Empower Your Security Practitioners

with Elastic SIEM

15 OCT 19

Kevin Keeney
Cyber Security Advocate
Introduction

Kevin Keeney
Cyber Security
Advocate
@kevinkeeneyjr
linkedin.com/in/kevinkeeney
 Empower your team

3
 Elastic Common Schema (ECS)
Normalize data to streamline analysis

● A common, extensible set of fields to

ingest data into Elasticsearch

● Ability to correlate data across

different data sources

● Ability to re-use analysis content

across solutions in Kibana

● An ever-expanding community of
vendors & experts contributing to ECS

4
 Elastic SIEM Internal context
Ecosystem
External context

● Endpoint sources Security orchestration,

automation, response
● Cloud platforms &
applications
Security incident
● Network sources
response
● User activity sources
● SIEMs & centralized General ticket & case
security data stores management

Community
Consulting

Education & training

6 These are just some of our partners and community members. The presence of a vendor logo doesn’t imply a business relationship with Elastic.
 Commercial
Adoption

Corelight
From the makers of Zeek/Bro

Palo Alto Networks

All the feeds that come from
NGFW versions 8.0-9.0

Cloudflare
Where CDN meets security

7
 Elastic SIEM (beta)
A SIEM for Elastic Stack users everywhere

Visualize your Elasticsearch

Elastic SIEM app data and navigate the
Elastic Stack

Elastic Common A distributed, RESTful Elastic &

Schema (ECS) search and analytics engine community
security
content

Network & host

data integrations
Elastic
Beats Logstash
Endpoint

8
 Response Prevention

Iterative

Detection
9
 No Compromises:

Speed Scale Relevance

10
 Introducing

Elastic
SIEM

11
 Auditbeat
● System module (Linux, macOS, Win.): packages,
processes, logins, sockets, users and groups
● Auditd module (Linux Kernel Audit info)

Curated integrations ● File integrity monitoring (Linux, macOS, Win.)

Host Filebeat
● System logs (auth logs) (Linux)
data ● Santa (macOS)

Winlogbeat
● Windows event logs
● Sysmon

12
 Packetbeat
● Flows
● DNS
● Other protocols
Curated integrations

Network Filebeat
● IDS/IPS/NMS modules: Zeek NMS, Suricata IDS

data ● NetFlow, CEF

● Firewall modules: Cisco ASA, FTD, Palo Alto
Networks, Ubiquiti IPTables
● Kubernetes modules: CoreDNS, Envoy proxy
● Google VPC flow logs, PubSub Input

13
14
15
16
17
18
19
20
21
22
23
24
 Automated Detection
Machine Learning jobs for Security Analytics
v.7.3
Three security ML jobs included:
rare_process_by_host_windows_ecs
rare_process_by_host_linux_ecs
suspicious _login_actvity_ecs

25
26
 Automated Detection
Machine Learning jobs for Security Analytics
v.7.4
Thirteen more security ML jobs added:
linux-anomalous-network-activity
linux-anomalous-network-port-activity
linux-anomalous-network-service
linux-anomalous-process-all-hosts
linux-anomalous-network-URL-activity
linux-anomalous-user-name
linux-anomalous-path-activity
windows-anomalous-path-activity
windows-anomalous-process-all-hosts
windows-anomalous-process-creation
windows-anomalous-service
windows-anomalous-script
windows-anomalous-network-activity
27
 Even more for security analysts to love

28
 Elastic SIEM Bottom-up Vision

5 Deep Community Ecosystem

Effective Detection Library 4

3 Rich Visualizations, Easy Workflow

Multiple Detection Engines 2

1 Fast Scalable Search Engine

29 Elastic Confidential Information - Roadmap information provided on this slide is an overview of overall direction and nothing is committed.
Endgame Integration Strengthens Protection
Elastic Endpoint & SIEM

Prevention Detection Response

Prevention starts with Elastic When prevention is not enough, Detection is made actionable with
Endpoint, blocking adversary detection is critical. Detection response. Endpoint and SIEM
attacks at the source. gains context in Elastic SIEM. together speed remediation.

Elastic Security - Integrated Endpoint Security and SIEM

Elastic Endpoint Elastic SIEM

Prevent, Detect, Collect Detect, Add Context, Respond
 Thank You!

15 OCT 19

Kevin Keeney
Cyber Security Advocate