-: In the last lesson, we talked about all of the log files
being sent into a centralized SIEM or syslog server.
Now we wanna start performing some data analytics
so we can start figuring out what's wrong with those logs
or what might be triggering those.
So the first thing we look at when we talk about
data analytics is integrating all of the logs
from all of our devices because that's gonna give us
more value and more information.
Yeah, it's great to look at my email server,
but when I'm only looking at the email server
and not looking at what's been coming through the routers,
the switches, the firewalls,
the data loss prevention system,
and putting all that together, I'm missing the big picture.
So, we wanna conduct manual log reviews
but that's really time consuming
and we don't have enough people to do that.
So we start using automated systems instead
because they're better and faster at doing it.
Instead of looking at all one million log entries
that came in, I can instead let the computer do that
and flag the ones that might be of interest and have you,
the cybersecurity analyst, analyze those
and determine what is of value and what isn't.
Automated systems can help us prioritize these items
for review based on heuristics
or previous signatures created, or the trends
that we've observed in the past.
Now, you need to conduct data aggregation and correlation,
trend analysis, and historical analysis
to be able to figure out the best information
from your data that you've been collecting.
Because if you collect all this data and never look at it,
it's not gonna do you any good.
So, the first one we wanna talk about is data aggregation
and correlation.
This is a really important concept because on the CSA+ exam,
you may see some questions that ask you
to correlate the data.
They'll give you some logs from a system,
from a network device, from a router,
and you'll have to look across
and figure out what's going on.
That's an important concept, right?
So you wanna combine the data from multiple sources
and events, and then you can see what the impact is
to the larger environment.
You'll be looking at things like syslogs,
authentication logs, application logs, event logs,
and other things in a central analysis node.
And one of the great ones here is Splunk.
I really love this product.
It does a great job of taking all of this information,
dumping it into a database, and we can do
big data analytics and correlate that information
across time and events.
This is what's known as a detective control
because we're going through and being a detective
and looking through all this information
to see what we can find.
Splunk is a great product for this.
There's numerous other ones out there.
Splunk just happens to be one of the ones
I've used a lot in the past.
Now, trend analysis is when you analyze the system,
events, and devices to detect trends and patterns.
This is gonna help you identify issues
that are outside of the expected normal growth
or usage patterns.
So you may be asked on the exam to look at some trend
and see what's standing out as wrong.
For example, I might give you some logs from a server
or a router that says, "Here's what the normal bandwidth is
"and here's what the bandwidth was last week.
"What's wrong?"
And maybe it's normally at 3 gigabits per traffic
and this week it's up to 11.
That's something you wanna investigate.
Why did it grow so much?
Is somebody stealing a bunch of information from our network
and that's causing us to have that issue?
Well, we don't know,
but you need to investigate that, right?
And so by using these logs across the enterprise,
you can start looking at that.
Splunk again does a great job of that.
I have a screenshot here showing you those patterns.
You can see how they rise and fall
and look at them over time.
Now, how is trend analysis different
than historical analysis?
Well, historical analysis looks at all those same systems,
events, and devices over time to detect
the patterns and trends.
But the big difference here is that it's usually done
over a very, very long period of time
and oftentimes you're looking in the rear view mirror
with historical analysis.
With trend analysis, you're looking forward
based on your past history.
But in historical analysis, you're looking backwards
because something bad already happened.
So maybe we just found out that someone has stolen
our top secret plans for our next company's function.
Well, we're gonna start going back
and pulling the thread and figuring out,
based on historical analysis, who touched that file,
when did they touch it, where did that file go,
who emailed it out, and we can start looking back
at that stuff over a very long period of time
based on the information we have in our database
of all of this correlated data.
(electronic music)