Скачать или смотреть Data Enrichment via DNS Lookups with Logstash

This video provides a walkthrough of performing data enrichment. Data enrichment involves using existing data to pull in additional context. This video demonstrates how to go from an IP address to a name or a name to an IP address using DNS.

We recommend using correlation techniques against pre-ingested DNS data instead of DNS for most DNS related lookups. One example of doing this is using the Logstash filter plugin called Elasticsearch to query data ingested into Elasticsearch.

To download the VM in the video, please use the link below:

https://sansorg.egnyte.com/dl/J8KjvG1tNC

If the link above does not work, try downloading it from https://www.hasecuritysolutions.com/s...

Do not forget to subscribe to this channel for updates on future videos.

Looking for help improving your detection capabilities? Reach out to [email protected] or (217) 730-3007. We routinely implement SIEM and NSM solutions both commercial and open source.

Speaker: Justin Henderson, CEO H & A Security Solutions LLC Justin is the co-founder of H&A Security Solutions, LLC, a company that deploys, maintains, and tunes SIEM, NSM, and other solutions for organizations. Justin also maintains one of the largest security onion deployments in the world with over 1200 network sensors. He is a passionate security architect and researcher whose experience in cybersecurity started at the age of thirteen when he began providing professional services to organizations. Justin was the 13th GSE to become both a red and blue SANS Cyber Guardian and holds over 60 industry certifications. As the author of SEC555 and co-author of SEC455 and SEC530, he’s able to bring his encyclopedia of IT knowledge into the classroom.

Follow Justin on Twitter @SecurityMapper at   / securitymapper   or using LinkedIn at   / justinhenderson2014  .