security hands-on @ pavilion - splunk · objective objective •learn to triage a security event...

8

Security Hands-on @ Pavilion Automate Security Operations with Phantom & Splunk Splunk | Security Markets September 26 | Washington, DC

Upload: others

Post on 21-May-2020

4 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Security Hands-on @ Pavilion - Splunk · Objective OBJECTIVE •Learn to triage a security event using a Phantom Automation Playbooktriggered by an event in Splunk. USE-CASE •Phantom

Security Hands-on @ PavilionAutomate Security Operations with Phantom & Splunk

Splunk | Security Markets

September 26 | Washington, DC

Page 2: Security Hands-on @ Pavilion - Splunk · Objective OBJECTIVE •Learn to triage a security event using a Phantom Automation Playbooktriggered by an event in Splunk. USE-CASE •Phantom

The Leader in Security Automation & Orchestration

phantom-community blog.phantom.usphantom.us/join

Phantom Community Growing Larger Each Day• Phantom Community Edition (free)• Share Community Playbooks• Contribute Apps• Documentation, Training, KB Articles• Q&A

Page 3: Security Hands-on @ Pavilion - Splunk · Objective OBJECTIVE •Learn to triage a security event using a Phantom Automation Playbooktriggered by an event in Splunk. USE-CASE •Phantom

Objective

OBJECTIVE• Learn to triage a security event using a Phantom Automation Playbook triggered by an event in Splunk.

USE-CASE• Phantom ingests a security event from Splunk.• Event requires triage; Phantom Automation Playbook is launched.• Results are reviewed in Phantom Mission Control; additional on demand actions launched.• Data is posted back to Splunk for archival purposes.

BENEFITS• Splunk integrated with Phantom automates event triage and streamlines security functions like investigation,

hunting, enrichment, containment & recovery. This is Splunk Adaptive Response in action.

3

Page 4: Security Hands-on @ Pavilion - Splunk · Objective OBJECTIVE •Learn to triage a security event using a Phantom Automation Playbooktriggered by an event in Splunk. USE-CASE •Phantom

Access information :• https://54.215.195.107/

Login :• ID : (shared during session)• Pass : (shared during session)

Other Instruction :• Ensure Chrome browser is in use

SET-UP INSTRUCTION

Page 5: Security Hands-on @ Pavilion - Splunk · Objective OBJECTIVE •Learn to triage a security event using a Phantom Automation Playbooktriggered by an event in Splunk. USE-CASE •Phantom

Ingest Event from Splunk

5

Page 6: Security Hands-on @ Pavilion - Splunk · Objective OBJECTIVE •Learn to triage a security event using a Phantom Automation Playbooktriggered by an event in Splunk. USE-CASE •Phantom

Phantom Automation Playbook

Page 7: Security Hands-on @ Pavilion - Splunk · Objective OBJECTIVE •Learn to triage a security event using a Phantom Automation Playbooktriggered by an event in Splunk. USE-CASE •Phantom

Phantom Mission Control

7

Page 8: Security Hands-on @ Pavilion - Splunk · Objective OBJECTIVE •Learn to triage a security event using a Phantom Automation Playbooktriggered by an event in Splunk. USE-CASE •Phantom

1. Ingest event data from Splunk• Open Splunk Incident Review

• Choose the “Send to Phantom” action for an event

• Select the Phantom Investigate Playbook; click “Run”

2. Review Phantom Automation Playbook• Open Phantom UI

• Chose “Playbooks” from menu and the “Investigate” Playbook from listing

• Review Playbook to ensure process is correct for future automations

3. Navigate to Phantom Mission Control• Select the file or IP address to execute additional actions

• Choose additional actions to run on ”Launch Action” pane (e.g. block hash, block IP)

8

STEP BY STEP GUIDE

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

インストールマニュアル Splunk Enterprise 6.2docs.splunk.com/images/8/8b/Splunk-6.2.0-ja_JP-Installation.pdf · Splunk Enterprise インストールマニュアルによう

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk user group - automating Splunk with Ansible

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Getting Security Operations Right with TTP0Ismael Valenzuela SANS Instructor, McAfee @aboutsecurity Rob Gresham Splunk> Phantom @SOCologize. ... - 0Tier Threat Response model vs 3Tier

SD-Security: Orchestration, Automation & Response mit ......Splunk > phantom CONTAINER: Artifact 1, Artifact 2, Artifact 3 etc. ... DATA PLATFORM ANALYTICS OPERATIONS Wie passt Phantom

European Space Agency - Linux Polska · Splunk | Case Study Solution Primary objective of the project team was to deliver a prototype of Splunk based web application for monitoring

Netﬁlter Iptables for Splunk Documentation - Read … · Netﬁlter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Simulating the Adversary to Test Your Splunk Security ... · You can automate adversary simulation •Using Splunk, Phantom, and open frameworks like MITRE ATT&CK™️ and Atomic

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers

Splunk Cloud Product Briefwinncom.com.ua/wp-content/uploads/2018/07/splunk-Log_Flow.pdf · Extend Benefits With Splunk Apps Splunk Cloud includes support for premium solutions such

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Fortscale Splunk Integrationinfo.fortscale.com/hubfs/UEBA Content/Fortscale Splunk Integration.pdf · Fortscale Splunk Integration ... Fortscale digests access and authentication

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Zscaler and Splunk ES and Phantom | Deployment Guide · 2020. 8. 21. · 4.4.3 Configure Splunk App ... • The dashes seen above are places for PID, message ID and other structured

Splunk Conf2010: Corporate Express presents Splunk with SAP

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

データ分析プラットフォーム「Splunk」eww.gp-club.panasonic.co.jp/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Splunk for SecuritySplunk Enterprise Security 6.0 Enterprise Security Key Enhancements User Behavior Analytics Phantom 조사활동에대한보고서 기능추가 SOC의요구사항에따른

SPLUNK Capabilities Overview - GTRI · Overview GTRI is the only ELITE Splunk integrator with certified Splunk architects and engineers on staff. In addition to ... SPLUNK-Overview

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk Enterprise 6.5.0 Splunk Enterprise 보안

Splunk in Rakuten: Splunk as a Service for all

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

Splunk conf2014 - Splunk for Data Science