Take a look at almost every log management best practice guide and you will find a bullet point for determining "normal" activity or analyzing trends. These guides, and most log management best practices in general, lack the details for practically determining what is "normal" and how to investigate abnormal activity.
This presentation intends to outline practical strategies for determining "normal" activity using baseline analysis with logs and security events. Topics will include overview of baselines and the necessary statistics, determining what to baseline with threat modeling, developing the baseline, reviewing the anomalous data, and tuning.
Derek is a security consultant focused on log management, threat detection, and security monitoring. Derek enjoys developing use cases, watching logs like an operator in The Matrix, and looking for interesting ways to detect post exploitation activity. He is a family man that is also actively involved in the Michigan Security (#MiSec) community.