Pen Test Austin - Two NEW courses, NetWars, CyberCity, Challenge coins all in Austin, TX!

Webcasts

To attend this webcast, login to your SANS Account or create your Account.

SOF-ELK(R): A Free, Scalable Analysis Platform for Forensic, Incident Response, and Security Operations

  • Tuesday, March 5th, 2019 at 1:00 PM EST (18:00:00 UTC)
  • Phil Hagen
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!

Overview

The slides for this webcast will not be made available.

There is no shortage of digital evidence, with many DFIR and Security Operations teams handling terabytes of log and network data per week. This amount of data presents unique challenges, and many tools are simply inadequate at such a large scale. Commercial platforms that are up to the task are often far out of budgetary reach for small- and medium-sized organizations.

The Elastic Stack, a big data storage and analysis platform, has become increasingly popular due to its scalability and open-source components. Countless investigative and security teams have incorporated Elastic into their toolkits, often realizing the significant level of effort required to customize and manage such a powerful tool. To overcome some of these hurdles, the SOF-ELK platform was created. SOF-ELK aims to be an appliance-like virtual machine that is preconfigured to ingest and parse several hundred different types of log entries, as well as NetFlow data. The intent is to provide analysts and investigators with a tool that leverages the power of the Elastic Stack with minimal setup time and effort. Originally a part of the SANS FOR572, Advanced Network Forensics & Threat Hunting course, SOF-ELK has been incorporated into additional SANS courses and is released as a free and open-source platform for the overall security community.

In this webcast, we will explore SOF-ELKs use cases, types of log data currently supported, as well as how to load data from live or archived sources. We will also show the various dashboards supplied with the VM and show how new features can be activated through the projects GitHub repository. 

Speaker Bio

Philip Hagen

Phil Hagen is the course lead and author of FOR572, Advanced Network Forensics and Analysis, a course that provides a hands-on curriculum on the skills necessary to perform investigations of network-based incidents, where the hard drives or memory of compromised systems are often missing. He is also a DFIR Strategist at Red Canary. Phil started his career as part of a specialization within the computer science department at the U.S. Air Force Academy, where he focused on network security and was an inaugural member of the computer security extracurricular group. He served in the U.S. Air Force as a communications officer at Beale AFB and the Pentagon, and then in 2003 Phil moved over to a position with a government contractor, providing technical services for various IT and information security projects. Now 18 years later, Phil's work has spanned the full life cycle of attacks--tool development, deployment, operational and investigative aftermath--giving him a rare opportunity to provide deep insight into the artifacts left behind. Phil has covered deep technical tasks, management of an entire computer forensic services portfolio and executive responsibilities. He's supported systems that demanded 24x7x365 functionality, managed a team of 85 computer forensic professionals in the national security sector, and provided forensic consulting services for law enforcement, government, and commercial clients. Phil also spends time developing and maintaining the SOF-ELK distribution. SOF-ELK is a virtual appliance that is pre-configured with the ELK stack (Elasticsearch, Logstash, and Kibana), and it is provided as a free tool to help the DFIR Community boost case efficiency and effectiveness. Phil is a mentor and teacher at heart, one of his biggest source of professional pride.

Need Help? Visit our FAQ page or email webcast-support@sans.org.

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.