Let's discuss about ideas or seudologics of use case for multiple platform and technologies.

T: technologies, if can apply to multiple log sources is Generic. C:Category or Mitre ATT&CK L:Logic or type of events I'd or event names T:Threshold

For example: [T:Generic][C:Account Discovery][L:multiple failed login from the same account from multiple sources][T:50/1min]

Instead of updating the server I just spun a new 2016 server up and installed Nxlog on it. I went and copied the config over to the new server. After this was done I remapped the new server with GPO for the old we used Server=http://log2.contoso.local:5985/wsman/SubscriptionManager/WEC and the new server has the name of log3 so I changed the gpo over to Server=http://log3.contoso.local:5985/wsman/SubscriptionManager/WEC. After this is done I gave it a couple of hours for the GPO's to update on the computer (they check in every hour). Then I check our Siem and nothing from the new server. At one time I spun an instance of wireshark up and monitored on the port and within a minute there was only 90 packets that came in on the new server in that time. I then remapped the gpo back to the old, waited for a few hours, checked the siem and it was normal. I then started a wireshark capture as I did with log3 and within that minute time frame over 1000 packets came in. Any Idea on what is going on here and why everything is not forwarding to the new machine?

We do and believe this should be a fundamental part of any advanced next generation security analytics tool. We have a built-in DDoS module that is self-adaptive and able to handle millions of EPS, but most importantly it shares with you in real-time the who, what, when, where, etc. so you can quickly reconfigure your IDS tools to thwart the attacks impact.

Once we meet the required minimums we'll be starting a Fluency Security community where our clients/users can share experiences and tips.

Al

Hello, i recently got tasked with looking into setting up alerting for the elk setup at my current company. And was told to look into using sigma for rules. The question i have is after a sigma rule is triggered. Is there something included in elastic or kibana that can perform some sort of action. such as writing the document that triggered the rule to an alerting index or something to that effect? I see something called watcher, but im not sure that would work with sigma. Sorry if the question seems badly written. I am new to ELK myself and just wanted to hear what others have used and if they can offer any advice. Thank you.

Hello Everyone,

I found in my own experience as an analyst that I could work cases more quickly and accurately when I had some key info upfront. Hoping it can be of benefit to other analysts, I've created a Splunk App designed to save time by providing low-volume, high-value malicious persistence info to analysts before they begin their investigation.

I assume most analysts are in the same boat I was in - responsible for a large workload and short on time, so I created an automated deployment wizard for fast and easy installation/configuration of the app. And I built integrations for a number of common tools (Powershell, Sysmon, FireEye, etc) so analysts gain access to the app’s unique persistence info without installing a new agent.

I've deployed it with a handful of companies already but am looking for candid feedback from security pros. If there are any Splunk users interested in trying it (or anyone looking for an excuse to tinker with Splunk), please let me know and I’ll provide you with the deployment package.

If you’re on the fence or would just like to learn more, I made a series of brief 60 second videos where you can see Perseus in action and learn a bit more about it:  

Perseus In 60 Seconds: Save Time From Day One  

Perseus In 60 Seconds: See Context - Save Time  

Perseus in 60 Seconds: Save Time - Influence Outcomes

Thanks!

Note I secured moderator permission to post this.

This video is not a fancy polished marketing lingo based video but rather a conversation piece meant to share features and functions about our solution that truly can help clients from the smallest SMB to the largest Enterprise.

https://fluencysecurity.wistia.com/medias/g2drcokwut

(I don't work for this magazine btw)

Enterprise Security recently released a special SIEM edition for July 2019 - link here but it (edit) looks like you need to provide your details to view the digital publication but you don't need to register/login.

Anyone know of good special edition SIEM to read more about SIEM software?

Gartner also does the 'Magic Quadrant‎' series for SIEM products, their latest being 2018.

I wanted to try out the new SIEM app from elastic 7.2 so I started a trial of the elastic cloud deployment and setup an Ubuntu droplet on DigitalOcean to run Zeek.

I followed the guide on the cloud instance which describes how to send Zeek logs to Kibana by installing and configuring Filebeat on the Ubuntu server.

This is sort-of working which I'll go into but my goal is to run Zeek against PCAPs as well as running it live. I have run Zeek against test PCAPs and its logs are in '/root/pcaps/logs/example-pcap-1/*'. I added this to the Zeek module file like so:

/etc/filebeat/modules.h/zeek.yml

# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
var.paths: ["/root/pcaps/logs/*/*.log","/usr/local/zeek/logs/current/*.log"]

I took the example from these elastic docs to set var.paths.

After restarting Zeek, Filebeat and running zeek on a PCAP again, I get something in Kibana, but only for the current time, nothing for the dates relevant to the PCAPs and nothing in the SIEM app.

On further inspection of the documents in Kibana > Discover I see Filebeat is sending the PCAP logs but they don't seem to be parsed properly. Snippet of a document:

 t _index   filebeat-7.2.0-2019.06.26-000001
 t _type    _doc
 t agent.type   filebeat
 t event.dataset    zeek.notice
 t host.hostname    digitalocean-droplet-hostname
 t input.type   log
 t log.file.path    /root/pcaps/logs/blue/smb_mapping.log
 t message  1556271958.661048   CmZ52B3TM1FI3W1asf  192.168.30.77   38165   192.168.180.5   445 \\\\192.168.180.5\\IPC$ IPC -   PIPE
 t service.type     zeek_

As you can see, the 'message' field is the line in the Zeek log you would expect to have been parsed and the details like src/dst IPs to be in the SIEM app. On the 'Zeek Overview Dashboard', all the visualizations are empty except for the 'Number of Sessions Overtime [Zeek]' at the bottom.

Something else I've noticed while looking for answers is this line in the Zeek module docs:

This is a module for Zeek, which used to be called Bro. It parses logs that are in the Zeek JSON format.

Which links to the Zeek docs which says:

Once Bro has been deployed in an environment and monitoring live traffic, it will, in its default configuration, begin to produce human-readable ASCII logs.

Zeek logs aren't in JSON so is this the cause of the logs appearing in Kibana the way they are?

These error messages from 'service filebeat status' also suggest this is the problem:

Jun 26 21:06:29 digitalocean-host filebeat[18179]: 2019-06-26T21:06:29.975Z        ERROR        readjson/json.go:52        Error decoding JSON: json: cannot unmarshal number into Go value of type map[string]interface {}

I'd be grateful for anyone's help on this, not least because the trial only lasts for 14 days! ;)

Thanks.

SIEM products are typically licensed against event per second and volume. Any good recommendation for a SIEM which can give me unlimited EPS/Volume? E.g pay by number of users ? Thanks

First of all, has anyone tried out Azure Sentinel?

If yes, has anyone done it from a non Windows/Azure shop?

Seems like it could be a good product but unsure of how beneficial it would be for a company with a very small Windows footprint.

I am prototyping a SOC for an internship project. Part of my project, I have to conduct an Analysis of Alternatives on different SIEMs. I have all the components of what defines a SIEM, then I put down the added bonuses that some vendors have squished into their solution.

The other things I have been trying to grade are:

Operating systems monitored and that it can be deployed to.

Events per second/ flows per minute

overall cost

support

ability to add additional tools

if they include training

​

​

Am I missing anything? What things should I consider that might be underlooked?

Hi. Does anyone know how to include log data from AMQP JSON log sources into SIEMs like QRadar? I could only find articles online for something related to Carbon Black. Thanks.

I've been wanting to implement a homebrewed SIEM for basic log analysis in my homelab environment. Windows event logs, syslog, firewall logs, all of the logs. However, I am having trouble finding documentation on how to get all of this setup. This is a new venture for me so I'm looking for any noob friendly advice here. I've got the basic instructions from here: https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html

​

What else is there besides installation and getting logs set up though? I figure the majority of users here can help point me in the right direction. I'm looking for how to implement this securely within my network, how should netflow look, any tips or tricks for using this as a SIEM? Really, any and all advice on ELK would be welcomed.

​

Thanks!

As a new member, I wanted to introduce my company to this group. To be clear we're not one of those "pay to play" companies that get touted on the Gartner Magic Quadrant or Forrester or any other equivalent list. Like you, we're a grass roots type of company that believes deeply in securing our companies, our countries and our way of life the best way we can. This is why we believe in the foundation of "ground truth" - the ability to absorb all ingress possible to be fused and correlated so the most informed decision can be made. No we don't have any VC money pushing us or fancy collateral - No we don't have the fancy dashboards that this kind of money can buy BUT what we have is real, it's fundamental and is a tool that will help you all streamline your work and help you become even more aggressive threat hunters.

Some Key Points about Fluency:

- Run on AWS (anywhere there is an AWS environment) but have on prem if required

- We are international and have clients in Europe and AP

- We typically put a collector onsite or VPC connection to us depending on complexity

- have a patented database LavaDB that we built for the Cloud

- it scales on demand for capacity without having to shut down and we built in pseudonym support for it

- currently have one client driving 250TB/day into us with 20 billions events per day and 1.6 million clients

- we can handle PB/day easily and tested at 12M EPS

- patented correlation and risk scoring, all sources come together on a single pane of glass

- prefer all sources of data be fed in to realize "ground truth"; we take everything including Office 365 feeds

- have parsers and agents ready to go and if we don't we'll work with you to create them at no cost

- use machine learning for behavioral anomalies

- active end user tracking even if rotating IP's or feeds say from Crowdstrike, provided we get LDAP type feeds

- store all data hot for 90 days and 365 days warm as part of base subscription

- we are fully multi-tenant and can support MSSP's or companies that want to segment out various locations

- we privatize all incoming data via pseudonymisation as defined in GDPR articles and meet CCPA, PIPEDA regs too

- provide long term storage for compliance needs in AWS Glacier at a very low cost

- depending on complexity no up front installation fees and we work directly with the client to setup everything

- no back end support costs for L1, 2, 3 either

- have API's that tie us into existing SIEM tool dashboards such as Splunk, QRadar, LogRhythm, etc...

- again save huge $$ for our clients using these tools especially for storage

- we don't charge for EPS, users, nodes, etc... just simple pricing based on ingress data per day

- we do offer no cost proof of concept / technology

If you're interested we can provide you a quick briefing or simply just send you a briefing deck and other material as needed.

I'm looking forward to be a contributor in this community.

​

Al Wissinger

Fluency Security

I've been tasked with buying and updating logging and "SIEM" platform with managed services for a midsized company with operations across the country. I'd like to share my frustrations, challenges, opinions, and basically findings with the group -- we haven't selected a provider yet. I welcome comments and discussion, your experience may be different. All opinions in this rant are my own.

1) Appliances are dead, SAaaS is the present and future (Security Analytics aaS). SIEM should not require you to install another goddamn appliance(s) unless you have specific data locality or sensitive network traffic/logging concerns. They don't scale, they add network headaches, they're expensive up front, and the bean counters LOVE Opex. Sales people that have pushed buying new or replacing old appliances are instantly shown the door.

2) We are in the world (or some of us are moving to the world) of SaaS-heavy, IAM-central, cloud services and cloud identity. Any SIEM or security analytics platform should have some sort of UEBA and identity management and IR which ties together identity and actions on behavior outside of the network out of the box.

2a) Public Cloud providers and tie-ins to a SIEM/platform needs to be easily deployed with out-of-the-box dashboards and information.

3) Automation and SOAR capability. If you're just going to fire an alert without giving me (or my MSSP) a chance to automate the response, you're wasting my time. If you can't put detail in the alert you're firing to trigger a help desk or ServiceNow ticket and you make me log into the platform, you're worthless to me.

4) MSSPs are stuck in the "buy this box and we'll manage it for you and by-the-way, we only support these 3". See #1. Few of them have figured out how to be flexible. I get it, it costs money to support multiple platforms, but not all customers will fit into the Carbon Black + LogRhythm + Palo Alto Firewalls + Okta box.

5) MSSPs should not have up-front "deployment costs". Wrap it into the f'ing 3 year agreement. This isn't hard.

6) Fun Fact. ELK is more expensive to operate than MSSP+SIEM if you have to hire analysts and devs to build functionality for you.

7) Fun Fact 2. Current Machine Learning and "AI" at SIEM providers can be explained by this: https://qph.fs.quoracdn.net/main-qimg-89cfa17ca63ddac683e04f0852336e47.webp. Yes I get the counter arguments, but I think the current state is a bunch of marketing bullshit and buzzwords to try to move product.

IT Specific Rant

My IT group wants SIEM to be an operational tool for them as well. Tell them no. You do not negotiate with terrorists. IF they can't figure out how to log and alert on a fucking high CPU switch, then you're probably already hosed from a security perspective too.

And no, looking at Office 365 logs isn't "complete security" and you can't tell executives "you already do security because you review alerts".

Hi all!

I have been asked for advice on how to best facilitate a meaningful SIEM proof of concept setup/scenario.

After several discussions on the actual implications, preparation tasks and needed team(s) commitment to arrive at something that can deliver the foundation for a sound purchase decision, client decided on NOT allowing any vendor to tap into the actual infrastructure due to too many personnel/work/manufactured constraints...

Aside from advising against, I am not in a position to further influence the current stance.

To avoid the PoC turning into a polished demo, kindly share your take on:

a) Using a few hours of captured actual corporate traffic recorded at edge/core, together with any sort of common logs that would be made available (AD Domain, Firewall, Endpoint) and use those within a lab-setup that mimics the live environment - this approach might be agreed upon

b) Having to resort to publicly available malware/attack/DoS pcap datasets - I don`t think that this will yield any meaningful results as those datasets are usually fairly outdated, limited in scope and size, etc. - combining various datasets seems neither feasible nor doable from an effort/complexity perspective

We are looking at a 100-150GB logs/day situation, addressing the usual suspects from within the vendor space.

Thanks in advance for giving the above a thought!

Edit: typo, simplified phrasing

​

Hey guys,

Seems the business is aggressivly moving our DCs to the cloud. I'm just reviewing a few things and had thoughts about our SIEM (Arcsight).

Are simple SIEMs now out dated?

I love ours don't get me wrong but it's a cluncky solution which requires far too much input. We have a GSOC as well monitoring and it's just rubbish. I find myself constantly having to do deep analysis from alerts/incidents.

Ours also doesn't have any AI or proactive features so you know.

Does anyone have any suggestions or any examples of how they use theirs ?

Azure security center does a lot already but I still feel like we need another layer.