The Importance Of Real time Data In Fighting Cyber Attacks
summary
Cybereason describes a real-time pipeline built on Kafka, Aerospike, Elasticsearch and Kubernetes that crunches ~9.8 TB/week and reduces thousands of raw alerts into a handful of malops (handful of malicious operations) for SOCs to act on. Engineering claims sustained throughput of 2 million events/sec, reads/writes at <30 ms per 1k bulk, and about 40 TB unique data for cross-machine correlation, autoscaling clusters every few days and keeping months-to-years retention for low-latency hunting.
AI-written summary · about
chapters (13)
- 0:00DIGITAL SUMMIT 2021 REIMAGINE REAL-TIME
- 4:33CYBER CRIME IS A SYSTEMIC BUSINESS RISK
- 5:22ALERT-CENTRIC SECURITY Slow. Inefficient. Costly
- 6:27OPERATION-CENTRIC SECURITY The Ideal State
- 7:21MALOP (MALICIOUS OPERATION) Providing the Complete Story of an Attack
- 8:45UNIFIED DEFENSES Deliver Unparalleled Benefits
- 9:49CYBEREASON DEFENSE PLATFORM Future-Ready Attack Protection
- 11:04BIG DATA PROCESSING ENGINE At The Speed Of The Adversary
- 11:42CYBEREASON ANALYSIS MODEL Dynamic persistent, real-time
- 12:23SOLUTION: CYBEREASON HUNTER
- 14:30CYBEREASON DATA PLATFORM Use cases
- 17:20VOLUME AND SCALE
- 18:22LEVERAGING AEROSPIKE
related talks
22mPractical approach to building real-time analytics for cybersecurity applications
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
32mBuilding Real-time Systems with Open Source Technologies
37mA Needle in a Haystack: How to Find a Threat Hidden in Over 6 Billion Logs Per Day
51mReal-time Fraud Detection: Challenges and Solutions
01h 05mPractical network defense at scale
55mKeynote - The Future of Cybersecurity Needs You, Here is Why.
32mDiscover the Modern Way to Build Real-Time Analytics Solutions at Any Scale