https://community.splunk.com/t5/Security/How-to-detect-APT-Advanced-persistent-threat-attack/m-p/238883#M6685 <P>Well, this is a very involved question that doesn't have a straightforward answer. By definition an APT is a compromise of a network by means not detectable by signature based security software. This means there really isn't a silver bullet to detect and APT.</P> <P>In my experience, the best way to discover an APT is through behavior modeling. What i mean by this is simply you need to know what legitimate behavior to expect on your network so that you can investigate any deviations from that norm. For example, if Mary's computer in accounting one day becomes an FTP server after years of just being a workstation then something may be awry. Splunk has a product to perform these functions already, but I believe there is a charge.</P> <P><A href="http://www.splunk.com/en_us/products/premium-solutions/user-behavior-analytics.html">http://www.splunk.com/en_us/products/premium-solutions/user-behavior-analytics.html</A></P> <P>There are other products that accomplish this same goal such as Observable Networks (<A href="https://observable.net/">https://observable.net/</A>) or you could attempt to devise your own system if you have the programming background. You could create a splunk app of your own that maintains an endpoint profile based on MAC address, but it would be a good bit of work.</P> Wed, 18 Nov 2015 14:49:02 GMT rmcdougal 2015-11-18T14:49:02Z https://community.splunk.com/t5/Security/How-to-detect-APT-Advanced-persistent-threat-attack/m-p/238882#M6684 <P>How to detect APT (Advanced persistent threat) attack ? </P> Wed, 18 Nov 2015 10:55:31 GMT https://community.splunk.com/t5/Security/How-to-detect-APT-Advanced-persistent-threat-attack/m-p/238882#M6684 Maheshparsi 2015-11-18T10:55:31Z https://community.splunk.com/t5/Security/How-to-detect-APT-Advanced-persistent-threat-attack/m-p/238883#M6685 <P>Well, this is a very involved question that doesn't have a straightforward answer. By definition an APT is a compromise of a network by means not detectable by signature based security software. This means there really isn't a silver bullet to detect and APT.</P> <P>In my experience, the best way to discover an APT is through behavior modeling. What i mean by this is simply you need to know what legitimate behavior to expect on your network so that you can investigate any deviations from that norm. For example, if Mary's computer in accounting one day becomes an FTP server after years of just being a workstation then something may be awry. Splunk has a product to perform these functions already, but I believe there is a charge.</P> <P><A href="http://www.splunk.com/en_us/products/premium-solutions/user-behavior-analytics.html">http://www.splunk.com/en_us/products/premium-solutions/user-behavior-analytics.html</A></P> <P>There are other products that accomplish this same goal such as Observable Networks (<A href="https://observable.net/">https://observable.net/</A>) or you could attempt to devise your own system if you have the programming background. You could create a splunk app of your own that maintains an endpoint profile based on MAC address, but it would be a good bit of work.</P> Wed, 18 Nov 2015 14:49:02 GMT https://community.splunk.com/t5/Security/How-to-detect-APT-Advanced-persistent-threat-attack/m-p/238883#M6685 rmcdougal 2015-11-18T14:49:02Z