Upload File

threat hunting and incident response with fireeye - …...agenda •about cs computer systems...

  • Home
  • Documents
  • Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye
14
Threat hunting and incident response with FireEye Jure Šimundić CS Computer Systems RiSK Conference 2019, Laško

Upload: others

Post on 21-May-2020

5 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Threat hunting and incident response with FireEye

Jure Šimundić

CS Computer Systems

RiSK Conference 2019, Laško

Page 2: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Agenda

• About CS Computer Systems

• Security Timeline

• Threat Hunting and Incident Response

• FireEye technology

• FireEye processes & FireEye people

• FireEye EcoSytem

Page 3: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

CS Computer Systems

• 30 years on the market

• 150 employees

• 500 certificates

• 18 mil EUR annual revenue

• IT Service Provider and System integrator

• Security Solutions

• Computer Solutions

• Communications Solutions

• Audio and Video Solutions

• CRM and Digital Marketing

Page 4: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Security Customers

• Government

• Finance

• Telco & Communications

• Energy

• Industry

• Media

Page 5: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Vendors

Computer Solutions HP,IBM,NetApp,Lenovo,Microsoft,RedHat,Vmware

Communications Cisco,HP,Juniper,BrandRex

SecurityFireEye,F5,CheckPoint,Imperva, Exabeam,IBM,

TrendMicro,Kaspersky,Forcepoint,CISCO,Tenable,

ReversingLabs

Audio&Video Avid,Harmonic,Evertz, Aviion

CRM, Digital Marketing OracleSiebel

Page 6: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Securitytimeline

Capability

Time

SIEM

monitoring

Response

Capability

ThreatIntel&

DataAnalytics

Antivirus

Firewall

IDS/IPS

NextGenFirewall

SIEM

AdvancedThreatProtection

ThreatDetectionandResponse

LogAnalytics

On-DemandCIRTservices

Forensics

IncidentResponse

ThreatIntelSubscription

APThunting

Page 7: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Threat Hunting and Incident Response

People

Processes

Technology

with …

FireEye

Page 8: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

FireEye Technology

Page 9: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

FireEye People & Processes

AXHX

CM

IA

SOC

Threat

Intelligence

Managed

Defense

Education

& Processes

Security

operations

platform

FaaS

Mandiant Helix

iSight

Page 10: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

FireEye EcoSystem

Page 11: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Questions, vprašanja, pitanja

FaaS

Mandiant

Helix

iSight

Page 12: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Conclusion

• Have a complete view of security:

§ educate and train peple

§ detection & prevention phase is important, but not everything

§ breaches are inevitable, sooner or later it can happen

§ be prepared for forensic analysis and incident response

§ work with a vendor that offers both detection and prevention, but can also help with forensic analysis and incident response

§ work with a partner that has the capability to help you solve the security incident, not just resell / install the technology

Page 13: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

Visit @ RiSK 2019 …

FireEye Detecting and hunting lateral movement

• Anca Holban, Senior Systems Engineer CEE

• Red Hall workshop, March 21st, 11:30 – 12:00

Page 14: Threat hunting and incident response with FireEye - …...Agenda •About CS Computer Systems •Security Timeline •Threat Hunting and Incident Response •FireEye technology •FireEye

PeopleTechnology

Processes

El fin

CSComputerSystemsPrečko1a|HR-10110Zagreb

T. +38513855855

F. +38513882555

W. www.cs.hr

E. [email protected]


IntSights for FireEye Integration Benefits External Threat … · 2020-06-07 · IntSights for FireEye External Threat Protection and Enterprise Security IntSights and FireEye deliver

ThreatAnalyticsPlatform (TAP) - FireEye...ThreatAnalyticsPlatform (TAP) DeploymentGuide April28,2014 FireEye,Inc.,1440McCarthyBlvd.,Milpitas,CA95035||+1877.FIREEYE

FireEye Managed Defense...FireEye Managed Defense is a managed detection and response (MDR) service that combines industry recognized cyber security expertise, FireEye technology and

© Mandiant, a FireEye Company. All rights reserved ... · © Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL 3 Hunting 101 leads qualify analytics triage FP IR

FireEye App for Splunk App Documentation - …tmp.vpetkov.net/fe-splunk.pdfFireEye App for Splunk App Documentation Version 1.1 FireEye App for Splunk . Table of Contents FireEye App

Advanced Threat Hunting with Carbon Black · Advanced Threat Hunting with Carbon Black 3 Overview Forty-seven percent of incident responders claim they assume their enterprise is

Hunting-Related Shooting Incident Report...Hunting Related Shooting Incident Reporting System Bureau of Information & Education HRSIS Report: STATEWIDE TOTALS 01 Hunting Related Shooting

Здравствуйтэ, Carbanak! · ©2018 FireEye Behind the Blog: Hunting for More Carbanak § Lots of Carbanak tickets submitted over the years § Samples would be easy to hunt

Copyright (c) 2012, FireEye, Inc. All rights reserved. | CONFIDENTIAL 1 FireEye Overview Nathan Labadie Systems Engineer, US-Central FireEye

Insight into the Nordics Threat Landscape - FireEye · Copyright © 2014, FireEye, Inc. All rights reservedCopyright © 2015, FireEye, Inc. Title: PowerPoint Presentation Author ~~~

Fireeye User Guide

Cyber Security Experts & Solution Providers | FireEye - FireEye Cyber … · 2019-11-13 · ©2019 FireEye §27% of organizations characterize their cyber security program as semi-

ENDPOINT SECURITY - FireEye Market

Flare&On)4:)Challenge)7)Solution)–)zsud.exe) - FireEye · FireEye,!Inc.,!1440!McCarthy!Blvd.,!Milpitas,!CA!95035!!|!!+1!408.321.6300!!|!!+1!877.FIREEYE!(347.3393)!!|[email protected]!!|!!!!!!!1!

Fireeye bds 2015

FireEye Network Security - isab.it · FireEye Network Security Effective protection against cyber breaches for midsize to large organizations OVERVIEW FireEye Network Security is

Advanced Incident Detection and Threat Hunting using ... · PDF fileAdvanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss Post CERT Botconf 2016

Fireeye Advanced Threat Protection

FireEye v.6.0 Security Target - Common Criteriacommoncriteriaportal.org/files/epfiles/st_vid10458-st.pdf · 2011-11-03 · FireEye, Inc. Page 1 Version 1.1 May 11, 2011 FireEye v.6.0

FireEye and LogRhythm · with suspicious behavior patterns to gain greater speed and accuracy in incident response. THE VALUE OF THIS PARTNERSHIP The comprehensive nature of the FireEye-LogRhythm

Comparison of AppGuard® with FireEye® Endpoint Security › wp-content › uploads › 2019 › 01 › App... · 2019-06-05 · FireEye endpoint agents REQUIRE numerous FireEye

Save on Real-Time Threat Protection with FireEye › content › dam › wcgcom › ...Save on Real-Time Threat Protection with FireEye he FireEye platform, including security management

STARTER KIT Infoblox DNS Firewall for FireEye KIT Infoblox DNS Firewall for FireEye. ... User Community ... Administrator guide. • You cannot add a FireEye integrated RPZ during

Incident Response - ISACA South Floridaisacasfl.org/.../uploads/2014/02/4-FireEye-Incident-Response.pdfFireEye Labs Incident Response . History Of Malware Creeper Virus Brain - - Experimental

Imperva SecureSphere and FireEye Malware Protection System … · 2016. 1. 22. · IMPV-SB-FireEye-0116-v1 FireEye Malware Protection System enables organizations to: • Protects

Flare-On 6: Challenge 6 BMPHIDE - FireEye...FireEye, Inc. | 601 McCarthy Blvd. Milpitas, CA 95035 | 408.321.6300 | 877.FIREEYE (347.3393) [email protected] | 6 –

FireEye - ISPAB Threat Environment

Hunting for PLATINUM · ©2018 FireEye Matias Bevilacqua § Principal Consultant at Mandiant § 15+ years experience § Incident Response § 5 years experience on IR/forensics R&D

FireEye Advanced Threat Report

Advanced Incident Detection and Threat Hunting using ...security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom... · Advanced Incident Detection and Threat Hunting using

FireEye Use Cases — FireEye Solution Deployment Experience

LTI - Larsen & Toubro Infotech · Edgar Dias, F5 Networks Enterprises should invest in people and build cyber threat-hunting practices: Shrikant Shitole, FireEye Critical enterprise

FireEye iSIGHT Intelligence · Copyright © 2015, FireEye, Inc. All rights reserved. CONFIDENTIAL 10 FireEye Threat Intelligence Sources Collected Curated Focused Rule Sets

TEEXASS UHHUNNTTI IN NGG AIINNCCIDDEENTT …6 2018 FATAL INCIDENTS - FIREARM/BOW HUNTING RELATED (A)* * Firearm/Bow & Hunting Related--an accident/incident resulting from the discharge

Copyright (c) 2012, FireEye, Inc. All rights reserved. | CONFIDENTIAL 1 FireEye Overview John Bolger Manager Channels, US-Central FireEye