security, tools and tips to protect information assets
Big Data security, tools and tips to protect information assets Eddie Garcia Chief Security Architect 1 A Big Data Revolution is Happening as We Speak Industrial Revolution Data Revolution 2 The Benefits
Hortonworks Cybersecurity Platform
1 Hortonworks Cybersecurity Platform Date of Publish: 2018-07-15 http://docs.hortonworks.com Contents Preparing to Upgrade...3 Back up Your Configuration...3 Stop All Metron Services...3 Upgrade Metron...4
Affordable High-Speed Sensors Everywhere. ntop Meetup Flocon 2016, Daytona Beach Jan 13th 2016
Affordable High-Speed Sensors Everywhere ntop Meetup Flocon 2016, Daytona Beach Jan 13th 2016 Welcome to the ntop Meetup Meeting Goals: Meet ntop users Describe our ideas and plans for 2016 Hear your comments
Prescriptive Security Operations Centers. Leveraging big data capabilities to build next generation SOC
Prescriptive Security Operations Centers Leveraging big data capabilities to build next generation SOC Cyber Security Industry in constant renewal in 2016 and 2017 1 Tbps Mirai IoT Botnet broke the Internet
Thales PunchPlatform Agenda
Thales PunchPlatform Agenda What It Does Building Blocks PunchPlatform team Deployment & Operations Typical Setups Customers and Use Cases RoadMap 1 What It Does Compose Arbitrary Industrial Data Processing
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
Building a Scalable Recommender System with Apache Spark, Apache Kafka and Elasticsearch
Nick Pentreath Nov / 14 / 16 Building a Scalable Recommender System with Apache Spark, Apache Kafka and Elasticsearch About @MLnick Principal Engineer, IBM Apache Spark PMC Focused on machine learning
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM OVERVIEW The Verizon 2016 Data Breach Investigations Report highlights that attackers are regularly outpacing the defenders.
microsoft
70-775.microsoft Number: 70-775 Passing Score: 800 Time Limit: 120 min Exam A QUESTION 1 Note: This question is part of a series of questions that present the same scenario. Each question in the series
NetFlow Optimizer. Overview. Version (Build ) May 2017
NetFlow Optimizer Overview Version 2.4.9 (Build 2.4.9.0.3) May 2017 Copyright 2013-2017 NetFlow Logic Corporation. All rights reserved. Patents both issued and pending. Contents About NetFlow Optimizer...
The Future of Threat Prevention
The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network
SOC AUTOMATION OF THREAT INVESTIGATION
SOC AUTOMATION OF THREAT INVESTIGATION White Paper When a Security Operations Center (SOC) is shown on TV, it has a specific portrayal. There is a large wall full of screens. World maps showing the threat
Analytics Driven, Simple, Accurate and Actionable Cyber Security Solution CYBER ANALYTICS
Analytics Driven, Simple, Accurate and Actionable Cyber Security Solution CYBER ANALYTICS Overview Cyberattacks are increasingly getting more frequent, more sophisticated and more widespread than ever
Novetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
RSA Advanced Security Operations Richard Nichols, Director EMEA. Copyright 2015 EMC Corporation. All rights reserved. 1
RSA Advanced Security Operations Richard Nichols, Director EMEA 1 What is the problem we need to solve? 2 Attackers Are Outpacing Defenders..and the Gap is Widening Attacker Capabilities The defender-detection
Seceon s Open Threat Management software
Seceon s Open Threat Management software Seceon s Open Threat Management software (OTM), is a cyber-security advanced threat management platform that visualizes, detects, and eliminates threats in real
Big Data Hadoop Developer Course Content. Big Data Hadoop Developer - The Complete Course Course Duration: 45 Hours
Big Data Hadoop Developer Course Content Who is the target audience? Big Data Hadoop Developer - The Complete Course Course Duration: 45 Hours Complete beginners who want to learn Big Data Hadoop Professionals
New Data Architectures For Netflow Analytics NANOG 74. Fangjin Yang - Imply
New Data Architectures For Netflow Analytics NANOG 74 Fangjin Yang - Cofounder @ Imply The Problem Comparing technologies Overview Operational analytic databases Try this at home The Problem Netflow data
<Partner Name> <Partner Product> RSA NETWITNESS Security Operations Implementation Guide. Gurucul Risk Analytics
RSA NETWITNESS Security Operations Implementation Guide Jeffrey Carlson, RSA Partner Engineering Last Modified: June 27 th, 2017 (GRA) Overview Gurucul is changing the
RSA ECAT DETECT, ANALYZE, RESPOND!
RSA ECAT DETECT, ANALYZE, RESPOND! Cyber Threat Landscape Attack surface (& attackers) expanding Web app Existing strategies & controls are failing Laptop EHR Firewall Attacks sophistication on the rise
Noam Ikar R&DVP. Complex Event Processing and Situational Awareness in the Digital Age
Noam Ikar R&DVP Complex Event Processing and Situational Awareness in the Digital Age We need to correlate events from inside and outside the organization by a smart layer Cyberint CEO, Dec 2017. Wikipedia
Cisco Tetration Analytics
Cisco Tetration Analytics Enhanced security and operations with real time analytics John Joo Tetration Business Unit Cisco Systems Security Challenges in Modern Data Centers Securing applications has become
How to Troubleshoot Databases and Exadata Using Oracle Log Analytics
How to Troubleshoot Databases and Exadata Using Oracle Log Analytics Nima Haddadkaveh Director, Product Management Oracle Management Cloud October, 2018 Copyright 2018, Oracle and/or its affiliates. All
Big Data Architect.
Big Data Architect www.austech.edu.au WHAT IS BIG DATA ARCHITECT? A big data architecture is designed to handle the ingestion, processing, and analysis of data that is too large or complex for traditional
MODERN BIG DATA DESIGN PATTERNS CASE DRIVEN DESINGS
MODERN BIG DATA DESIGN PATTERNS CASE DRIVEN DESINGS SUJEE MANIYAM FOUNDER / PRINCIPAL @ ELEPHANT SCALE www.elephantscale.com sujee@elephantscale.com HI, I M SUJEE MANIYAM Founder / Principal @ ElephantScale
MOBILE FORENSICS AND SECURITY
DHS S&T CYBER SECURITY DIVISION 2014 Cyber Security Division R&D Showcase MOBILE FORENSICS AND SECURITY NowSecure Andrew Hoog December 16, 2014 Mobile Devices Are Complicated Average Android Device 300
Delving Deep into Hadoop Course Contents Introduction to Hadoop and Architecture
Delving Deep into Hadoop Course Contents Introduction to Hadoop and Architecture Hadoop 1.0 Architecture Introduction to Hadoop & Big Data Hadoop Evolution Hadoop Architecture Networking Concepts Use cases
Fluentd + MongoDB + Spark = Awesome Sauce
Fluentd + MongoDB + Spark = Awesome Sauce Nishant Sahay, Sr. Architect, Wipro Limited Bhavani Ananth, Tech Manager, Wipro Limited Your company logo here Wipro Open Source Practice: Vision & Mission Vision
Lenses 2.1 Enterprise Features PRODUCT DATA SHEET
Lenses 2.1 Enterprise Features PRODUCT DATA SHEET 1 OVERVIEW DataOps is the art of progressing from data to value in seconds. For us, its all about making data operations as easy and fast as using the
Certified Big Data Hadoop and Spark Scala Course Curriculum
Certified Big Data Hadoop and Spark Scala Course Curriculum The Certified Big Data Hadoop and Spark Scala course by DataFlair is a perfect blend of indepth theoretical knowledge and strong practical skills
Increase Threat Detection & Incident Response
Martin Rudd Carrier Scale Network Security: Increase Threat Detection & Incident Response www.telesoft-technologies.com copyright 2017 by Telesoft Technologies. All rights reserved. Agenda Brief bio Threat
Practical Machine Learning Agenda
Practical Machine Learning Agenda Starting From Log Management Moving To Machine Learning PunchPlatform team Thales Challenges Thanks 1 Starting From Log Management 2 Starting From Log Management Data
LOGSTASH: BFD* Security Weekly: December 4, Phil Hagen. / +PhilHagen. *Big Forensic Data
TASH: BFD* Security Weekly: December 4, 2014 Phil Hagen phil@redcanary.co / phil@lewestech.com @PhilHagen / +PhilHagen 1 *Big Forensic Data ALL ABOUT PHIL SANS Certified Instructor and Course lead, FOR572:
The Critical Assets Filter for the SOC Focus discovery and analytics to expedite security investigations
White Paper Focus discovery and analytics to expedite security investigations By Barbara Kay, CISSP With limited analyst time and many alerts going untriaged, security operation centers are getting more
One Hospital s Cybersecurity Journey
MAY 11 12, 2017 SAN FRANCISCO, CA One Hospital s Cybersecurity Journey SanFrancisco.HealthPrivacyForum.com #HITprivacy Introduction Senior Director Information Systems Technology, Children s Mercy Hospital
Hortonworks Cybersecurity Platform
1 Hortonworks Cybersecurity Platform Date of Publish: 2018-07-30 http://docs.hortonworks.com Contents Preparing to Upgrade...3 Back up Your Configuration...3 Stop All Metron Services...3 Upgrade Metron...4
Self-driving Datacenter: Analytics
Self-driving Datacenter: Analytics George Boulescu Consulting Systems Engineer 19/10/2016 Alvin Toffler is a former associate editor of Fortune magazine, known for his works discussing the digital revolution,
CiscoWorks Security Information Management Solution 3.1
Data Sheet CiscoWorks Security Information Management Solution 3.1 One of the greatest challenges in enterprise security is managing the flood of alerts generated by a growing number of multivendor security
How Vectra Cognito enables the implementation of an adaptive security architecture
Compliance brief How Vectra Cognito enables the implementation of an adaptive security architecture Historically, enterprises have relied on prevention and policy-based controls for security, deploying
Popular SIEM vs aisiem
Popular SIEM vs aisiem You cannot flip a page in any Cybersecurity magazine, or scroll through security blogging sites without a mention of Next Gen SIEM. You can understand why traditional SIEM vendors
SHARKSEER Zero Day Net Defense. Ronald Nielson Technical Director
SHARKSEER Zero Day Net Defense Ronald Nielson Technical Director SHARKSEER Program Definition: Detects and mitigates web-based malware Zero-Day and Advanced Persistent Threats using COTS technology by
Empower stakeholders with single-pane visibility and insights Enrich firewall security data
SonicWall Analytics Transforming data into information, information into knowledge, knowledge into decisions and decisions into actions SonicWall Analytics provides an eagle-eye view into everything that
Bring Context To Your Machine Data With Hadoop, RDBMS & Splunk
Bring Context To Your Machine Data With Hadoop, RDBMS & Splunk Raanan Dagan and Rohit Pujari September 25, 2017 Washington, DC Forward-Looking Statements During the course of this presentation, we may
Certified Big Data and Hadoop Course Curriculum
Certified Big Data and Hadoop Course Curriculum The Certified Big Data and Hadoop course by DataFlair is a perfect blend of in-depth theoretical knowledge and strong practical skills via implementation
ARTIFICIAL INTELLIGENCE POWERED AUTOMATED THREAT HUNTING AND NETWORK SELF-DEFENSE
ARTIFICIAL INTELLIGENCE POWERED AUTOMATED THREAT HUNTING AND NETWORK SELF-DEFENSE Vectra Cognito HIGHLIGHTS Finds active attackers inside your network Automates security investigations with conclusive
Apache Ignite - Using a Memory Grid for Heterogeneous Computation Frameworks A Use Case Guided Explanation. Chris Herrera Hashmap
Apache Ignite - Using a Memory Grid for Heterogeneous Computation Frameworks A Use Case Guided Explanation Chris Herrera Hashmap Topics Who - Key Hashmap Team Members The Use Case - Our Need for a Memory
Cisco Stealthwatch Improves Threat Defense with Network Visibility and Security Analytics
Solution Overview Cisco Stealthwatch Improves Threat Defense with Network Visibility and Security Analytics BENEFITS Gain visibility across all network conversations, including east-west and north-south
What matters in Cyber Security
What matters in Cyber Security A CTO perspective Dr. Robert W. Griffin Chief Security Architect #RSAemeaSummit 1 What CEOs say Cyber Risk matters! Cyber rated #3 risk in survey of 588 C- and Board-level
Cost Effective, Scalable Packet Capture and Cyber Analytics Cluster for Low Bandwidth Enterprise Customers
Cost Effective, Scalable Packet Capture and Cyber Analytics Cluster for Low Bandwidth Enterprise Customers The Enterprise Lite Packet Capture Cluster Platform is a complete solution based on NextComputing
THE PIONEER IN REAL-TIME CYBER SITUATIONAL AWARENESS
DATA SHEET THE PIONEER IN REAL-TIME CYBER SITUATIONAL AWARENESS LUMETA SPECTRE FOR 100% REAL-TIME INFRASTRUCTURE VISIBILITY, REAL-TIME NETWORK CHANGE MONITORING AND THREAT DETECTION FOR PREVENTING SUCCESSFUL
Hadoop. Introduction / Overview
Hadoop Introduction / Overview Preface We will use these PowerPoint slides to guide us through our topic. Expect 15 minute segments of lecture Expect 1-4 hour lab segments Expect minimal pretty pictures
ELK for Enterprise IR Visibility
ELK for Enterprise IR Visibility Mark Goudie, Security Consulting Director Barry Anderson, Security Architect Agenda Introduction Security Challenges IR and Issues ELK Inputs Enrichment Cloud Integration
Administration of Symantec Cyber Security Services (July 2015) Sample Exam
Administration of Symantec Cyber Security Services (July 2015) Sample Exam Contents SAMPLE QUESTIONS... 1 ANSWERS... 6 Sample Questions 1. Which DeepSight Intelligence Datafeed can be used to create a
Cyber Security at large scale
Cyber Security & Data Summit June 18 Cyber Security at large scale www.telesoft-technologies.com copyright 2017 by Telesoft Technologies. All rights reserved. Agenda Telesoft Introduction Large scale Challenges
Flow-Based Network Monitoring using nprobe and ntopng
Flow-Based Network Monitoring using nprobe and ntopng Simone Mainardi, PhD @simonemainardi mainardi@ntop.org Agenda About ntop Flow-based network monitoring, beyond SNMP nprobe: NetFlow/IPFIX/sFlow probe
Cisco Tetration Analytics
Cisco Tetration Analytics Enhanced security and operations with real time analytics Christopher Say (CCIE RS SP) Consulting System Engineer csaychoh@cisco.com Challenges in operating a hybrid data center
IBM Security QRadar Version Architecture and Deployment Guide IBM
IBM Security QRadar Version 7.3.1 Architecture and Deployment Guide IBM Note Before you use this information and the product that it supports, read the information in Notices on page 41. Product information
RSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Analyze & prioritize alerts across various sources The cornerstone of security
Future Challenges and Changes in Industrial Cybersecurity. Sid Snitkin VP Cybersecurity Services ARC Advisory Group
Future Challenges and Changes in Industrial Cybersecurity Sid Snitkin VP Cybersecurity Services ARC Advisory Group Srsnitkin@ARCweb.com Agenda Industrial Cybersecurity Today Scope, Assumptions and Strategies
Index. Scott Klein 2017 S. Klein, IoT Solutions in Microsoft s Azure IoT Suite, DOI /
Index A Advanced Message Queueing Protocol (AMQP), 44 Analytics, 9 Apache Ambari project, 209 210 API key, 244 Application data, 4 Azure Active Directory (AAD), 91, 257 Azure Blob Storage, 191 Azure data
Network Traffic Visibility and Anomaly October 27th, 2016 Dan Ellis
Network Traffic Visibility and Anomaly Detection @Scale: October 27th, 2016 Dan Ellis Introduction Network traffic visibility? Introduction Network traffic visibility? What data is available on your network
Security Monitoring. Managed Vulnerability Services. Managed Endpoint Protection. Platform. Platform Managed Endpoint Detection and Response
Security Operations Flexible and Scalable Solutions to Improve Your Security Capabilities Security threats continue to rise each year and are increasing in sophistication and malicious intent. Unfortunately,
TRUSTED IT: REDEFINE SOCIAL, MOBILE & CLOUD INFRASTRUCTURE. John McDonald
TRUSTED IT: REDEFINE SOCIAL, MOBILE & CLOUD INFRASTRUCTURE John McDonald 1 What is Trust? Can I trust that my assets will be available when I need them? Availability Critical Assets Security Can I trust
SOLUTION BRIEF DFLabs IncMan SOAR - The Security Orchestration, Automation and Response Platform for SOCs.
SOLUTION BRIEF DFLabs IncMan SOAR - The Security Orchestration, Automation and Response Platform for SOCs. This Solution Brief outlines how DFLabs IncMan SOAR is designed to automate, orchestrate and measure
Enterprise Situational Intelligence
DATA SHEET Enterprise Situational Intelligence You can attain a real-time, authoritative view of your network infrastructure using Lumeta ESI. Running in an always-on mode, ESI delivers network indexing,
Ingest. Aaron Mildenstein, Consulting Architect Tokyo Dec 14, 2017
Ingest Aaron Mildenstein, Consulting Architect Tokyo Dec 14, 2017 Data Ingestion The process of collecting and importing data for immediate use 2 ? Simple things should be simple. Shay Banon Elastic{ON}