Analytics

Also available as:

PDF

Contents

Hortonworks Cybersecurity Package

Analytics

Copyright © 2012-2017 Hortonworks, Inc.

Except where otherwise noted, this document is licensed under Creative Commons Attribution ShareAlike 4.0 License

http://creativecommons.org/licenses/by-sa/4.0/legalcode

Hortonworks Cybersecurity Package (HCP) is a modern data application based on Apache Metron, powered by Apache Hadoop, Apache Storm, and related technologies.

HCP provides a framework and tools to enable greater efficiency in Security Operation Centers (SOCs) along with better and faster threat detection in real-time at massive scale. It provides ingestion, parsing and normalization of fully enriched, contextualized data, threat intelligence feeds, triage and machine learning based detection. It also provides end user near real-time dashboards.

Based on a strong foundation in the Hortonworks Data Platform (HDP) and Hortonworks DataFlow (HDF) stacks, HCP provides an integrated advanced platform for security analytics.

Please visit the Hortonworks Data Platform page for more information on Hortonworks technology. For more information on Hortonworks services, please visit either the Support or Training page. Feel free to Contact Us directly to discuss your specific needs.

Contents

1. Overview

2. Creating Profiles

Installing Profiler

Getting Started

Configuring the Profiler

Starting the Profiler

Profile Examples

Accessing Profiles

Selecting Profile Measurements
Specifying Profile Time and Duration
Client Profile Example

3. Creating Models

Installing the YARN Application
Deploying Models
Adding the MaaS Stellar Function to the Sensor Configuration
Starting Topologies and Sending Data
Modifying a Model

4. Analyzing Enriched Data Using Apache Zeppelin

Setting up Zeppelin to Run with HCP

Using Zeppelin Interpreters
Loading Telemetry Information into Zeppelin
Working with Zeppelin

Using Zeppelin to Analyze Data

Next Steps

5. Creating Runbooks Using Apache Zeppelin

Setting up Zeppelin to Run with HCP

Using Zeppelin Interpreters
Loading Telemetry Information into Zeppelin
Working with Zeppelin

Using Zeppelin to Create Runbooks

6. Analyzing Data Using Statistical and Mathematical Functions

Approximation Statistics

Mathematical Functions

Distributional Statistics

Statistical Outlier Detection

Outlier Analysis

Median Absolution Deviation
Example

List of Figures

4.1. Zeppelin Settings Toolbar
4.2. Bro Protocols
4.3. Bro Telemetry Received
4.4. Most Active Hosts
4.5. DNS Servers
4.6. Mime Types
4.7. Exploded HTTP Records
4.8. Suspicious xdosexc
4.9. x-dosexc Requests
4.10. When Interactions Occur
5.1. Zeppelin Settings Toolbar
5.2. Zeppelin Top Talkers
5.3. Zeppelin Flows By Hour

List of Tables

2.1. Profile Elements
2.2. Profiler Properties
2.3. Profiler Client Configuration Parameters
6.1. Approximation Statistics
6.2. Mathematical Functions
6.3. Distributional Statistics
6.4. Statistical Outlier Detection