• Home

  • Documents

  • Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and...
27
Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017 | Washington, DC

Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

  • Upload
    others

  • View
    5

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Tossing Splunk in Your PANNinja’s Guide to the Galaxy of Splunk and Palo Alto Networks

Kevin Gonzalez | Security Operations Manager

September 25, 2017 | Washington, DC

Page 2: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

THIS SLIDE IS REQUIRED FOR ALL 3 PARTY PRESENTATIONS.

Page 3: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

3

Page 4: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

© 2017 SPLUNK INC.

1. Utilizing Splunk Enterprise Security to:• Reduce alert chaos• Tame your PANW Threat Intelligence Feeds

2. Saving time with a Splunk/PANW API Fusion

3. Knowing the “who” at all times by populating PANW’s User-ID

4. Utilizing the Splunk Universal Forwarder to fix all of your problems

Agenda

Page 5: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Splunk Enterprise Security & Palo Alto Networks

5

▶ Incident Response• Single pane of glass• Adaptive response based on

correlated information▶ Threat Intelligence

• Centralized repository• Easy to maintain• Deduplication and content filtering

Page 6: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

© 2017 SPLUNK INC.

▶ Create Notable Events geared towards your PAN Firewall• Auto-Wildfire submissions

• Per-Notable event tagging for PAN Dynamic Block Lists

▶ Utilize Threat Intelligence Data Models to feed your Palo Alto Network Firewalls:• De-duplicate and publish filtered threat

intel• Auto-add trusted intel to dynamic block

lists via tags

Splunk Enterprise Security & Palo Alto NetworksIntegrating PANW into Enterprise Security

Page 7: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Splunk Enterprise Security & Palo Alto Networks

7

Page 8: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Splunk Enterprise Security & Palo Alto Networks

8

Page 9: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

© 2017 SPLUNK INC.

http://pansplunk.readthedocs.io/en/latest/com

mands.html#pantag

pantag

Page 10: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

10

API HarmonySplunk, Palo Alto Networks, and their API’s

Page 11: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

© 2017 SPLUNK INC.

https://github.com/splunk/splunk-sdk-python

Splunk SDK for Python

Page 12: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

© 2017 SPLUNK INC.

https://www.paloaltonetworks.com/documentati

on/71/pan-os/xml-api

PAN-OS XML API

Page 13: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

pantag - ExtendedAuto-tag trusted Domain and HTTP IOCs to Dynamic Block Lists

▶ Splunk Cloud customers are currently limited to IP and HTTP

▶ Use your Splunk Enterprise Security Data Models

Page 14: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

How About Using the APIs to Maintain Your Address Objects?

▶ Pre-existing address object library? No problem.

▶ Need it done now? No problem.▶ Create new address object library

managed by Splunk data▶ Regularly update address objects

with pre-defined tags

Page 15: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Updating PAN-OS Address Objects

▶ Address object:• Standardization• Creation• Modification

▶ Splunk query that contains all necessary data

▶ + crontab

Page 16: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Palo Alto Networks User-IDWhy we all want it…

▶ Benefits• Improved visibility• Policy Control• Logging, Reporting and Forensics

▶ Use Cases• Security• Legal • Human Resources

Page 17: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Palo Alto Networks User-IDWhy we had some problems…

▶ Non-Microsoft endpoints▶ No centralized point of reference

for User-ID Agent▶ Cloud-based systems ▶ Lack of historical data

Page 18: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Palo Alto Networks User-ID – Solution Overview

Page 19: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Updating User-ID With RADIUS Logs

▶ X amount of incomplete sources can depict a full picture

▶ Wireless AP Logs• Device MAC• Device IP

▶ RADIUS Logs• User• Device MAC• Automatic Lookups

Page 20: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

© 2017 SPLUNK INC.

http://pansplunk.readthedocs.io/en/latest/commands.html#panuserup

date

panuserupdate

Page 21: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Updating User-ID With SIP and “Best Guess” Scenarios

▶ Know your apps▶ Know the data from those apps▶ Now apply that knowledge▶ Examples:

• SIP Data from Lync/Skype• Raw URL Logs passing user info

Page 22: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

“Best Guess” Scenarios and Timeouts…

▶ Individualized User-ID timeout▶ Increased customization▶ APIs are your best friend…

Page 23: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Updating User-ID with Custom Scripts

▶ Endpoints are your true source• Contain LAN/WAN IPs• Contain User Info

▶ The Splunk Universal Forwarder are also your best friend

▶ Historical evidence of all User/IP mappings… completed.

Page 24: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

▶ GlobalProtect Install Validation▶ Version Checks▶ Setting Checks▶ Assess your egress▶ Bug Workarounds

Other Splunk Universal Forwarder Use Cases

As it relates to Palo Alto Networks…

Page 25: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

GlobaLprotect Bug Workaround Utilizing The SplunkUniversal Forwarder

25

▶ v3.0.x ▶ Ubiquitous VPN on Windows▶ Ungraceful Network Disconnects▶ Internal DNS Settings Frozen

Page 26: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

Questions, Comments, Concerns?

Page 27: Tossing Splunk in Your PAN...Tossing Splunk in Your PAN Ninja’s Guide to the Galaxy of Splunk and Palo Alto Networks Kevin Gonzalez | Security Operations Manager September 25, 2017

© 2017 SPLUNK INC.

Don't forget to rate this session in the .conf2017 mobile app

Thank You


Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Documents
Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Documents
Splunk App for StreamMany Solutions, One Goal. Some history •Splunk acquires Cloudmeter, December 2013 •Renamed Splunk App for Stream •Released with Splunk 6.0 (August, 2014)

Splunk App for StreamMany Solutions, One Goal. Some history •Splunk acquires Cloudmeter, December 2013 •Renamed Splunk App for Stream •Released with Splunk 6.0 (August, 2014)

Documents
Splunk in Rakuten: Splunk as a Service for all

Splunk in Rakuten: Splunk as a Service for all

Retail
SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Documents
Splunk Enterprise 6.5.0 Splunk Enterprise 보안

Splunk Enterprise 6.5.0 Splunk Enterprise 보안

Documents
ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Documents
Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

Documents
Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Technology
Salmon Carcass Tossing 2016

Salmon Carcass Tossing 2016

Education
Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Documents
Splunk conf2014 - Splunk for Data Science

Splunk conf2014 - Splunk for Data Science

Technology
Salmon Carcass Tossing 2014

Salmon Carcass Tossing 2014

Technology
Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Technology
Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Documents
Splunk conf2014 - Onboarding Data Into Splunk

Splunk conf2014 - Onboarding Data Into Splunk

Technology
CERCLA & RCRA: Tossing Toxic Trash

CERCLA & RCRA: Tossing Toxic Trash

Environment
Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

Documents
データ分析プラットフォーム「Splunk」eww.gp-club.panasonic.co.jp/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

データ分析プラットフォーム「Splunk」eww.gp-club.panasonic.co.jp/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Documents
Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Documents
Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers

Documents
Splunk 教學 - Splunk Documentationdocs.splunk.com/images/d/db/Tutorial_zh_TW_502.pdf · 簡介 歡迎使用 Splunk 教學！ Splunk 是什麼？ Splunk 是一個可從構成您

Splunk 教學 - Splunk Documentationdocs.splunk.com/images/d/db/Tutorial_zh_TW_502.pdf · 簡介 歡迎使用 Splunk 教學！ Splunk 是什麼？ Splunk 是一個可從構成您

Documents
Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Documents
Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Documents
stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Documents
Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Documents
Splunk Conf2010: Corporate Express presents Splunk with SAP

Splunk Conf2010: Corporate Express presents Splunk with SAP

Technology
Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Documents
Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Documents
Tossing Coins

Tossing Coins

Documents