OpenSoc 101: Using Hadoop For Security
OpenSoc 101: Using Hadoop For Security
Hortonworks, Cisco, and a host of other contributors are working on a Hadoop-based, extensible security analytics tool.
Join the DZone community and get the full member experience.
Join For FreeThe open source HPCC Systems platform is a proven, easy to use solution for managing data at scale. Visit our Easy Guide to learn more about this completely free platform, test drive some code in the online Playground, and get started today.
OpenSOC is a great idea. It's a open source project using Hadoop to develop an extensible security analytics tool. Hortonworks and Cisco are working on it with a host of others. Security is something that could use an open project as all companies need this. It's accessible code, so if you are a big data Java programmer with some Apache Storm, please consider it as a project to work on. Coming from a security startup, I can tell you that you don't realize how insecure your network and servers are until you actively and passively scan from inside and outside and then analyze that huge volume of data. Download and install these open source tools and set it up. After that you can quickly see what features you might want to contribute or documentation or just finding bugs. Open Source works when everyone realizes they are on the team once they start using it. If you have no security scanning in place, download and setup a Kali box and start generating some data and find some glaring issues. There are some great tools to check for SQL Injection, open ports and various issues. Kali is a great Linux distribution that is easy to setup and has all the tools you will need to scan for problems.
OpenSoc requires a lot of software, but it's items you should have in Hadoop cluster already:
- Apache Flume 1.4.0 +
- Apache Kafka 0.8.1+
- Apache Storm 0.9 +
- Apache Hadoop 2.x (any distribution)
- Apache Hive 12 + (13 recommended)
- Apache Hbase 0.94+
- Elastic Search 1.1 +
- MySQL 5.6+
You will also need a server with 2 network cards, OpenSoc has a suggestion for which type if you haven't purchased a server for this purpose yet. To get things started look at the slides below and check out the wiki.
http://www.slideshare.net/Hadoop_Summit/analyzing-12-million-network-packets-per-second-in-realtime
http://www.slideshare.net/Hadoop_Summit/design-patterns-for-real-time-streaming-data-analytics
Spark
http://www.slideshare.net/Hadoop_Summit/spark-crash-course-workshop-at-hadoop-summit
Managing data at scale doesn’t have to be hard. Find out how the completely free, open source HPCC Systems platform makes it easier to update, easier to program, easier to integrate data, and easier to manage clusters. Download and get started today.
Like This Article? Read More From DZone
Opinions expressed by DZone contributors are their own.
{{ parent.title || parent.header.title}}
{{ parent.tldr }}
{{ parent.linkDescription }}
{{ parent.urlSource.name }}