- [Instructor] It is important that you have
a way to interpret common data values
into a universal format,
and that you actually have a good data model
within your organization.
So you may ask, so what is actually a data model, right?
So what are you talking about?
A data model is actually
a hierarchical structure mapping of semantic knowledge
about one or more datasets.
By having a good data model
for all your security event data,
it will actually allow you to build an assortment
of specialized and also very fast queries of those datasets,
right?
That's why it's actually important
for you to have a good data model.
Now, in order for you to be able to create
an effective data model,
you have to first understand the sources
of the security event data in your infrastructure.
Here, I'm actually showing a security information
and events management system or SIEM
that is actually retrieving data from different sources,
including IPS devices, firewalls,
NetFlow generation devices, servers, endpoints,
and syslog from infrastructure devices as well.
Depending on how the event data
is actually structured from those sources
and how different fields within that data are actually
extracted, related, and organized,
that's how it can actually affect
your data model architecture, right?
And now, the good news is also that
there are actually tools, such as Splunk and many others,
that already accept data from well known security devices
and other sources.
And this tool allows you to actually arrange that data
to have and also get additional fields
that allows you to actually do complex and simple searches
and field extractions and look ups within your organization.
Now there's also a problem within the industry
on the different ways security tools and humans
refer to security events, incidents,
and related information.
This is why specifications like
the vocabulary for event recording and incident sharing,
otherwise known as VERIS, actually have been created,
right?
So, here I'm actually showing the VERIS website.
VERIS was actually originally created
by folks from Verizon and other organization.
And actually it is a set of metrics designed to
provide a common language for describing security incidents
in a structured and a reputable manner, right?
The overall of VERIS is actually to lay a foundation
on which we can constructively and cooperatively learn
from our experiences to actually better manage risk.