Hurricane Labs: Recent Episodes

View Details

One of the most requested features I hear from clients as a Splunk Managed Services Provider (MSSP) is to have a mechanism for managing the version of the Splunk Universal Forwarder across the environment from the Deployment Server. We could easily manage Splunk configurations for our clients via the Deployment Server, but any UF version upgrades would have to be handled by the client using their typical process for managing software in their environment.

You might be thinking, “Hey Tom, can’t they just upgrade this using Ansible/Puppet/SCCM/whatever?” That’s a great point, and was our typical recommendation. However, not every environment has the same level of technical maturity to have all of their package management automated across their environment. Informing a client that they have to manually upgrade a Splunk agent on dozens or more different systems wasn’t the most fun news to share.

Fortunately, Splunk has recently introduced a new app to help solve part of this problem, Splunk Remote Upgrader for Linux Universal Forwarders. As the name suggests, this app is designed to handle UF upgrades on Linux systems. I’ve always found that the best way to learn something new is to test it out in a lab environment and see what happens, so let’s take this new app for a test drive!

Test environment and AssumptionsFor my test, I’ve set up a very simple Splunk environment consisting of the following:

• A Splunk Enterprise 9.4.0 system functioning as an all-in-one system with a deployment server
• A Splunk Universal Forwarder running a supported version of Splunk. For my example, I picked 9.0.7, but the oldest version supported is 8.0.

The Remote UF Upgrader is a service that runs external to the Splunk UF itself, and will need to be installed separately. This means that you’ll have to at least deploy this package to all of your Linux systems with a UF installed, but once this is deployed, you’ll be able to do future upgrades via the Deployment Server.

Since this app is a bit unique in that it has components that need to be installed on both the Deployment Server and the Universal Forwarders, lets look at each part separately.

Deploying the App on the Deployment ServerFrom the perspective of the deployment server, the app is fairly straightforward and deploys like a normal app, with some additional steps needed to include the UF packages you wish to deploy. When you extract the app to $SPLUNK_HOME/etc/deployment-apps, there will be a directory splunk_app_uf_remote_upgrade_linux that is created.

Inside the app, you should create a local/packages directory to store the UF installers that are used for the upgrade. You’ll also need to include the signature file for the UF installer – you can download this from Splunk at the same time that you download the UF installer.

Click the “More” link to download the x509 signature for your UF installer

If I want to provision the tarball installer of the Splunk 9.4.0 UF to be installed on remote UFs, my local/packages directory will end up looking like this:

splunk@tk-demo-uf-upgrade-ds:/opt/splunk/etc/deployment-apps/splunk_app_uf_remote_upgrade_linux/local/packages$ ls -ltrah

total 130M

-rw-rw-r– 1 splunk splunk 130M Dec 13 13:40 splunkforwarder-9.4.0-6b4ebe426ca6-linux-amd64.tgz

-rw-r–r– 1 splunk splunk 8.7K Feb 3 12:34 splunkforwarder-9.4.0-6b4ebe426ca6-linux-amd64.tgz.sig

Note that I have both the .tgz UF installer and the corresponding signature file.

You can also copy future versions of the splunk-upgrader app (which is named splunk-upgrader-100.tgz in the initial release of the app) into local/packages to handle future upgrades of the UF upgrader on your remote endpoints. Since this is the first version of the app, I’ve not yet been able to test upgrades of the upgrader. If you do make any configuration changes to the upgrader package, you can also include those in the local/packages directory.

Finally, you’ll want to set up a serverclass for distributing the UF upgrader to your Linux endpoints. This is where the machineTypesFilter in serverclass.conf can come in handy, as you want to limit this upgrader to Linux systems only. You’ll also probably want to make this a dedicated serverclass, so that you can better control what systems get upgraded and when. In my lab environment, however, I’m just going to push this to all the Linux systems like this:

[serverClass:all_linux]

machineTypesFilter = linux*

whitelist.0 = *

[serverClass:all_linux:app:splunk_app_uf_remote_upgrade_linux]

restartSplunkWeb = 0

restartSplunkd = 1

I’ve put together a quick video to show you how the app looks when configured on the deployment server:

Once you reload the deployment server, all of your UFs in this serverclass will end up with the splunk_app_uf_remote_upgrade_linux app deployed to etc/apps and we’ll be ready for the next step!

Installing the Remote UF UpgraderWhile you will need to install the UF upgrader on each system, you can still use the Deployment Server to distribute the installer to all of your Linux UFs. With the default app packaging in version 1.0.0 of the app, you’ll find the installer at splunk_app_uf_remote_upgrade_linux/default/packages/splunk-upgrader-100.tgz.

As a user with administrative privileges, we can untar this to a directory such as /opt:

root@tk-demo-uf-upgrade-uf2:/opt# tar -zxvf /opt/splunkforwarder/etc/apps/splunk_app_uf_remote_upgrade_linux/default/packages/splunk-upgrader-100.tgz

splunkupgrader/

splunkupgrader/history/

splunkupgrader/history/README

splunkupgrader/bin/

splunkupgrader/bin/permission.sh

splunkupgrader/bin/logging.sh

splunkupgrader/bin/monitor.sh

splunkupgrader/bin/pkg_validation_util.sh

splunkupgrader/bin/install.sh

splunkupgrader/bin/upgrade_rpm.sh

splunkupgrader/bin/upgrade.sh

splunkupgrader/bin/preflight_constants.sh

splunkupgrader/bin/upgrade_deb.sh

splunkupgrader/bin/splunk_util.sh

splunkupgrader/bin/constants.sh

splunkupgrader/bin/util.sh

splunkupgrader/bin/uninstall.sh

splunkupgrader/bin/self_upgrade.sh

splunkupgrader/bin/upgrade_tgz.sh

splunkupgrader/bin/validate_version.sh

splunkupgrader/bin/init_config.sh

splunkupgrader/bin/splunk_updater_launcher.sh

splunkupgrader/bin/history.sh

splunkupgrader/bin/process.sh

splunkupgrader/bin/install_sudo_prereqs.sh

splunkupgrader/bin/report.sh

splunkupgrader/config/

splunkupgrader/config/default_config

splunkupgrader/resource/

splunkupgrader/resource/Splunk_Root_CA.cer

splunkupgrader/resource/SplunkPGPKey.pub

splunkupgrader/resource/splunk-upgrader.service

splunkupgrader/resource/eula.txt

splunkupgrader/log/

splunkupgrader/log/.keep

splunkupgrader/VERSION

Next, run the installer for the UF upgrader! I’m going to use the flag to have it create the default user for this example. You’ll see the installer step through the installation process, and then start the splunk-upgrader.service via systemd:

root@tk-demo-uf-upgrade-uf2:/opt# /opt/splunkupgrader/bin/install.sh –accept-license –create-user

2025-02-04-12:35:04 ### Running pre-install checks ###

2025-02-04-12:35:04 Checking if Splunk updater is already running

Unit splunk-upgrader.service could not be found.

2025-02-04-12:35:05 Checking if the current user can run all required commands with sudo

2025-02-04-12:35:05 Verified that the current user can run all base required commands with sudo

2025-02-04-12:35:05 ### Checking user ###

2025-02-04-12:35:05 Checking if user “splunkupgrader” exists

2025-02-04-12:35:05 Creating new user with configured name (splunkupgrader)

2025-02-04-12:35:05 Creating group splunkupgrader

id: ‘splunkupgrader’: no such user

2025-02-04-12:35:05 Creating user splunkupgrader

2025-02-04-12:35:05 ### Discovering SPLUNK_HOME ###

2025-02-04-12:35:12 Adding new SPLUNK_HOME=/opt/splunkforwarder

SPLUNK_HOME=/opt/splunkforwarder

2025-02-04-12:35:12 Successfully set SPLUNK_HOME to the given location: /opt/splunkforwarder

2025-02-04-12:35:12 ### Ensure location not under SPLUNK_HOME ###

2025-02-04-12:35:12 Check if current location is under SPLUNK_HOME.

2025-02-04-12:35:12 ### Verifying that the required package-type dependent binaries are present ###

/opt/splunkupgrader/bin/splunk_util.sh: line 354: rpm: command not found

dpkg-query: package ‘splunkforwarder’ is not installed

Use dpkg –contents (= dpkg-deb –contents) to list archive files contents.

2025-02-04-12:35:13 Checking for any required binaries for package type “tgz”

2025-02-04-12:35:13 ### Adding permissions for the new SPLK_USER ###

2025-02-04-12:35:13 ### Validating user permissions ###

2025-02-04-12:35:13 Checking in advance if the current user has permissions to verify the target user “splunkupgrader”‘s sudo permissions

2025-02-04-12:35:13 Verified that the current user can run all required verification commands for target user “splunkupgrader” with sudo

2025-02-04-12:35:13 Checking if the given user “splunkupgrader” can run all required commands with passwordless sudo

2025-02-04-12:35:14 Verified that the given user “splunkupgrader” can run all required commands with passwordless sudo

2025-02-04-12:35:14 ### Beginning install ###

2025-02-04-12:35:14 Updating splunk-upgrader.service unit file to run as the configured user (splunkupgrader) + group (splunkupgrader)

2025-02-04-12:35:15 Setting file and directory permissions in SPLUNK_UPDATER_HOME (/opt/splunkupgrader/bin/../) to the configured user (splunkupgrader) + group (splunkupgrader)

2025-02-04-12:35:15 Enabling and starting Splunk updater service “splunk-upgrader”

Created symlink /etc/systemd/system/multi-user.target.wants/splunk-upgrader.service → /etc/systemd/system/splunk-upgrader.service.

• splunk-upgrader.service – Splunk Upgrader daemon that monitors for new UF packages to upgrade to

Loaded: loaded (/etc/systemd/system/splunk-upgrader.service; enabled; vendor preset: enabled)

Active: active (running) since Tue 2025-02-04 12:35:15 EST; 37ms ago

Main PID: 2695 (splunk_updater_)

Tasks: 2 (limit: 2308)

Memory: 664.0K

CPU: 27ms

CGroup: /system.slice/splunk-upgrader.service

└─2695 /bin/bash /opt/splunkupgrader/bin/splunk_updater_launcher.sh

Feb 04 12:35:15 tk-demo-uf-upgrade-uf2 systemd[1]: Started Splunk Upgrader daemon that monitors for n…e to.

Hint: Some lines were ellipsized, use -l to show in full.

2025-02-04-12:35:15 ### Finished installing ###

2025-02-04-12:35:15 Appending the current Splunk Updater installation log from /opt/splunkupgrader/bin/..//log/install.log to /opt/splunkforwarder/var/log/splunk/splunk-upgrade-install.log

You’ll also see that a new directory named SPLUNK_UPDATER_MONITORED_DIR is created in /tmp by the installer:

root@tk-demo-uf-upgrade-uf2:~# ls /tmp | grep -i splunk

SPLUNK_UPDATER_MONITORED_DIR

At this point, if you already have the UF package in place in the app being pushed from the deployment server, you’ll see your UF get upgraded automatically. Logs for the upgrade are stored in $SPLUNK_HOME/var/log/splunk, and include splunk-upgrade-install.log (logs for installing the splunkupgrader app), upgrader_package_delivery.log (logs for the delivery of the UF installation package), and splunk-upgrade.log (for the Splunk upgrade itself).

A successful upgrade will look like this in the upgrader_package_delivery.log:

2025-02-04-12:36:16 Checking if any forwarder packages are available

2025-02-04-12:36:16 Found files in /opt/splunkforwarder/etc/apps/splunk_app_uf_remote_upgrade_linux/bin/../local/packages. Will deliver them.

2025-02-04-12:36:16 Copying files from /opt/splunkforwarder/etc/apps/splunk_app_uf_remote_upgrade_linux/bin/../local/packages to /tmp/SPLUNK_UPDATER_MONITORED_DIR

2025-02-04-12:36:16 Running cmd: cp -r “/opt/splunkforwarder/etc/apps/splunk_app_uf_remote_upgrade_linux/bin/../local/packages/.” “/tmp/SPLUNK_UPDATER_MONITORED_DIR”

2025-02-04-12:36:17 Creating a trigger file to start upgrade: /tmp/SPLUNK_UPDATER_MONITORED_DIR/start_uf_upgrade

2025-02-04-12:36:17 Running cmd: touch “/tmp/SPLUNK_UPDATER_MONITORED_DIR/start_uf_upgrade”

2025-02-04-12:36:17 Completed the package delivery. Creating a file to make sure it only happens once.

2025-02-04-12:36:17 Running cmd: touch “/opt/splunkforwarder/etc/apps/splunk_app_uf_remote_upgrade_linux/bin/pkg_delivered”

2025-02-04-12:36:17 Completed!

When the upgrade is complete, you’ll see that the UF now reflects the upgraded version:

root@tk-demo-uf-upgrade-uf2:~# /opt/splunkforwarder/bin/splunk version

Warning: Attempting to revert the SPLUNK_HOME ownership

Warning: Executing “chown -R root:root /opt/splunkforwarder”

Couldn’t change ownership for /opt/splunkforwarder/lib: No such file or directory

Splunk Universal Forwarder 9.4.0 (build 6b4ebe426ca6)

You’ll also see the new version of the UF reflected in the Forwarder Management UI on your Deployment Server (if you’re running an updated version of Splunk Enterprise on your DS, as it looks better now in 9.4!)

Want to see the whole process at once? This video will show you how:

Wrap upAnd that’s it – you’ve now successfully set up your environment so that you can deploy UF version upgrades on your Linux hosts from your Deployment Server. Splunk says that there’s a Windows version of this that they’re working on as well, so I’ll be sure to test that out when it becomes available too.

—–

Troubleshooting information:While getting this set up, I ran into a couple issues, some of which likely were just the result of me doing something wrong. However, I wanted to pass that information along in case it helps you later.

Don’t run from $SPLUNK_HOMESince this app is designed to upgrade the Splunk Universal Forwarder, you can’t deploy the app inside the Splunk UF’s installation directory. If you try to do that, you’ll see this error when attempting to run the install script:

2025-02-03-15:47:55 ### Discovering SPLUNK_HOME ###

2025-02-03-15:48:03 Adding new SPLUNK_HOME=/opt/splunkforwarder

SPLUNK_HOME=/opt/splunkforwarder

2025-02-03-15:48:03 Successfully set SPLUNK_HOME to the given location: /opt/splunkforwarder

2025-02-03-15:48:03 ### Ensure location not under SPLUNK_HOME ###

2025-02-03-15:48:03 Check if current location is under SPLUNK_HOME.

2025-02-03-15:48:03 This location is under SPLUNK_HOME, abort installation is required to prevent permission issues.

Permissions/ownership issues This seems to happen if the installation is interrupted by another check failing, and you need to run the script to install a second time. In this case, the splunkupgrader user didn’t have complete ownership of everything in the application directory, and threw the following error:

2025-02-03-15:55:18 ### Beginning install ###

2025-02-03-15:55:18 Updater user “splunkupgrader” does not have execute permissions for SPLUNK_UPDATER_HOME=”/opt/splunkupgrader/bin/../”, aborting

I was able to fix this with the following command:

chown -R splunkupgrader: /opt/splunkupgrader

The post Upgrading Splunk Universal Forwarders from the Deployment Server appeared first on Hurricane Labs.

View Details

IntroductionIn this Developer Spotlight, we feature Cameron Schmidt, a Splunk app developer at Hurricane Labs. With over a decade of experience, he has helped enhance Splunk’s functionality with over dozens of Splunk apps — many of which are featured on Splunkbase. Join us as we explore his journey and impact.

From Curiosity to Code: A Developer’s JourneyCameron’s journey into software development began 13 years ago, fueled by his passion for problem-solving and data-driven solutions. For the past nine years, he has been a key contributor at Hurricane Labs, where he has developed numerous Splunk apps, including the Better Webhooks app and the Hurricane Labs Content+ app.

“I enjoy solving complex problems, optimizing workflows, and building applications that make data more accessible and actionable,” Cameron shares. His work focuses on creating new integrations and enhancing existing tools to improve the user experience for Splunk developers and administrators.

Getting Started with Splunk: The First StepsCameron was first introduced to Splunk as a college intern working in his university’s Security Department. “At the time, our team had just started using Splunk for threat detection, but there was a steep learning curve. No one had deep expertise yet, which gave me the opportunity to dive in and learn it from the ground up.”

As he became more familiar with Splunk, Cameron saw the need for additional tools to expand its capabilities. “We quickly realized that while Splunk was powerful, some of our needs went beyond its default features. That’s when I started developing custom Splunk apps to fill the gaps.”

This hands-on experience set the foundation for his career. After college, he joined Hurricane Labs as a Splunk app developer, where he has spent years building custom solutions for organizations looking to maximize their Splunk investments.

Creating Custom Splunk Solutions

Throughout his career, Cameron has developed apps for a wide range of organizations, from small startups to large enterprises. “Every business has unique needs. While Splunk is an incredible platform, sometimes the built-in tools don’t quite get users where they need to be. That’s where custom development comes in.”

With extensive experience developing Splunk applications, Cameron has built dozens of apps tailored to security monitoring, performance optimization, and specialized integrations. “I love the challenge of extending Splunk’s capabilities to meet new demands. There’s always a way to push the limits of what’s possible with the right tools and a bit of creativity.”

The Better Webhooks AppOne of Cameron’s notable contributions is the Better Webhooks app, which enhances Splunk’s webhook functionality. “Splunk has a built-in webhook feature that triggers HTTP requests when alerts occur, but it’s fairly limited and lacks flexibility,” he explains.

Seeing an opportunity to improve the integration experience, Cameron built the Better Webhooks app. “Think of it as upgrading a basic wrench to an adjustable one. This app expands integration possibilities, adds advanced features, and improves security—something that’s crucial for many businesses.”

At Hurricane Labs, for example, the team relies on Webex for communication, but Splunk’s default webhook security was insufficient. “This app not only increases functionality but also ensures safer integrations, which was a major improvement for us.”

Go-To Developer Resources

When it comes to building Splunk apps, Cameron has a few go-to resources. “I visit the Splunk Developer Portal frequently—it’s full of valuable documentation that I highly recommend. Splunk Lantern is also a great place to find well-written, in-depth articles.”

He’s also an active participant in the Splunk Community Slack group. “It’s a volunteer-driven space, but I’ve found it incredibly helpful when tackling tricky development challenges. The community is always willing to share knowledge.”

Pro Tips from CameronFor those new to Splunk app development, Cameron emphasizes the platform’s flexibility. “With many tools, you’re often constrained by what an app or integration allows you to do. That hasn’t been my experience with Splunk—its openness is one of the reasons I love building apps for it.”

He encourages new developers to experiment and push boundaries. “I hope other app developers discover the same sense of freedom and creativity that I’ve found in Splunk development. There’s always room to innovate.”

A Spicy Hobby: Growing PeppersOutside of development, Cameron has a unique hobby—growing peppers. “It started as a COVID project, but I’ve really come to love it. I built a small raised garden in my backyard, where I grow all sorts of hot pepper varieties. Every fall, I turn them into hot sauce and give them away.” “Some of them can be extremely hot, so I always make sure people are prepared! But not all of them are super spicy—there’s a good mix.”

ConclusionCameron Schmidt’s passion for development and problem-solving drives his impact in the Splunk community. His commitment to creating innovative tools and empowering organizations with data serves as an inspiration for aspiring developers. Stay tuned for more inspiring stories in our Developer Spotlight series! Want to be our next Developer Spotlight? Let us know by filling out this form!

The post Developer Spotlight of Splunk: Cameron Schmidt appeared first on Hurricane Labs.

View Details

Tom Sheehan (Hurricane Labs Director of Cybersecurity Consulting and Compliance) attended the inaugural Horizon3 Global Partner summit earlier this month. This event brought together the brightest minds and boldest innovators in cybersecurity for a day of education, collaboration, and vision. Held in Frisco Texas, the event spotlighted Horizon3.ai’s evolving impact on security, showcasing a community committed to disrupting the status quo and redefining what’s possible in offensive cybersecurity.

Welcome & Vision

Kicking off with a powerful message of Celebrate. Collaborate. Educate., the morning set the tone for a future-forward agenda. Horizon3.ai reinforced its core commitment to partner-first principles: enable and empower, invest in community, and build trust by example.

Evolving the Security Landscape

A central theme of the day was the Journey to Autonomous Security—a transformation from traditional reactive methods to proactive, offense-informed defense strategies. Key innovations like NodeZero, Horizon3’s autonomous pentesting platform, were positioned as catalysts in this shift.

Participants saw firsthand how Horizon3.ai:

1. Empowers IT and security teams to Find, Fix, and Verify vulnerabilities at scale
2. Uses real-time, AI powered multi-stage attacks that chain together exploits, exposed services, and misconfigurations. and detect exploits including misconfigurations.
3. Incorporates adversary behavior modeling, honeytokens, and red-team-like capabilities to enhance detection and response

Product Evolution

The NodeZero product evolution unveiled features to simplify remediation, improve MTTR (Mean Time to Remediation), and align security metrics with board-level outcomes.

These capabilities include:

1. Intuitive remediation workflows
2. Enhanced tripwire deployment for precision threat detection
3. Executive-ready insights for demonstrating ROI
4. N-day rapid response attacks
5. NodeZero Insights – organization-wide visibility into your security posture

From War Room to Board Room

The presentations emphasized how offense drives defense and how integrating pentesting into regular workflows can radically improve visibility and readiness. Organizations using NodeZero move from annual/bi-annual testing to weekly+ assessments, dramatically reducing risk exposure.

Data points we found interesting included:

1. 81x faster and 65% cheaper than traditional consulting engagements

2. DOGE approves the NSA utilizing NodeZero in the DOD as it’s saving hundreds of thousands of man hours and resources

3. Seamless hybrid cloud testing across SaaS, on-prem, and cloud infrastructure

4. Real-world case studies illustrating measurable outcomes in threat detection, risk reduction, and executive reporting

5. Massive issue with misconfiguration of EDR tools across 60,000 pentestsRecognizing ExcellenceThe day closed by celebrating standout partners across the globe, honoring those who exemplified innovation, impact, and growth.Hurricane Labs and Horizon3At Hurricane Labs, our Autonomous Penetration Testing Service leverages the power of Horizon3’s cutting-edge platform to deliver more than just traditional penetration testing. For our Splunk customers, we’re able to take it a step further by focusing on use case validation—ensuring your security controls are not only robust but also tailored to your unique environment. Our service provides actionable insights to strengthen your defenses and enhance threat detection.

   Key Benefits of our Nimbus H3 Service:

   • Pinpoint vulnerabilities and actual threat vectors in your environment

   • Test your existing security tools

   • Develop and validate use cases for precise threat detection

   • Ensure proper logging for comprehensive visibility

   • Strengthen your security posture with tailored, actionable insights

   • Support compliance with regulations like PCI DSS, HIPAA, and GDPR

   • Expert guidance from Hurricane Labs’ subject matter experts

     The post Driving the Future of Cybersecurity: Highlights from the Horizon3 Global Partner Summit appeared first on Hurricane Labs.

View Details

In a major step to expand its cybersecurity and data analytics capabilities, Cisco Systems has acquired Splunk Inc. in a $28 billion all-cash deal. Finalized on March 18, 2024, this marks the largest acquisition in Cisco’s history, highlighting its ongoing shift towards software and services.

Why Cisco Bought SplunkCisco, long known for its hardware, has been steadily pivoting towards software-driven solutions and recurring revenue models. Bringing Splunk into the fold strengthens this transition, as Splunk’s powerful data analytics and security platforms complement Cisco’s expanding software portfolio. With Splunk’s expertise in analyzing machine-generated data, Cisco gains advanced tools to tackle growing cybersecurity and data management challenges.

Since its founding in 2003, Splunk has become a key player in data analytics, helping businesses turn raw machine data into actionable insights. Its platforms are widely used for IT operations, security, and business intelligence. Partnering with Cisco allows Splunk to tap into a vast global network, accelerating innovation and delivering greater value to customers.

Leadership and IntegrationFollowing the acquisition, Splunk continues to operate with its existing management structure, retaining its brand identity within Cisco. In May 2024, Splunk’s CEO, Gary Steele, stepped into a senior executive role at Cisco while maintaining oversight of Splunk as general manager. This continuity aims to preserve Splunk’s innovative approach and maintain strong customer relationships while integrating more closely with Cisco’s broader operations.

As part of this strategic shift, Cisco merged its observability product development—including AppDynamics—into Splunk’s unit. This consolidation is designed to create a unified platform for monitoring and analytics, giving customers deeper visibility into their IT systems and improving operational performance.

Market Impact and Customer BenefitsThis acquisition has far-reaching implications for the cybersecurity and data analytics industries. By merging Cisco’s networking expertise with Splunk’s data analytics capabilities, the combined entity is positioned to deliver integrated solutions that address complex security threats and IT challenges. Customers can expect more comprehensive tools to manage their digital infrastructure effectively.

For Splunk’s existing users, the acquisition signals continued product support and innovation. Cisco has stated that Splunk’s pricing will remain unchanged, providing stability for current customers. Additionally, with Cisco’s resources backing Splunk, product development is expected to accelerate, bringing new features and enhancements to market more quickly.

Financial Moves and Legal WinsAhead of the acquisition, Splunk took steps to streamline operations. In November 2023, it announced a workforce reduction of about 7%, impacting roughly 500 employees. This restructuring was aimed at improving efficiency and was not directly tied to Cisco’s acquisition.

On the legal front, Splunk secured a key victory in April 2024, winning an intellectual property case against startup competitor Cribl, Inc. The jury awarded Splunk nominal damages, reinforcing its commitment to defending its technology and market position.

What’s on The Horizon? | Hurricane Labs Managed Splunk CybersecurityThe Cisco-Splunk merger aligns with the growing demand for advanced cybersecurity and data-driven decision-making. As businesses increasingly focus on protecting digital assets and optimizing IT environments with managed cybersecurity services, the combined expertise of Cisco and Splunk is expected to drive innovation in security and analytics solutions.

Beyond strengthening Cisco’s competitive position, this acquisition lays the groundwork for future advancements in integrated cybersecurity and data intelligence. Industry watchers and customers alike will be keeping a close eye on the impact of this deal, anticipating the transformative changes it could bring to the tech landscape.

The post Cisco Acquired Splunk: What Changes? appeared first on Hurricane Labs.

View Details

The digital world is transforming at an unprecedented pace. Generative AI introduces groundbreaking opportunities for innovation—alongside serious cybersecurity challenges. While embedding AI across business operations increases efficiency, it also exposes systems to new forms of risk. To stay resilient and secure, organizations need to tailor their cybersecurity strategies to these evolving technologies.

Why Generative AI—Why Now?The simple answer is this: the productivity gains are game-changing. In the past, implementing new tools could take years and bring only marginal benefits—often less than a 5% boost. Generative AI is different. It’s inexpensive (sometimes even free), easy to adopt, and in many cases can deliver productivity increases of 15% or more. This technology is now a key differentiator in the marketplace, making it a critical part of strategic growth. As with any innovation, security and compliance must be part of the conversation.

Getting a Grip on AI BasicsBefore building any security framework, businesses need to understand how generative AI works. Key concepts include:

• Data Sets: These train the large language models (LLMs). The quality and trustworthiness of the data are vital. Businesses should avoid using sensitive information—such as Protected Health Information (PHI) or Personally Identifiable Information (PII)—in training data.
• Prompt Engineering: This is the art of writing clear, targeted inputs to generate accurate and relevant outputs. A vague prompt about “bears” will yield different results than a specific request for a scientific article on bear behavior.
• Temperature: This setting affects the randomness of responses. A lower temperature leads to more consistent answers, while a higher one creates more varied (and sometimes unreliable) outputs, often referred to as “hallucinations.”

Knowledge and training are foundational steps before diving into AI-related security planning.

Building an AI Security ApproachOnce the fundamentals are clear, organizations can begin defining appropriate protections. Policy development is now a must. Not long ago, many companies considered banning AI use altogether. But as productivity benefits became clear—and as employees adopted AI informally—many shifted focus. Today, formal AI usage policies are common, and internal committees are often formed to guide responsible use.

Key focus areas include:

• Acceptable Use: Outlining how AI tools should be used in line with company values and standards. This includes quality checks and clearly defined limits on inappropriate use.
• Ethical Boundaries: Preventing misuse of AI for biased, unsafe, or discriminatory practices. This includes restricting the creation of content that infringes on intellectual property or violates ethical norms.
• Security Awareness: Training staff to avoid entering confidential data—like PII or trade secrets—into public AI systems. Adopt a “trust after verification” mindset.

With the right policies, companies can foster a transparent, risk-aware environment that encourages smart AI adoption.

Strengthening Technical SafeguardsFrom a technical perspective, the most powerful defenses remain Multi-Factor Authentication (MFA) and active monitoring. As deepfake technology becomes more accessible, confirming someone’s identity through a shared phrase or known cue can help verify legitimacy.

In addition, AI systems should be monitored frequently for patterns of use, output quality, and how closely results align with expectations. By collecting meaningful data—like frequently used prompts or the cleanliness of input data—organizations gain a clearer picture of how their AI tools are performing.

Core Elements of an AI PolicyA well-rounded AI policy should address:

• 1. Approved vs. restricted data, use cases, and tools
• 2. When and how to seek support or guidance
• 3. Transparency requirements around AI-generated content
• 4. Procedures for vetting and approving new AI tools
• 5. Ethical guidelines
• 6. Oversight mechanisms, such as regular usage audits

Compliance Requirements and AIFinally, AI use must align with relevant regulations. Here are a few key frameworks to keep in mind:

• GDPR (General Data Protection Regulation): Companies working with data from EU citizens need to make sure AI systems handle personal data responsibly. Individuals must also be given the option to have their data deleted from AI models.
• HIPAA (Health Insurance Portability and Accountability Act): In healthcare, AI tools must protect sensitive health data and prevent any potential misuse or exposure of PHI.
• EU AI Act: This regulation requires businesses operating in or with the EU to assess AI systems based on their level of risk and follow more stringent rules for high-risk applications.
• U.S. Frameworks: While there’s no overarching federal law governing AI in the U.S. just yet, organizations can look to the NIST AI Risk Management Framework and ISO/IEC 42001 for guidance. These standards help companies adopt responsible practices and prepare for future regulation.

Hurricane Labs | Managed Cybersecurity Services* At Hurricane Labs, we specialize in providing top-tier managed cybersecurity services with a strong focus on Splunk. Since 2003, our team of experts has been helping organizations strengthen their security postures through 24/7 Security Operations Center (SOC) management, Splunk Enterprise Security support, penetration testing, and consulting services. As official partners of both Splunk and CrowdStrike, we deliver tailored solutions that align with our clients’ unique needs and environments. Our mission is to work closely with every organization we serve, delivering customized, proactive strategies to stay ahead of evolving cyber threats. The post A Modern Approach to Generative Technology and Compliance appeared first on Hurricane Labs.

View Details

The New Challenger in AIFor years, the artificial intelligence world has been controlled by a few dominant players, but a fresh contender has entered the scene, disrupting the status quo. DeepSeek, a relatively obscure Chinese AI startup, has made an astonishing entrance onto the global stage. Practically unknown outside of tight industry circles, the company has rapidly become a major force, challenging the supremacy of giants like OpenAI. What’s even more remarkable is that DeepSeek has done this at a fraction of the cost traditionally associated with AI development.

The implications of this shake-up are staggering. DeepSeek’s rise triggered a dramatic financial reaction, culminating in an unprecedented $593 billion drop in Nvidia’s market value. But this isn’t just about one company’s stock price—it’s a sign that the entire AI industry is shifting. DeepSeek’s emergence calls into question many long-held beliefs about AI development, forcing industry leaders to rethink their strategies and investors to reassess their expectations.

The Secret Behind DeepSeek’s SuccessAt the core of DeepSeek’s impact is its ability to build high-performing AI models while keeping costs surprisingly low. In contrast to the dominant AI companies that funnel billions into research, development, and computational resources, DeepSeek has found a way to do more with less. The startup’s approach focuses on streamlining hardware use, adopting innovative training techniques, and making strategic optimizations in data processing.

While established AI firms lean heavily on vast computational resources, DeepSeek has prioritized architectural efficiency, making it possible to achieve results that rival, and in some cases even surpass, the industry’s most advanced models. By doing so, they have proven that AI innovation does not require exorbitant spending. This realization sent shockwaves through the tech industry, prompting major players to reconsider their financial and technological approaches.

How DeepSeek Crushed Nvidia’s Market ValueThe impact of DeepSeek’s advancements has been particularly devastating for Nvidia, the undisputed leader in AI hardware. Nvidia’s dominance has long been built on the expectation that AI companies would continue to require massive amounts of high-powered GPUs for training and deploying advanced models. But DeepSeek’s breakthrough changed that assumption overnight.

With a more cost-effective AI development process, DeepSeek has demonstrated that cutting-edge AI can be built with fewer high-end chips. The moment investors grasped the significance of this, panic spread through the market. Nvidia’s stock took a historic plunge, shedding nearly $600 billion in value.

This was not just a knee-jerk reaction from skittish investors—it was a recognition of a fundamental shift in the AI industry. If more companies adopt DeepSeek’s resource-efficient methods, the demand for Nvidia’s expensive GPUs could diminish over time, forcing the company to rethink its own future in AI.

A New AI Arms Race Between China and the U.S.DeepSeek’s rapid ascent has intensified competition between the United States and China in AI innovation. For years, American firms such as OpenAI, Google DeepMind, and Anthropic have been considered the undisputed leaders in artificial intelligence. However, DeepSeek’s achievements challenge that perception, proving that China is not only catching up but is now a formidable competitor.

Beyond the economic and corporate impacts, DeepSeek’s success has also raised geopolitical concerns. Governments around the world are paying close attention, as policymakers and industry leaders analyze the implications of China’s rising influence in AI. This newfound competitiveness could lead to shifts in national security policies, intellectual property debates, and global economic strategies.

If DeepSeek’s approach becomes widely adopted, the balance of power in AI development may change in ways that were previously unthinkable. The company has not only introduced a new way to build AI but has also sparked an international race to develop more cost-effective solutions.

The Response from Western AI GiantsDeepSeek’s disruption has not gone unnoticed by the major Western AI firms. Many are now accelerating their research efforts in an attempt to stay ahead. Some companies are investigating new chip architectures and alternative AI training methods that could reduce dependency on costly GPUs. Others are pushing for regulatory changes that might help them maintain an edge in this increasingly competitive environment.

Additionally, collaborations between AI firms and semiconductor manufacturers are becoming more common, as the industry looks for ways to boost efficiency without relying entirely on Nvidia’s high-end chips. Analysts predict that we are on the brink of a major shift in AI research, with an increased focus on optimization and cost-effective development.

The Wake-Up Call for AI Industry LeadersDeepSeek’s rise is forcing major AI companies to reevaluate long-standing assumptions about artificial intelligence development. Up until now, the prevailing belief was that bigger budgets equaled better AI. But DeepSeek has shown that innovation and efficiency can sometimes outweigh sheer financial power.

Now, companies that have spent billions on high-budget AI projects must rethink their approaches. The realization that cutting-edge AI can be built without excessive spending is bound to trigger a reassessment of research priorities, training methodologies, and overall business strategies.

Beyond corporate boardrooms, this shift is also influencing the investment world. Venture capitalists who previously funneled money into high-cost AI projects are beginning to reconsider their funding strategies. This could create new opportunities for smaller startups with disruptive ideas, making the AI ecosystem more diverse than ever before.

The Future of AI in the Post-DeepSeek EraDeepSeek’s rise signals the start of a new era in artificial intelligence. By proving that high-performance AI is not limited to companies with billion-dollar budgets, the startup has opened the door for a new wave of competition.

As more companies and research institutions explore DeepSeek’s methodologies, the AI industry may experience a transformation in how models are trained and deployed. Efficiency could become a driving factor in AI development, shifting the focus away from brute-force computational power. This could level the playing field, allowing smaller startups to compete with established tech giants.

At the same time, regulatory bodies may need to adjust their policies to reflect this new reality. If AI development becomes more cost-efficient and widely accessible, governments will need to address issues related to intellectual property, security, and ethical AI deployment.

A New Chapter in AI HistoryDeepSeek has done more than disrupt the AI industry—it has rewritten the rules. Whether this shift will ultimately strengthen or weaken existing AI powerhouses depends on how they respond to the challenge. What is certain, however, is that the global AI landscape will never be the same.

Moving forward, we can expect to see the emergence of AI frameworks that prioritize efficiency over sheer scale. This could democratize AI innovation, making it possible for more companies to enter the space and compete on a more even footing.

The next few years will determine whether DeepSeek’s breakthrough is a temporary shake-up or the beginning of a long-term transformation. Either way, one thing is clear: the future of artificial intelligence has been irreversibly changed.

Hurricane Labs | Managed Cybersecurity and NewsAt Hurricane Labs, our mission is to deliver managed network security services that empower our clients to achieve success with confidence. As a leading provider of managed cybersecurity solutions, we take pride in being North America’s top Splunk-powered MSSP SOC team. Trusted by high-level organizations, we offer expert guidance and comprehensive Splunk Managed Services to strengthen their security posture.

The post DeepSeek: The Chinese AI Startup That Shook the Tech World appeared first on Hurricane Labs.

View Details

One thing not often thought of is the lowly crash test dummy. Traditionally, crash test dummies were modeled after male bodies leading to vehicle safety standards and designs being disproportionately geared towards protecting male passengers. As a result, studies found that women and children suffered more significant injuries more frequently in car crashes.

Similarly, our security standards and programs have struggled to keep pace with the threats of today leading to bias in what gets protected and how. Traditional security testing and assessment methods are not enough for modern stakeholders who require real-time assurance that data and business processes are protected from evolving threats. In today’s threatscape, breaches are not a matter of “if”, but “when”.

Many compliance requirements mandate annual, biannual, or quarterly penetration tests. These penetration tests often focus on standard attack scenarios. Other common compliance requirements include independent audits, assurance assessments, and risk-based corrective action plans. The problem is these assessments struggle to keep pace with how quickly attacks and your own environment change.

Forward-thinking organizations have turned to regular tabletop exercises to test their Incident Response and crisis response readiness. These exercises build muscle memory for your teams so that they know who to contact and what to do during common breach scenarios. Regularly practicing these scenarios helps everyone stay calm during a real event – and we all know calm minds make better decisions.

Having a Continuous Threat Exposure Management (CTEM) program is another way to address these limitations. A CTEM program should be directed to find and fix whatever most threatens your business. There are technologies you could leverage in this program to provide ongoing, data-driven validation of an organization’s security posture. This is crucial to have an attacker’s viewpoint of the organization’s changing environment. Using this approach allows organizations to proactively address gaps before a malicious actor exploits them.

CTEM, Breach Attack Simulation (BAS) and Security Validation tools typically include a few common components:Assessment ScopeScoping hybrid, cloud, and multi-cloud environments presents a challenge for traditional testing methods. Additionally, a penetration test may only touch on a quarter of MITRE tactics/techniques during a test. Newer tools dynamically adjust the scope based on systems they can see, testing across the frameworks (MITRE, Kill Chain, etc.) for a more holistic evaluation.

AutomationAnother similarity is they have some level of automation. This reduces the need for human intervention and frees up your team to focus on critical issues. An added benefit is the ease of retesting once remediations have been completed. Automated attack methods ensure consistency in retesting and save time.

Assess your Security ControlsOrganizations deploy numerous security controls as part of their defense-in-depth strategy. Utilizing a validation tool will allow you to verify that controls are functioning as intended. You can proactively fix discovered misconfigurations and enhance detections to account for gaps. Retesting after improvements will provide data demonstrating risk reduction.

Actionable MitigationTeams often struggle to provide meaningful remediation guidance following an assessment. It is crucial to understand the contextual risk of each finding to prioritize remediation. Low-risk vulnerabilities are often the last to get addressed, but what if that low vulnerability was the first exploit on the attack path that allowed for the attacker to compromise a database containing sensitive data? Such vulnerabilities should be scored as a higher risk based on the impact. The data gathered from regular testing helps determine which risks are most critical.

Test Emerging ThreatsNew attacks should be regularly tested in your environment to evaluate your organization’s controls against modern techniques. An example use case here is running a zero-day test to assess its impact in your environment. You can then provide your patching team with a list of servers where exploitation of that zero-day lead to the greatest impacts. This prioritization will ensure you respond more effectively and efficiently to zero-day vulnerabilities. Your blue team will also gain valuable context for that threat in your environment to quickly craft detections and mitigations.

Continuously identifying threats while refining your response and remediation will move your program beyond antiquated assessment requirements.

If you are ready to elevate your security program from an outdated “crash test dummy” approach and address current threats with modern methods contact us at Sales@hurricanelabs.comThe post Modern Security Testing – Leveling up the Crash Test Dummy appeared first on Hurricane Labs.

View Details

It’s one thing to help support an organization with a mission that you feel strongly about. But seeing something that you feel strongly about growing from an idea into something that is making a massive impact across the Cybersecurity industry and the world is something that is difficult to put into words. But, I’m going to try.

Without further ado, this is my reflection on CPTC10 and a decade of the Collegiate Penetration Testing Competition.

The BeginningsLike many things in life, my involvement in CPTC was much a case of knowing the right people and being in the right place at the right time. In the spring of 2014, Professor Bill Stackpole at RIT reached out to me to be part of an industry panel to listen in on final presentations from student groups in one of his classes. From this class came the idea to expand this beyond the students at RIT, and invite other schools to participate. From there, and the support of Bob Kalka, CPTC was born.

For the first several years, the event was local to RIT, and mainly attracted students from schools within a driving distance from the campus. We had a handful of dedicated core volunteers who worked tirelessly to build an infrastructure to make the event happen, and ran into a ton of challenges associated with scaling infrastructure for this type of event. We expanded beyond the walls of RIT in 2017 with three regional events, and added an international event in Dubai in 2019. With these additions, we saw a massive growth in the number of teams that were able to participate, as well as the number of volunteers to make the event possible.

One of the challenges that I’ve always faced with my involvement in CPTC is how I fit in. Unlike many of the other volunteers, I didn’t come to the event with a ton of pentesting experience. But I wanted to do what I could in order to make the event the best it could be. And that’s really what has come to make CPTC special.

As our team built out CPTC, we wanted to make it as real-world as possible. Instead of making it a CTF-style event where teams looked for certain, specific flags, we went for a more realistic approach. This involves designing a company from the ground up – figuring out what their business will look like, what types of systems will exist in their network, how those systems will work together, and what employees will make up their team. We develop custom applications to replicate systems in the environment (often with consultation from industry representatives or other experts in a given field), and create character profiles for individual employees.

In preparing and participating in the competition, students are asked to complete tasks that are based on real, current events, or on our experience in the field. Just as an example – every team that participated in CPTC10 needed to fill out a vendor security assessment (VSA) as part of their registration process. The questions in the VSA we used were based on relevant areas of interest pulled from real security assessment questionnaires that myself and several other members of the CPTC team have seen in the field. We’ve also worked to add timely elements to the competition, including activities around interacting with (and escaping the security controls of) AI models and setting up vishing campaigns using AI. All of this helps make CPTC something truly special.

One of the most amazing parts of this year was to get rave reviews from other industry professionals who were seeing CPTC for the first time and impressed with its realism and educational value. Getting a chance to speak with Zach Hill from BHIS and see his enthusiasm for the event was something really special for me. That, along with seeing the students who participate in CPTC each year go into industry and share how CPTC helped them in their careers.

How Hurricane Labs fits inOne challenge I faced when first getting started in supporting CPTC was figuring out how Hurricane Labs would fit in. While we do offer pentesting services for a number of clients, it’s a relatively small part of our overall business. But fortunately, there still was a lot we could do to help support the event.

I’ve talked about this before, but CPTC has become one of my team’s favorite parts of every year. They not only get to use CPTC to practice and improve their professional skills, but use the event as an opportunity to help prepare future cybersecurity professionals to be better equipped for the real world. We do this by treating the CPTC environment like an actual Hurricane Labs managed security services customer.

Prior to each CPTC event, our team works with the application and infrastructure teams within CPTC to ensure we’re bringing the right data into Splunk, which is our tool of choice for alerting. When events are going on, there’s a team of analysts pouring over logs, dashboards, and threat hunting for potential rules violations that occur. This gives the student competitors the added realism of working in an environment with an actual SOC team.

If a team’s actions during their pentest cause an impact to the customer’s business, such as locking out a number of user accounts, they’ll have the opportunity to interact with the (potentially frustrated) customer and identify a way to resolve the issue. We call these interactions “educational opportunities”, as the goal here is to not penalize the team, but instead give them a chance to handle the issue in a professional way and get immediate feedback from our team on what they did well and what they could do to improve in the future.

My Participation this YearThis year, I had the opportunity to help support four different on-site CPTC events – the Great Lakes, Central, and Western regionals, and the Global Finals event. It’s long been my goal to make it to every CPTC regional at some point, and I was able to add two new ones to my list for this year!

Leading up to the eventsPrior to teams arriving on-site at a regional, there’s a ton of work to do. In addition to planning out the theme and infrastructure for the competition, there’s a lot of other parts to CPTC that need to get done. This includes coordinating any rule changes we wish to make for the upcoming season, preparing team registration and communication materials, answering team captain and coach questions, and doing our best to accommodate all the teams that want to participate at a regional event.

Since one of our main goals as organizers is to support education, we try to make every effort we can to ensure that every team that’s interested in participating has the chance to do so. With only a limited number of regional events and the challenges that come with obtaining travel funding for many schools, this often becomes a bit of a puzzle, where we’re working with different schools to identify the most cost effective regional event for them to attend.

We also try to prioritize accommodations for teams that are first time competitors as well as community colleges, so that both established and new teams have a chance to experience CPTC. Sometimes this can result in some weird placements (such as teams from Texas ending up in our New England or Western Regionals), but we’ve designed the event to offer a consistent experience across all regions and offer a wildcard scoring system to ensure that teams have a consistent chance to make it to Finals regardless of the regional where they participate.

In the end, we’ve consistently been filling all of the open spaces at all of our US-based regional events, with a small waitlist developing closer to registration. For teams that are interested in competing in CPTC in the future, our advice is to get your registration completed early once it opens to have the best chance of getting your first choice regional placement.

Great Lakes Regional, Baldwin Wallace UniversityThe Great Lakes Regional took place in October and was our first regional weekend of the CPTC10 season. This weekend had a couple challenges as it required us to handle the international events in Dubai and Jordan during the same timeframe as this US-based event, which gave us a good test of our infrastructure team’s ability to rapidly re-deply infrastructure with a very quick turnaround. This first weekend gives us a good stress test of all of the components of the event, and sometimes when this event is occurring we’ll identify improvements to be made to the event in real-time in order to help ensure a positive experience for the student teams.

One of the best parts of the Great Lakes Regional is its proximity to Hurricane Labs, and a lot of our teammates. We consistently have around 10 current and former members of the Hurricane Labs team (many of who are Baldwin Wallace alumni) on-site for this regional, which is an amazing resource for ensuring that the event runs smoothly and that we always have someone who can jump in and help with whatever needs to be done.

We’ve been fortunate enough to be able to host 3 different Great Lakes regional events at Baldwin Wallace, and they’ve not only been a great partner for CPTC but also for Hurricane Labs as well. I’d especially like to thank Dr. Kenneth Atchinson for all of his support of cybersecurity education and for helping make this event (and so many others like it) possible.

Central Regional, Tennessee Tech UniversityBeing a midwesterner, I decided that the most effective way to end up at Tennessee Tech was to drive. This is just a “short” 8 hour trip from Cleveland, but ended up having a cool CPTC connection. Along the way, we saw a sign for Buc-ee’s and decided to make a stop, since I’d never experienced one before.

While wandering around the massive expanse of beaver-themed snacks and souvenirs, someone approached me and asked if I was one of the guys who worked with CPTC. We chatted for a bit, and it turns out that I had run into an alum of CPTC from around the CPTC8 season. He mentioned that the lessons learned at CPTC really helped him when he was getting started in his career. That brief interaction alone started the trip on a high note, and really shows the impact that CPTC is having on the lives of young cybersecurity professionals.

Tennessee Tech has been a long-term regional partner for us and Travis and Jeremy do a great job putting the event together. We also got to be one of the first events held in their brand new Ashraf Islam Engineering Building, which was a lovely space to use for the teams. I’ve been looking forward to making the trek to the Central regional since Tennessee Tech started hosting back in 2019, and glad I finally had the chance to do so.

Western Regional, Stanford UniversityFor the last CPTC10 regional weekend I did something totally different – I decided to embrace the fact that airplanes exist and visit one of the events we have on the Pacific coast. Stanford University has been a long-time regional partner and has hosted the Western regional since we’ve had a Western regional. It was great to finally get a chance to visit their campus for the regional event and help ensure that this event went smoothly. Thanks to Alex and Kerri at Stanford for their work to make this event happen.

This weekend ended up being a bit more chaotic than expected due to the fallout of Hurricane Helene, which forced us to push the Southeast regional back a month. Despite the logistical challenges, we were able to successfully complete three regional events this weekend, which set us up for Global Finals.

CPTC10 Global FinalsThe culmination of the CPTC season is the Global Finals, which took place during the Martin Luther King weekend at RIT’s campus. We were fortunate to have seven different Hurricane Labs team members on site at this event, which ends up being about a quarter of the total onsite volunteers.

One of the highlights of the weekend was reflecting on a decade of CPTC, and what it means to all of us. There are four of the original founding volunteers of CPTC still involved who have poured the last 10 years of our lives into making this event something truly special, and being able to see the evolution of the competition over that timeframe is nothing short of astounding.

Three of the four 10-year CPTC volunteers: Lucas Morris, Tom Kopchak, and Bob Kalka

We also had something really unique happen this year – all three of the teams that placed at finals (Dakota State University – 1st; University of Florida – 2nd; and Penn State University – 3rd) are all schools that have never placed before at CPTC finals. To me, this really shows that being successful in CPTC isn’t based on who you are or where you come from, but instead what you put into preparing for the event and how you execute on your plan.

What an incredible team

I owe a great deal of thanks to all of my peers at Hurricane Labs for their involvement in support of CPTC this year. We are a small but mighty force who have a massive part in making the event function.

• Casey Bitting: Casey is one of the newest members of the HL leadership team as our SOC Manager, but that doesn’t mean he’s forgotten all technical skills (yet). Casey is a key member of the CPTC monitoring team, investigating alerts and threat hunting for potential rules violations during the event.
• Cameron Schmidt: Cameron uses his development skills to take the CPTC monitoring team to the next level. He’s created custom dashboards and apps in the CPTC Splunk environment, built Splunk searches faster than I can read Slack messages, and even has stepped up to handle the Splunk admin tasks I should be doing.
• Erin Call: Erin’s role at HL and CPTC are surprisingly similar – she’s a SOC Architect for both. She builds out detections and correlation searches to help the CPTC monitoring team find anomalous activity in record time, and takes what we learn at CPTC back to HL to better support our customers and their security use cases.
• Jonathan Gavris: Jonathan is our SOARchitect at HL, and brings the same enthusiasm he has for everything to CPTC. From designing Splunk SOAR playbooks to automating responses to in-game alerts, you can clearly see his passion for CPTC and all things Splunk come through in everyone he interacts with.
• Meredith Kasper: Meredith has been at my left hand since starting as a CPTC volunteer. Without her, we simply wouldn’t have students at the events. She leads competitor communication, helps us build team materials for the event, and is a huge part of responding to the hundreds of support tickets we get over a CPTC season. For finals this year, she also took on the rollout (and covered costs for) of our AI Vishing system that students used as part of the event.
• Rocio Slobodzian: Rocio – our project management team lead at HL – also leads our outreach efforts for CPTC. She took on the massive task of coordinating discussions with CPTC sponsors and ensuring that they were welcomed at CPTC events. There were so many ways that her involvement this year helped support the event – from onboarding volunteers, to building out competition materials and slide decks, to coordinating all of the details for the CPTC10 banquet at Global Finals.
• Ryan Kazubski: Ryan is one of our SOC analysts at HL, and he enjoys working with alerts so much that he ends up doing the same thing during his free time in support of CPTC. Handling and investigating security alerts is often an exhausting, thankless job, but Ryan’s personality and enthusiasm always brings a smile to everyone’s face.

And I would be amiss to not thank Hurricane Labs for all their support of my insanity around CPTC over the past decade. From initially giving me the ability to get involved, to supporting me both financially and professionally across dozens of CPTC events over the past 10 years – I am very grateful.

We’ve done so much over the decade, and I can’t wait to see what the future holds.

The post Hurricane Labs Reflections on CPTC10 (Collegiate Penetration Testing Competition) appeared first on Hurricane Labs.

View Details

Phishing is one of the most common and dangerous cyber threats facing organizations
today. Despite growing awareness, employees often still fall victim to these attacks.
Even worse, cybercriminals now have more sophisticated tools at their disposal fueled
by artificial intelligence (AI). What once required a team of attackers to conduct a spear-
phishing attack can now be accomplished by a single person using generative AI.
Understanding the psychological factors behind why employees click on malicious links
can help organizations develop more effective prevention strategies and strengthen
their overall cybersecurity posture.1. The Role of Social Engineering Phishing attacks often rely on social engineering tactics that exploit human emotions. Cybercriminals will create a false sense of urgency or fear, prompting employees to act quickly without considering the legitimacy of the request. For example, phishing emails may
appear to be from a senior executive making it more likely that an employee will
act quickly without questioning the email’s authenticity.
By educating employees about the tactics cybercriminals use, organizations can
help reduce the risk of successful phishing attempts. Resources like the
Hurricane Labs blog explain the differences between phishing and other types of
email threats, helping employees better recognize suspicious communications.

1. Cognitive Bias and ImpulsivityHumans are wired to take shortcuts in decision-
   making, which is often referred to as cognitive bias. Phishing attacks exploit
   these shortcuts by presenting information that appears legitimate at first glance.
   For example, a phishing email might ask an employee to update their login
   credentials by clicking on a link, which seems like a standard procedure.
   Furthermore, technologies like deepfakes, vishing (voice phishing), and face-
   swapping are increasingly used to create realistic deceptive interactions. These
   tools are cheap and easily accessible to cybercriminals. Training programs
   should emphasize the importance of scrutinizing all unsolicited requests for
   sensitive information. Employees should be encouraged to verify requests using
   alternate communication methods. For instance, they could navigate to a
   company website to log in directly rather than clicking on a link in an email, or
   use messaging platforms to confirm an unusual request, such as buying gift
   cards.

2. Building Stronger Security Training ProgramsTo effectively combat phishing, organizations must develop robust security training programs. Training should go beyond the basics of identifying phishing emails and instead focus on building a security-conscious culture. Employees should be trained to recognize various
   social engineering tactics such as pretexting and baiting in addition to traditional phishing techniques.

Simulated phishing attacks are a practical way for employees to practice
identifying phishing attempts in a controlled environment. These simulations
should be updated regularly to reflect evolving attack methods as cybercriminals
are increasingly using more sophisticated techniques. Relying on outdated
tactics like looking for poor grammar or spelling errors is no longer sufficient.

1. Encouraging ReportingCreating a culture where employees feel comfortable
   reporting phishing attempts is essential. Employees should know exactly who to
   contact and how to report suspicious emails or activities. By fostering a culture of
   open communication where security is enabling the business, organizations can
   identify phishing attacks more quickly and act before significant damage occurs.

2. Implement Multi-Factor Authentication (MFA)While training is vital, technical controls are also necessary to minimize the impact of successful phishing
   attacks. One of the most effective ways to protect against unauthorized access,
   even if credentials are compromised, is multi-factor authentication (MFA).
   Implementing MFA can add an additional layer of security making it more difficult
   for attackers to gain access to an account even if they manage to deceive an
   employee into divulging their credentials.

Phishing attacks continue to evolve but with the right combination of employee
education, culture, and technical defenses, organizations can significantly reduce the risk to their business. Humans are the weak link in phishing attacks so understanding the psychology behind what makes these attacks successful can allow you to proactively protect against phishing in the age of AI.

Hurricane Labs | Managed Splunk ServicesThe managed cybersecurity services offered by Hurricane Labs empower organizations to effectively manage and mitigate security incidents in an increasingly complex threat landscape. Hurricane Labs is a renowned leader in Splunk solutions across North America.

Thomas Sheehan is the Director of Cybersecurity Consulting and Compliance for Hurricane Labs

Read his other work on Compliance and Ethics

The post Phishing: A Persistent Threat in the Age of AI appeared first on Hurricane Labs.

View Details

The Salt Typhoon Cyber Attack: A Wake Up Call?In late 2024, a sophisticated cyber espionage operation rocked the cybersecurity world. Linked to a Chinese state-sponsored hacking group dubbed “Salt Typhoon”. This breach has raised serious concerns about the security of critical infrastructure and the evolving tactics of nation-state hackers. The sheer scale of the intrusion, along with its implications for national security, should be a wake-up call for industries and governments worldwide.

What Was The Salt Typhoon Cyber Attack?Salt Typhoon, a group reportedly backed by China’s cyber-espionage operations, successfully infiltrated multiple U.S. telecommunications companies. Their objective? To gain access to call metadata, geolocation data, and potentially even live conversations—information that could be used for surveillance, intelligence gathering, or even cyber warfare.

This breach is among the most severe in recent memory, underscoring how state-sponsored hackers are shifting their focus toward compromising national security assets. The ability of such groups to exploit weaknesses in critical communication networks presents a significant threat not just to businesses but to governments and civilians alike.

The Discovery and Scale of the BreachThe attack came to light when the Cybersecurity and Infrastructure Security Agency (CISA) conducted what was initially a routine check of federal networks. That assessment quickly unraveled into a full-scale investigation, revealing that at least nine major U.S. telecom providers—including AT&T, Verizon, and T-Mobile—had been compromised.

Hackers gained access by exploiting outdated and unpatched systems, despite security updates being available for years. This highlights a recurring issue in cybersecurity: companies often delay critical updates, leaving their networks exposed. Once inside, Salt Typhoon operatives moved laterally across systems, extracting vast amounts of sensitive metadata. This data not only revealed communication patterns but also pinpointed locations and, potentially, the identities of high-profile individuals.

How the Attack UnfoldedExploiting Weaknesses in InfrastructureOne of the most concerning aspects of this attack was how it relied on security gaps that had been identified long ago. Cybersecurity experts have repeatedly warned about the dangers of postponing software updates, yet many organizations failed to take action. This negligence created an easy entry point for Salt Typhoon, allowing them to infiltrate telecom networks with minimal resistance.

The hackers specifically targeted network routers and telecommunications infrastructure—areas that often receive less attention in traditional IT security frameworks. Once inside, they deployed sophisticated techniques to maintain long-term access while evading detection.

Advanced Evasion TechniquesSalt Typhoon operatives demonstrated a high level of skill in avoiding detection. They relied on encrypted communication channels, fileless malware, and legitimate administrative tools to blend in with normal network traffic. By spreading their attack across multiple access points, they made it difficult for cybersecurity teams to fully eliminate their presence. Even if one breach was identified and closed, others remained active, prolonging their access to sensitive data.

Government and Industry ResponseU.S. Sanctions and CountermeasuresIn response to the attack, the U.S. Treasury Department imposed sanctions on individuals and organizations connected to Salt Typhoon. These measures aim to cut off financial and operational resources, making it harder for the hackers to continue their activities.

However, many cybersecurity experts argue that relying solely on sanctions is not enough. A more aggressive and proactive defense strategy is necessary to protect critical infrastructure from future cyber espionage campaigns. Reacting after the damage is done leaves nations and businesses vulnerable to repeated attacks.

The Role of the Ongoing Trade WarThe broader geopolitical situation can’t be ignored when analyzing this attack. Given the ongoing trade war between the U.S. and China, coupled with sanctions against China’s allied nations, there is a growing likelihood of increased retaliation in the form of cyber attacks. These threats may not be limited to telecommunications; rather, they could extend to other critical industries, like finance, energy, and manufacturing. The goal of such attacks may shift from intelligence gathering to economic disruption, further escalating tensions between the two nations.

Telecommunications Industry Steps UpAfter the breach was uncovered, affected telecom companies launched extensive efforts to secure their networks. AT&T and Verizon, for example, reported that they had successfully removed the attackers, but cybersecurity specialists warn that remnants of the intrusion may still linger.

In response, companies have increased their cybersecurity investments, focusing on network segmentation, stronger threat detection, and more frequent security updates. Critics argue that such measures should have been implemented long before a breach of this magnitude occurred.

What Did We Learn?The Cost of ComplacencyPerhaps the biggest takeaway from this incident is the danger of ignoring known vulnerabilities. The fact that security patches were available for years but left unimplemented reflects a widespread issue in the industry: a tendency to react only after an attack rather than taking preventive measures. Businesses and governments must shift from reactive security strategies to proactive risk management techniques like penetration testing services.

Strengthening Public-Private Cybersecurity CooperationThis breach also underscores the necessity of collaboration between government agencies and private companies. Effective cybersecurity requires intelligence sharing, coordinated responses, and joint security initiatives. Establishing real-time information-sharing networks can help organizations stay ahead of state-sponsored cyber threats.

Stricter Cybersecurity RegulationsThe attack highlights the urgent need for stronger cybersecurity regulations, particularly for critical infrastructure providers. Governments should mandate routine security audits, enforce patching schedules, and require greater transparency in cybersecurity practices to prevent similar breaches in the future.

The Future of Cyber WarfareNation-State Cyber Threats on the RiseSalt Typhoon is not an isolated case. State-sponsored cyber operations are becoming a key component of geopolitical conflicts, with countries using cyber espionage to gain intelligence and disrupt adversaries.

China, Russia, North Korea, and Iran have all been linked to major cyberattacks targeting governments, financial institutions, and technology firms. As these tactics evolve, so must the defenses of targeted nations and organizations.

AI’s Growing Role in CybersecurityArtificial intelligence is increasingly shaping both cyberattacks and defenses. Hackers now use AI-driven automation to identify vulnerabilities and launch sophisticated attacks at an unprecedented scale. In response, cybersecurity firms and government agencies are deploying AI-powered threat detection systems capable of identifying and mitigating threats in real time.

Adopting Zero-Trust Security ModelsOne of the most effective ways to counter cyber threats like Salt Typhoon is the implementation of a Zero-Trust security model. This approach assumes that threats can come from both inside and outside an organization, requiring strict verification at every level of network access. Adopting Zero-Trust principles can significantly limit unauthorized access and minimize the risk of lateral movement within systems.

Hurricane Labs | Managed Cybersecurity Services and NewsWhile sanctions and increased cybersecurity investments are steps in the right direction, the real solution lies in a proactive, collaborative, and technologically advanced approach to defense.

Cyber warfare isn’t a distant possibility anymore—it is a current reality. Governments, businesses, and individuals need to adopt stronger security frameworks by way of implementing managed IT security services. We need to enforce stricter regulations, and cultivate a culture of vigilance to protect critical infrastructure from future attacks. The question is not if another attack will happen, but how prepared we will be when it does.

The post The Salt Typhoon Cyber Attack: A Wake Up Call? appeared first on Hurricane Labs.

View Details

Transform your network monitoring capabilities with the powerful combination of Arista Networks’ advanced telemetry and Splunk’s powerful analytics platform. This comprehensive guide will walk you through establishing a robust integration between these industry-leading solutions, enabling sophisticated network visibility and analytics.

Prerequisites

Ensure you have the following components ready:

• Arista switch administrative credentials
• CLI access to the Arista switch
• Latest stable release of Splunk Universal Forwarder RPM package
• AristaAppForSplunk SWIX file compatible with your EOS version
• Splunk Cloud credentials (if using cloud deployment)

Initial Arista Switch Configuration

Enable eAPI Access

Begin by configuring the essential eAPI access on your Arista switch:

Configure Advanced Monitoring Features

Enable comprehensive network metrics collection through sFlow:

Optimize configuration visibility by disabling running-config cache:

Core Component Installation

Universal Forwarder Deployment

Install Splunk’s Universal Forwarder component:

AristaAppForSplunk Implementation

Deploy and configure the Arista-specific integration components:

Restart essential services for proper initialization:

Integration Configuration

Splunk Forwarder Setup

Access and configure the forwarder settings:

Implement secure authentication:

Note: Use <0> for development environments and <7> for production deployments.The use of <0> is recommended for development environments as the secret will be displayed in clear plain text, while the use of <7> will ensure an that the secret is encrypted and will not be displayed in that plain text.

Data Collection Configuration

Define your data collection parameters:

Activate your configuration:

Splunk Cloud Integration

For Splunk Cloud deployments, follow these configuration steps:

1. Access the bash console on the Arista switch using the EOS Command Line Interface. a. This will prompt you for your username and password.
2. Navigate to /opt/splunkforwarder/etc/apps
3. Deploy your cloud package:
4. Verify file permissions
5. Execute Splunk restart from Arista Shell
6. Validate deployment status:Validation and Monitoring

Integration Health Verification

Ensure successful deployment through these key verification steps:

1. Confirm data flow in Splunk interface
2. The following search is a quick way to verify if the data is flowing. It allows you to view which host have successfully sent data and the type of data they have sent
    2. Verify component network connectivity
    3. Monitor forwarder status using show splunk-forwarder
    4. Review system logs for potential issues**Advanced Troubleshooting** Address potential integration challenges by verifying:


    * Network connectivity and routing
    * Authentication credentials
    * Port configurations and firewall rules
    * System and application logs**Future Optimization** Your Arista Networks and Splunk integration is now ready to deliver advanced network analytics and monitoring capabilities. This foundation enables:


    * Real-time network visibility
    * Proactive performance monitoring
    * Advanced analytics and reporting
    * Automated incident responseFor advanced configurations and optimization strategies, consult the official Arista Networks documentation. Enterprise support is available through both Arista and Splunk to ensure optimal deployment performance.

Welcome to enhanced network monitoring!

The post The Field Engineer’s Handbook: Configuring an Arista Networks Switch with Splunk appeared first on Hurricane Labs.

View Details

Introduction:Splunk SOAR (Security, Orchestration, Automation, and Response) is a very useful tool that can super charge your security operations by giving your security team a relatively easy, low code, automation capability that has great integrations with tools you already use, straight out of the box.

One of the things that makes SOAR a favorite tool of mine, is that it is relatively easy to start learning with little-to-no coding experience required. You can develop playbooks that immediately bring you and your security team value and start making everyone’s lives easier. However, while SOAR is relatively easy to pick up, it does not leave you disappointed when you begin to dive deeper. Once you develop some experience and learn some of SOAR’s quirks and niches; combine that with some Python and creativity, and you are left with a very flexible product that you can mold to take powerful actions that can truly revolutionize your security posture. As someone who loves to be both technical and creative, SOAR has become an awesome playground for me to develop new solutions that ultimately help our clients better reach their security automation goals.

While Splunk SOAR has proven to be a very powerful tool, there is one area that I have found to be lacking, and that is the lack of functionality to sort ingested containers pulled via the “On-Poll” action. In this blog I want to talk about why this is an issue and the custom function I developed to fix it!

As a bonus, I included a GitHub link to the custom function that can be downloaded completely for free to help you solve this problem in your Splunk SOAR environment – found at the end of the blog!

What Is a Container?

Data comes into SOAR as “containers” which essentially are JSON objects that can contain more nested JSON objects (Artifacts). When a container is created in SOAR, two main things happen.

1. It is assigned a label.
2. Active playbooks (automation) associated with that label, run on the container and can access the data in the container.

Containers contain all the data from the event that generated it. For example, a Splunk alert ingested as a container in SOAR will contain all the data from the alert, again, in a JSON format.

Pictured in the screenshot above is a container in Splunk SOAR titled “This Is A Container” assigned the label “gavris_test”

What Is On-Poll?

You can get data/containers into Splunk SOAR through two methods. You can send it to SOAR from somewhere (pushing) – or SOAR can pull it. The latter uses what is called “On-Poll” because SOAR (or, more specifically, an App in SOAR) is “polling” for updates on a set schedule or interval.

The “Generator” app in SOAR allows you to generate containers via On-Poll to simulate dummy Splunk alerts. This allows you to create playbooks and test on simulated events with ease (we will be using this more in just a little bit!)

The Ideal Scenario & The Problem:

So we established what containers are and the two main things that happen when a container is created in Splunk SOAR – they have a label and run playbooks active on that label. We also established the different methods of creating containers in Splunk SOAR – sending or polling. Great! Before we dive into the problem, I want to explain the ideal scenario.

In this scenario we are sending data from Splunk to SOAR (not polling). Say we created 3 separate alerts in Splunk to detect malicious activity. You would likely be using the Splunk App for SOAR Export to send these alerts to SOAR, where you can define the SOAR instance, container severity, sensitivity and most importantly the container label.

Remember, the label you assign to the container defines what playbook(s) run on it! If you have different alerts, you ideally want them to have different labels to run different automation, right? That’s because you would likely treat an alert regarding a Phishing email, for example, differently than you would an alert regarding Malware, or an IDS detection – so your playbooks that run on these alerts will also likely be different since they are taking different actions and doing different things!

This is the best-case scenario. You define the labels you want to assign to the alerts when they get created as containers in SOAR, and you’re in business. You can have any different playbooks running on any different labels all day long and SOAR is happily automating your alerts away.

Now, we go to the other side of the coin, our friend, On-Poll. In some cases, your only option to get data into SOAR is to use the On-Poll action in whichever SOAR app you are trying to configure. This is not a bad option, but it is natively limited, and herein lies the root of our problem. Let’s take a closer look at the Ingest Settings page for the Generator app, containing the On-Poll configuration.

Notice the limitation of the On-Poll action; you can only specify ONE label to assign to the containers ingested by this app – in this case, a label called “generated_events.”

When running the Generator app, you can see all the containers being ingested under one label. Now the Generator app is meant to simulate real alerts being ingested as containers; and it does a great job doing so! In fact, it shows that we have several different alert ‘types’ being ingested – in this screenshot we see containers named “Malicious URL Request Attempt”, “ASN Transaction”, and a couple Malware alerts.

These containers would realistically require different playbooks to run on them, which would require different labels. However, due to the limitation of On-Poll, only 1 label can be defined or configured, which means we are limited only to playbooks active on that label.

For some use cases, this may not be an issue, but you run into some serious limitations if you are ingesting several ‘types’ of containers, using the On-Poll action, that need to run different playbooks!

To elaborate, if I need to run a playbook to enrich my “Malicious URL Request Attempt” alerts and another playbook to detonate malware in a sandbox for my Malware alerts, I must have both of those playbooks active on the “generated_events” label – not ideal (more on this in the next section).

Using the actual Splunk app on SOAR as another example, you can see that it is no different:

If you are resorted to using the On-Poll action to ingest all your Splunk alerts or notables from Splunk Enterprise Security, how do you run different playbooks on all the different alerts you have?

Thinking even bigger picture here, if you are ingesting emails, tickets, or any other data via On-Poll, how do those run different playbooks depending on the content of those containers? This was the main issue that I was confronted with and got me thinking about a creative way to solve it!

Some Possible Workarounds:

What are some ways to deal with this dilemma? While brainstorming for a good solution to this problem, I mentally went through a check list and initially thought about these potential workarounds:

The first workaround is to simply have all your active playbooks run on the label your containers are ingested under and have some logic in them to stop the playbook run when it realizes that the automation will not work for the container it is running on.

For instance, you can have a filter block at the top of the playbook. If you want the specific playbook to only continue its run if “Phishing Alert” is in the container title, for example, then any other container that this playbook runs on will result in the playbook stopping very early on in the run. SOAR will then go on to the next playbook if there are multiple playbooks set active on the label.

The problem with this approach is that it does not scale well at all. Using the Splunk alert example again, if you have 5 different alerts/notables being ingested into SOAR as containers, it may take up to 5 playbook runs until it gets to the right playbook. You might get away with this at a small scale, but if you are ingesting 20, 30, 50, or 100 (etc.) different alerts that all need different playbooks to run on them; letting that many playbooks run on 1 container until it gets to the right one is wildly inefficient and will likely cause resource issues in SOAR itself.

The second workaround, if applicable, is to have separate assets or instances of your app polling your different data to different labels. For example, you can set up different instances of the Splunk app in SOAR and adjust your On-Poll query that pulls your notables, to look for notables with a specific name. You can have an asset pull in Phishing alerts, another pulling in Malware alerts, another pulling in IDS alerts, etc.

But again, this gets very tedious and inefficient at scale, leaving you with possibly dozens of app assets/instances at best, and this may not even be possible with certain apps at worst. For example, if you are On-Polling an email inbox to ingest emails into SOAR, you may not have permissions or be able to make different inboxes or be able to direct specific emails to new inboxes to create new assets for those inboxes in SOAR. This becomes a potential headache to solve this problem outside of SOAR, and it is also not efficient or ideal to do so either.

My Solution – Introducing: The SOARting List

My first thought when initially confronted with this problem, was that we need to solve this in SOAR itself. Since we can’t set different labels when configuring the On-Poll action, maybe I can make a playbook to do it for me. Here were my thoughts:

There needs to be only 1 main playbook running on containers that are ingested under the initial label, using some sort of dictionary or key/value pair to look at the container and determine what label it needs to switch to. This will eliminate the scaling issue and ensure that no matter how many container ‘types’ are ingested under the one label, only 1 playbook will be initially running on the containers.

My second thought was that this main playbook must do 2 things:

1. • 1. The playbook needs to be able to “identify” the container to know what type of container it is, based on some data in the container; whether that’s the container’s name or some field in one of the artifacts.
   • 1. The playbook needs to change the label of the container based on the container ‘type’; effectively sorting it from its initial label it’s ingested under, to its destination label that will then trigger the actual playbook(s) intended for this container.

Using the Splunk alert example again, this would make my ideal outcome be the following:

If all my alerts come ingested under 1 label called “notables”, my master playbook will run on the container, determine if it is a “Phishing”, “Malware”, or “IDS” alert/container – then switch the label on the container from “notables” to “phishing”, “malware”, or “ids” so that when the label on the container changes, it runs ONLY the intended playbook next on the container. Excellent!

This is exactly what I created in my custom function appropriately called “The SOARting List”, because it runs in an active playbook on the label configured at On-Poll and sorts your containers to their appropriate labels triggering the desired automation to be run, swiftly and precisely.

The SOARting List – Deep Dive:

As a gift to the Splunk community, I am giving the SOARting List custom function away at the end of this blog to help you fix this issue in your Splunk SOAR environments and hopefully get you more value from your SOAR!

Here is a deep dive on how to use it:

The SOARting List has 2 components to be fully functional – the custom function itself and a custom list you must create in SOAR that will essentially be a dictionary of Key/Value pairs in two columns.

• 1. Column A, contains a unique string that the SOARting List will look for in the container (your Key).
• 1. Column B, the label you desire the container to switch to (your Value).

Here is what the custom function looks like in a playbook, without it being populated:

There are 3 necessary fields:

• 1. The name of the custom list containing your dictionary.
• 1. Your “Key Comparator” which is the data path of the field that the unique string in the custom list will compare against to check if it should output the corresponding label.
• 1. A default label that the SOARting List will output if sorting fails. This can be the original label it was ingested under, or a completely new label to trigger any automation you want.

Here is what the custom function looks like populated:

And here is the “Alert_Sorting” custom list that the custom function is referencing:

As you can see, the custom list in SOAR is split into two columns which get read by the SOARting List as a dictionary (Key/Value pair). It takes the string in Column A and checks it against the string in the data path you define in the “key_comparator” field in the custom function. In this case the container’s name. If the string in the custom list is found IN the container name, it outputs the corresponding label!

I want to emphasize this; the string in the custom list does not need to FULLY match string in the data path, to output the label. It takes the string in Column A of the custom list and checks to see if it is IN the string in the data path.

This is because sometimes there are variables in container names (or artifact fields) that change, but you can still have most of the name be consistent. For example, your “key_comparator” data path might be a container name from an IDS alert that contains different IP addresses; for example, a container titled “IDS Alert from xxx.xxx.xxx.xxx” (some IP address). You can match on the string “IDS Alert” or even “IDS Alert from” omitting the variable portion, to still sort these containers to the same destination label to run the same playbook(s)!

You can then use the output label of the SOARting List and input that in the community custom function called “container_update” to update the container to its new label.

However, if you want the SOARting List to handle updating the container itself, you can uncomment out line 66 of the Custom Function to allow it to do it for you:

This option makes your sorting playbook look even cleaner by having the SOARting list custom function as your only block in the playbook:

After all is said and done, you set your playbook to be active on whichever label you are ingesting events under and watch your containers sort themselves, on ingest!

Using my previous example from above, I set my SOARting List to be active on the “generated_events” label which sorted my containers to the following:

I also like to add a comment to my containers when they switch labels so I can briefly see, at a glance, that it worked:

You can see here that this container sorted from “generated_events” to “malicious_url” because the SOARting List compared the string “Malicious URL Request” found in the custom list, to the key comparator – the containers name – which was “Malicious URL Request Attempt” and found that the container name included that string. Because the container name included “Malicious URL Request”, it output the new label “malicious_url.” Woo!

Conclusion:

This has been a fun ride in SOAR-land and I hope that you can find value in this custom function to help you with your container sorting needs! If you have any feedback or ideas to make this custom function even better, please feel free to reach out to me at jgavris@hurricanelabs.com

Keep on SOARing!

SOARting List Github Link: https://github.com/GavriSec/SOARting_List

You can watch the full video tutorial on our Hurricane Labs youtube channel! https://youtu.be/d6oVcK2XWBY

The post Splunk SOAR – Sorting Containers to Improve SOAR On-Poll Functionality (Free Custom Function Provided) appeared first on Hurricane Labs.

View Details

IntroductionOne of the most powerful things to do with data is to visualize it. Being able to see the data in various contexts can help executives and security professionals alike understand their cyber environment better and identify their strengths and weaknesses. Dashboards in Splunk are fairly easy to make but sometimes you may not always know how to get started.

For this tutorial, we are using fake data generated from a Splunkbase app called Eventgen (https://splunkbase.splunk.com/app/1924). It provides 5 sourcetypes that are similar to actual sourcetypes you may have in your environment. The sample “messagetrace” data provides generated logs of email information. Analyzing the email in your organization is smart for security purposes and can provide insights on email behavior, phishing attacks, and spam rates.

This is how your data might look in a search after you have onboarded it into Splunk.

The first step toward building a dashboard is to look at your data and see what fields are available. Sometimes all the fields you need are already extracted. Other times you may need to add more field extractions or create calculated fields so that you are able to search for the information that you want. For this tutorial, we want to analyze all of the statuses for these emails and make sure that we are blocking what should be blocked and delivering what should be delivered. If not, we might need to examine our email filtering.

These are some of the fields that look like the kind of information we want to have in our dashboard.

Panel 1: Email OverviewWe can get an overview of our email delivery by doing a simple stats search and counting the Statuses, like this:

Next we will take a look at the potential Visualizations that we can use. Click on the Visualization tab. It defaults to “Column Chart”. Click on the name of the visualization and more options will pop up. This is where you can select a different visualization.

A pie chart might be a great way to visualize this particular data, so select the pie chart. Now it is ready to add to a dashboard. To do this, click on the Save As button at the top and choose New Dashboard from the drop-down.

Then create a Dashboard Title (let’s use “Email Analysis”), an optional Description, your sharing permissions, and type. Classic Dashboards are simple visualizations, so that is what we are going to choose. Give the panel a title of Email Overview, then click Save To Dashboard.

Choose “New Dashboard” since we don’t already have one made. Next time we would choose “Existing Dashboard” and search for the dashboard name.

Panel 2: Email Status TimechartIn this panel, we can get an overview of when the most emails are delivered or blocked. This search uses the timechart command which looks great with the Line Chart Visualization. Timecharts are helpful because timecharts can show patterns that might occur during certain times of the day. Select the Line Chart visualization, Save As to an Existing Dashboard, and call the panel “Email Status Timechart”.

Now we have a timechart of the email statuses.

Edit the DashboardNow that we have two panels, we should edit the dashboard. Go to the dashboard and click on the Edit button. There are two ways to edit: the UI or the Source (XML code). For this tutorial, we will just edit in the UI, which is the user interface.

The panels are currently stacked on top of each other, but we can move them to be next to each other instead. Place your mouse pointer over the double dotted lines and drag the bottom panel upward next to the top panel. Then click Save.. TA DA! The dashboard has been edited!

The dashboard panels are now next to each other.

Other ways to edit the dashboard include adding a time range picker and input dropdowns, but we are not covering that today. You can use inputs to make dashboards more dynamic and filter information as needed.

Add More PanelsTry some of the searches below and add more panels. If your data does not have this exact information, replace the index, sourcetype, and fields with the names of the relevant data points found in your data. Then try to find a visualization that works for it. You can also leave it as a table in your dashboard.

The post Let’s Build A Splunk Dashboard! appeared first on Hurricane Labs.

View Details

Webhooks are an incredibly useful tool. Thanks to wide support across SaaS vendors, they provide a solid foundation for integrating one system with another without either system having to know anything about the other. However, as much as I love webhooks, I don’t get to use them with Splunk as much as I’d like because of some key weaknesses in Splunk’s implementation. In this blog post I’d like to talk about those shortcomings, and how I attempted to remedy them with a new app.

What are webhooks?Webhooks are asynchronous HTTP requests sent from a system when an event happens, typically with a JSON payload including more details on what the event was. The URL the HTTP request is sent to is user-configurable. As an example, as an OpsGenie user, you can configure the product to send you an HTTP request every time an alert is created, updated, or closed. If you’re interested in learning more about webhooks after this blog post, ngrok publishes an extremely useful resource on webhooks. I highly recommend checking that out.

When it comes to compliance, cybersecurity is non-negotiable. The combined power of Splunk and CrowdStrike services creates a strong defense against evolving cyber threats. With real-time visibility, advanced analytics, and proactive endpoint protection, these solutions help organizations stay one step ahead of cybercriminals while meeting stringent compliance requirements. As many services continue to embrace digital transformation, leveraging the capabilities of Splunk and CrowdStrike becomes essential in safeguarding sensitive data, maintaining customer trust, and ensuring business continuity in an increasingly interconnected world.

Subscribe to the Hurricane Labs newsletter to stay updated on all things cybersecurity, and get in contact with us if you’d like to discuss your security posture with one of our team members.

Why are webhooks useful?Let’s say my organization uses two products, PagerDuty and ServiceNow. We use PagerDuty for alert notifications, and whenever a PagerDuty incident is escalated, we create a ServiceNow ticket to track the escalation. I would love to automate this process, but I don’t want to constantly poll PagerDuty for incidents and check if they’re escalated. Thankfully, PagerDuty has webhook support! So instead, I can host a simple application that listens for POST requests to a particular URL and creates a ServiceNow ticket when it receives them. Thanks to serverless solutions such as AWS Lambda or Cloudflare Workers, I don’t even necessarily need to bother myself with any of the HTTP request handling. I then configure PagerDuty to send webhooks to that URL whenever an incident is escalated. I have now automated that entire workflow. This is the power of webhooks!

Webhooks in SplunkSplunk ships with an app called “alert_webhook” which contains an alert action for sending webhooks. This allows you to send a webhook any time a Splunk alert fires. This can be very powerful because frequently Splunk is ingesting log data from a wide variety of systems. You could effectively “build your own” webhook support for products that don’t offer their own!

However, Splunk’s webhook action has some major weaknesses that hamstring its usefulness. First, the user has no control over the payload that is sent in each request. While the payload contents do include just about everything you could possibly want to send, the format is set in stone. I’ll get back to why this is an issue.

Next, and a much bigger problem, is authentication. Splunk has absolutely zero support for authenticated webhooks. Better hope no one on the internet discovers your webhook URL!

I’m far from the first person to identify these issues, but I set out to build an app that addressed them.

Better WebhooksBetter Webhooks is the app I built to try and help out those like myself who were hoping for more fully-featured webhooks support. It stores all credentials in Splunk’s encrypted credential store so it passes Splunk Cloud’s vetting requirements. I used Splunk UI Toolkit to build an interface for adding credentials, and wrote a simple alert action to handle sending the webhooks themselves. Below are some more details on the app’s features.

Custom PayloadsIt’s much more common for a SaaS vendor to support outbound webhooks than it is for them to support inbound ones. In my experience, most of the time we are left to write our own handlers for webhooks, or use intermediary services such as Zapier.

Nevertheless, there do exist some products which will listen on the internet for you

and handle webhooks you fling at them. Unfortunately for us Splunk users, these services almost always have their own very specific payload formats if you want to use them. Better Webhooks allows you to connect Splunk alerts up to these webhook handlers.

The app allows one to specify the entire JSON payload and supports some tokens as well. If Splunk’s default payload format works for you, I support that too.

While I haven’t seen someone do this yet, I think this alert action could be used as a simple alternative to full-fledged Splunk apps. For instance, creating an alert using OpsGenie’s API is as simple as POSTing a specific JSON payload to a specific URL with a valid API key header. This could be entirely done using a Better Webhook alert action!

AuthenticationIf one is going to try and add support for authenticating webhooks, how would they do it? webhooks.fyi documents six different methods that vendors use to secure their webhook implementations. I didn’t implement all of them for Better Webhooks, but I did implement the two I’ve seen “in the wild”:

Shared secret

This simply requires the webhook sender to include a secret that the server can check, rejecting any request that doesn’t include it. The shared secret can be passed using HTTP basic auth or a custom HTTP header. Better Webhooks supports either option.

HMACWhile a little more complicated, HMAC is a much more interesting way to secure webhooks. In addition to allowing the receiver to authenticate the request, HMAC also allows them to confidently say the payload wasn’t tampered with during transit. It does this by hashing the webhook payload with a shared secret and a timestamp (making replay attacks more difficult). Unfortunately, just as there are no widely accepted methods to securing a webhook, not everyone uses the same hash function for HMAC. I’ve seen SHA256 and SHA1, so I support both.

Conclusion and a request for feedbackI hope this helped explain my rationale behind creating the Better Webhooks app. I strongly believe that with a tool like this, Splunk can unlock all sorts of potential for organizations big and small.

Additionally, while I tried my best to cover a variety of use cases, I suspect there are features I hadn’t considered that would be useful to people. If you have an authentication scheme the app doesn’t support or some other feature request, please reach out to me at cschmidt@hurricanelabs.com.

The post Improving Splunk Webhooks appeared first on Hurricane Labs.

View Details

Hurricane Labs Free Webinar: Demystifying Splunk Cloud StorageAre you unsure of the best options for storing and archiving data in your Splunk Cloud environment? We’ll help demystify the different storage offerings and give you the best use cases for each, and give you some tips for managing your Splunk Cloud storage costs.This webinar will be a must-attend for anyone currently using Splunk Cloud or considering making the switch. Join us on 5/15 and ask your Splunk architect if DDAS, DDAA, or DDSS is right for you!

– Learn about the different storage options in Splunk Cloud and how to size your storage to best fit your needs– Plan ahead for using archived data when you need it
– Explore tools and techniques for managing your storage usage in Splunk CloudEvent Details:Date: Wednesday, May 15th, 2024
Time: 1 p.m. EST
Location: Zoom (you will be emailed a link after completing registration)

REGISTER TODAY

About Your Speaker:Tom KopchakTom Kopchak is the Director of Technical Operations at Hurricane Labs. He is a Splunk Accredited Architect and Consultant and an esteemed member of SplunkTrust. Tom has several years of experience building, designing, and managing Splunk deployments as well as managing teams of Splunk engineers. He holds a Master’s degree in Computing Security from the Rochester Institute of Technology, and has spoken at dozens of infosec conferences.

The post Splunk Cloud Storage May Webinar appeared first on Hurricane Labs.

View Details

IntroductionIf you’re running Splunk Enterprise Security Suite, you are already leveraging accelerated datamodels to power your detections and altering. However, there may be situations where you want to leverage those same datamodels you already have when running searches on your other search heads. You could enable acceleration on all your search heads, but doing so will result in higher resource consumption due to all the duplication of searches running from each search head to build the same datamodel acceleration(DMA) summaries.

But, there is a better option! Splunk now allows sharing of data model acceleration summaries across search heads, and it’s pretty easy to set up. Here’s how you do it!

Sharing Data Model Acceleration Summaries1. On the search head that is currently accelerating summaries, identify the datamodels that are currently accelerated that you would like to share. You can view these by going to Settings -> Data Models. You’ll also want to verify the app context for each data model. On a Splunk Enterprise Security (ES) search head, these are typically defined in the Splunk_SA_CIM app.

1. Ensure that the same apps are installed on the search head where you want to share the datamodels. For example, if all of your datamodels are accelerated in the Splunk_SA_CIM app on the ES search head, you’ll want to make sure that this same app is installed on the new search head.
2. On your ES search head (assuming this is a standalone instance), grab the GUID from $SPLUNK_HOMNE/etc/instance.cfg
3. On your new search head, check out the current status of your datamodels. Assuming this is a new installation, you won’t see acceleration enabled for any data model.

4. Configure the acceleration.source_guid parameter for a data model where you want to share the summaries. I recommend picking one for testing first, then applying others. In this example, we’ll start with the Acceleration data model.6. Restart Splunk on the new search head, and then check the data models setting page again. You’ll see that it now indicates the Authentication data model is accelerated:7. On the new search head, run the following search to confirm that you can access the shared datamodel. If you get results, it means it is working!

5. Repeat the process for other datamodels that you would like to share, making sure you use the same app context on the new search head as where the datamodels are defined on the origin search head.

6. That’s it! All of these datamodels are now shared and available on your new search head. ConclusionAt this point, you now know how to leverage shared data model acceleration summaries across your Splunk environment. If you need help getting this set up, or want to enable better security alerting with your Splunk data, reach out to us – we’ll be happy to help!

The post Enable Sharing of Datamodel Acceleration Summaries between Search Heads appeared first on Hurricane Labs.

View Details

Splunk parses pure JSON logs almost like magic. The format works really well for Splunk to automatically extract fields you would need in your searches. However, an issue arises when a JSON log separates the key and the value into two different key/value pairs where “key” and “value” become the fields. For example, a JSON log will often look like the below:

Splunk will be able to parse the fields timestamp, level, message, user, user{}.id, user{}.username, and ip_address with their corresponding values. So, you would be able to run the search index=donuts | table timestamp level message user{}.username ip_address and get the following results:

Easy, right? But what happens when the keys and values are not on the same line in the log? If the JSON log is formatted with a nested list of keys and values, then Splunk will extract it like so:

The fields will be moreInformation{}.key and moreInformation{}.value, not DonutId, DonutType, or DonutToppings. In a table this might be enough for your needs, but you may want to run searches that coordinate the keys to their values more explicitly.

We get this automatically in Splunk, where the keys and values that we want are separated and not explicitly paired with each other.

And our goal is for these key/value pairs to be explicitly set for the searches we want to run: DonutId = 1234567

Our solution is to use a combination of the mvfind and mvindex eval functions: https://docs.splunk.com/Documentation/SCS/current/SearchReference/MultivalueEvalFunctions The mvfind function will help us identify which key we want to use for the field name, while the mvindex function will associate the value to the key we are using for a field. What happens is that new meaningful fields are created that you can now use in your search.

The search would look like this:

You would do this for each field that you want to use from the nested JSON. Find the key, then associate the corresponding value using the index location within the JSON. You can do this within the search or use the eval commands in a Calculated Field to reuse the fields easily in other searches.

The post Oh No! My JSON Keys and Values are Separated! How Can I Extract Them For My Searches? appeared first on Hurricane Labs.

View Details

In today’s digital age, businesses constantly face unprecedented cybersecurity challenges. The ever-evolving threat landscape, stringent regulatory requirements, and the growing volume of sensitive data make safeguarding your organization’s data a top priority. Fortunately, you can leverage advanced cybersecurity solutions to protect assets and customer data.

Understanding the ChallengesIndustries with large volumes of sensitive information are a target for cybercriminals due to the potential for high financial gain. Threat actors employ a variety of tactics, including malware, phishing attacks, and advanced persistent threats (APTs), to breach security defenses.

How Splunk HelpsSplunk is a leading platform for collecting, analyzing, and visualizing machine-generated data, making it an invaluable tool for enhancing cybersecurity across all industries.

Real-time VisibilityReal-time visibility within Splunk is a game-changer for companies aiming to fortify their cybersecurity posture. It represents a dynamic, continuously updated perspective on an organization’s IT environment, providing critical insights into network activities, security events, and potential threats as they unfold.

At the heart of Splunk’s real-time visibility capabilities is its data aggregation and analysis prowess. Splunk excels in collecting data from an array of sources, ranging from system logs and security appliances to cloud services and user activities. This data is then centralized, indexed, and made accessible for rapid analysis. What sets Splunk apart is its ability to handle massive volumes of data in real time, ensuring that security teams have an up-to-the-minute understanding of their environment.

Threat DetectionThreat detection in Splunk is a multifaceted process that relies on the platform’s advanced analytics and machine learning capabilities to identify and respond to security threats effectively. Splunk’s threat detection capabilities create a holistic view of an organization’s IT environment. This comprehensive data collection, combined with real-time monitoring, enables Splunk to recognize unusual patterns, behaviors, and deviations from the norm that may indicate a security threat.

One of Splunk’s key strengths in threat detection is its flexibility and customizability. Security teams can create tailored alerts and triggers to match their organization’s unique security requirements. This means that Splunk doesn’t rely solely on predefined threat signatures but allows organizations to adapt and fine-tune their threat detection strategies as their environment evolves.

Moreover, Splunk’s threat detection capabilities extend beyond just identifying active threats; it also plays a crucial role in proactive threat hunting. Security teams can use Splunk to conduct deep-dive investigations into historical data to uncover potential threats that may have gone unnoticed. This proactive approach to threat detection is essential in a landscape where advanced adversaries are constantly evolving their tactics.

Compliance ManagementSplunk’s robust compliance management capabilities provide organizations with a comprehensive solution to meet stringent requirements efficiently.

One of Splunk’s key strengths in compliance management lies in its ability to automate data collection and reporting processes. It can ingest and centralize data from various sources, including logs, security appliances, and applications. This automated data aggregation not only streamlines the compliance reporting process but also reduces the potential for human error that can lead to costly compliance violations. Financial institutions can create customized dashboards and reports that align with specific compliance standards, making it easier to demonstrate adherence during audits and regulatory assessments.

Additionally, Splunk’s compliance management features extend to continuous monitoring and alerting. It enables organizations to track security-related events and activities in real time, ensuring that any deviations from compliance standards are promptly identified and addressed.

How CrowdStrike Enhances SecurityCrowdStrike is a renowned leader in cloud-native endpoint security, offering a range of services that complement Splunk’s capabilities.

Endpoint ProtectionEndpoint protection is a critical component of cybersecurity, and CrowdStrike is a leader in this field with its Falcon platform. CrowdStrike’s endpoint protection goes beyond traditional antivirus solutions by providing comprehensive and real-time security for all endpoints within an organization.

At the core of CrowdStrike’s endpoint protection is its cloud-native architecture. Rather than relying on outdated signature-based detection methods, Falcon leverages artificial intelligence and machine learning algorithms to proactively identify and prevent threats. This approach allows CrowdStrike to detect and mitigate even the most sophisticated and evasive malware– including zero-day attacks–before they can compromise endpoints.

One key advantage of CrowdStrike’s solution is its ability to provide real-time visibility and control over all endpoints. Financial institutions can centrally manage and monitor the security of their entire network, including remote and mobile devices, from a single cloud-based dashboard. This level of visibility is essential for rapidly identifying and responding to threats as they emerge, ensuring that sensitive data remains protected.

Threat IntelligenceCrowdStrike excels in providing robust threat intelligence capabilities through its Falcon platform. Threat intelligence is the collection, analysis, and dissemination of information about potential cyber threats, helping organizations better understand and defend against malicious activities. CrowdStrike’s approach to threat intelligence is comprehensive and continually evolving to stay ahead of cyber adversaries.

One of the key strengths of CrowdStrike’s Threat Intelligence is its real-time and global perspective. CrowdStrike continuously monitors and analyzes threat data from a vast network of sensors, endpoints, and organizations worldwide. This extensive data collection allows CrowdStrike to provide organizations with timely and actionable threat insights. Financial institutions benefit from this real-time perspective as it helps them proactively identify emerging threats, zero-day vulnerabilities, and evolving attack tactics before they become widespread.

CrowdStrike’s Threat Intelligence team is staffed with seasoned cybersecurity experts who leverage the collected data to create actionable insights. They dissect threat actors’ motivations, tactics, techniques, and procedures (TTPs), offering a deeper understanding of who is behind attacks and why. This level of granularity is invaluable for financial organizations in terms of making informed decisions about their cybersecurity strategies, adjusting their defenses, and allocating resources effectively.

Incident ResponseCrowdStrike’s Falcon platform offers a robust and efficient incident response solution. Rapid and effective incident response is essential to minimize the impact of security breaches, protect sensitive financial data, and maintain business continuity.

One of the standout features of CrowdStrike’s incident response capabilities is its real-time detection and response. Falcon continuously monitors endpoints, network traffic, and other data sources for suspicious activities and known threat indicators. When a potential incident is detected, CrowdStrike provides immediate alerts to security teams, allowing them to swiftly investigate and respond to the threat. This rapid response is vital in preventing breaches from escalating and causing significant damage.

Falcon’s incident response capabilities also include threat hunting, which is the proactive search for potential threats within an organization’s environment. It leverages global threat intelligence data to identify signs of compromise, unusual behavior, and hidden threats that may not trigger standard alerts. This proactive approach helps organizations stay ahead of attackers and discover hidden threats before they can inflict harm.

Furthermore, CrowdStrike’s incident response services include the ability to contain and remediate incidents effectively. Security teams can remotely isolate compromised endpoints to prevent further lateral movement by attackers. They can also initiate investigations to determine the scope of the breach and the extent of potential damage. Once the incident is contained and investigated, Falcon provides guidance and tools for remediation, allowing organizations to recover quickly and strengthen their defenses against future attacks.

Integration with SplunkThe integration between Splunk and CrowdStrike represents a formidable alliance in the realm of cybersecurity, offering a seamless and comprehensive solution to safeguard digital assets and respond effectively to evolving threats. This integration harnesses the strengths of both platforms, enhancing threat detection, incident response, and overall security posture.

Splunk’s robust data aggregation and analytics capabilities are complemented by CrowdStrike’s cutting-edge endpoint protection and threat intelligence. Together, these platforms create a powerful synergy. Splunk ingests data from various sources, including logs, security devices, and applications, providing real-time visibility into an organization’s security environment. CrowdStrike, on the other hand, excels in endpoint protection, detecting and mitigating threats at the device level. By integrating CrowdStrike’s endpoint data with Splunk’s centralized data platform, security teams gain a holistic view of their environment, allowing for more accurate and proactive threat detection. They can correlate endpoint security events with broader network activity, identifying potential threats in real-time.

The integration also facilitates streamlined incident response. When a security incident is detected, Splunk and CrowdStrike work together to enable rapid containment and investigation. Security teams can leverage Splunk’s data analysis capabilities alongside CrowdStrike’s endpoint data to assess the scope and impact of an incident comprehensively. This collaboration reduces response times and enhances the effectiveness of incident mitigation efforts. Companies benefit from a unified, data-driven approach that empowers them to respond swiftly to security incidents, thereby protecting their critical assets and maintaining regulatory compliance in their respective sector.

Enhancing Your Cybersecurity Posture With Splunk & Crowdstrike When it comes to compliance, cybersecurity is non-negotiable. The combined power of Splunk and CrowdStrike services creates a strong defense against evolving cyber threats. With real-time visibility, advanced analytics, and proactive endpoint protection, these solutions help organizations stay one step ahead of cybercriminals while meeting stringent compliance requirements. As many services continue to embrace digital transformation, leveraging the capabilities of Splunk and CrowdStrike becomes essential in safeguarding sensitive data, maintaining customer trust, and ensuring business continuity in an increasingly interconnected world.

Subscribe to the Hurricane Labs newsletter to stay updated on all things cybersecurity, and get in contact with us if you’d like to discuss your security posture with one of our team members.

The post Strengthening Cybersecurity to Enhance Compliance: The Splunk and CrowdStrike Advantage appeared first on Hurricane Labs.

View Details

IntroductionIf you’re a Splunk admin, there’s an excellent chance you’ve used the btool command to troubleshoot your configuration. This command is the best way to understand configuration precedence in Splunk and what settings in the config files are active in your environment.

One common frustration for an experienced Splunk administrator transitioning to Splunk Cloud is giving up command-line access to the Splunk infrastructure. Not having this visibility and needing to manage apps through the Splunk web interface is definitely a change that can take some getting used to. However, I want to introduce you to a Splunk app that I’ve found that makes this adjustment quite a bit easier.

Introducing Admins Little HelperThe Admins Little Helper for Splunk app brings a familiar command line tool to the Splunk search interface in Splunk Cloud. Install the app in your Splunk Cloud environment (it doesn’t require a restart, at least on the Victoria Experience stacks that I’ve tested), and you’ll have the | btool search command available.

Here’s a video walkthrough of how to get this app set up and what using it looks like:

One great feature of this app is that it will allow you to see the configurations both on the search heads and the indexers. You can do this by running a search with the | btool command and looking at the splunk_server field in the results:

1. Start by running a search using the | btool command. In this example, I’m looking for the wineventlog stanza in props.conf.

2. You will see multiple search results. In this example, there are four events returned. One of these events is from the search head, and the other three are from the indexers.

3. Expand the event and scroll down to the bottom where the splunk_server field is shown. You will see the hostname of the system where the btool command was executed. In Splunk Cloud, hosts with names that begin with sh-i- are search heads, and those that begin with idx-i-** are indexers.

Results from a search head:

Results from an indexer:

Wrap UpHopefully knowing that this tool exists will help you in your transition to Splunk Cloud. I know I’ve definitely found it useful when doing troubleshooting for our clients. If you’re looking for help with managing Splunk Cloud or have other questions, don’t hesitate to reach out to us!

The post Using Admin’s Little Helper in Splunk Cloud appeared first on Hurricane Labs.

View Details

A few members of the Hurricane Labs team spent the last week of October at the Cleveland Information Security Summit conference at the IX-Center in Berea, Ohio. Key members of our team were available for 4 days and had a wonderful time talking to students, women in technology, clients, and prospective clients.

The conference held many great sessions across the 4 days including an interactive tabletop and a surprise special speaking appearance from Meredith Kasper and Tom Kopchak on Wednesday. They spoke on “Splunking a Hydroelectric Dam for the Collegiate Penetration Competition” and spent an hour diving into the fun of investigations in Splunk logs and data onboarding, alerting, competition integrity, and how we use all of this to help our customers.

If you met us at the booth and are interested in our services, please drop us a line via email at sales@hurricanelabs.com or contact us here.

We’ll see you next year!

The post Highlights from Information Security Summit in Cleveland appeared first on Hurricane Labs.

View Details

Financial institutions are entrusted with a vast treasure trove of sensitive data. In this digital age, protecting this data and maintaining customer trust is paramount. Managed Detection & Response (MDR) emerges as a powerful ally for mid-sized financial businesses seeking to bolster their cybersecurity posture.

The Essence of MDRAt its core, MDR is a financial institution’s shield against an ever-evolving cyber threat landscape. In an industry where trust and security are paramount, MDR employs continuous monitoring of network traffic and endpoints, making use of cutting-edge tools like artificial intelligence, machine learning, and behavioral analytics.

The human expertise component of MDR is particularly indispensable, with seasoned security analysts validating and investigating alerts while formulating rapid and efficient responses tailored to the unique challenges of financial services. MDR ultimately combines technology and human vigilance, ensuring the financial sector’s resilience in the face of cyberattacks and safeguarding the stability and trust in the industry.

The Benefits of MDR for Financial CompaniesManaged detection & response offers a myriad of benefits for financial services companies, making it an indispensable component of your cybersecurity strategy.

Rapid Threat Detection and ResponseRapid threat detection and response is a critical aspect of MDR, particularly in the context of the financial sector. Financial institutions handle vast amounts of sensitive data daily, making them prime targets for cybercriminals. MDR, with its continuous monitoring capabilities, plays a pivotal role in fortifying the defenses of financial organizations against these ever-present threats.

MDR’s continuous monitoring oversees every aspect of a financial institution’s digital landscape. It involves the relentless scrutiny of network traffic, user behavior, and system endpoints in real-time. Cutting-edge technologies are employed to establish a baseline of what constitutes normal activity within your systems. Any deviations from this norm, which may indicate potential threats, are promptly flagged for investigation.

One of the primary benefits of MDR is its ability to provide early warnings. When even the slightest abnormality is detected, highly skilled security analysts step into action. They leverage their expertise to assess the situation, validate the alerts, and determine the severity of the threat. This human element is essential as it adds contextual intelligence that automated systems alone cannot provide. In cases where a genuine threat is identified, MDR enables swift and precise response strategies to be executed.

Customized SolutionsThe financial sector is incredibly diverse, with organizations varying in size, complexity, and the nature of their operations. As a result, off-the-shelf, one-size-fits-all cybersecurity solutions often fall short of providing the comprehensive protection that these institutions require. MDR recognizes this inherent diversity and stands out by tailoring its cybersecurity strategies to meet the unique needs and vulnerabilities of each organization.

One of the fundamental strengths of MDR is its ability to conduct thorough assessments and risk evaluations for each financial institution it serves. This process involves a deep dive into the organization’s digital infrastructure, understanding its specific assets, applications, user behaviors, and regulatory requirements. By doing so, MDR providers gain a comprehensive understanding of the institution’s risk profile, enabling them to design a cybersecurity strategy that precisely aligns with its needs.

Furthermore, cybersecurity is an ongoing process. Strategies must evolve as your environment changes, adapting to emerging threats and ensuring your organization remains resilient. This level of customization not only enhances the effectiveness of cybersecurity measures but also provides financial institutions with the peace of mind that they are investing in a security solution that is as unique as their business model and operational landscape. In a field where a one-size-fits-all approach often falls short, MDR’s customized solutions offer a vital edge in safeguarding the assets and integrity of financial institutions.

Enhanced Data PrivacyCompliance with regulations is not just a legal requirement but also a fundamental aspect of building and maintaining trust with clients and partners. MDR plays a pivotal role in helping financial organizations ensure data privacy and regulatory compliance remain robust and steadfast.

MDR’s contribution to enhanced data privacy begins with its comprehensive monitoring capabilities. MDR providers continuously scrutinize network traffic and endpoints to detect any unauthorized access, suspicious data transfers, or potential breaches that might compromise sensitive financial data. This proactive approach allows organizations to promptly identify and rectify any lapses in data privacy before they lead to regulatory violations or data breaches.

Moreover, MDR providers often possess a deep understanding of the regulatory landscape, staying up-to-date with the evolving requirements and nuances of pertinent regulations. This expertise is invaluable in helping financial institutions align their cybersecurity practices with the specific requirements of these laws, safeguarding both their clients’ trust and their legal standing in an increasingly regulated environment.

24/7 VigilanceCyber threats operate on their own schedule and don’t adhere to traditional business hours. MDR brings 24/7 monitoring to the forefront of an organization’s cybersecurity strategy, ensuring that threats are addressed promptly, throughout all hours.

MDR’s continuous, round-the-clock monitoring is like having a security team that never sleeps. This vigilance extends beyond just monitoring network traffic and endpoints; it encompasses the ability to detect anomalous activities and potential threats. This proactive approach is instrumental in identifying and mitigating threats as they arise, minimizing the window of opportunity for cybercriminals to cause harm.

Furthermore, MDR providers understand the importance of swift response to emerging threats. When an alert is triggered, highly skilled security analysts are at the ready to investigate, validate, and take immediate action to neutralize the threat, regardless of the time of day. This rapid response capability is vital for preventing or minimizing the impact of cyberattacks, as cybercriminals often strike when they believe organizations are most vulnerable.

Synergy of Cybersecurity ComponentsMDR represents a sophisticated and multifaceted cybersecurity strategy that covers several crucial components to provide comprehensive protection for organizations. One of its key elements is advanced threat detection systems. These tools employ cutting-edge technologies to continuously scan your organization’s network, scrutinizing every packet of data for anomalies and potential security breaches. By doing so, they can detect emerging threats, including zero-day attacks and sophisticated malware, often before they can inflict significant damage.

In addition to threat detection systems, MDR leverages Security Information and Event Management (SIEM) platforms. These systems are adept at collecting and analyzing data from a plethora of sources within an organization’s digital infrastructure. SIEM platforms excel at identifying patterns and anomalies that might signify a security threat. By aggregating and correlating data from various sources, including network logs, endpoint data, and application logs, SIEM enhances the ability to detect both external and insider threats, providing a holistic view of an organization’s security posture.

The Bigger Picture: Financial CybersecurityIn the intricate landscape of financial cybersecurity, the protection of sensitive data and the preservation of an institution’s reputation are top concerns. In this digital age, where the financial sector is both a prime target and a pillar of the global economy, the significance of MDR becomes even more pronounced. It offers continuous, real-time monitoring that not only identifies threats but orchestrates rapid and precise responses to mitigate them. It customizes its strategies to suit the unique needs and vulnerabilities of each financial organization, acknowledging that one size does not fit all in the realm of cybersecurity.

MDR extends its influence beyond the realm of technology, recognizing the importance of human expertise and proactive measures. It integrates advanced threat detection systems, SIEM platforms, incident response capabilities, and security awareness training programs, fostering a holistic approach to security.

In essence, MDR’s role in financial cybersecurity is not just pivotal; it’s the cornerstone upon which a resilient, trustworthy, and secure financial landscape is built.

Subscribe to the Hurricane Labs newsletter to stay updated on all things cybersecurity, and get in contact with us if you’d like to discuss your security posture with one of our team members.

The post Fortifying Cybersecurity in the Finance Industry with Managed Detection & Response appeared first on Hurricane Labs.

View Details

In today’s rapidly evolving digital landscape, the financial services industry is undergoing a profound transformation. The shift to cloud computing has become a cornerstone of this transformation, offering unparalleled scalability, flexibility, and cost-efficiency. However, with this newfound agility comes cybersecurity challenges that cannot be ignored. As you embark on the journey to migrate critical operations and sensitive data to the cloud, the need for robust cybersecurity strategies is crucial.

Navigating the Cloud Migration LandscapeIn the realm of financial services, where the stakes are high and the regulatory environment is unforgiving, the decision to migrate to the cloud is a strategic one that cannot be taken lightly. It’s a journey that requires meticulous planning, a deep understanding of your unique requirements, and a keen awareness of the ever-evolving threat landscape. When it comes to cloud migration, one size only fits some, and financial institutions must tailor their approach to align with their specific needs.

The first step in navigating this landscape is a comprehensive assessment of your existing infrastructure and applications. This involves identifying which systems are candidates for migration and determining whether they can be moved as-is, require modification, or should be retired altogether. Simultaneously, evaluating the sensitivity and classification of data within these systems is important, as it lays the foundation for the cybersecurity measures that must be put in place. This assessment is a complex process that demands a multidisciplinary team, including IT, security, and compliance experts, working in tandem to make informed decisions about what goes to the cloud and what stays on-premises.

A Proactive Approach to Cloud SecurityBefore embarking on any cloud migration initiative, you must first meticulously identify potential risks and vulnerabilities specific to their operational landscape. This entails conducting a thorough risk assessment that takes into account your existing security posture, the nature of data being handled, and the regulatory compliance obligations that must be met. By doing so, they can gain a comprehensive understanding of the unique security challenges that cloud migration may introduce.

Once these risks are identified, you should develop a clear and well-defined set of security objectives for their cloud environment. By articulating these objectives, you can establish a strong foundation for their cloud security strategy and ensure that all stakeholders are on the same page when it comes to safeguarding data in the cloud. These security objectives serve as guiding principles that influence every decision throughout the cloud migration journey, from selecting the appropriate cloud service model to configuring access controls and encryption policies.

Moreover, this proactive approach extends beyond the initial migration phase. Financial businesses must continuously monitor their cloud environments, adapt their security measures to address emerging threats, and regularly test their security controls through penetration testing and vulnerability assessments. This ongoing vigilance is vital in an era where cyber threats are ever-evolving, and complacency can lead to costly breaches.

Compliance and Data ProtectionIn the highly regulated world of financial services, compliance is an important facet to consider when migrating to the cloud. Strategies must harmonize seamlessly with industry regulations, data protection standards, and legal frameworks that govern the handling and storage of financial data. Financial institutions are entrusted with vast volumes of sensitive information and ensuring its security and privacy is a legal and ethical obligation.

One of the foundational pillars of compliance and data protection in cloud migration is encryption. Financial organizations must employ robust encryption mechanisms to safeguard data at rest, in transit, and even during processing within the cloud environment. This includes both data encryption and key management practices, ensuring that only authorized parties can access and decrypt sensitive information. Encryption not only helps meet compliance requirements but also adds an additional layer of defense against data breaches.

Access controls are equally critical in maintaining compliance and data protection. Financial institutions must implement stringent access policies that govern who can access what data and under what circumstances. Role-based access control (RBAC), multi-factor authentication (MFA), and continuous monitoring of user activities are essential components of a comprehensive access control strategy. By carefully managing user privileges and permissions, you can reduce the risk of unauthorized access and data exposure, thereby upholding regulatory compliance.

Moreover, data residency considerations play a pivotal role in compliance. Many financial regulations mandate that certain data cannot leave specific geographic regions or jurisdictions. When migrating to the cloud, organizations must partner with cloud service providers that offer data centers and storage solutions within these predefined boundaries. This ensures that data remains within the legal confines of the region.

Risk Assessment and MitigationFinancial organizations must recognize that cloud migration introduces a unique set of risks, from potential data breaches to service disruptions, each of which can have severe financial, reputational, and regulatory repercussions. Therefore, a tailored risk assessment process is imperative, one that takes into account the intricacies of financial operations and the stringent compliance requirements governing this industry.

A thorough risk assessment begins by identifying vulnerabilities within the existing infrastructure and applications that are candidates for migration. This includes assessing the security of legacy systems, databases, and applications to determine whether they can be seamlessly moved to the cloud or if they require modifications and enhancements to meet modern security standards. Working in close collaboration with cybersecurity experts who possess domain-specific knowledge of financial services risks is essential. These experts can help you anticipate and evaluate potential threats that might otherwise be overlooked, such as insider threats, targeted attacks, or sophisticated fraud schemes.

Furthermore, risk mitigation strategies must be developed in parallel with the risk assessment. This involves creating a comprehensive plan that outlines how each identified risk will be addressed, reduced, or eliminated. This plan should include detailed security controls, monitoring mechanisms, and incident response procedures specific to your needs and regulatory obligations. By proactively identifying risks and implementing robust mitigation strategies, you can significantly reduce the likelihood of security incidents during and after the cloud migration, preserving data integrity and business continuity while upholding their commitment to safeguarding customer information.

Implementing Cloud Security Best PracticesIn the ever-evolving landscape of financial services, where the cloud is becoming the backbone of operations, implementing cloud security best practices is not just advisable—it’s imperative.

In the cloud, the dynamic nature of resources and services requires constant vigilance. Real-time monitoring and logging help detect anomalous activities and potential security incidents as they occur, allowing organizations to respond swiftly to threats. Coupled with threat detection mechanisms, such as intrusion detection systems (IDS) and security information and event management (SIEM) tools, you can proactively identify and mitigate security risks in the cloud environment. These tools provide invaluable insights into user behavior, network traffic, and system anomalies, empowering you to stay one step ahead of cyber threats.

Furthermore, robust incident response plans tailored to the cloud environment are essential to cloud security best practices. You must prepare for the inevitability of security incidents, ensuring that they have well-defined procedures in place to contain, investigate, and remediate any breaches swiftly and efficiently. These plans should be regularly tested and updated to align with the evolving threat landscape and changing cloud infrastructure. By embracing these best practices, you can establish a robust security framework that not only protects sensitive data but also upholds the trust of clients and regulators alike in an era where cybersecurity threats are a constant reality.

The Role of Expertise in Financial Cloud SecurityIn the financial services industry, where data is the currency of trust, having professionals with deep knowledge and experience is critical. These experts bring a level of insight and understanding that is tailored to the unique challenges posed by cloud migration in financial services.

Cybersecurity professionals with a background in financial services aren’t just well-versed in the general principles of cybersecurity; they intimately understand the intricacies of securing financial data. They grasp the nuances of regulatory frameworks that lay out the stringent compliance requirements governing financial institutions. This knowledge ensures that every step of your cloud migration journey aligns perfectly with the legal obligations that protect both your organization and your clients.

Moreover, experts with a financial services background can provide invaluable guidance on risk mitigation. They recognize the vulnerabilities that are unique to financial institutions and can help you identify potential threats that might not be immediately apparent. These professionals enable you to take a proactive stance, developing comprehensive risk assessment and mitigation strategies that minimize exposure and fortify your defenses against cyber threats.

A Secure and Agile FutureAs you embark on your cloud migration journey, security should be at the forefront. A safe transition to the cloud requires a strategic approach that takes into account compliance, risk assessment, and best practices. Partnering with experts who understand the unique challenges of the financial sector is essential for a secure and agile future in the cloud.

Subscribe to the Hurricane Labs newsletter to stay updated on all things cybersecurity, and get in contact with us if you’d like to discuss your security posture with one of our team members.

The post Cloud Security in Financial Services: Strategies for Safe Migration appeared first on Hurricane Labs.

View Details

In an era of persistent cyber threats, financial institutions must take every possible step to protect their assets and customer data. Penetration testing and purple teaming are vital components of a comprehensive security strategy.

Understanding Penetration TestingPenetration testing, often referred to as “pen testing,” is a simulated cyberattack on a financial system. It involves ethical hackers, or “white-hat” hackers, attempting to breach a system’s defenses to uncover vulnerabilities and weaknesses. The goal is to discover potential entry points that malicious actors could exploit.

The Benefits of Penetration TestingVulnerability IdentificationPenetration testing helps pinpoint weaknesses in the financial system’s architecture, software, or configurations that may be exploited by attackers.

Vulnerability identification through penetration testing is a critical facet of ensuring the robust security of financial institutions. By subjecting their systems to simulated cyberattacks, organizations can uncover specific weaknesses that might otherwise remain hidden. These vulnerabilities could reside in the very architecture of the financial system, its software components, or even configuration settings. Penetration testing allows financial institutions to address these vulnerabilities proactively, taking concrete steps to reinforce their defenses before malicious actors can exploit them.

In essence, vulnerability identification in penetration testing exposes chinks in the armor, enabling organizations to strengthen their security posture and safeguard their sensitive data from the ever-present threat of cyberattacks.

Risk MitigationBy identifying vulnerabilities, organizations can take proactive steps to address and mitigate risks before cybercriminals can exploit them.

The risk mitigation process does more than just expose vulnerabilities; it presents an action plan for potential threats. Once vulnerabilities are exposed through penetration testing, organizations can create targeted strategies to address and neutralize these weaknesses. This may involve patching software vulnerabilities, reconfiguring systems, or bolstering security protocols. The significance lies in the ability to tackle vulnerabilities head-on, reducing the exposure and the window of opportunity for malicious actors. By doing so, organizations can substantially lower the risk of successful cyberattacks, reinforcing their resilience against potential breaches and demonstrating a steadfast commitment to safeguarding their assets and customer data.

CompliancePenetration tests are often required to comply with industry regulations and demonstrate a commitment to cybersecurity best practices.

Compliance is especially important for financial institutions, and penetration testing plays a pivotal role in meeting regulatory requirements. Many industry regulations and standards, such as the Payment Card Industry Data Security Standard (PCI DSS), demand periodic penetration testing as a means to ensure the protection of sensitive financial data.

By conducting these tests, organizations not only adhere to mandated guidelines but also showcase their proactive approach to cybersecurity best practices. Compliance, in this context, goes beyond mere regulatory checkboxes; it reflects a sincere commitment to the security and privacy of client information. Penetration testing also serves as a tangible demonstration of a financial institution’s dedication to upholding industry standards, establishing trust among stakeholders, and safeguarding the integrity of the financial services sector as a whole.

Taking it a Step Further with Purple TeamingPurple teaming builds upon the foundation of penetration testing. It fosters collaboration between the blue team (defenders) and red team (attackers) to enhance security effectiveness. This approach ensures that vulnerabilities identified during penetration testing are effectively remediated.

The Benefits of Purple TeamingRealistic ScenariosRealistic scenarios are the cornerstone of purple teaming, offering financial institutions a unique opportunity to gain profound insights into the intricacies of cyberattacks.

Unlike purely theoretical exercises, purple teaming recreates actual attack scenarios that mirror real-world threats. This approach enables organizations to experience firsthand how an attack could unfold within their specific environment. By doing so, financial institutions not only identify vulnerabilities but also understand the tactics, techniques, and procedures (TTPs) of potential threats. This comprehensive understanding empowers organizations to fine-tune their defenses, improve threat detection, and enhance incident response capabilities.

In essence, purple teaming goes beyond concepts, providing a practical and immersive training ground for teams to proactively prepare for the ever-evolving and sophisticated cyber threats they may encounter.

Enhanced Communication, Collaboration & DefenseBy working together, blue and red teams can develop and test strategies to improve the organization’s overall security posture.

Enhanced defense is a pivotal outcome of the collaborative approach in purple teaming, where the blue team (defenders) and red team (attackers) join forces to bolster an organization’s security posture. This synergy between opposing teams creates a dynamic and constructive environment for security improvement.

Blue teams, armed with their in-depth knowledge of the organization’s systems and defenses, collaborate closely with the red teams, who mimic adversaries’ tactics. Together, they engage in a continuous feedback loop of attack and defense. This process not only uncovers vulnerabilities but also fosters the development and testing of robust security strategies.

By challenging assumptions, refining detection mechanisms, and evolving incident response procedures, the organization can significantly enhance its overall security readiness. Ultimately, purple teaming cultivates a culture of resilience, where security practices are constantly refined, adaptive, and responsive.

Securing Financial Systems with ConfidenceThe realm of financial security is crucial in today’s digital world.. Penetration testing and purple teaming stand as formidable allies in the battle against cyber threats by offering a multifaceted approach that goes beyond traditional security measures. Penetration testing shines a light on vulnerabilities, enabling proactive risk mitigation, compliance adherence, and enhanced cyber resilience. Meanwhile, purple teaming introduces realism, encouraging collaboration between defenders and attackers to fine-tune defenses, develop innovative strategies, and foster a culture of continuous improvement.

By combining these powerful tools, financial institutions can achieve a state of heightened readiness against detrimental attacks. As threats continue to evolve, the benefits of penetration testing and purple teaming become increasingly apparent, ensuring that critical attacks are prevented, sensitive data is safeguarded, and trust in the financial industry remains unwavering.

Subscribe to the Hurricane Labs newsletter to stay updated on all things cybersecurity, and get in contact with us if you’d like to discuss your security posture with one of our team members.

The post The Benefits of Penetration Testing and Purple Teaming for Financial Security Assessments appeared first on Hurricane Labs.

View Details

At Hurricane Labs, we’re committed to keeping you informed about the latest developments in cybersecurity, and today, we’re thrilled to share some exciting news from CrowdStrike. The security landscape is evolving rapidly, and CrowdStrike continues to lead the way as the modern security platform of choice for the XDR era.

This week, at Fal.Con 2023, CrowdStrike unveiled the next generation of the Falcon platform—the ‘Raptor’ release. This update introduces foundational upgrades that promise to elevate your cybersecurity defenses to a whole new level.

What Does the ‘Raptor’ Release Bring to the Table?The ‘Raptor’ release isn’t just an incremental update; it’s a game changer. It’s designed to enhance CrowdStrike’s market-leading endpoint security, cloud security, and identity protection solutions. But that’s not all—it unlocks XDR (Extended Detection and Response) and AI capabilities that add unprecedented value to the Falcon platform.

Here are some key highlights of the ‘Raptor’ release:1. Lightning-Fast Data Handling: With petabyte-scale data collection, lightning-fast data search, and storage capabilities powered by Falcon LogScale technology, you’ll experience unparalleled speed and efficiency in incident investigation. 2. Modernized Detections: The update introduces a fresh and intuitive detection experience for CrowdStrike’s popular EPP (Endpoint Protection Platform) and EDR (Endpoint Detection and Response) offerings. This means you’ll have a more user-friendly interface to work with, making it easier to identify and respond to threats. 3. AI-Powered Analyst Experience: The ‘Raptor’ release reimagines the analyst experience by putting AI at the center of incident management. This empowers security analysts to detect and disrupt increasingly sophisticated adversary tradecraft more rapidly.

What Does This Mean for You?As a Hurricane Labs customer or partner, you’re in for a treat. The ‘Raptor’ release equips you with unprecedented data, speed, and AI capabilities to detect and prevent modern threats. Here’s how it benefits you:

• Accelerated Incident Investigations: Investigate incidents at lightning speed, reducing the time it takes to respond to threats effectively.
• Comprehensive Protection: Close gaps in your attack surface and strengthen your defenses to stop breaches before they occur.
• XDR and Embedded AI: Gain access to comprehensive XDR and embedded AI capabilities to outpace adversaries.

When Can You Expect It?The ‘Raptor’ release will be rolled out gradually to the CrowdStrike partner community and customer base over the next year. The initial wave is set to begin in late September. Rest assured, we’ll keep you informed about the rollout timeline and provide the necessary support to ensure a seamless transition.

Stay Ahead of AdversariesIn the ever-evolving landscape of cybersecurity, staying ahead of adversaries is crucial. With ‘Raptor,’ organizations can harness the power of data at scale and the speed needed to outpace threats. It’s an exciting time for CrowdStrike, but most importantly, it’s a significant advancement for our customers and partners.

At Hurricane Labs, we’re here to help you make the most of these cutting-edge updates. If you have questions about the new capabilities or need support during the rollout, we’re just a message away.

The ‘Raptor’ release from CrowdStrike signifies a new era in cybersecurity. It’s not just about protecting your systems; it’s about proactively outmaneuvering threats. With the right tools and expertise, you can turn the tables on cyber adversaries and keep your organization safe.

Stay tuned for more updates and insights from Hurricane Labs. Your security is our priority.

The post Unlocking the Power of ‘Raptor’: CrowdStrike’s Game-Changing Update appeared first on Hurricane Labs.

View Details

In the Splunk GUI, you can select and enable multiple searches. However, what if you want to enable only a set of searches that match specific conditions?. There’s no built-in way to do this yet, but we can use a Splunk query and a python script using the API to accomplish the task.

Query for the searches you want to enableWe can use a rest query in Splunk to look for searches to enable. For example, if you want to find all ESCU searches for Windows that use the process datamodel:

Copy to Clipboard| rest splunk_server=local /servicesNS/-/-/configs/conf-savedsearches | where match(title, "ESCU") AND match(search, "(?i)datamodel=Endpoint.Processes") AND match(search, "dest") AND !match(description, "^WARNING") AND !match(title, "Linux") AND !match(title, "MacOS")| search action.risk=1 disabled=1| table title eai:acl.app disabled action.escu.analytic_story description searchThis query

1. Uses the rest command to pull in all saved search data
2. Filters using regex matches for searches with
   1. Titles that contain ESCU
   2. Search logic that uses the Endpoint.Processes datamodel
   3. Search logic that outputs the dest field
   4. Excluding deprecated and experimental searches (these have a description that start with WARNING)
   5. Excluding searches with Linux or MacOS in the title

Once you confirm this search contains all the searches you would like to enable, we can…

Output the results to JSONThis will allow us to input the search results into a Python script.

Append the following to the previous search:

Copy to Clipboard| stats values(title) as searches by eai:acl.app | rename eai:acl.app as app | tojson output_field=search_group| stats values(search_group) as search_groups| eval search_groups="[".mvjoin(search_groups, ",")."]"This additional logic

1. Groups the search titles into a multi-value field by app (because the API endpoint needs the app for each search)
2. Outputs the results to a JSON field named search_group
3. Groups all the search_group values into a single multivalued field named search_groups
4. Joins the search_groups field together into a valid list we can copy into our script The scriptCopy the output of the search_groups field from the query into this script:

Copy to Clipboardimport requests# IP or hostnamehost = "127.0.0.1"# Usually 8089mgmt_port = "8089"# Get the value of the splunkd_* cookie after authenticating to Splunk webauth_cookie = ""search_groups = headers = {'Authorization': f'Splunk {auth_cookie}'}for search_group in search_groups: for search in search_group['searches']: url = f"https://{host}:{mgmt_port}/servicesNS/nobody/{search_group['app']}/saved/searches/{search}/enable" response = requests.request("POST", url, headers=headers, verify=False) if response.status_code == 200: print(f"Successfully enabled {search}.") else: print(f"Failed to enable {search}. Response code: {response.status_code}")Before running

1. Update the host variable to your search head’s IP or hostname
2. Update the mgmt_port variable if needed
3. Then copy the value of the splunkd_8443 cookie from Splunk web into the auth_cookie variable
4. Paste in the results from the query into the search_groups variable (don’t wrap it in quotes, it needs to be a valid list)

Once all the variables are correctly set, run the script. It will take some time to run depending on the number of searches because it’s one API call per search at a time, but it’s much faster than manually going through and clicking enable.

This method is useful when bulk enabling rules for use in RBA, correlation rules, or to just see what alert volume looks like for a large set of rules. From here, if you’re trying to get actionable alerting from a large set of alerts at once, I recommended using correlation rules such as Active Directory Privilege Escalation Identified. Rules like this look at the risk index for multiple rules from the same analytic story triggering from the same host. To tune further, you can identify which rules are involved in the correlation rule most often. Adding exclusions if you can, or disabling the rule if there is no consistent benign activity triggering the rule.

The post Splunk Tutorial: How To Bulk Enable Splunk Searches appeared first on Hurricane Labs.

View Details

.conf23 has wrapped up, and what an incredible journey it's been! For the first time, Hurricane Labs proudly sponsored the event, interacting with customers, partners, and devoted blog enthusiasts. Our main focus? Diving deep into the digital resilience theme, Splunk’s continuous dedication to broadening its horizons beyond mere security to holistic business and IT [...]

The post Data Resilience, Insights, Action! Recapping Splunk .conf 2023 appeared first on Hurricane Labs.

View Details

Introduction One of my least favorite features in Splunk is KV Store - mainly, because whenever I have to deal with it as a Splunk administrator, it’s broken in some horrible new way that I need to figure out. The goal of this post is to capture one of these troubleshooting adventures that we [...]

The post Splunk Tutorial: KV Store Troubleshooting Adventures appeared first on Hurricane Labs.

View Details

JSON is a fantastic logging format and Splunk has built in support for it. However, when dealing with JSON logs, there’s a certain field structure that can be a little tricky to manage: The issue here is that Splunk will extract these fields as name=foo and value=bar by default. I’ve tried a couple [...]

The post SPL Tricks: Dealing with Nested Name-Value Pairs in JSON appeared first on Hurricane Labs.

View Details

As cybersecurity enthusiasts, we don’t miss any chance to participate in events that challenge our skills and support up-and-coming security professionals in the process. That’s why it was a thrill to represent Hurricane Labs at the Northeast regional event for the Collegiate Cyber Defense Competition (NECCDC 2023). Meredith Kasper and I were a part of the Red Team. The purpose of this team is to load up the competition with targeted attacks. It’s the perfect opportunity for student competitors to get the full experience of triaging attacks against their infrastructure.

This year’s event was especially notable because all of the infrastructure was hosted on Amazon Web Services (AWS). The scope also included the AWS management console, which immediately piqued my interest as an attractive target.

In this blog post, I’ll share my expert approach for red-teaming an AWS environment. As we dive into the intricacies of AWS security, I’ll also equip you with the best security tips to safeguard your own AWS environment.

Mounting an AWS Attack Our first access to the competition infrastructure is typically achieved via a credential compromise – similar to many of the attacks out there today. During NECCDC, students are typically given a list of default credentials at the start of the event. As red team members, we often find a way to get a hold of these too.

The educational opportunity here is pretty simple: assume default credentials are compromised.

The most interesting column in this sheet for me was the one labeled “AWS”.

First, I had to determine the AWS account IDs. This task was accomplished with a simple curl request to the AWS metadata URL on the instances we had access to. From there, I began logging into every account in the sheet and got a sense of what I could do from every role.

Key observations: * Every user had the ability to log into the AWS management console * Users on the sales team had full access to a public S3 bucket * Users in the engineer role had full access to EC2 permissions * Users in the security role had a custom permission scoped to managing IAM roles, but this didn’t allow adding new roles to existing or new users * One user (scornelissen) had additional permissions beyond the engineering role

While this base level of access was interesting, many of the first attempts to escalate permissions didn’t work. Specifically, I wasn’t able to add higher permissions to an existing user or group, or create a new user and assign any role. While this was a setback, I went searching for other options that would allow me to gain more access.

AWS Access KeysThe discovery that the users on the security team had significant permissions around IAM roles was interesting. I ended up discovering that it was possible to generate an AWS access key for the currently logged in user. However, I could also generate an AWS access key for any other user in the organization. This meant that, while I couldn’t add new users, I could hijack any existing account and assume the permissions of that user. I could also change the password for the account as well.

With these access keys, it was then possible to use the AWS API to modify existing accounts. I could also reset passwords for users with higher levels of access.

Here’s a screen recording of the entire privilege escalation process. This shows an account takeover of a team’s administrative account from a user with lower permissions.

This was the breakthrough I needed to take control of every team’s AWS account, and further establish persistence into the AWS environment. We had a stack of AWS access keys, and went to work.

We worked together as Red Team members to inform teams of our presence, such as making some “updates” to their public facing website:

Obviously, having your public-facing website look like this isn’t a great image to show to potential new clients.

Since the goal of the Red Team is to differentiate teams, we need to impact scoring. We accomplished this by making some “improvements to AWS security groups”…

…as well as saving the teams on their AWS costs by downsizing instances and then shutting them off (because we like saving money on the Red Team).

How did the teams respond?The good news is that the majority of the teams took note of the compromise of their AWS environments. Additionally, they worked together to try to remediate any issues.

First, it was necessary for teams to identify how we got in and how we were accessing their accounts. Fortunately, the competition infrastructure team was nice enough to provide each team with functional AWS CloudTrail logging. This gave teams visibility into all of the Red Team-related account shenanigans. By watching these logs for suspicious activities, they could identify accounts that were used maliciously. Subsequently, they could change credentials and revoke access keys. Teams that were most effective at removing our access entirely, typically employed a strategy of keeping a continuous watch of the CloudTrail logs.

By the end of the event, around half of the teams had completely removed all of the (known) Red Team access into their AWS accounts. Of the three teams that placed 1st, 2nd, and 3rd, all of them regained control of their AWS account by the morning of the second day. Kudos to these teams for quickly figuring out a way to navigate the attacks and secure their environments.

AWS Security Recommendations from this NECCDC 2023 Experience: Let’s put ourselves into the student teams’ shoes. You’ve just been given control of a pre-existing AWS environment, you have no idea of the state of security, and need to secure it. What do you do?

• Change Default Credentials: It’s a good idea to assume passwords are compromised. Additionally, assume that you don’t know if any credentials are outside of the control of trusted and authorized individuals. Best practice is to force a password reset for all users. You can communicate new credentials to users via a mechanism where you can validate whether or not they’re ending up in the right hands.
• Audit User Accounts: Access to the AWS management console should only go to users who need it. Does your sales team need access to the AWS console? Probably not. The principle of least privilege is key here.
• Audit IAM Roles: Review all of the IAM roles present in your environment, especially custom ones. Roles that allow wide permissions changes should be tightly controlled. Also, limited permissions should be assigned to users based on their job function.
• Maintain Control of Your AWS Root Account – And Don’t Ever Use It: Normal administration should be accomplished by using accounts with assigned permissions. The root account should be stored securely for emergency use only, and not day-to-day operations.
• Audit AWS Access Keys: Review all AWS access keys that have been created. Revoke any that aren’t actively being used, and rotate any that are known to be used legitimately. Consider alternative API access mechanisms that don’t grant the same level of administrative control. Establish policies for access key rotation.
• Audit S3 Buckets: S3 buckets should generally not be publicly accessible. Many breaches and information disclosure attacks have involved S3 buckets that were intentionally made publicly available.
• Enable CloudTrail: Ensure you are capturing AWS CloudTrail events. Even better – forward those events to a SIEM such as Splunk and set up alerting for unauthorized access!
• Assume Your Systems are Compromised: Don’t trust anything. If the AWS environment itself has been compromised, there’s a good chance that there are also outstanding issues with the servers and software running on your cloud infrastructure as well.

Due to the complexity of AWS and the number of services, this list is not comprehensive. However, it is a good starting point to locking down access to your cloud environment.

Why this is beneficial to me:My day job at Hurricane Labs mostly involves Splunk consultation and implementation. So you’re probably wondering, “hey Tom, why do you do this stuff?” The truth is – I enjoy the fact that it’s a learning experience for everyone involved.

Red-teaming exercises like this are a fun challenge. I get to figure out how to get and maintain access to a bunch of systems, often while learning something new in the process. While I’ve done some AWS administration before, performing an offensive attack against 10 identical corporate networks entirely hosted in AWS while also trying to figure out how to escalate privileges and maintain access was a new and fun experience for me. And I think both the student teams and I came out more familiar with AWS and its various security controls along the way.

Special thanks to Hurricane Labs for giving me the support to participate in these types of events. Due to their support, I’ve been fortunate enough to be able to participate as a Red Teamer in this region since 2018, and am looking forward to being back next year as well.

The post NECCDC 2023: Red Team Adventures appeared first on Hurricane Labs.

View Details

As a cybersecurity leader, you know that security is the foundation of your business’s success. Not only are you responsible for proactively monitoring and responding to threats, but also ensuring compliance with up-to-date regulations.

But who has the time? It can be an overwhelming task to stay on top of all these changing variables without compromising security – which is where managed cyber security services come in.

With an experienced team of experts and advanced technologies at your fingertips, finding proactive solutions to protect against vulnerabilities and malicious attacks gets easier (and less expensive) than ever before.

In this blog post, we’ll take a look at the key benefits offered by managed cyber security services – so read on for more information.

Cost SavingsOne of the biggest advantages of choosing a managed service provider is cost savings.

What are the financial benefits of a Managed Security Services Provider (MSSP)?* Companies can reduce their overhead costs, * They no longer have to maintain an in-house team or invest in expensive tools, and * Less budget burdens and allow for a focus more on other areas of the business.

Expertise Another benefit of using a managed service provider is access to expertise and experience.

How do MSSPs have so much more expertise on their teams than the average business?* MSSPs employ experts in cyber security, * They have professionals who understand the latest threats and how to manage cybersecurity systems effectively to protect against them, and * They provide regular assessments so any potential issues can be addressed quickly.

Scalability Finally, using a managed service provider offers scalability for businesses as well.

What do services providers do to make sure they can keep up with organizational changes?* When an organization’s needs change, MSPs can easily adjust their services, * They can do so without disrupting operations or compromising security measures, and * They empower businesses to quickly scale up or down depending on demands without having to worry about costly investment in additional personnel or resources.

Looking for a Managed Cyber Security Services Provider?Managed cyber security services offer a wealth of benefits for organizations.

When you choose to work with an MSSP, you can save costs in the long-term and have confidence knowing that your data is in safe hands. Additionally, the expertise of the MSSP team combined with their ability to scale with your needs enables you to never miss a beat in responding to threats—or take advantage of emerging trends that are beneficial to your daily operations.

It may feel daunting nowadays, but with the right protection measures in place, any organization can ensure that its digital infrastructure is secure and compliant.

If you think managed cyber security services would be a good fit for your business, Hurricane Labs can provide comprehensive solutions that meet your budget and specific needs. Let us help protect your data so you can keep moving forward without disruption.

Talk to an Expert TodayThe post Managed Cyber Security Services Benefits: A Rapid-Fire View appeared first on Hurricane Labs.

View Details

Are the myriad of cyber security threats overwhelming your Splunk Security SOC team? Are you looking for a way to automate your response processes and streamlining your cyber security operations? Consider investigating SOAR – Security Orchestration Automation and Response. One of the most popular cyber security solutions currently available on the market, SOAR could be exactly what your team is looking for. In this blog post, we’ll dive deep into understanding what SOAR is and how it works so that you can make the best decision for your organization’s security program.

Put in simplest terms, Splunk SOAR automates many tasks that are related to cyber security. Automation allows organizations to gain an increased visibility into their IT environments and gain actionable intelligence into potential threats – and in a way that cuts down on the overwhelm occurring across security teams today.

But let’s break it down even further.

First, what’s the difference between Splunk SIEM and Splunk SOAR?The Splunk SIEM and Splunk SOAR cyber security solutions are distinct technologies that provide complementary capabilities for optimizing SOC performance. When leveraged together, these powerful solutions heighten the level of security monitoring effectiveness – giving organizations the assurance they need to operate with confidence.

SIEMThe SIEM, or Security Information & Event Management, technology provides essential situational awareness for your IT security operations – aggregating and correlating relevant data from multiple sources to generate actionable alerts. Utilizing advanced analytics, SIEM technologies are finely tuned by security professionals to mitigate false positives so true threats can be identified faster; however, the sheer volume of alerts can be overwhelming for any SOC team tasked with prioritization and remediation.

If you’d like to learn more about Splunk Enterprise Security as a SIEM, check out our related blog post: Understanding Splunk ES and Its Role in Cybersecurity.

SOARSOAR allows security teams to tackle and quickly respond to the mountain of alerts produced by their SIEM. By automating response processes, gathering important data and managing cases efficiently, a successful integration with secure alerting systems helps create adaptable incident responses on-demand.

It’s time to explore the various elements and benefits of SOAR. Let’s dig in.

When it comes to the SOAR cyber security acronym, what does orchestration really mean?The term ‘orchestrating’ refers to an advanced machine-driven coordination of a series of interdependent security actions across a complex infrastructure, which ensures that different tools — mostly security focused but also non-security ones — coexist harmoniously and interact with each other. In this manner, Splunk SOAR enables enterprises to gain context around potential breaches and incidents, allowing analysts to go beyond mere alert management and instead focus on investigating the root cause of the problem. Splunk SOAR is thus a powerful asset in any organization’s cyber security arsenal.

tl;dr Fast, Machine-Driven Coordination – Connecting security actions across complex infrastructures, enabling unified security operations. * Deep, Contextual Insight – Data is aggregated to provide incident-specific context as well as a comprehensive overview of the environment. * Enhanced Investigation & Response –* Teams can leverage dashboards and other visuals at every step of the discovery, investigation, and response action process.

What are the advanced benefits of the automation element of Splunk SOAR?Splunk SOAR automates many of the repetitive, manual tasks that security analysts are often bogged down with, such as alert triage and incident response. This frees up time for analysts to focus on more strategic tasks, such as threat detection and prevention.

In addition, Splunk SOAR’s automation capabilities help ensure that incidents are dealt with quickly and efficiently, minimizing the impact on your organization. When it comes to threat detection, threat triage, and decision-making, each of these stages and more can happen in seconds with automation and without human involvement.

tl;dr Task Automation – Removes repetitive and manual tasks that cause alert fatigue. * Rapid Incident Response – Ensures incident handling is efficient to minimize business impact. * Seconds, Not Hours –* Threat handling actions can occur in seconds – and without analyst involvement.

Additional features of the Splunk SOAR cyber security solution: Case ManagementA case in Splunk SOAR is a container that consolidates multiple events into one incident. Splunk SOAR provides workbooks for case management. Case management lets users codify a standard operating procedure into a reusable template and assign tasks to collaborators.

App IntegrationApps can be integrated and connect your Splunk SOAR cyber security solution with other security technologies to coordinate workflows. Hurricane Labs can help you from start to finish with your Splunk SOAR deployment, including custom SOAR app development. Let us know if we can help.

Playbooks Playbooks are a series of automated security actions across tools. Furthermore, pre-made playbooks and an accessible visual playbook editor are both available in Splunk SOAR. Additionally, with a services provider like Hurricane Labs, you can also gain the customized development of SOAR playbooks set up specifically for your unique environment.

Overall, what does Splunk SOAR help security teams accomplish? Splunk SOAR brings tremendous benefits to security teams by increasing efficiency and allowing them to delegate mundane tasks to machines. This frees up time for more complex projects, enabling the team members to focus on more impactful initiatives.

The post Splunk SOAR Cyber Security: A Comprehensive Overview appeared first on Hurricane Labs.

View Details

With the ever-evolving threat environment, it’s more important than ever to understand how Splunk cyber security capabilities can help protect enterprise data. Having a deep understanding of how Splunk ES (Enterprise Security) can monitor and protect data will not only boost security confidence but also increase productivity within an organization.

Whether you’re just starting out with Splunk ES or looking for ways to increase its effectiveness, this blog post will give you valuable insight into how its features can help protect against today’s cyber threats.

Here are some of the topics covered:

• An overview of the Splunk ES key components.
• How Splunk ES integrates with other systems for better security.
• The role of correlation searches and analytics in detecting potential threats.
• An explanation of the different data sources that Splunk ES can monitor.
• Understanding the best practices for using Splunk ES to monitor cybersecurity threats.

“Having a deep understanding of how Splunk can help monitor and protect data will not only boost confidence but also increase productivity within an organization,” says Kelsey Clark, Director of Splunk and Security Marketing at Hurricane Labs. “Fortunately, the Hurricane Labs team has the breadth and depth of Splunk-focused experience to help our customers experience great success with leveraging our capabilities across their Splunk for security use case.”

With this information in mind, teams will have a better understanding of how they can utilize Splunk technology. With Splunk ES, teams can gain an unprecedented level of visibility into what’s happening within their networks and take proactive steps toward prevention. So don’t delay – start exploring what Splunk ES has to offer today.

What is Splunk ES? Splunk ES is an innovative solution to modern security management, giving powerful insights into your organization’s overall cybersecurity. It gives security teams a comprehensive overview of the risks and threats your business faces – so you can protect it on a massive scale.

The robust alerting and investigation capabilities that come along with Splunk enable teams to quickly identify and respond to any threats, while customizable dashboards and reports allow stakeholders to easily track and analyze trends in their data.

It’s worth noting that Splunk ES is especially powerful with the help of a Splunk-powered Managed Security Provider such as Hurricane Labs. Either through your own Splunk professionals or with our Splunk experts, you can integrate Splunk with a SOC platform and create custom alerts, searches, and workflows tailored to fit the individual needs of your team. Splunk empowers teams with the real-time actionable insight needed for a comprehensive security program.

In short: Splunk ES gives you the tools to take comprehensive control over your Splunk cyber security operations.

Need help with your Splunk ES use case?Let’s connect to discuss your requirements and find out how the Hurricane Labs experts can help.

Book Your Free ConsultationSplunk Enterprise Security Key ComponentsYou can deploy Splunk Enterprise Security (ES) both on Splunk Enterprise and Splunk Cloud, which enables advanced SIEM use cases. Either of these solutions allow you to collect, analyze, and correlate massive amounts of network and machine data in real time. When you manage ES through a web browser, Splunk provides security teams relevant, actionable intelligence to effectively respond to threats and manage security processes.

Key ComponentsEach of the following components handles segments or roles of data handling or processing activities.

Processing Components: * Splunk Forwarder – Forwarders ingest data. There are two types of Splunk Forwarders: 1. The Splunk Universal Forwarder, and 2. The Splunk Heavy Forwarder. The Universal Forwarder inputs data, performs preprocessing on the data, and then forwards the data to the indexer. * Splunk Indexer – Used for data parsing and indexing. The indexers receive and store the data being forwarded from the forwarders. They also search the data in response to search head requests. Indexers make it easier to perform search operations. * Search Head – Graphical user interface (GUI) where users can search, analyze, or report data based on key words. Ultimately, this component performs the search management function. The search head consolidates the results from the indexers and serves them to users.

To find out more about how the data flows through Splunk Enterprise, check out the data pipeline information in Splunk docs.

Leveraging Splunk Cyber Security Capabilities for Advanced Security OperationsSplunk ES is the go-to option for cyber security experts. This powerful app provides an effective, robust means of defense against threats from email, web browsing, social media accounts, and other sources by monitoring incoming traffic for malicious activity or indicators of compromise (IOCs). With its integrated SOC capabilities and easily customizable settings to keep up with dynamic needs, Splunk ES offers complete visibility into your network environment so that potential risks or bad actors can be swiftly identified.

Splunk offers the following advantages for your SOC: * Real-time insight into the status of your security, * Single dashboard with centralized insights, * Provides actionable insight for threat analysis and incident investigation, and * Reduces false positives and other false alarms across your security infrastructure.

“With Splunk ES we are able to keep up with the ever-changing threat landscape and ensure our customers’ data is secure,” says CISO at Enterprise Financial company and valued customer of Hurricane Labs. “The combination of sophisticated analytics tools with built-in monitoring and visualization capabilities makes it an ideal choice for any security team looking for comprehensive protection.”

Additionally, security analysts are able to use collected data to build out SIEM use cases and intelligence profiles on detected threats for decisive action when necessary. Interested in how to build effective security use cases? Check out our recent blog post to better understand how you can build SIEM use cases that are best for your business.

How does Splunk ES integrate with other systems for enhanced security?Integrating is the process of bringing together and connecting the component subsystems into one system. Fortunately, Splunk is integration friendly. Splunk ES integrates with existing SIEM tools – such as network firewalls and multi-factor authentication tools (MFA) – and leverages machine learning algorithms to identify suspicious activity in your network traffic. Additionally, Splunk apps can be leveraged to further functionality across the platform and with no limitations.

You can use Splunk ES to monitor user behavior, detect anomalies, track threats across multiple systems, and respond quickly in the event of an attack. However, it’s good to note that custom integrations may be necessary to fully connect your systems and navigate complex environments. That’s where Hurricane Labs comes in.

If you need assistance full integrating Splunk Enterprise Security into your environment – and even managing it – our experts have what it takes to help you succeed.

What are correlation searches and advanced analytics that help security teams detect and defend against modern threats?Data collection helps you capture all relevant events from across your IT infrastructure and store them in a centralized location for easy access. With event analysis and correlation rules you can detect suspicious activity by analyzing events from multiple sources in real time. Dashboards and reports provide visibility into your security posture in an easy-to-understand format that allows you to identify potential risks quickly.

A correlation search is a type of scheduled search that lets you detect suspicious patterns in your data. You can configure a correlation search to generate a notable event when search results meet specific conditions.

Splunk Docs provides a great overview of how you can plan the use case for the correlation search. As indicated in the tutorial, you “create a correlation search to address a security use case or problem that you want to solve. If you want to know when vulnerability scanners scan your network, or a high number of devices are infected with the same strain of malware, you can create a correlation search to detect that behavior and alert you. Correlation searches allow you to search across one or more types of data and identify patterns that could indicate suspicious or malicious activity in your environment.”

Along with correlation searches, Splunk ES enables security teams to defend against threats with advanced security analytics and intelligence that provide focused detection and specific alerts to shorten triage times.

What are the different data sources that can be indexed and analyzed by Splunk Enterprise Security?Splunk can support any data type. Organizations are able to leverage different apps and add-ons that best suit business needs.

Hurricane Labs has identified eight data types that are important for SOC engineers and managers to be aware of for a comprehensive SIEM implementation. You can download The Big 8 PDF here.

If you’re looking for a more in-depth view of data source planning, check out the Splunk docs article about data source planning for Splunk Enterprise Security.

Splunk ES Best Practices for Monitoring Modern ThreatsWhen you’re leveraging Splunk ES as your SIEM solution, the main number one best practice is: whatever you’re going to do, make sure you do it with a plan.

This is where having specific SIEM use cases in mind come in handy. This is because you want to build alerts around those use cases. In addition, have an idea of how your data will be used as it’s only as good as the data you put into it.

More best practices to come! Stay tuned for our upcoming blog post that does a deep dive into Splunk Enterprise Security monitoring best practices.

In Summary To sum up, Splunk’s cyber security solutions are a powerful tool for any organization looking for better visibility into their security posture. With Splunk ES as the core of an organization’s SOC, it provides comprehensive security coverage for organizations in all industry verticals. Specifically, Splunk offers a complete picture of an organization’s security posture enabling Splunk cyber security teams to act quickly in the event of an attack attempt.

If you need help achieving these goals with your current or new Splunk ES deployment don’t hesitate to reach out. Hurricane Labs’ Splunk experts are here to support your success through our years of experience managing Splunk cyber security use cases at scale with high reliability services and protection.

The post Understanding Splunk ES and Its Role in Cybersecurity appeared first on Hurricane Labs.

View Details

It’s no secret: cybersecurity isn’t a one size fits all world. Every organization has different needs and complexities, which means that the usefulness of the security use cases you develop will vary depending on what your business does.

And now you’re probably wondering, “How do I find out which security use cases are worth investing in?” Well before we answer that question let’s take a look at some of the basics.

What is a SIEM?A SIEM, or Security Information and Event Management, is a powerful tool for security teams to gain visibility into their environment. By providing quick alerting, SIEM technology enables a SOC, or Security Operations Center, to not only detect malicious activity but also respond appropriately during time sensitive situations.

The core element of successfully leveraging this solution? You guessed right: security use cases!

In order for organizations to be successful, their SIEM must have business-specific use cases. Having a security use case strategy will help security analysts spend more time on valuable tasks and less time dealing with alerts that are unimportant to business operations.

Security Use Case ConsiderationsA good place to start when developing your use case strategy is to create a threat profile that identifies any risks that could affect your environment. There’s always something that needs protection, so make sure you consider your threats fully before moving forward.

Here’s a list we’ve made before for reference, but be aware these are just examples:

• Industry Vertical
• Operating Regions
• Business Requirements
• Company Assets and User Types
• Personally Identifiable Information (PII)
• Insider Threats
• Apps and Services
• Security Products / Tools
• Adversary Behaviors / Trends
• Cyber Security Incidents

Build the Best SIEM Use Cases for Your BusinessSecurity teams will quickly become overwhelmed with alert fatigue when they don’t have proper plans in place. Without an effective way to manage security use cases, an organization risks creating too many use cases, which can lead to wild and out of control SIEM, or visibility gaps, which are an additional security issue.

The Joker would never agree with this, but in order to make sure everything goes smoothly it’s essential to have a plan for your SIEM.

These are our top 6 pro recommendations for you.

1.) Frame Your Security Use CasesOnce you’ve considered the threat landscape and better understand your business-specific security risks, it’s time to define your use cases based on risk-driven insights.

Pro Tip: By building use cases that are relevant to your environment, security teams can avoid scope creep (i.e., use cases that end up expanding beyond their management or monitoring capabilities) and ensure they stay on track.

2.) Identify Specific Data SourcesThere are a lot of different data sources out there and you need to make sure that the information is relevant for your top priority risks. The sooner you identify which data sources are most appropriate for your needs, the better.

Pro Tip: It’s important to focus on your prioritized objectives first. If you have the license and capability, then data from “just in case” data sources may be brought in–additional context will always come in handy during an investigation!

3.) Apply Data-Powered AnalyticsChoosing the right data analytics can help identify anomalies quickly. This will also help ensure your SIEM is aligned with your objectives.

Pro Tip: Don’t get caught up in the moment. Before you try to perform complex analytics, make sure that the simpler SIEM use case analytics can be managed first before you advance further.

4.) Catalog Your Use Case SetSIEMs can be expensive to implement and maintain. Organizing your use cases into families and subfamilies will help you maximize efficiency while also ensuring optimal return on investment.

Pro Splunk Tip: If you leverage Splunk Enterprise Security, you will want to use Analytic Stories. This capability provides contextual and actionable guidance to help you better define your use cases and organize your content.

If you need any help, Hurricane Labs specializes in providing custom Splunk SIEM capabilities for our customers!

5.) Prioritize Your Use CasesAgain, there are many ways that deploying use cases that have not been built for your business requirements may decrease the effectiveness of a SIEM. This is especially true for security teams that do not have the advanced skill sets to handle the complexity of their use case deployments.

Pro Tip: Determine which use cases should take priority before deploying them.

6.) Understand the Use Case Life CycleSecurity use cases go through multiple stages–including planning, deployment, and evaluation–that need to be managed to ensure their effectiveness.

Pro Tip: You should review your use cases at regular intervals, such as once a year or more often if necessary, to make sure they still align with the originally intended goal. During your review, include any new data ingested into your SIEM, or that are still relevant to your organization and current level of defensive measures.

Download The Quick Reference e-Guide NowHow Managed Services Providers Can Play a Meaningful Role in Your SIEM SuccessThe challenge of supporting mission critical tasks can be a major roadblock for many security teams. A good strategy to help enhance your cybersecurity posture is using a SIEM, but it takes the necessary staffing and tools required with this type of system so they are effective in their purpose.

The best way to keep your business secure is with an expert by your side. With the help of a dedicated managed services provider (MSP), like Hurricane Labs, you can rest assured knowing that all aspects will be taken care of! They can help you determine which security measures are most important, create custom detection rules or automate processes; all while providing complete implementation and administration of these solutions with ease!

Hurricane Labs is an MSP that helps businesses optimize their Splunk security solutions. We ensure you’re following best practices and driving success for your organization’s data protection strategy with our experts on board!

We’re here to ensure that your SIEM is up and running with the right partner for success. Let us know if you would like to schedule a consultation to learn more about our services.

The post The Ultimate Guide to Building Effective Security Use Cases appeared first on Hurricane Labs.

View Details

As a security professional, you know that while technology is an important tool to prevent malicious activity from becoming a real problem in your environment, it’s only part of the equation. A well-designed Security Operations Center (SOC) is essential for protecting your enterprise against the ever-evolving risks that come with modern technology.

So how do you build an effective SOC?Building a SOC requires many considerations; proper planning will enable you to effectively monitor threats, respond swiftly when an attack occurs, and maintain secure compliance standards. Through this blog post, we’ll explore seven proven best practices to consider when building a productive and robust SOC that can withstand any security challenge thrown its way.

Let’s get started.

Follow these seven best practices to help you build a SOC and ensure its success1. Understand the feasibility of your project before you start to build a SOC.Establishing a successful Security Operations Center (SOC) starts with an in-depth feasibility assessment, which should be done early on. Such assessments must account for all usual variables, such as budget and personnel capacity, while also including various other factors that may have an effect on the overall outcome.

For instance, proper staffing is a key factor in the effectiveness of any security operations center. Having the right number of personnel directly impacts capability–if 24/7 monitoring isn’t feasible, then it can create an environment where success is unattainable.

Not sure you have the capabilities to build or manage a SOC on your own? Discover the advantages of a Managed Security Services Provider and learn why it’s essential for round-the-clock security operations–all detailed in our related blog post.

1. Determine what services are desired. The main functionality of a SOC is to provide monitoring and incident response. However, a SOC may provide additional services depending on unique needs of an organization. These services may include malware analysis, vulnerability management, and digital forensics.

It’s important to ensure the desired service expectations of a SOC–creating greater clarity around the expectations and responsibilities an efficient SOC will deliver.

1. Develop your use cases and data sources. Use cases–how users will interact with your systems–should be developed for monitoring purposes. These use cases should be relevant to the organization and must be worth alerting. Knowing the organization’s environment can enhance this so that critical assets are prioritized.

You’ll want to:

• Determine the data sources for your use cases,
• Consider relevant threats and incidents to monitor for.

Depending on the organization’s goals, certain use cases may be developed for compliance purposes. If these compliance alerts do not need to be analyzed thoroughly, then automation–which can be supported by SOAR–may make them more efficient and reduce stress on the SOC.

1. Choose cohesive, flexible technologies.A SOC may utilize many technologies for their services. These technologies must be chosen wisely to ensure the SOC fulfills their goals.

SIEM and SOAR solutions are often paired together for monitoring and incident response. The chosen technologies should be tailored to the organization’s environment and needs.

1. Select your preferred SOC model.There are three models of SOCs that should be considered based on an organization’s needs and desires: dedicated, outsourced, and hybrid solutions.

2. A dedicated SOC provides the most control and visibility, but may have an increased cost.

3. Outsourcing a SOC to a third-party like an MSSP may be cheaper than establishing a dedicated SOC.

4. A hybrid solution would outsource some responsibilities of the SOC to a third-party.

5. Define organization-relevant metrics.An organization can use metrics collected for the SOC to identify areas for improvement and make informed decisions. These metrics must be measurable and relevant to be helpful. The metrics may also be used to determine how successful the SOC is running currently, and where it should be in the future.

6. Integrate documentation methods into the process. The process of documenting is essential to many information technology functions, and a SOC heavily utilizes documentation. Policies, procedures, problems, exceptions, and other information should be thoroughly documented to ensure that they are clearly defined and that the information is available for future use. SOC analysts in particular may use many documented playbooks for different use cases.

Bottom LineA SOC can provide invaluable peace of mind and protection for your organization, but only if it’s done right. There are a lot of moving parts to building a successful SOC as well as maintaining it, but it’s only worth it if you can make it work. If you need help getting started or want someone to take the reigns, reach out to Hurricane Labs. Our experts would be more than happy to assist you.

Additionally, you’re looking for more about setting up a SOC, be sure to check out our two-part podcast about it:

• Designing a SOC: Internal or External? Part 1
• Designing a SOC Part 2: Successful partnerships with MSSPs The post Building a SOC: 7 Best Practices to Consider appeared first on Hurricane Labs.

View Details

As companies rely more and more on technology to do business, it becomes increasingly important for employers of all sizes to be aware of the security risks. Ensuring company data, devices, and records are secure is a top priority for every organization—no matter its size.

But how exactly can you keep your digital assets safe?

Here we outline seven best practices for business security. These security tips will not only keep malicious actors at bay but will also empower your workforce with the policies and procedures they need to feel confident in their day-to-day tasks.

Check out the previous blog posts in our cybersecurity best practices series–highlighting both personal security and employee security to help you stay safe.

1. TrainingNecessary business security best practice for your everyday employees

Training may be common sense, but adequate training and appropriate training are not.

Employees need to be trained on how to spot possible infractions on organizational security and defuse the situation appropriately. That said, most training programs organizations of all sizes use are laughable at best and are typically seen as a waste of time by employees.

Like any other kind of training, security training should be more than an e-learning and a quiz. It should be a real, practical example of an event that has a high probability of happening.

People typically learn best by being able to relate what they’re reading, watching, and/or hearing to a real-world example that they can place themselves in. It does no good to tell people to read a 40-page document and take a quiz at the end just to be able to say “user X took the assessment, they are culpable in the event something happens now”. That’s not how security works–that’s not even how training works.

Much like compliance standards, simply checking the box is not the solution to security training.

Employees need to understand, implement, and execute security best practices inside the organization. To accomplish this objective, the training needs to feel like a real threat to them.

A useful, real world analogyEveryone thinks about their house burning down because of the oven being left on at one time or another. For employees, that same sense of urgency and skepticism needs to happen in their security thought processes. Every employee needs to be able to say, “Hey, that’s not right. Who are you? Why are you here? Can I see your credentials? Why isn’t someone accompanying you?”

Pretend anyone you’ve never seen before is an oven that was left on and the organization is the house that it’s going to burn down if the appropriate measures aren’t taken.

1. PolicyNecessary business security best practice for your everyday employees

Business security policies are the framework for everything else inside an organization’s security planning. Policies will vary from business to business. They can be as simple as “no social media sites from the corporate network” to more advanced strategies such as “disabling all removable media and wifi connections on workstations within the facility”.

Through the use of policy in an organization, employees can be held accountable for not meeting the explicitly written criteria for access to company resources, malicious external entities, etc. In the event of foul play, the policy agreement can be used for enforcement of disciplinary actions.

Not only does policy help protect the employee and the organization through the easy reminder of “hey, you signed this NDA or acceptable use policy”, but it also allows the organization to change the requirements of employees to match the ever-changing environment in business.

1. AntivirusNecessary business security best practice for your everyday employees

Antivirus is another important measure for business security strategies, because a good product will stop the majority of threats to assets.

Most antivirus solutions provide a decent layer of security for the user. They’ll typically block and/or remove most malicious software downloaded from the Internet or that come through email attachments.

Stated previously, any antivirus is better than no antivirus.

Many organizations implement solutions like Symantec Enterprise Protection or Trend Micro Enterprise security suites to protect their networks from the most common viruses, malware, and malicious attachments.

Enterprise grade antivirus/anti-malware products are typically a centrally managed security as a service (SaaS) solution. These solutions utilize policies and groups configured in a management console on a dedicated system to handle updates and malware alerting within the network.

1. FirewallsNecessary business security best practice for your everyday employees as well as some more sophisticated recommendations

Firewalls are the most common network security appliance in any organization. They’re often the most expensive as well. Not only is there the initial cost, but then you have the ongoing maintenance and configuration as the needs of the business shift. A common phrase heard throughout the InfoSec community after a compromise or breach, which has also become a bit of a joke about weak security practices, is: “But, we have a firewall!”

Unfortunately, many organizations simply purchase a firewall, perform the initial configuration, and leave it sitting in a rack somewhere never to be touched again–leaving them incredibly vulnerable to new attacks.

The business necessity side of the argument:The key to firewall success is to continually audit, update, and generally maintain a firewall setup to achieve the highest possible level of security. At the very least, and I’m talking bare minimum, an organization should be tending to the firewall any time a change is made to the system, updated on a monthly basis, and audited quarterly to coincide with compliance requirements, and so forth.

Used in conjunction with additional resources and strategies for securing information assets, firewalls can provide a layer of protection to deter most broad-spectrum attacks.

The advanced security level side of the argument:This is based on the methodology by which the firewall is configured. The best way to configure a firewall, despite the increased overhead for administration and configuration hours, is to leverage the Deny All rule.

The Deny All rule comes standard in any firewall default configuration and you can build upon it by whitelisting services that are approved for your environment. Unfortunately, the common practice–not necessarily best practice–is to put a firewall into play, start with the Allow All rule, and start blocking the bad stuff. While this generally closes up holes in the environment, over time, you’re still leaving your business open to vulnerabilities until someone on your security or IT team gets around to doing that actual configuration.

In the long run, building your firewall policies via whitelisting against a Deny All rule can be cumbersome for whomever is in charge of configurations and maintenance. However, it’s important to note that it allows for more flexibility and straightforward configuration than the reverse of trying to block all of the bad stuff.

1. Physical / Facilities SecurityNecessary business security best practice for your everyday employees as well as some more sophisticated recommendations

With regard to physical and facilities security in an organization, the infosec community could literally write a book on the topic (and has). Two examples that come to mind are The Complete Guide to Physical Security by Paul Baker and Daniel Benny and The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick. Everything from the front door lock, through how you authenticate for authorized access to a server room, is included in this topic.

I aim to cover some of the basic best practices in the industry. Keep in mind that just like other areas of information security, there’s no one-size-fits-all solution or methodology for every business environment.

Part of physical security also involves the training of employees to be on the lookout for certain behaviors in individuals and how to handle specific requests.

One of the most common ways to breach a company is through a physical penetration test via social engineering (previously touched on in the second part of this series). An individual posing as a contractor, or perhaps a utilities employee requesting access to sensitive areas of the facility, is an easy way for them to get in. After getting in they can plant keyloggers and various tools used to exfiltrate data like usernames, passwords, or create a way for them to get into the environment through a backdoor from the outside.

It is, in fact, such a common methodology for intrusion that an entire sector of the information security industry is devoted to the physical penetration test. The idea during a physical penetration test is to find out how far into an organization’s facility you can get and how deep into sensitive areas you can reach before people call you out and want to confirm who you are and what you’re doing.

Physical security has three basic components: access control, surveillance, and testing. Access control, like in software solutions and network security, revolves around limiting who can get in without proper authorization and authentication methods.

Surveillance involves watching the facility, the happenings therein on a day-to-day basis, and monitoring for suspicious activity. =

Testing involves periodic auditing and testing of all access controls and surveillance methodologies and processes in place within the organization to ensure that it is actively reviewed and improved upon.

Access control for a facility seems like an easy task at first, but in reality there are a number of things that the average planner and/or project manager takes into account in this realm of physical security. Often overlooked are things like company growth and changing needs on an organizational basis. There are stipulations put in place by compliance standards, such as PCI or HIPAA, that involve the company as a whole and don’t focus simply on “IT needs”; however, they ensure that the desired control mechanisms and the access control system itself work together and are tuned and maintained properly. As with many information security components, physical security is not a “set it and forget it” situation and is always going to be changing with the needs of the organization.

Surveillance for a facility is typically handled through the use of CCTV and similar camera approaches. Video recordings of people entering and exiting the building perimeter, server rooms, documents/records areas, anywhere that contains sensitive equipment or data can assist in the general security of a facility. It is not the end-all solution for facility security management and should be treated like every other component of securing an environment: it needs tuning along with policies and procedures to back it up.

Testing is probably the most important factor in facilities security because it’s literally the only way you’re going to be able to find out if the security implementations that are in place are working as intended, or if they need to be reworked to account for various situations. The testing phase should be completed with an internal test as well as an external test to achieve a better sense of where the loopholes are in logic and facilities penetration.

1. IDS/IPS & Anomaly DetectionAdvanced business security best practice

Intrusion Detection and Prevention systems (IDS/IPS), when tuned properly, are an effective way to monitor and prevent external attacks against an organization’s network. Through the use of rules that look for matching parameters in packet data, an IDS/IPS can literally stop an attack in its tracks. These systems act as border guards for your network waiting for any and all traffic that is passing through before it reaches the firewall. In the event that malicious traffic is passed by the IDS/IPS systems, in theory, a properly configured firewall can stop it before it enters the network. These systems also create log data for analysis and further tuning of the environment’s protection measures.

There are many vendors and solutions for IDS/IPS implementation. Options for the open-source realm come in the form of Snort, Bro, and Suricata, or there are proprietary solutions through the likes of FireEye, CheckPoint, McAfee, and others.

Implementing these devices into your environment is not necessarily the easiest task; they take a lot of patience, configuration, know-how, and tuning by your security and IT teams to operate in an efficient manner that is conducive to a well-rounded, stable, heightened-security environment.

1. SIEM / SOC UseAdvanced business security best practice

SIEMs create an environment where the security team can gain visibility into what’s actually happening on the network. These tools, if used correctly, bring together the concepts of Security Information Management as well as Security Event Management. This combination adds capabilities to an organization’s environment. SIEMs allow for data aggregation, correlation, alerting, dashboards, compliance data, historical retention, and the ability to have data on hand for forensic analysis. One of the common SIEM tools in the industry is Splunk Enterprise Security.

While SIEMs may be commonplace throughout the information security industry as a logging method and analytics tool, I will note that it is no easy task to simply get the useful data.

SIEMs are not a set it and forget it solutionSIEMs fall into a more advanced business security scenario in this context because it isn’t a simple set it and forget it solution. SIEMs require a lot of insight into how an organization’s systems and network behave. It monitors what users are (not) allowed to do and how implementations of web filtering, antivirus, and access/authentication/authorization measures cooperate and interact in the environment. It also has the ability to tune out the noise and get the real, raw, important data.

Most organizations want to leverage this machine data with a supplementary Security Operations Center (SOC). A SOC is where individuals tune the SIEM, create dashboards and reports for business use, and analyze alerts that come in for actions taken against the organization’s environment. This kind of situation requires a higher level of communication and transparency between the organization’s IT personnel and the SOC to truly get the value out of the implementation.

Clear expectations must be considered about things like what should be alerting and what shouldn’t, what is important to the organization to monitor, and so on. These expectations should also be paired with existing security practices, policies, and procedures, along with any risk assessment and mitigation documentation, to better assist in the realm of compliance and organizational security.

ConclusionA key takeaway from this series: Security isn’t a set it and forget it scenario.

Each part of your security program must undergo regular reviews to align with business objectives and to keep up with the constantly evolving threat landscape. After implementing measures, don’t forget to test and optimize them for optimal protection. It’s also important to do so without sacrificing user experience too much–otherwise, if it gets to a point where it’s too cumbersome to use, no-one will abide by it.

Save yourself time and stress. Consider reaching out to an experienced managed security service provider–like Hurricane Labs (we offer penetration testing too). Not only will an MSSP ensure your organization is compliant with safety standards, but also that it reaches a higher level of maturity in terms of business security protection.

The post 7 Cybersecurity Tips to Protect Your Business appeared first on Hurricane Labs.

View Details

In the first installment of our cybersecurity best practices, we explored how individuals can safeguard their personal data. But just as vital to security is employee security awareness and protecting important information within an organization. One wrong move by employees could have major repercussions not only for themselves but also across the company’s reputation.

Part two delves into the steps employees should take to ensure protection. From password to mobile device precautions–all are necessary employee security measures to prevent vulnerable exposure in the workplace.

1. PasswordsGood for everyday security users

The same set of rules from the first part of the series apply with employee security as well.

RecommendationsIf you want to keep your work accounts secure, don’t rely on weak passwords like “lovemyjob123” or even worse–using the same passwords across both personal and professional accounts. Rely instead on strong, unique combinations of letters, numbers and symbols. It’ll give attackers one less vector for infiltrating sensitive data.

Like in part one, you should also use a solid password manager like Bitwarden. Password managers can handle all of your work accounts as well as generate secure passwords for you.

1. Email UseGood for everyday security users

Using personal email for business activities–and vice versa–is the wrong thing to be doing.

As an employee you are more likely to be the target of phishing scams and malicious emails at your company email address. For your personal email address, you are more likely to receive the “Hot Girls in your area” or “Low-cost Viagra” spam email.

Both of these kinds of emails are malicious and obviously not desirable–and can cause serious damage in both environments.

1. Mobile DevicesGood for everyday security users

Many organizations have a “Bring Your Own Device”–or BYOD–employee security policy in place for employees to use their personal cell phones for work. If this is the case, there are likely many policies in the company’s handbook for acceptable use on these devices.

It should go without saying, but I’ll say it anyway: “Regardless of company policy, DO NOT put company information on your personal device.”

This means no email on your personal phone, no photos of client sites or the server room, or any part of the facility. No texts with your boss or coworkers about things relating to work.

If you’re out to dinner and you leave your phone on the table, there’s the chance that someone could swipe it while you’re not paying attention. If all your data and company data is on that phone, now it’s gone.

RecommendationsIf your organization offers a BYOD employee security policy, it’s better to keep your company data separate from your personal. The reason is because if your device is compromised for any reason, your data and the company’s data is vulnerable.

Some vendors like Samsung offer a sandbox environment–called Knox by Samsung. A sandbox is an environment keeps your personal data and business data separate and requires different authentication for each profile/mode, if it’s set up correctly.

Additionally, most organizations should be utilizing a Mobile Device Management (MDM) platform. The purpose here is to control the security, patching, and access the mobile devices in their environment have. One such case, using the example of a device being stolen, would be that the next time the device can check in via an internet connection, the MDM administrator can set it to wipe the data.

1. Unauthorized / Non-Company DevicesGood for everyday security users

This might seem trivial, but don’t plug in random devices that you find laying around the office or anywhere else.

One of the fastest ways to compromise a computer is to count on an employee plugging in a random flash drive. It could be one they find in the parking lot or in the break room somewhere after a “red team” operation has taken place. And just by opening it up, someone has compromised the physical building via social engineering or other means.

RecommendationsThe best employee security policy is to take any unidentifiable device to the IT department to have them investigate. They are more likely to have a sandboxed environment–or test machine–they can use that’s off-network and exists solely for the purpose of this kind of event.

Devices that cannot be confirmed to belonging to the company, such as flash drives, external hard drives, SD Cards, phones, and laptops, should be immediately removed from active use. They should also be disallowed to connect to the company network or any sensitive equipment within the organization. Plugging in or connecting these devices opens up your workstations, servers, and network to malware, backdoors, rootkits, keyloggers, and ransomware through auto running executables, and malicious files.

1. Illegal ActivityGood for everyday security users

Illegal activity on a company network is a common occurrence and can lead to information leaks.

Music streaming, movie streaming, illegal downloads (torrents), and pirated software on a network can have serious consequences from a legal, financial, and information security standpoint. Using software that connects to random places on the Internet to download files and/or stream media can result in the download of malware or remote access software.

An exampleImagine for a moment that your boss found that you were torrenting illegal applications on the company network and hardware to use in your environment to accomplish some task. Not only are you liable for any damages caused by the illegal downloads, but the company will be liable for any financial costs in licensing or legal fees to right the wrong caused by your actions. Plus, there could be further reaching implications because of this activity including (but not limited to) company reputation loss (resulting in financial losses), confidential data disclosure such as proprietary code or paperwork, and customer or personnel data.

That pirated copy of photoshop you downloaded so you could make the image for the latest blogpost, memo, or website change prettier? Yeah, that could have just cost you your job, the company thousands of dollars in damages versus hundreds in licensing, and contracts with clients that keep the lights on for the business.

The point is, don’t do these things on company time, the company network, or on company systems. If you do, you can open yourself up to legal trouble, unemployment, malware, data disclosure, and a damaged reputation.

1. PhishingGood for both everyday security users and advanced users

Phishing is almost exactly like it sounds: fishing for information. This attack is the attempt of a malicious third party to exfiltrate data or have an employee perform some kind of action by spoofing communications, typically via crafted email or website. The objective is to gain access to and defraud an account. Phishing targets anything from usernames and passwords, credit card numbers, all the way to high-dollar money transfers.

As the saying goes: “If it sounds too good to be true, it probably is”.

When it comes to phishing attempts, this is all too true.

The free iPad spam email that requires you to sign into a site with your credentials to redeem your prize? That’s a phishing attempt. The sudden redirection to a dropbox.com account sign-in page without a prompt? That’s is a phishing attempt.

If you receive an email you weren’t expecting from your bank about a money transfer authorization, it’s probably not real. To be sure, separately search for your bank’s phone number, don’t use any data or links for that email, and confirm with the actual bank what is happening.

An exampleIn the example image below, a wire transfer request was made by a phisher through a VERY convincing email message purporting to be USAA.

One way to ensure your safety in the event of a phish attempt is to take a look at any links within an email. That is, don’t click on them, but hover your cursor over them and check the URL that it would be sending you to.

For example, hover your cursor over this link: www.google.com. The link text says it’s google.com, but the actual hyperlink points at yahoo.com. This is a non-threat example, but this very basic tactic is used in phishing by assuming that a user is going to simply click on the next in front of their face without question. Sadly, this happens all too often.

Pictured here is an example Email from Cornell University https://it.cornell.edu/phish/4113.

These crafty emails and websites are not always easy to identify. Even the most careful and observant user can be hit by the phish.

Recommendations1. Be suspicious, be wary, stay frosty. 2. A well-known security vendor in the industry, SonicWall, created a Phishing IQ Test. So if you’d like to take a stab at checking your phishing identification skills, this is a helpful tool. 3. If your employer is not already leveraging a phishing or security awareness training program, such as Cofense, implementing one is very important.

1. Social EngineeringGood for both everyday security users and advanced users

In the context of information security, social engineering is the manipulation of people into performing actions or giving up information. However, social engineering is usually just one small piece in a grander puzzle for exfiltrating data from an organization’s systems.

Objectives and methodsAwareness of the various attacks types as well as the objectives of malicious actors are both beneficial to your employee security program.

The primary goal of social engineering is to gather intelligence on an organization, its employees, and its processes. How an organization handles visitors and/or navigates breaches is part of both the reconnaissance phase as well as the gaining access phase of the hacking lifecycle.

The end-goal in most social engineering activities is to gain at least one set of credentials. Typically, they’ll be aiming for credentials with elevated access privileges such as an administrator account–or at the very least a power user account.

Social engineers attack remotely through phishing attempts as well as via email or mock web pages. They also do it in person through the use of clever tactics too.

Giving out personally identifiable information or sensitive company details through things like phone calls is another valid form of social engineering.

A recent Twitter post, by another infosec community member, stated that she heard an employee at a company blatantly give out a credit card number clear as day over the phone; including the expiration date and security code… This kind of information disclosure can be incredibly damaging to a company as well as to the employee.

You need to be cognizant of who can hear or see sensitive data any time you access it.

There’s also plenty of opportunity for onsite social engineering.

As an employee, it’s your job to be paranoid and cautious of people who come into your workplace. The front-desk receptionist needs to vet anyone who walks in the front door before they’re allowed any further into the facility. Once the visitor is confirmed and authorized, they should be accompanied at all times, by an employee of the department they’re visiting, to reduce any potential opportunity for social engineering tactics to be used.

RecommendationsEmployee awareness of any work being done in their immediate work area is critical. Policies that train those in the area of which they work need to teach to watch out for a new person in your area. Locking computers when not in use, is another super important tip. Also, the awareness that leaving any sensitive information out in the open view opens up the opportunity to “shoulder surf”. These are the best practices to remove the risk of social engineering success.

Wrapping it upUltimately, in the world of cybersecurity, there is no such thing as being too cautious. By following the steps laid out in this blog post, employees can take active measures to prevent themselves from becoming a weak link in their organization’s security system.

I’ll leave you with these words of wisdom:

When in doubt, throw it out!

This is an old saying that connects to preventing food poisoning. This concept also applies to information security, from an employee perspective, because you don’t want to “poison” your confidential and/or sensitive data. So get rid of anything that doesn’t smell quite right.

Stay vigilant and stay secure out there.

The post Employee Security – 7 Best Practices to Consider appeared first on Hurricane Labs.

View Details

Does waking up each morning to an earful about the latest cyber disasters leave you worried about your personal security? With all ransomware attacks, identity theft scams, and countries hacking one another, it’s enough to make anyone wonder…

How about starting off with a cup of clarity instead?

In this blog post, we’ll cover essential security basics that’ll protect you from online scams, phishing sites, and malicious malware looming around the internet today–no matter what level of user you are.

Arm yourself against risk and take control over personal security now.

1. Password ReuseGood for everyday security users

Password reuse is still the single biggest and most pervasive of the personal security habit flaws today. The problem is that reusing passwords across multiple online accounts leaves you–and anyone in connection with you–vulnerable to exploitation.

To put it in plain, blunt English: DO NOT use the same password for Facebook as you do for your online banking account. You’re just making it too easy for the bad guys to use it.

Example: A bad situation for password reusersIf you’re still shrugging your shoulders and not sure if you should bother reading on… let’s take a look at an example of how bad this could really be.

You might’ve noticed the news stories back in 2013 about the Yahoo breach that culminated in over 1 billion accounts being compromised.

Think about that for a minute… 1 BILLION accounts.

Let’s assume that half of those people used the same password for their online banking services. That’s 500,000,000 possible breaches of bank accounts worldwide–minimum!

It only takes the compromise of ONE service, and then the rest that use that same password will quickly be in the same sinking boat. Not to mention, once an account is compromised, across the rest of your identity is a snap, even for the most unskilled of attackers. Pivoting means using the first compromise point to move or pivot around and gain access to other systems on the network.

Recommendations1. Be aware of the perils of password reuse, 2. Invest in stronger authentication protocols: Duo or Google Authenticator are a couple multi-factor authentication options, and 3. Understand how a password management program works–and use one–it’ll make your login life a lot less of a headache. We recommend Bitwarden and 1Password as being good options for personal security for users of all experience levels.

1. Password CreationGood for everyday security users

Next, enter: password creation.

Passwords these days have a bunch of rules that go along with creating them. They must be a certain number of characters long, have both an upper and lowercase letter, a number, and a special character. These rules are in place for a very important security reason…

And that is because commonly used words and numbers make cracking a password pretty darn easy. This is a problem that can be easily fixed:

Stop using your kids’ birthdays as passwords and pins. Stop using your favorite color, season, or your pet’s name. These are all weak in the world of passwords. They also are also typically easy to find on the internet or via social engineering–one of the prominent attack methods malicious actors use to acquire a user’s credentials.

Plug: Password managers are coolFortunately, by using a password manager, you won’t have to think up any passwords–except the one you use to log in to your password manager vault. The password manager will generate strong passwords for you!

As an extra layer of personal security precaution, it’s a good idea to choose something unrealistic when it comes to the password confirmation or reminder question. And then save the “answer” in your password manager too. This will remove the possibility that someone is able to ask you enough questions about your life to figure it out.

So do any of your current passwords fall into the top likely passwords list? If so, you might want to consider changing those.

Recommendations1. Be aware of the security risks that come along with easy to guess passwords as well as the advantages of using complex passwords. 2. Again, give a password manager a go, if you’re not already using one. 3. You can also use the Password Strength Meter to test your passwords.

Note: Despite their claims that they don’t document input data, I would suggest NOT using an actual password for your accounts in the Password Strength Meter. Doing so presents a security risk. This tool should only be put to use as a demo.

If you like, have your password manager generate a strong password and enter that password into the Password Strength Meter to see how strong it really is.

1. Multi-Factor AuthenticationGood for everyday security users

Multi-factor authentication is an invaluable security measure to protect your online accounts–for personal security as well as every level of security. By combining something you have with something you know, it creates a complex scenario for malicious actors instead of using easily guessed credentials–deterring most credential theft activities.

Two-factor authentication (2FA) or multi-factor authentication(MFA) can come in a variety of forms.

Examples include a physical key card that’s required in addition to a password or phrase to gain access to account. Or, more commonly, a randomly generated code with a validity timer that’s tied to your account on an authorized device you own (the something you have). This is paired with your password (the something you know) to add an extra layer of identity authentication to your data.

Multi-factor implies that more than two resources are involved in the authentication process. For example two-factor authentication (2FA) would be a password + fingerprint, multi-factor authentication (MFA) might be password + fingerprint + pin + randomly-generated-key.

RecommendationsDuo or Google Authenticator are two widely used authenticators that are recommended by security professionals–for personal security as well as employee security. By following the provided links, you will find it’s easy to implement them!

1. AntivirusGood for everyday security users

This one should go without saying, even for the most careful of us in the IT and infosec world. No antivirus (AV) software is perfect and will be able to catch 100% of the bad stuff coming your way online.

Not to mention, many AV solutions will flag non-malicious items–meaning the use of an AV solution may come with having to do some application-specific configuration. For example, explicitly allowing known-good programs–known as whitelisting–or setting up allowed ports–if your AV includes a firewall and/or active web monitoring.

RecommendationsUltimately, any antivirus solution is better than no antivirus solution.

Common products you can find off the shelf at any electronics retailer do most of the hard work for most folks–products like Trend Micro Internet Security or Norton 360. Even that free stuff you find from your niece or nephew that “knows all about computers” like Avast Antivirus and AVG; they’re better than nothing at all.

For paid software, I like Bitdefender Internet Security as it covers multiple PCs and it’s highly rated based on all its available features: antivirus, anti-malware, and web filtering. It can even help you protect your sensitive data through the use of its proprietary wallet system, which launches your banking sites in a secured, sandboxed–meaning separated from the rest of your computer–web browser.

For free software I actually really like the latest versions of Microsoft Defender built into Windows 10 and Windows 11. It’s constantly up to date with the latest signatures, has become more robust in its coverage and capabilities, and is generally out of the way of your day-to-day computer use.

If putting down a chunk of money for a paid software for all your devices isn’t in the cards as far as your personal security goes, that’s okay. You can take solace in the fact that you can get by with the built-in AV of the Windows ecosystem.

1. Secure BrowsingGood for both everyday security users and advanced users

Although secure browsing is subjective–to some it’s never ever visiting a website that could possibly harm your computer and to others it means disabling the bits of code that can expose your computer to malware.

The solution here is to use a browser that is NOT Internet Explorer or Microsoft Edge*. If you can, switch to Google Chrome or Mozilla Firefox at a minimum.

Why do you want to use Chrome or Firefox? Because they offer extensions or add-ons from a vetted store of sorts that can help protect you online–and Internet Explorer cannot.

These extensions are built by third party developers and are hosted on a Google or Mozilla server for download as additional functionality for your browser; think app-store for your web browser. The majority of security alerts that our SOC sees on a daily basis come from visiting sites. Specifically, those in a highly vulnerable browser that just runs whatever code it sees on the page and hopes for the best.

Back to the extensions, there are a few that can help you out but might take a little bit of configuration.

By default, these extensions might make some websites unusable, or at the very least odd-looking. Such extensions for Google Chrome are called ScriptSafe, Ghostery, and uBlock Origin. For Mozilla Firefox, the add-ons you would want to look at installing include NoScript, Ghostery, and Ublock Origin.

*Microsoft Edge is a Chromium (Chrome) based browser and does have an extension/add-on library. However, because it’s the de facto web browser in Windows now, you should treat it similarly to Internet Explorer overall.

Recommendations1. Keep in mind that your results may vary based on your browsing habits and how you choose to set these add-ons up. 2. For a minimalist approach, I recommend starting with ublock Origin–in either Chrome or Firefox–to get a taste of how it works, and then move on to bigger and better things with the other options added in. 3. Good to know: These browser extensions will stop all auto-executing code snippets on a website from actually processing if they match a predefined list of known threat signatures. Additionally, Google Chrome use Google’s own threat lists to block known harmful sites by default. You should consider Chrome the primary alternative browser to use.

1. PGPGood for advanced users

What is PGP? Glad you asked.

PGP, or Pretty Good Privacy, is an encryption method that provides privacy and authentication through the signing, encrypting, and decrypting of texts, emails, files, directories, and disk partitions. What it does is use a combination of hashing, compression, and symmetric-key cryptography in conjunction with public-key cryptography to encrypt data that is sent to external parties.

In essence, PGP works by creating a public and private key pair that ties to your username, an email address, or another account of some kind. That pair is used to encrypt data and authenticate the sending entity.

For example: Encryption of plaintext data (i.e., gmail) is handled with a one-time (secret) session key. The session key is then encrypted using the user’s public key. This is so the email that’s sent over the wire is only seen as the ciphertext and key.

Decryption of the message is then handled by the recipient’s private key to decrypt the session key. And then that session key is used to decrypt the ciphertext in the message so that the original plaintext can be seen.

Looking for more information on PGP? The Electronic Frontier Foundation (EFF) has a great writeup on PGP, what it does, and how it works on various operating systems.

RecommendationsGnuPG for Windows, Mac, and Linux.

1. Disk EncryptionGood for advanced users

For Windows:

Windows 8.1 and Windows 10 offer device encryption, but only if you’re signed into a Microsoft Account and on supported hardware configurations. Furthermore, to enable BitLocker for a more robust encryption methodology, you must be using a Professional or Enterprise edition of the Operating System.

However, there are other options for disk encryption in Windows. These come in the form of third party tools such as DiskCryptor or VeraCrypt, which have their own licensing terms, uses, and limitations.

For OS X:

The primary way to do full disk encryption on your Macintosh is to use the FileVault encryption method built into OS X.

For Linux:

Most mainstream Linux distributions, such as Ubuntu, offer whole disk level encryption. This encryption can be set up during the installation phase along with home folder encryption.

What does whole-disk and/or device encryption do for you?

In terms of device theft or loss, without the hardware/device passphrase–which should also be strong–the device would have to be wiped to be usable by anyone else.

Please note that some advanced forensics tools can still pull data from an encrypted device in some cases. However, this is incredibly time consuming and is likely only to happen via state-sponsored attackers or law enforcement agencies. The goal here is not to protect the device, it’s to protect the information it holds.

Best to you on your personal security journeyNo one is exempt from the threats that exist online today. By understanding the basics of personal security best practices, you’re less likely to fall prey to scams or cyber attacks. Keep these tips in mind–and share them with anyone who could use a little extra protection for their personal information too.

Want to learn more about security best practices in the workplace? Be on the lookout for our next blog post about employee security.

The post 7 Ways To Improve Your Personal Security Right Now appeared first on Hurricane Labs.

View Details

If you’re like me, you love Splunk. It’s an amazing tool for monitoring and troubleshooting your systems. But there’s one thing that can drive a Splunk sysadmin crazy–high CPU usage. With this in mind, I’m going to show you how to identify and reduce high CPU usage in Splunk Stream.

Let’s get started!

Introducing Splunk StreamFirst, a little about the Splunk App for Stream.

The advantage of this Splunk app is that it allows for the collection of wire data from many different source types that might be otherwise difficult to capture in Splunk.

As a matter of fact, at Hurricane Labs we use Splunk Stream to collect DNS event data as part of our comprehensive security alerting services. However, despite being admirers of the app’s capabilities, deploying it has been known to take a toll on CPU utilization of the server managing distributed Stream forwarders.

If you’ve had this happen to you, just know, you’re not alone!

Troubleshooting symptoms of high CPU usage in a distributed Splunk Stream deploymentIn a distributed deployment mode, you have a Splunk Enterprise instance that functions as a management node for the Universal Forwarders which are collecting data. The Splunk Enterprise host runs the splunk_app_stream app, and the Universal Forwarders (UFs) run the Splun_TA_stream app.

Get an informative overview of this type of deployment with Splunk’s helpful diagram.

Now, once you’ve configured a distributed Splunk Stream deployment, you may see high CPU utilization on the Splunk Enterprise instance where splunk_app_stream is configured. This is often due to the overhead of a large number of Stream UFs sending traffic to a web address on your system, https:///en-us/custom/splunk_app_stream/ping. By default, this ping event happens every 5 seconds.

To view incoming requests, you can tail the splunkd_ui_access.log and observe incoming requests. At this point, if these logs are flying by, there’s a good chance this is the cause of the high CPU utilization you are seeing.

Sample LogsBelow you will see sample logs. Note that all these events occur in around 3 seconds.

Copy to Clipboardsplunk@splunkdemo:/opt/splunk/var/log/splunk$ tail -F splunkd_ui_access.log192.168.1.252 - - [06/Dec/2022:09:53:30.547 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2315ms192.168.1.15 - - [06/Dec/2022:09:53:30.112 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2839ms192.168.1.4 - - [06/Dec/2022:09:53:30.268 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2754ms192.168.1.20 - - [06/Dec/2022:09:53:30.094 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2979ms192.168.1.135 - - [06/Dec/2022:09:53:30.317 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2854ms192.168.1.99 - - [06/Dec/2022:09:53:30.379 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2818ms192.168.1.20 - - [06/Dec/2022:09:53:30.444 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2914ms192.168.1.5 - - [06/Dec/2022:09:53:30.493 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2866ms192.168.1.211 - - [06/Dec/2022:09:53:30.129 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 3317ms192.168.1.60 - - [06/Dec/2022:09:53:30.141 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 3317ms192.168.1.12 - - [06/Dec/2022:09:53:30.579 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2886ms192.168.1.135 - - [06/Dec/2022:09:53:30.383 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 3082ms192.168.1.12 - - [06/Dec/2022:09:53:30.483 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2987ms192.168.1.71 - - [06/Dec/2022:09:53:31.096 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2376ms192.168.1.36 - - [06/Dec/2022:09:53:31.239 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2457ms192.168.1.89 - - [06/Dec/2022:09:53:31.280 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2478ms192.168.1.4 - - [06/Dec/2022:09:53:31.360 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2746ms192.168.1.36 - - [06/Dec/2022:09:53:31.287 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2826ms192.168.1.13 - - [06/Dec/2022:09:53:32.113 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2066ms192.168.1.31 - - [06/Dec/2022:09:53:31.254 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2981ms192.168.1.10 - - [06/Dec/2022:09:53:31.304 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2951ms192.168.1.76 - - [06/Dec/2022:09:53:32.187 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2258ms192.168.1.21 - - [06/Dec/2022:09:53:32.192 -0500] "GET /en-us/custom/splunk_app_stream/ping/ HTTP/1.1" 200 527 "-" "SplunkStream/8.1.0" - - 2264msYou can further confirm the issue by logging into the Splunk Enterprise instance, opening up top on your terminal, and pressing the c key to view the command associated with each process.

In this example, you’ll see a large number of Python processes running that are related to rest_validate_streamfwdauth.ValidateStreamfwdAuth.

The number will vary depending on the number of clients checking in. However, when I see this issue occurring, there’s always a bunch of these that show up pretty consistently while watching the process list refresh.

Now that you’ve identified this problem, let’s fix it.

The solution to the high CPU utilization problemRemember when I mentioned that the default ping interval in stream is every 5 seconds? As you can imagine, this can result in a significant number of incoming connections to your Stream server, which then results in a high CPU utilization situation.

The fixTo fix this issue, you’ll need to apply a streamfwd.conf to the Splunk_TA_stream app that you are pushing out to your Universal Forwarders running Stream and collecting data. Additionally, you’ll likely need to do this via the Deployment Server or whatever other configuration management mechanism you are using in your environment to get apps to UFs.

Word of caution: this change MUST be made in the app where the streamfwd binary is running, typically Splunk_TA_stream. If the streamfwd.conf file exists elsewhere, it will not apply. This is different from how you would typically expect Splunk configuration precedence to work.

As can be seen on my demo system, the conf file on the deployment server looks like this:

Copy to Clipboardsplunk@splunkdemo:/opt/splunk/etc/deployment-apps/Splunk_TA_stream$ cat local/streamfwd.conf[streamfwd]#This increases the default check in interval from 5 seconds to 5 minutespingInterval = 300Once this change is made and the UFs pull down the new config, you should see the CPU utilization on the Splunk Stream Server drop significantly. Furthermore, in larger environments, you may look to further increase the pingInterval depending on the number of UFs you have checking in.

Final ThoughtsIn conclusion, this is a pretty common issue I’ve worked to resolve at a number of Hurricane Labs Splunk clients. If this is something you’ve experienced in your Splunk environment, I hope this tutorial will help you resolve this issue!

Happy Splunking!

The post How to Fix High CPU Usage in Splunk Stream appeared first on Hurricane Labs.

View Details

With the increasing pressure from complex cybersecurity threats, many security leaders are turning to specialized expertise–such as a managed security services provider (MSSP or Splunk MSSP)–for help.  In this Q&A, Matt Yonchak, a Splunk and security expert who has been working in the field for more than 15 years, shares his insights on today's [...]

The post Expert Q&A: Unlock A Splunk MSSP Perspective on Today’s Cybersecurity World appeared first on Hurricane Labs.

View Details

Cybersecurity leaders are under constant pressure to protect their companies from cyber threats with organizational threat awareness continuing to be a key concern. According to research, More than 50% of CISOs feel that their organizations aren't prepared for an attack. In addition, managing an entire program internally can take up too much time and [...]

The post 9 Benefits of Using a Managed Security Services Provider appeared first on Hurricane Labs.

View Details

It’s no secret: cybersecurity isn’t a one size fits all world. Every organization has different needs and complexities, which means that the usefulness of security use cases will vary depending on what your business does! And now you're probably wondering, "How do I find out which security use cases are worth investing in?" Well [...]

The post The Ultimate Guide to Building Effective Security Use Cases appeared first on Hurricane Labs.

View Details

Don’t wait until something is already vulnerable and being exploited–have a plan in place on the steps needed to remediate a vulnerability quickly. Being proactive about your vulnerability management will give your organization a significantly faster response time–and will help ease any sense of panic when an attack occurs.  Looking for more information? Check [...]

The post 7 Steps to a Proactive Vulnerability Management Plan appeared first on Hurricane Labs.

View Details

In today's podcast, we talk about the Cyber Safety Review Board and their report on Log4j. Also, make sure to check out some of the articles and resources mentioned during this episode: DHS Launches First-Ever Cyber Safety Review Board via Homeland Security Pentest Stories: Responsible vulnerability disclosure via Heather Terry & Dennis Goodlett How [...]

The post SOC Talk: Cyber Safety Review Board and the Log4j Report appeared first on Hurricane Labs.

View Details

With the introduction of Splunk Enterprise 9.0, Splunk has changed the language used for certain directories in indexer-clustering. Let’s explore how this works in practice. Some history and background In versions of Splunk prior to 9.0, the configurations that would be sent to the indexers would be stored in the $SPLUNK_HOME/etc/master-apps directory on the [...]

The post Exploring the Directory Naming Change in Splunk Enterprise 9.0 Indexer Clustering appeared first on Hurricane Labs.

View Details

Introduction When deploying Splunk Enterprise Security, there are several configuration optimizations which can be used to improve the performance of the environment. A notable example is the scheduler configuration, which allows for more scheduled and summarization searches to run simultaneously. The default scheduler settings in Splunk often do not allow for enough resources to [...]

The post Optimizing Your Splunk Cloud Scheduler for Enterprise Security appeared first on Hurricane Labs.

View Details

Heather meets with Tom Kopchak to discuss strategies for organizations should utilize when creating cybersecurity training programs. In case you missed it, check out the first part of our Teaching and Learning Cybersecurity podcast series. Also, tune in to our related podcast: Addressing the Cybersecurity Skills Gap featuring Heather Terry, Tom Kopchak, Roxy, and Dusty Miller! Click here [...]

The post Teaching and Learning Cybersecurity: Closing the Skills Gap, Part 2 appeared first on Hurricane Labs.

View Details

One of the most requested features in Splunk has been better audit logging for changes. With the introduction of Splunk Enterprise 9.0, a new feature has been introduced for configuration change tracking. Let’s take a look at how this new feature works! Overview To implement the change logging feature, Splunk 9.0 introduces a new [...]

The post First Look: Splunk 9.0 Configuration Change Logging appeared first on Hurricane Labs.

View Details

CVE-2022-32158 Details Hurricane Labs is aware of the recent vulnerability involving Splunk Enterprise deployment servers. This vulnerability was announced by Splunk on 2022-06-14.  Successful exploitation of this vulnerability could result in a compromised universal forwarder being able to leverage the deployment server to distribute configuration changes to all other universal forwarders connected to the [...]

The post Security Advisory Regarding Splunk Enterprise Deployment Servers appeared first on Hurricane Labs.

View Details

One common task that comes up when troubleshooting Splunk search performance issues is validating the correct resources are available. For on-premise Splunk Enterprise, you can easily do this through the Monitoring Console: Settings -> Monitoring Console The amount of memory and CPU cores will be displayed in the upper [...]

The post Splunk Cloud: Determining Search Head Resources appeared first on Hurricane Labs.

View Details

If you’re looking for resources to help you learn about the world of cybersecurity, here are the 7 RFCs Roxy, Hurricane Labs’ Director of Compliance, recommends you start with. Looking for more details? Check out their webinar, Making Sense of RFCs! The List 1. RFC 2196 Site Security Handbook RFC 2196 (Site [...]

The post Making Sense of RFCs: Reading List appeared first on Hurricane Labs.

View Details

Heather meets with Tom Kopchak to reflect on his recent experiences teaching cybersecurity and on what skills are needed to help bridge the cybersecurity skills gap. Also, make sure to check out some of our related posts and podcasts: Addressing the Cybersecurity Skills Gap podcast featuring Heather Terry, Tom Kopchak, Roxy, and Dusty Miller [...]

The post Teaching and Learning Cybersecurity: Closing the Skills Gap, Part 1 appeared first on Hurricane Labs.

View Details

CVE-2022-30190 (Follina) Details Hurricane Labs is aware of the recent CVE-2022-30190 / Follina Zero-Day. Follina is a remote code execution vulnerability that exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the [...]

The post Security Advisory Regarding Follina appeared first on Hurricane Labs.