What we learnt from running our Security Operations Center

No ratings

Presented at Bsidesljubljana 2017 by

Robert Kiss

Gyorgy Demarcsek

We would like to present how we built our Security Operations Center in Python on top of ElasticSearch and what are the learnings from running it for more than 3 years now. This tool can alert us during the night if there is any indication of compromise in our system and creates JIRA ticket for non-urgent alerts, so we don’t forget to get back to it the next day. Although it is not open-source, we will cover its architecture and most of the detection rules and third party integrations which can be useful for anyone running their own SOC. We will talk about how we keep fine-tuning our automatic incident detection mechanisms by fighting false positives in order to improve the effectiveness of our SOC. We will demonstrate how smart detection rules can help you detect vulnerabilities in your web application like XSS and open redirect exploitation. But we will also show how such a tool can help in detecting infra-level compromise as well thanks to open source utilities like auditd, apparmor, snort or Reddalert. Additionally, we will cover how we work together within and beyond the security team (e.g. code reviews in a devops environment) and how we try to incorporate learnings from previous incidents in order to improve our detection rules and incident response plan. Finally, we will highlight some good and bad decisions we made along the way so you can avoid making the bad ones yourself.