Dave Pack from LogRhythm dropped in
to see me at the UltimateWindowsSecurity.com booth (come see us at booth 2240 South hall)
booth here at RSA. As you know LogRhythm
has been sponsoring my real training for free webinars for many years and is
one of my favorite SIEMs so I thought I’d do a quick interview to see what’s
new at LogRhythm.
Video transcript:
Randy: Alright, so we’re live here at RSA at the
UltimateWindowsSecurity Booth and I got David Pack here. We’ve done a lot of webinars together in the
past on the Windows Security log. LogRhythm has got an awesome SIEM. You know how much I love it for a number of
reasons. So what’s new? What are you guy’s doing? What’s some big stuff?
David: Yeah, so what we’re really focusing on is
building a workflow to handle the full threat life cycle.
Randy: Ok.
David: You know, everything from that initial
detection to providing the tools to validate and qualify the detection, moving
it into case management where evidence can be gathered and you know, a true,
full picture of the story be put together and then ultimately adding on
automated response actions to that. You
know, the whole goal is to lower the time to detect these events and then also
lower the time to respond to these events, get them identified and cleaned up
as quickly as possible.
Randy: So, you know, what is that that you’re
doing? Are you building, you know, I can
take notes and I can add stakeholders to this incident and document what is my
resolution?
David: That’s right.
It’s a fully integrated case management feature within the SIEM and you
know, the workflows are, you can add evidence, different types of
evidence. It could be log data, it could
be raw logs, it could be attachments, it could be notes. Add different collaborators in. You could get to the case from a URL where
you add an external collaborator that doesn’t actually have an account with a
log in. You might need HR to come do one
specific task. You can add them and then
do their task and move on.
Randy: Yeah, because what if you’ve got a company
that is already using another collaboration tool, like, I hate to use other
product names while I’m interviewing a good sponsor friend, but you know, like
Asana, Wrike, because you know we are looking at using that kind of stuff, but
that’s cool you could just create a new task or project over there if there’s
other stakeholders that you don’t want in your SIEM.
David: That’s right.
Randy: And just put that URL there.
David: Yeah, and there’s an API to integrate and
some integration in the works with some of those other popular ticketing and
case management type systems that are out there. So we kind of understand we
need to play well with other solutions.
This is really supposed to be the start at least of that threat
management life cycle.
Randy: I like that.
So instead of just hey there’s something you need to look at and then
you’re on your own. We’re going to
facilitate the whole process because that’s really only the beginning, the
alert in the SIEM or that light on the dash board, really that’s just beginning.
David: That’s right.
What we were seeing, a lot of people were dropping alerts or you know,
they’d start working on one and got pulled away to do something else, came back
and a different alert may have came in and that initial one kind of was forgot
about, so they didn’t really have a place to, alright let’s start a case here,
formal workflow, formal collaborators, a place to gather other types of
evidence and workflow and pull it all together.
Randy: I
like it. What about knowledge
management. Do you still work in the
knowledge engineering area?
David:
It’s LogRhythm
Labs.
Randy: So,
I’m always interested in that because obviously what built UltimateWindowsSecurity
and what my folks, my audience is always interested in is how do we interpret
log data and you guys have made such a big investment over the years with a
whole department devoted to getting that knowledge and codifying it inside a
log rhythm. So, I’m always interested in
hearing what’s new there.
David: So
that’s still happening. That’s just an
ongoing investment, you know, we write all the parsing and normalization
rules. That’s really what enables our
real time analytics engine to do its job, basically adding structure to all its
log data. So that’s an ongoing thing,
something we always do for everything that can generate a log out there. The other half of LogRhythm
Labs is really focused on the security analytics, the actual analytic rules
that are finding bad things that are happening.
So one of the things we’ve recently done is developed what we call a
security analytics co-pilot service where we will help organizations get these
analytical modules properly deployed in their environment, up and running. We will have periodic check-ins to help them
understand what is the meaning when this alert fires. We’ll give them some recommended actions to
take. Okay, you might want to joule down
on the impacted hose and then pivot off to this user and really kind of be
their analytics co-pilot, help them get the most they can out of all the
content that Log Rhythm Labs is producing.
Randy: That’s cool.
You know, the fact that you guys, I know that I always harp on this, but
it’s still, I think, core to what makes LogRhythm
what it is and it’s the normalization and categorization, but here’s the thing
that always gets me. Alright, parse as
many log sources as you can, but when you come up with a threat signature, you
don’t have to write that threat signature for every log source out there that
produces those kind of events, right?
David:
That’s right.
Randy: Can you just explain how the fact that the
events are normalized allows you really write that threat signature criteria or
rule one time?
David:
Right, so you know, so all of these rules are basically working against the
normalized layer of data, LogRhythm
terminology.
Randy: A
log on is a log on is a log on.
David: A
log on is a log on. Every log that comes
through the system is identified and what we call a common event, where a log
on is a log on regardless of the operating system or the application. So the rule might say, you know, X number of
failed logons followed by logons, so classic use case, but because we’re
normalizing everything across the board, it works against everything.
Randy: Yeah, yeah, that’s cool. Well, I love that. I also love the fact, let me just put a plug in
for my software company LogBinder. You guys have integrated and normalized the
events that our software LogBinder
generates from SharePoint, SQL Server and Exchange right into the rest of
everything else that LogRhythm can
show you. And so, we’ve got some
customers in common that are using that to good effect.
David: Absolutely, yeah, yeah it’s great data for
SOC to have or an IT organization to have access to and it’s pretty difficult
to get to work without a product like yours, you know, working with a product
like ours.
Randy: Yeah.
David: It’s a great relationship.
Randy:
Some good synergy.
David: A
lot of good value there, absolutely.
Randy:
Alright, well thanks, I know you have to get back to your booth. Thanks for coming by, David.
David:
Thanks Randy. Thanks for having me.
If you are at RSA come see me at
booth 2240 in the South Hall and LogRhythm is at 1207 South hall.