Upgrade to Pro — share decks privately, control downloads, hide ads and more …

セキュリティログ分析基盤の構築 on AWS

セキュリティログ分析基盤の構築 on AWS

2018.5.16 Security JAWS での発表資料です

Avatar for Masayoshi Mizutani

Masayoshi Mizutani

May 16, 2018
Tweet

More Decks by Masayoshi Mizutani

Other Decks in Technology

Transcript

  1. ࣗݾ঺հˍൃද֓ཁ wਫ୩ਖ਼ܚ !N@NJ[VUBOJ  w ೔ຊ*#.ೖࣾ w ౦ژجૅݚڀॴ w ηΩϡϦςΟࣄۀ෦5PLZP40$

    w ΫοΫύουגࣜձࣾೖࣾ w ΠϯϑϥετϥΫνϟʔ෦ηΩϡϦςΟνʔϜ wࠓ೔ͷൃද   ݄ʹฐࣾ5FDI$POGͷ-5Ͱ࿩ͨ͠಺༰ͷ࠷৽൛Ͱ͢
  2. ηΩϡϦςΟϩά෼ੳͱ͍͑͹4*&.ɺ͔͠͠Ϋϥ΢υ্ͩͱʜ wϩάͷૹ৴ݩΛಈతʹ੍ޚͰ͖ͳ͍ w ૹ৴ݩʴϩάͷܗࣜͷΤϯτϦΛ؅ཧ͢Δ"1*͕ͳ͍ w Χλϩά্͸ࣗಈొ࿥͢Δͱݴ͍ͬͯΔ͕͏·͘௥Ճ͞Εͳ͍ w ΠϯελϯεɾαʔϏεͷ௥Ճɾ࡟আʹରԠ͢Δͷ͕େม wશମߏ੒Λؾܰʹ͍͡Εͳ͍ w

    ߏ଄্εέʔϧΞ΢τ͢Δ͕खಈˍࣦഊ͢Δͱഁ໓ w εέʔϧΞ΢τͨ͠΋ͷͷதʹϩά͕࢒ΔͷͰεέʔϧΠϯෆՄ w ϩά͕όʔετͨ͠ͱ͖ͷରԠ͕େม wϧʔϧͷςετ͕೉͍͠ w ςετͷͨΊʹෳ਺ߏ੒༻ҙ͢ΔPS࣮؀ڥͰ΍Δ w "1*ͳͲͳ͍ͷͰɺ౰વਓखͰؤுΔ w ΫΠοΫʹϧʔϧͷௐ੔͕Ͱ͖ͳ͍มߋʹΑΔαΠυΤϑΣΫτͰۤ࿑͢Δ   ˞ҰൠԽ͞Εͨ࿩Ͱ͸ͳ͘ɺͱ͋Δ੡඼ͷܦݧʹج͍ͮͨ૝ఆͰ͢
  3. ΞʔΩςΫνϟ֓ཁ ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ Lambda Lambda Lambda Kinesis Stream S3 S3

    Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Ξϥʔτͷௐࠪ CloudWatch Logs/Event, GuardDuty, CloudTrail EC2 instances ͦͷଞϓϩμΫτ Kinesis Stream Kinesis Stream ˞ࡉ͔͍ͱ͜Ζ͸ͪΐͬͱ୺ંͬͯ·͢
  4. ΞʔΩςΫνϟ֓ཁ ύʔτ෼͚ ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ Lambda Lambda Lambda Kinesis Stream S3

    S3 Athena ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ Ξϥʔτͷൃใ ϩάͷม׵ EC2 Elasticsearch Service ߴ଎ͰΠϯλϥΫςΟϒͳ ୹ظతϩάͷݕࡧ ௕ظؒʹΘͨΔ ϩάͷݕࡧ GHE PagerDuty Slack Ξϥʔτͷൃใɾ؅ཧ Ξϥʔτͷௐࠪ EC2 instances ͦͷଞϓϩμΫτ Kinesis Stream Kinesis Stream ϩάऩूύʔτ ϩάॲཧύʔτ Ξϥʔτॲཧύʔτ CloudWatch Logs/Event, GuardDuty, CloudTrail
  5. ϩάॲཧύʔτ  wϑΝΠϧੜ੒Πϕϯτͷॲཧ
  4ˠ-BNCEBˠ,JOFTJT4USFBN  w 4ͷ$SFBUF0CKFDUΠϕϯτΛ-BNCEBͰड͚ͯ,JOFTJT4USFBNʹྲྀ͢ w -BNCEBʹ͸௚઀ϩά͸ྲྀͣ͞ʹ4্ͷϑΝΠϧͷΩʔͳͲ࠷௿ݶͷ

    ৘ใ͚ͩΛྲྀ͢ w ,JOFTJT4USFBNͰΠϕϯτ৘ใΛड͚औͬͨޙଓͷ-BNCEB͕4಺ͷ ϑΝΠϧΛಡΈࠐΈϩάσʔλΛऔಘ͢Δ   ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ Lambda Lambda Kinesis Stream ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ ϩάͷม׵ Kinesis Stream
  6. ϩάॲཧύʔτ  wϩάͷม׵UP(SBZMPH w ,JOFTJT4USFBN͔ΒϩάϑΝΠϧઃஔͷΠϕϯτΛड͚औͬͨޙɺ ϑΝΠϧΛ4͔ΒಡΈऔΔˠϩάͷύʔεˠ(SBZMPH΁సૹ w ύʔα͸ࣗલͰ༻ҙ4ͷόέοτʴύεͰϑΥʔϚοτΛ൑ผ w (SBZMPHͷ(&-'ܗࣜʹม׵ͨ͠ޙ5$1Ͱసૹ

    wϩάͷม׵UP"UIFOB w -BNCEBͰ"UIFOBʹରԠͨ͠+40/ܗࣜʹม׵ w (MVFΛ࢖ͬͨม׵ʹͰ͖ͳ͍͔ݕ౼த   ϩάϑΝΠϧઃஔͷ ΠϕϯτΛݕग़ Lambda Lambda Kinesis Stream ϧʔϧΛ༻͍ͨ Ξϥʔτͷݕ஌ ϩάͷม׵ Kinesis Stream