Scale Your Auditing Events

on YouTube ↗44m

" summary

Explains that Auditbeat replaces parsing brittle auditd log lines by sending raw audit records to Elasticsearch and correlating events across hosts, including a Filebeat module and Kubernetes daemonset deployment; demonstrates scale with 400,000 events in 24 hours and prebuilt dashboards and 92 detection rules; shows concrete features: file integrity hashing with configurable scan rates, namespace/container attribution, ILM for tiered storage, and that the pipeline works in production to reduce parsing pain and surface actionable alerts.

AI-written summary · about

" chapters (15)

1. 0:00Start
2. 0:28Security incidents come in three levels FYI, WTF, AND OMG
3. 1:34NO SILVER BULLET
4. 2:22MONITOR File and network access System calls Commands run by a user Security events
5. 9:02Disclaimer I BUILD HIGHLY MONITORED HELLO WORLD APPS
6. 11:09elastic stack
7. 11:27FILEBEAT MODULE: AUDITO
8. 16:52DEMO
9. 19:03SYSTEM MODULE Simpler syntax for host, process, socket, user
10. 28:21RUNNING ON KUBERNETES
11. 29:51ELASTIC SIEM
12. 37:42PS: MACHINE LEARNING aka Anomaly Detection
13. 38:23CONCLUSION
14. 39:00CODE auditbeat-in-action
15. 39:17SIMILAR SOLUTIONS

" related talks

• 51mScale Your Auditing EventsPhilipp Krenn · DevOps Fest 2020 Online
• 49mScale Your Auditing EventsPhilipp Krenn · DevConf.CZ 2019
• 35mUsing K8s Audit Logs to Secure Your ClusterMark Stemm · KubeCon + CloudNativeCon Europe 2019
• 25mAuditing in Kubernetes 101Nikhita Raghunath · Kubernetes Forum Delhi 2020
• 22mAudit in Kubernetes Now, and in the FutureMaciej Szulik · CloudNativeCon + KubeCon Europe 2017
• 32mThreat Hunting at Scale: Auditing Thousands of Clusters With Falco + F...Furkan Türkal, Emin Aktaş · KubeCon + CloudNativeCon Europe 2022
• 20mKubernetes audit log best practicesKenneth DuMez · Conf42 Cloud Native 2023
• 42mMake your logs work for youHonza Kral · PyCon Australia 2015