Главная
Study mode:
on
1
Intro
2
Overview
3
About Me
4
Security Architecture
5
Logging
6
Live Packing
7
Grow
8
Logs
9
Logstash
10
Kibana
11
The Data
12
Critical Stack
13
Bro Code
14
Threat Intelligence
15
Normalization
16
Conditional Filtering
17
Log Stash
18
GeoIP
19
Translate Plugin
20
Log Stash Output
21
GeoIP Map Output
22
Adding Context
23
TARDIS Framework
24
Visualization
25
Summary
26
Github
Description:
Explore a powerful open-source framework for automating security event analysis and incident response in this Black Hat conference talk. Learn how to integrate ELK (ElasticSearch, Kibana, and LogStash), Bro IDS, and community threat intelligence feeds to obtain business and security context from events in your environment. Discover techniques for collecting, storing, and visualizing data, as well as automating evidence collection for quicker response times. Gain insights into logging, live packing, Logstash configuration, Kibana visualization, threat intelligence integration, and the TARDIS Framework. Follow along as the speaker demonstrates practical applications of these tools and techniques, culminating in the release of an open-source framework designed to streamline security operations and enhance threat detection capabilities.

My Bro The ELK - Obtaining Context From Security Events

Black Hat
Add to list
0:00 / 0:00