• Home

  • Documents

  • OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing...
39
OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED 06 DEC 2017 Dr. Lisa Mathews, Security Engineer

OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

  • Upload
    others

  • View
    2

  • Download
    0

Embed Size (px)

Citation preview

Page 1: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

OPENC2:

PROTECTING OUR FUTURE AT

MACHINE SPEED

06 DEC 2017

Dr. Lisa Mathews,Security Engineer

Page 2: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

2

Agenda

2

Background

Design Philosophy/ Principles

OpenC2 Syntax

OASIS Transition

Current Plan

Call for Participation

Page 3: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

3

Background: The Motivation and Vision

3

Challenge

Coordinated Defense in Cyber Relevant Time

Vision: Future Cyber Defense Tactics

Sharing of indicators

Coordination of response actions

Automated, multi-part actions at machine speed

Strategy

Decouple Functional Blocks and Standardize Interfaces

Identify and fill gaps as they pertain to Cyber Threat Indicator Sharing and Response

Participate in a diverse and collaborative environment

Standardization is a Key Enabler for Automation

Page 4: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

4

Integration in the Absence of Standards

4

Page 5: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

5

5

Decoupled Security Stack: Making Security More Manageable (& interchangeable)

Identify Protect Detect Respond Recover

Acting

Decision

Making

Sense

Making

SensingSENSORS

Instrumentation, raw telemetry,

netflow, A/V logs, firewall logs,

external threat intel

ANALYTICSUse cases,

correlation, anomaly

detection, heuristics

COURSES OF ACTION /

ORCHESTRATION:Workbenches, Workflow Engines, Security

Orchestration and Automated Response

ACTUATORSThings that block, move, stop/start, delete, quarantine, etc.

OpenC2

OpenC2

Actuator

Profiles

STIX Patterning Language

MITRE

Cyber Analytic

Repository

STIX

CybOX

OpenCOA /

OpenPlaybook

?

Page 6: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

6

OpenC2 at a glance

6

Unambiguous Machine-to-Machine Communication

Simplicity

Low overhead on sensor and actuator

Focuses on ‘Acting’ portion of cyber defense

OpenC2 assumes the following has been done: Sensing; ‘What’ triggers the action

Analytics; ‘Why’

Decision; ‘Which’ action

OpenC2 will leverage pre-existing protocols and efforts

Page 7: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

7

OpenC2 Focuses on ‘Acting’

7

STIX

Standard Threat INTEL object

Supports Analysis

TAXII

Standard Transport protocol

Supports Secure Exchange

OpenC2

Standard Command Language

Supports Automated Response

OpenC2 is part of a Suite of OASIS Standards

Page 8: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

8

OpenC2 Design Principles

Lightweight

Efficient machine-to-machine communications

Abstract

Focuses on ‘What’ to do versus “Device Specific”

Extensible

Extensions enable additional precision and flexibility

Agnostic

Transport, authentication, integrity controls etc.

Enables flexibility with respect to implementation

Enable Unambiguous Machine-to-Machine Command and Control Messages

Page 9: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

9

OpenC2 Assumptions

Basic Assumptions

The analytics have been done

The decision to respond has been made

The Transmitting and Receiving entities are authorized to

do so

Assured transport

Page 10: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

10

OpenC2 Parameters

10

The Lexicon Decouples the aspects of the commands

ACTION: What is to be done

TARGET: What you are doing it to

ACTUATOR: Who is performing the command

Extensions permit additional precision to the commands

SPECIFIER: Identifies general to specific targets or actuators

OPTIONS: Provide additional details for the command, target, actuator

Benefits of decoupling

Facilitates integration of new technologies

Supports high level effects based AND device specific use case

Page 11: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

11

Example Actions / Targets

11

scan

locate

create/query/set/delete

report

notify

deny/contain/allow

start/stop/restart

pause/resume

detonate

redirect

update

save

…

device

directory

domain_name

email_addr

email_message

file

ipv4_addr/ipv6_addr

mac_addr

ip_connection

process

url

user_account

…

Actions Targets

Page 12: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

12

Example OpenC2 Command

12

# Block all ftp data transfers from hosts and request ack. Note that the five-tuple is

incomplete

{“action”: “deny”,

“target”: {

“type”: “openc2:five-tuple”,

“specifiers”: {

“Layer4Protocol”: “TCP”,

“src-port”: 21

}

}

“actuator”: {

“type”: “openc2:firewall”,

“specifiers”: {endpoint},

“options”:{ openc2: drop}

},

“command-options”: {

{“id”:“UUID=123e4567-e89b-12d3-a456-426655440000”}

{response=TRUE}

}

Page 13: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

13

OpenC2 Use Case

Abstract Use Case

Mitigate Evil Domain

Local Orchestrator

Deny Evil Domain

Scan evil.pdf

Contain Infected WS

Actuator executes command

Implement across Agnostic Transport Mechanism

Vendor

APIs

Agnostic Transport

Orchestration

OpenC2 Proxy

Page 14: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

14

Prototype Implementation

Orchestrators and Actuators converge on the OpenC2 message fabric

OpenC2 ‘Proxy’ maps to hardware API

Converging on Message Fabric facilitates implementation

Vendor

APIs

OpenC2 Message Fabric

OpenC2 Proxy

Page 15: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

15

Demonstrate Vendor Agnostic

Allows corporate

wide sharing of

cyber defense

tactics

Minimizes impact

when changing

components

Vendor

APIs

OpenC2 Message Fabric

OpenC2 Proxy

Page 16: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

16

Demonstrates Architecture & Technology Agnostic

Deny Command is

executed

REGARDLESS of

product

Simplifies integration

of new technologies

that achieve similar

actions

Unified tactical

approach

independent of

equipment set

OpenFlow

OpenC2 Subscriber

OpenC2 Proxy

Device

Manager APISDN

Controller

Whitebox

Switch

OpenC2 Publisher

Page 17: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

17

OpenC2 Documentation Approach

Core Language Specification

Actions

Default target namespace

Semantics, syntax

Profile framework

Minimum to implement

Actuator Profiles

Scope and applicability

Required and optional actions and nuances in the context of the actuator

Applicable targets

Specifiers and options for a class of actuators

Implementation Guides

Page 18: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

18

Transition to OASIS

OASIS Kickoff meeting on June 7, 2017

OASIS Technical Committee

Monthly Meetings

OpenC2 Sub-committees

Language SC meets weekly

Specification of syntax, actions and targets

Actuator Profile SC meets biweekly

Gathering of ‘frenemies’

Implementation Considerations SC meets monthly

External dependencies such as IA, Transport etc.

Page 19: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

19

OASIS Technical Committee Organization

OpenC2 TCJoe Brule / Sounil Yu

LanguageJason Romano /

Duncan Sparrell

Actuator

ProfilesJyoti Verma /

Dave Kemp

Implementation

ConsiderationsBret Jordan /

David Lemire

Page 20: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

20

Language: Proposed Work Plan

Sequence of Committee Specification Drafts (CSDs)

November TC CSD version 0.1.0 (approved on 11/14/2017) Document layout

Actions

January TC CSD version 0.2.0 Targets

Mandatory-to-Implement (MTI) Encoding (JSON) structure agreed to

February TC CSD version 0.3.0 Responses, Alerts and Modifiers

Address unresolved details from 0.1 and 0.2

March TC Committee Specification Version 1.0.0 Actuator Information

Page 21: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

21

Profile Development Approaches

Bottom-up

Start with full list of 30-40 actuator functions, then factor out common functionality into a higher-level profile (2nd level Endpoint / Network / Manager, or top level Generic)

Top-down

Start with 2nd level profiles

Split off more granular profiles as necessary

Actuator SC will pursue both approaches

List of specialized actuator functions under development

2nd level profiles also being considered

“Meet in the Middle”

Page 22: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

22

Actuator Profile Granularity

Roadmap / lists of potential profiles:https://docs.google.com/document/d/1nlXzQOD0xT-SMp4vfFIELvmV8AiWhmXwn8PoEjMEe3g

Successive refinement:

Generic

EndpointNetwork

Firewall RouterSwitch IPS Remediation IdM SIEM ...

Manager

https://docs.google.com/document/d/1nlXzQOD0xT-SMp4vfFIELvmV8AiWhmXwn8PoEjMEe3g
Page 23: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

23

Implementation Considerations

Subcommittee focuses on interoperability

OpenC2 Ecosystem

Message Transfer Mechanisms

Information Assurance Features

Primarily guidance (non-normative) products

Tracking and complementing Language and

Actuator SCs

Page 24: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

24

Request of the Cybersecurity Stakeholders

Use Cases

Exercise the Language & Identify Gaps

Actuator Profile Data Call

Which Actions from the Language Specification will be

used?

Which Targets from the Language Specification do you

act upon?

What Specifiers do you need?

What Options are available in your product?

Page 25: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

25

We Welcome Your Support

Please show your support on https://wiki.oasis-

open.org/openc2/UsersSupportingOpenC2

Ask your vendors to show their intentions on

https://wiki.oasis-

open.org/openc2/ProductsWithOpenC2

https://wiki.oasis-open.org/openc2/UsersSupportingOpenC2
https://wiki.oasis-open.org/openc2/ProductsWithOpenC2
Page 26: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

Questions? Comments? Complaints? 26

OpenC2 Leadership

Joe Brule (Co-chair)

Sounil Yu (Co-chair)

Joyce Fai (Executive Secretary)

Duncan Sparrell (Language Subcommittee)

Jason Romano (Language Subcommittee)

Dave Kemp (Actuator Profile)

Jyoti Verma (Actuator Profile)

Dave Lemire (Implementation Considerations)

Bret Jordan (Implementation Considerations)

Contact us at [email protected]

mailto:[email protected]
Page 27: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

Backups27

Page 28: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

Observations28

Actuator profiles are the mechanism by which industry-specific knowledge is incorporated into the OpenC2 standard

Industry participation will enable success

Industry collaboration will define the distinction between the standard and product differentiators

Actuators to be defined by capabilities

‘Hardware’ based approach is redundant and does not support NFV

Multiple ‘profiles’ may be required

‘Foundational’ profile?

Page 29: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

OpenC2 External Dependencies 29

OpenC2 is necessary but insufficient

OpenC2 Assumes

Decision has been made

Action is warranted

The command can get there intact and securely.

Recipient is authenticated and authorized.

OpenC2 Focuses on the ACTING portion of cyber defense

OpenC2 Implementations will FAIL without a robust means

to convey commands!

Page 30: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

OpenC2 Assurance Threats - 130

Threats against Inter-enclave

C2 – an actor may:

alter C2 message to degrade

or halt defensive responses,

send spoofed commands to

open up enclave B to attack,

view C2 traffic to gain

warning of defensive

responses,

Disrupt network services to

prevent delivery of C2

messages.

ENCLAVE A

ENCLAVE B

Orchestrator

1

1

Device

Page 31: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

OpenC2 Assurance Threats - 231

ENCLAVE A

ENCLAVE B

Device

Orchestrator

2

2 Threats against intra-enclave C2 – an actor may:

alter C2 messages to degrade or halt defensive responses,

send false commands to open up an enclave for attack,

Spoof C2 replies to disrupt defense or confuse defenders,

Flood devices to prevent delivery of C2 messages.

Page 32: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

OpenC2 Derived Security Requirements32

To combat or mitigate threats against inter- and intra-enclave cases, OpenC2 may need:

Confidentiality – ability to control visibility of OpenC2 messages to only authorized recipients.

Integrity – assurance that OpenC2 message sent is the message received

Authorization – limit sending and receiving to authorized parties only

Authentication/Proof-of-Origin – ability for all recipients to know the source of a message or identify of the sender

Availability – assurance that messages can always be sent

Reliability – assurance that messages are delivered to all intended recipients

Page 33: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

Prototypes Posted on Github33

Yuuki

University of Maryland

Implements OpenC2 as multiple dispatch on type

Actuators are dynamically created and hot swappable

OrchID

Zepko

OpenC2 proxy built in Django

OCAS

S-fractal

OpenC2 API Proxy written in ERLANG

Pub-sub on bsd

G2

Implementation of OpenC2 on open source firewall written in C

Page 34: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

Additional Prototype Efforts34

OpenDXL Message Fabric

Joint INTEL/ G2

Cisco ASA Prototype Implementation

Orchestrator issues DENY and ALLOW to Cisco ASA based on CTIA update

Reactor Master/ Reactor Relay

Zepko

Use of OpenC2 in inter-domain commanding use case

IACD Course of Action Implementation

JHU/APL on behalf of NSA

15 OpenC2 Actions issued to Nine actuators

Implemented in Java

Page 35: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

Actuator Roadmap35

Goals

Define initial set of cyber defense functions

Identify initial set of profiles to be developed

Approach

Identify Product Categories & perform Market Survey

Identify the sent of functions/ features common across the category

Define conformance tests

Create Profile

Page 36: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

OpenC2 as a Concept36

Page 37: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

At the Language Description Level 37

Page 38: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

OpenC2 at the Actuator Profile Level38

Page 39: OPENC2: PROTECTING OUR FUTURE AT MACHINE SPEED · Acting Decision Making Sense Making Sensing SENSORS Instrumentation, raw telemetry, netflow, A/V logs, firewall logs, external threat

39

End Notes

Contribution: Status and Way Forward Brief by Joe

Brule, Executive Director, OpenC2

Cisco® is a registered trademark of Cisco Systems, Inc.

Oasis® is a registered trademark of Oasis, Inc.

Yuuki © Joshua Brule

OrchID © OpenC2

OCAS © sFractal Consulting


digidaw LOGS

digidaw LOGS

Documents
Logs, Logs, Logs - What you need to know to catch a thief

Logs, Logs, Logs - What you need to know to catch a thief

Technology
11-5 Common Logs and Natural Logs

11-5 Common Logs and Natural Logs

Documents
Jeopardy $100 Facts About Logarithms Exponentials to Logs Evaluating Logs Expanding Logs Condensing Logs $200 $300 $400 $300 $200 $100 $400 $300 $200 $100

Jeopardy $100 Facts About Logarithms Exponentials to Logs Evaluating Logs Expanding Logs Condensing Logs $200 $300 $400 $300 $200 $100 $400 $300 $200 $100

Documents
LOGS...............THE BACK LOGS

LOGS...............THE BACK LOGS

Education
Logs, Logs, Every Where, Nor Any Byte to Grok

Logs, Logs, Every Where, Nor Any Byte to Grok

Technology
Interpretacion Logs

Interpretacion Logs

Documents
Combining Gamma Ray Logs With Boring Logs

Combining Gamma Ray Logs With Boring Logs

Documents
Making gPTP Capable for Secure Time Synchronization · Secure Global Time The STBM logs TMAC calculation/verification events to the SEM

Making gPTP Capable for Secure Time Synchronization · Secure Global Time The STBM logs TMAC calculation/verification events to the SEM

Documents
Porosity Logs

Porosity Logs

Documents
OpenC2 Language Mapping for SDN Control - OASIS · Web viewOpen Command and Control (OpenC2) Language Mapping for SDN Control Version 0.9 21 April 2016 Randall Sharo

OpenC2 Language Mapping for SDN Control - OASIS · Web viewOpen Command and Control (OpenC2) Language Mapping for SDN Control Version 0.9 21 April 2016 Randall Sharo

Documents
Honka logs

Honka logs

Documents
Logs Miner : Portal for Data Mining Web Access Logs

Logs Miner : Portal for Data Mining Web Access Logs

Documents
Making your logs work for you: Drupal escalation and disaster recovery

Making your logs work for you: Drupal escalation and disaster recovery

Technology
Murus Logs Visualizer Manual Logs... · 2016-11-24 · MURUS LOGS VISUALIZER MANUAL rev 1.0 4 Welcome to Murus Logs Visualizer Murus Logs Visualizer is a tool for monitoring PF log

Murus Logs Visualizer Manual Logs... · 2016-11-24 · MURUS LOGS VISUALIZER MANUAL rev 1.0 4 Welcome to Murus Logs Visualizer Murus Logs Visualizer is a tool for monitoring PF log

Documents
Open Command and Control (OpenC2) Language Description ... · technologies and varying network environments. 2.2 OpenC2 and Deployment Environments OpenC2 is defined at a level of

Open Command and Control (OpenC2) Language Description ... · technologies and varying network environments. 2.2 OpenC2 and Deployment Environments OpenC2 is defined at a level of

Documents
06 Resistivity Logs Induction Logs

06 Resistivity Logs Induction Logs

Documents
Boring Logs

Boring Logs

Documents
MODSECURITY Firewall de Aplicação WEB Open Source · 2019. 10. 11. · Proxy Reverso ou Embarcado. 23 Logs, Lots of Logs. 24 Apache Logs: Logs, Lots of Logs. 25 Modsecurity Audit

MODSECURITY Firewall de Aplicação WEB Open Source · 2019. 10. 11. · Proxy Reverso ou Embarcado. 23 Logs, Lots of Logs. 24 Apache Logs: Logs, Lots of Logs. 25 Modsecurity Audit

Documents
ELK, making sense of your data - secure.trifork.com · Elastic.co pere.urbon@elastic.co ELK, making sense of your data (not just for logs!) $>whoami Pere Urbon-Bayes (Software Engineer

ELK, making sense of your data - secure.trifork.com · Elastic.co [email protected] ELK, making sense of your data (not just for logs!) $>whoami Pere Urbon-Bayes (Software Engineer

Documents
SpiceWorks Webinar: Whose logs, what logs, why logs

SpiceWorks Webinar: Whose logs, what logs, why logs

Technology
Whose Logs, What Logs, Why Logs - Your Quickest Path to Security Visibility

Whose Logs, What Logs, Why Logs - Your Quickest Path to Security Visibility

Technology
Trucking Logs

Trucking Logs

Documents
APPENDIX D SOIL BORING LOGS / CORE LOGS

APPENDIX D SOIL BORING LOGS / CORE LOGS

Documents
Open Command and Control (OpenC2) Information Assurance ... · Information Assurance Implementation Considerations . Version 1.0 – Release Candidate . ... • Information security

Open Command and Control (OpenC2) Information Assurance ... · Information Assurance Implementation Considerations . Version 1.0 – Release Candidate . ... • Information security

Documents
Logs, Logs, Logs, from Natural Element Homes

Logs, Logs, Logs, from Natural Element Homes

Documents
Logs – Solve USING LOGS METHOD

Logs – Solve USING LOGS METHOD

Documents
Logs management

Logs management

Technology
Security Interoperability & Automation · From “The Register” The Humans Aren’t Going Away ... Recognised as a standard for interoperability ... Open Command and Control (OpenC2)

Security Interoperability & Automation · From “The Register” The Humans Aren’t Going Away ... Recognised as a standard for interoperability ... Open Command and Control (OpenC2)

Documents
Aliens Logs

Aliens Logs

Documents