Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Real-Time Cloud Security at Scale with Neo4j

Hays Hutton, Cloud Architect, Palo Alto Networks

  • Be the first to comment

Real-Time Cloud Security at Scale with Neo4j

  1. 1. Real-Time Cloud Security At Scale with Neo4j
  2. 2. Background and a Mental Model
  3. 3. 3 | © 2020 Palo Alto Networks. All Rights Reserved. Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win. -- John Lambert https://github.com/JohnLaTwC/Shared/blob/master/Defenders%20think%20in%20lists.%20Attackers%20think%20i n%20graphs.%20As%20long%20as%20this%20is%20true%2C%20attackers%20win.md
  4. 4. • Military Strategist • Helped Create the A10 and F15 • His theories are basis for current Marine Corps strategy (maneuver warfare) • Created OODA loop John Boyd (an aside)
  5. 5. OODA Loop
  6. 6. 6 | © 2020 Palo Alto Networks. All Rights Reserved. What’s Your Abstraction? How are you orienting? A Log Entry • Tuple with Timestamp • Mainly Correlates Via Timestamp • Dynamically build up your abstractions in a SIEM or with SQL Node and Edges • Property Nodes and Simple Edges • Relations already built • Abstractions are from the Domain and built on write • Mimic Real World (Digital Twin) OR
  7. 7. 7 | © 2020 Palo Alto Networks. All Rights Reserved. A Raw Feed Example Event
  8. 8. 8 | © 2020 Palo Alto Networks. All Rights Reserved. What’s Your Speed?
  9. 9. 9 | © 2020 Palo Alto Networks. All Rights Reserved. Archimedes - Architecture
  10. 10. Binary Bucket Cloud Storage iam-feeds Cloud Pub/Sub Asset Inventory Cloud Asset Inventory resource--feeds Cloud Pub/Sub Asset export (snapshot) Asset Changes gcp-project archimedes-net Virtual Private Cloud graph-db Compute Engine loader Compute Engine alertgen Cloud Functions filtered Cloud Pub/Sub triggers query resource configs loading base snapshots change events alerts Cloud Pub/Sub change events XSOAR Archimedes - Architecture 10 | © 2020 Palo Alto Networks. All Rights Reserved.
  11. 11. 11 | © 2020 Palo Alto Networks. All Rights Reserved. Demo
  12. 12. End hhutton@paloaltonetworks.com

×