4 ms·

A big problem is insiders selling information or ransoming it under the guise of a breach. Employees are the single greatest threat to any organization so behav

A big problem is insiders selling information or ransoming it under the guise of a breach. Employees are the single greatest threat to any organization so behavior analytics is starting to become really big. As I tell people, "We don't care if you browse Reddit, we only care if you start doing things an employee shouldn't". But to answer your questions we would just ingest those alerts into Splunk, build a KB on how to handle the alerts when they trigger and then begin the process of filtering out the noise. The SOC Analyst who works these alerts will get numb to them but still pick out the unusual ones to investigate.

CDT-MLT 4y ago
That is something right there. I am intrigued by this.
bogomipz 4y ago
I'm curious are there any open source "behavior analytics" projects that are gaining traction?
- Godel_unicode 4y ago
  No, you need too much data and it’s too specific to the environment.
traceroute66 4y ago
> just ingest those alerts into Splunk Aah yes, Splunk.... Good tool, but realistically only viable for those working for a corporate-sized employer with corporate-sized pockets filled with $$$$$$$. Most people can't afford to simply dump it all into Splunk and (if they are using Splunk at all) have to pre-filter first. Which kind of defeats the point of Splunk if they're already doing the hard work outside, and so might was well use some cheaper (F)OSS tool.
- milkshakes 4y ago
  you can do the same type of work with spark, which is free
- rsdbdr203 4y ago
  Working on a startup to basically be 75% of the features of Splunk at 50% the cost: https://log-store.com/ https://log-store.com/ Right now it's 100% free, because I'm just looking for user feedback. I think/hope there is an opening in the market for folks looking for an easy-to-use, but powerful tool like Splunk, but can't afford their hefty price tag. All feedback welcomed! Also created an open-source ETL tool: https://log-ship.com https://log-ship.com
  - traceroute66 4y ago
    That sounds interesting, I'll certainly give it a go when I get a chance in the near-future !

CDT-MLT 4y ago

That is something right there. I am intrigued by this.

bogomipz 4y ago

I'm curious are there any open source "behavior analytics" projects that are gaining traction?

Godel_unicode 4y ago
No, you need too much data and it’s too specific to the environment.

traceroute66 4y ago

> just ingest those alerts into Splunk Aah yes, Splunk.... Good tool, but realistically only viable for those working for a corporate-sized employer with corporate-sized pockets filled with $$$$$$$. Most people can't afford to simply dump it all into Splunk and (if they are using Splunk at all) have to pre-filter first. Which kind of defeats the point of Splunk if they're already doing the hard work outside, and so might was well use some cheaper (F)OSS tool.

milkshakes 4y ago
you can do the same type of work with spark, which is free
rsdbdr203 4y ago
Working on a startup to basically be 75% of the features of Splunk at 50% the cost: https://log-store.com/ https://log-store.com/ Right now it's 100% free, because I'm just looking for user feedback. I think/hope there is an opening in the market for folks looking for an easy-to-use, but powerful tool like Splunk, but can't afford their hefty price tag. All feedback welcomed! Also created an open-source ETL tool: https://log-ship.com https://log-ship.com
- traceroute66 4y ago
  That sounds interesting, I'll certainly give it a go when I get a chance in the near-future !