What Are the Newest Tools Available for Network Security Detection? Find Out at TechEX25

Shawn: We use machine learning to detect anomalies in our web access logs, nginx, Apache, and Tomcat. We generate alerts for abnormal user agents, excessive 5xx response codes, infrequently accessed paths, and a high number of SSL requests based on the server name in the SSL cert.

Shawn: Some of the key points in our session include:
– Best practices that we find to be relatively easy to implement, and provide a good increase in security
– Alerts we find the most useful
– How we create our alerts
– How we use machine learning to generate some of the alerts we use for our automation
– How we built our automation while not spending an excessive amount of our budget

Dale: I’ll add that we will also cover:
– Building alerts in our environment after running various common pentest tools
– Suggestions on alerts to build for AD/O365/Entra/Azure/Web logs
– Using machine learning to look for web scanners

Shawn: We will be giving out a physical printout — a cheatsheet of sorts — for most of the alerts we have set up. That will include actual event codes and key things to look for, so attendees can take something back to their institutions or organizations and implement it quickly. 

I always want to make sure that there are actual takeaways and examples of what we did and how, so that someone else can replicate it and make it fit their systems. 

I also want attendees to take home that this is a process. It is not quick. It takes a lot of time, and no one tool will solve all of your problems. 

Dale: We want attendees to leave our presentation with ideas they can implement themselves. The tools we suggest don’t need to be run only by a pentester; they should be part of your overall security strategy.

Shawn: Validate that your alerts are working by running tools you know should trigger them. Make sure that during your yearly pentest, which we are all supposed to do, they trigger on what the pentester is doing. If not, communicate with the tester and adjust as needed.

Dale: Test your alerts because things can change. 

I found in my own alerts that a field name changed, and the alert was never updated for that change, so it didn’t fire. It’s hard to keep track of all the moving parts, but you still need to regression-test occasionally.