Overview

Logging and analysis is a critical component in cyber network defense and allows for both reactive and proactive detection of adversarial activities. When properly utilized it becomes the backbone for agile detection as well as provides understanding to the overall environment. Logging and analysis products and techniques have been around for many years and are quickly gaining more and more functionality. This section will introduce free logging and analysis tools and focus on techniques to make sense of and augment traditional logs. It also covers how to handle the big data problem of handling billions of logs and how advances in free tools are starting to give commercial solutions a run for their money.

Day one is designed to bring all students up to speed on SIEM concepts and to bring all students to a base level to carry them through the rest of the class. It is designed to also cover SIEM best practices. During day one we will be introducing Elasticsearch, Logstash, and Kibana within SOF-ELK (a VM co-maintained by Phil Hagen and Justin Henderson) and immediately go into labs to get students comfortable with ingesting, manipulating, and reporting on log data.

Overview

A vast majority of network communication occurs over key network protocols and yet it is uncommon for organizations to use or collect this data. The sheer volume can be overwhelming. However, these common data sources provide an opportunity in identifying modern day attacks.

This section covers how to collect and handle this massive amount of data. Methods for collecting these logs through service logs such as from DNS servers will be covered as well as passive ways of pulling the same data from the network itself. Techniques will be demonstrated to augment and add valuable context to the data as it is collected.

Finally, analytical principles will be covered for finding the needles in the stack of needles. We will cover how even if we have the problem of searching through billions of logs that we can surface only meaningful items of interest. Active dashboards will be designed to quickly find the logs of interest and to provide analysts with additional context for what to do next.

Overview

The value in endpoint logs provides tremendous visibility in detecting attacks. Especially, in regards to finding post compromise activity, endpoint logs can quickly become second to none. However, logs even on a single desktop can range in the tens if not hundreds of thousand events per day. Multiply this by the number of systems in your environment and it is no surprise why organizations get overwhelmed.

This section will cover the how and more importantly the why behind collecting system logs. Various collection strategies and tools will be used to gain hands on experience and to provide simplification with handling and filtering the seemingly infinite amount of data generated by both servers and workstations.

Workstations log strategies will be covered in depth due to their value in today's modern attack vectors. After all, modern day attacks typically start and then spread from workstations.

Overview

Know thyself is often quoted to defenders as a key defense strategy. And yet this one of the most difficult things to accomplish. Take something such as having a list of all assets in an organization and knowing if any non-company assets are on the network. The task sounds simple but ends up being incredibly difficult to maintain in today's ever evolving networks.

This section focuses on applying techniques to automatically maintain a list of assets and their configurations as well as methods to distinguish if they are authorized vs unauthorized. Key locations to provide high fidelity data will be covered and techniques to correlate and combine multiple sources of data together will be demonstrated to build a master inventory list.

Other forms of knowing thyself will be introduced such as gaining hands on experience in applying network and system baselining techniques. We will monitor network flows and identify abnormal activity such as C2 beaconing as well as look for unusual user activity.

Finally, we will apply large data analysis techniques to sift through massive amounts of endpoint data. This will be used to find things such as unwanted persistence mechanisms, dual-homed devices, and more.

Overview

Multiple security devices exist but often are designed to be independent. Analyst are commonly divided into specialty areas and focus on their respective area such as a network intrusion detection system. However, alerts from a single security device lack context and are akin to the common analogy of "looking up from the bottom of a well".

This section focuses on combining multiple security logs for central analysis. More importantly we will cover methods for combining multiple sources to provide improved context to analysts. We will also show how providing context with asset data can help prioritize analyst time, saving money and addressing risks that matter.

After covering ways to optimize traditional security alerts we will jump into new methods to utilize logging technology to implement virtual tripwires. While it would be ideal to prevent attacker's from gaining access to your network it is a given that at some point you will be compromised. However, compromise is just the beginning and not the end goal. Adversaries will crawl your systems and network to achieve their own ends. Knowing this we will implement logging based tripwires that should a single one be "stepped on" we can quickly detect and respond to the adversary.

Overview

The course culminates in a team-based design, detect, and defend the flag competition. Powered by NetWars, day six provides a full day of hands-on work applying the principles taught throughout the week.

Your team will progress through multiple levels and missions designed to ensure mastery of the modern cyber defense techniques promoted all week long. From building a logging architecture, augmenting logs, analyzing network logs, analyzing system logs, and developing dashboards to find attacks, this challenging exercise will reinforce key principles in a fun, hands-on, team-based challenge.