Extending Security Analytics to support Operational Efficiency John A. Greco Deloitte & Touche LLP Cyber Risk Services
Extending security analytics to support operational efficiency Key components of the Security Analytics Architecture Log decoder Packet decoder Concentrator Analytics server/broker Archiver ESA (Complex Event Processing) 2
Security Analytics (SA) ecosystem 3
Extending Security Analytics to Support Operational Efficiency What s the REST API? REST (Representational State Transfer) is a simple stateless architecture that runs over http/https Similar to using a browser to pull a web page back The REST API (Application Programming Interface) can access the SA resource tree via URLs to receive data about the resource. Some examples: 4
REST API TCP Port Map 5
Extending Security Analytics to Support Operational Efficiency What s possible with the SA REST API? Allows simple access to the Security Analytics interface via http/https Ability to invoke programmatic ad-hoc queries with a meaningful Security context on behalf of forensic digs or active incidents Ability to extract useful metrics for statistics How to extract REST syntax & examples http://saconcentrator:50105/logs?msg=pull 6
Extending Security Analytics to Support Operational Efficiency 7
Extending Security Analytics to Support Operational Efficiency How do I REST with SA? Use curl to programmatically perform a REST API call to extract session ids from the SA Ecosystem /usr/bin/curl --user 'admin:netwitness' "http://saconcentrator:50105/sdk?msg=query&query=sele ct+sessionid+where+time%3d%272014-jul- 01+08%3A00%3A00%27-%272014-Jul- 31+09%3A00%3A00%27%26%26(alert%20exists)%26% 26(device.type%3Dfireeyewebmps)&size=100" 8
Extending Security Analytics to Support Operational Efficiency 9
Extending Security Analytics to Support Operational Efficiency How to signal an external system for task triage, ticketing 10
This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee ( DTTL ), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as Deloitte Global ) does not provide services to clients. Please see www.deloitte.com/about for a detailed description of DTTL and its member firms. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting. 11
THANK YOU