On This Page

Visual Analytics - Delivering Actionable Security Intelligence

Raffael Marty, PixlCloud | August 1-2 & 3-4



Overview

Big data and security intelligence are the two very hot topics in security. We are collecting more and more information from both the infrastructure, but increasingly also directly from our applications. This vast amount of data gets increasingly hard to understand. Terms like map reduce, hadoop, spark, elasticsearch, etc. are part of many discussions. But what are those technologies? And what do they have to do with security intelligence? We will see that none of these technologies are sufficient in our quest to defend our networks and information. Data visualization is the only approach that scales to the ever changing threat landscape and infrastructure configurations. Using big data visualization techniques, you can gain a far deeper understanding of what's happening on your network right now. You can uncover hidden patterns of data, identify emerging vulnerabilities and attacks, and respond decisively with countermeasures that are far more likely to succeed than conventional methods. The attendees will learn about log analysis, big data, information visualization, data sources for IT security, and learn how to generate visual representations of IT data. The training is filled with hands-on exercises utilizing the DAVIX live CD.

Day 1:

Log Analysis
  • Data Sources Discussion such as PCAP, Firewall, IDS, Threat Feeds, etc.
  • Data Analysis and Visualization Linux (DAVIX)
  • Log Data Processing (CSVKit, ...)
Log Management and SIEM
  • Log management and SIEM overview
  • LogStash and Moloch
  • Big data - Hadoop, Spark, ElasticSearch

Day 2:

Visualization
  • Information Visualization History
  • Visualization Theory
  • Data Visualization Tools and Libraries
    • - e.g., Mondrian, Gephi, AfterGlow
  • Visualization Resources

Security Visualization Use-cases
  • Perimeter Threat
  • Network Flow Analysis
  • Firewall Visualization
  • IDS/IPS Signature Analysis
  • Vulnerability Scans
  • Proxy Data
  • User Activity
  • Host-based Data Analysis

Who Should Take this Course

Anyone with an interest in data analytics, big data, and visualization. For example, Security Analysts, Security Engineers, Incident Responders, Security Managers, and System Administrators.

Student Requirements

Working UNIX knowledge, some programming experience, and basic familiarity with TCP/IP networking.

What Students Should Bring

Students need to bring a laptop with the latest version of VMWare player or any other software that can run a VMWare image.

What Students Will Be Provided With

Students will be provided with "Applied Security Visualization," an exercise work book, and the DAVIX visualization distro.

Trainers

Raffael Marty is one of the world's most recognized authorities on security data analytics. The author of Applied Security Visualization and creator of the open source DAVIX analytics platform, Raffy is the Founder and CEO of PixlCloud, a next-generation data visualization application for big data. With a track record at companies including IBM Research and ArcSight, Raffy is thoroughly familiar with established practices and emerging trends in data analytics. He has served as Chief Security Strategist with Splunk and was a co- founder of Loggly, a cloud-based log management solution. For more than 12 years, Raffy has helped Fortune 500 companies defend themselves against sophisticated adversaries and has trained organizations around the world in the art of data visualization for security. Practicing zen has become an important part of Raffy's life.

Video Preview (Training Description Above - Top of Page)