Defcon 13: Raffael Marty, Visual Security Event Analysis

In the network security world, event graphs are evolving into a useful data analysis tool, providing a powerful alternative to reading raw log data. By visually outlining relationships among security events, analysts are given a tool to intuitively draw conclusions about the current state of their network and to respond quickly to emerging issues. I will be showing a myriad of graphs generated with data from various sources, such as Web servers, firewalls, network based intrusion detection systems, mail servers, and operating system logs. Each of the graphs will be used to show a certain property of the dataset analyzed. They will show anomalous behavior, misconfigurations and simply help document activities in a network. As part of this talk, I will release a tool tool that can be used to experiment with generating event graphs.A quick tutorial will show how easy it is to generate graphs from security data of your own environment. Raffael Marty is a senior security engineer with ArcSight, the global leader in Enterprise Security Management. He initiated the Content team, holding responsibility over all the content in ArcSight's product, ranging from correlation rules to categorizations, vulnerability mappings, to visualizations and dashboards. Before joining ArcSight, he was a member of the Global Security Analysis Lab at IBM Research, where he participated in various intrusion detection related projects. His Master's thesis focused on correlating events and testing intrusion detection systems. The resulting tool he created, Thor, can be used to generate correlation tables for multiple, heterogeneous IDS sensors.