ZeekWeek 2022 - What the Metadata... - Stan Kiefer
By Stan Kiefer, Security Product Researcher, Corelight
Traditionally, network identifiers such as IP and MAC addresses are fairly constant and can easily be attributed back to a specific host at a specific location at a given time. In the cloud, this level of consistency does not exist, complicating incident investigation.
In cloud or container environments, the layer 3 portion of networking is, in most cases, abstracted away from the higher level tasks of running workloads or presenting data. Because of this abstraction, when Zeek logs are collected for cloud or container network environments, the attribution is much more difficult for users of the logs to obtain. The log users would need to know which instance, host, pod, container, etc had the IP address seen within the logs at the exact time the log was created. In most cloud environments, this simply is not tracked due to the abstracted nature of the solutions. In this talk, we will walk the audience through the traditional look/feel of network data, the void we believe exists in that same data taken from cloud or container solutions, then close the gap by showing the enriched log data and explaining how the enriched logs could be used by a network admin, incident responder or threat hunter. We will demonstrate how we took real time metadata from several cloud capabilities (K8s, AWS, and Docker) and enriched the Zeek logs in each.
Speaker Bio: Stan is a Product Researcher at Corelight, focusing on rapid prototyping security solutions. Previously he worked for Symantec Corporation leading their cybersecurity simulation capabilities leveraging cloud infrastructure. Stan also served the US Air Force for 12 years working inside information security and intelligence organizations.