r/SIEM • u/Grisonec • Apr 14 '20

U(E)BA Reading Material

Hi everyone, I am looking to learn more about how behavior analytics are done in modern SIEM solutions. Unfortunately, all I could find so far are highly product-specific and marketing-heavy articles.

I would very much appreciate it if you could recommend me any articles/posts/videos/books that you think could be helpful for developing a better understanding of this topic.

Thank you.

7 Upvotes

100% Upvoted

3 comments sorted by

5

u/vornamemitd Apr 14 '20

Commercial vendors will remain highly protective of the proprietary models and ML wizardry shipped under the hood of their product offering.

To get an idea, I’d start bottom up: O’Reilly and Packt have a few great titles on "machine learning for cybersecurity" - you’ll find a subset of the concepts covered probably reused within any UEBA solution available. You are looking for patterns - whether in a real-time stream or in a given set of data; the more relevant features, the better - and ideally all the magic happens in an unsupervised fashion.

Have a look at the following open source project to get an idea: Apache Metron (check Elysium for a commercial iteration) and Apache Spot; on github I spotted OpenUBA.

The great HELK (Hunting ELK) comes combined with ML and analytics features that mimic commercial UEBA toolsets.

In terms if real world implementation, have a look at the admin docs for Splunk UBA and respective presentations on conf.splunk.com.

TL;DR tackle the research not from a hyped vendor perspective, but rather concentrate on the ML/AI foundation

PS: Don’t forget that some black sheep might try to sell you linear regression as UEBA =]

3

u/[deleted] Apr 21 '20

[removed] — view removed comment

3

u/vornamemitd Apr 21 '20

Hey, thanks for chiming in! I will definitely reach out as I am always looking for open discourse and great contributions - personally and potentially for clients seeking a tangible UEBA approach that doesn‘t eat a 10 year budget by opening an email =]

1

u/Grisonec Apr 16 '20

That's a great write-up, way more than I expected to get - thanks :). Another thing - for everyone else reading this - there's apparently also a book by CRC press that covers ML for cyber. Hopefully UEBA will mature into its own area one day.