FloCon 2020

Posters and concepts related to the FloCon 2020 theme, "Using Data to Defend," will be presented during this session. Our sponsors will also be on hand to provide demonstrations and answer questions about their products and services.

Presentations Include:
Network Traffic Analysis with SiLK 
Timothy Shimeall; Senior Member of the Technical Staff, CERT Division - Software Engineering Institute
Nancy Ott; Senior Technical Writer/Editor, Software Engineering Institute
Previous revisions to the SiLK Analysts' Handbook, "Network Traffic Analysis with SiLK", shifted the focus from individual tools in the SiLK tool suite to the perspective of network traffic analysts. As such, the handbook is organized according to a workflow for analysts to follow when investigating network activity and anomalies. The analytical thought processes outlined in the new version of this handbook apply to any type of general security analysis. This handbook offers insight on how to think through the problems, address them, and apply the methodology to analysis of network flow or other data.

The new 2019 revision of the handbook (copies available at this session) offers additional content, including case studies exploring possible data leakage, using the new aggregate bag structures to track incoming and outgoing data volumes as paired data, and tips to speed analyses using the SiLK tool suite. Presenters Timothy Shimeall and Nancy Ott (two of the guide's co-authors) will also be gathering feedback from FloCon attendees about content for the upcoming 2020 revision to the Analysts' Handbook. Your input will inform and help to prioritize work on the next update of this guide!

Large-Scale Indicator Caches using Analysis Pipeline and the Elastic Stack
Dillon Lareau; Software Engineer, CERT Division - Software Engineering Institute
Anusha Sinha; Assistant Software Engineer, CERT Division - Software Engineering Institute
Indicator caches make it quicker and easier to find the presence of specific indicators in flow traffic, such as IP addresses or domain names. Indicator caches also make it possible to later associate those cache records with specific flow data without having to perform expensive searches of the actual repository. We developed and tested a system to generate and search these indicator caches using Analysis Pipeline, Logstash, Elasticsearch, and Kibana that is able to handle over 40 Billion flows per day.