Practical network defense at scale
summary
Built a scalable SIEM around the ELK stack that ingests about 1,000,000 log lines in 12s on eight nodes and correlates sFlow/NetFlow, firewall, DHCP/DNS, bro and cloud logs. Pipeline normalizes, tags and types fields so queries can answer “who talked to which DB on which port” and power tiered alerts, escalation and kill‑chain logic. Retention, legal constraints, false‑positive tuning and automated test bots shape operations; machine learning is evaluated but not trusted to protect crown jewels.
AI-written summary · about
chapters (5)
related talks
33mSecurity Logging Use Cases: Building an Open-Source SIEM
37mA Needle in a Haystack: How to Find a Threat Hidden in Over 6 Billion Logs Per Day
29mReinventing ETL for Detection and Response Teams
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
50mTo Normalized Logs, and Beyond - Building a Threat Detection...
29mPractical ISP CSIRT Incident Handling w/ Network Flows, ELK Stack & Cybersecurity Intelligence...
27mCollect All the Data; Protect All the Things
49mProtecting the Web at a scale using consul and Elk