Practical ISP CSIRT Incident Handling w/ Network Flows, ELK Stack & Cybersecurity Intelligence...
summary
Community Nimbus service ingests NetFlow/IPFIX/sFlow from autonomous systems, correlates with Team Cymru reputation (hundreds of thousands of malware samples processed per day), and surfaces near‑real‑time alerts in an ELK/Kibana stack; a Tier‑2 ISP case shows this running on ~500 Gbps backbone with live Mirai detections and clickable filters to pivot to offending IPs. Reputation scores decay to zero in eight days, sharing algorithms so operators can apply local policy scoring, and onboarding requires AS owners and a mutual MDA.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:30Introduction
- 9:31Dashboards
- 16:15Mirai Botnet
- 20:14Score Decay
- 23:23Conclusion and Future Perspective
related talks
01h 05mPractical network defense at scale
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
26mNetwork monitoring with FOSS
04h 02mOpen-source Tools for CSIRTs
40mStrengthening Cyber Resiliency in a Time of Geopolitical Crises...
27mCollect All the Data; Protect All the Things
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report