Full transcript
0:00Alrighty. Hi everyone. Thanks so much for tuning in. Look, I'm pretty excited to get together and join with a good friend, James. James Spiterry. I'm so sorry, James. Am I Am I going to get your your last name right? >> All right. Awesome. James is hanging out over at Elastic doing some incredible stuff. And I'm super excited to get a
0:19chance to learn all that you've been cooking up and how things been over in the Elastic world. >> Yeah, man. Like, thanks for having us. It's really good to be here. So, I've been at Elastic about 7 years now. had various different roles. Currently, what I'm doing is leading our product efforts for all the fun stuff with AI and
0:35automation these days. Uh I guess it's good for people to know. I come from a practitioner background. I've been doing sack ops my whole career. Elastic has always been like kind of a dream role I had. I started off as a solutions engineer or solutions architect. Basically helping users actually architect this thing within a security operations environment. Moved on to
0:53product marketing and now product management. So, I get to get the ideas from my head into the product, which is always a great feeling. So, yeah, >> that is awesome. In 7 years, goodness, I think you got me beat. You know, there's no secret. I may say my day job is over at Huntress and uh hey, one of the
1:08security researchers over there got to be straight up. Hey, Huntress is a similar solution that does some similar stuff. But I wanted to totally be all upfront. Like I think we're getting a chance to dive into a little bit more of the technical details, a little bit more of the nerdy fun stuff for really the whole community for the awareness, the
1:25education on what is accessible to you, whether that's free opportunities, whether it's maybe some pay as you go stuff. Alastic, I know you've got a whole variety of what can folks get their hands on? >> Yeah, for sure. So if we backtrack a bit, right, most people know us as the elkstack. You've heard a bit of elastic,
1:42bit of luxana. Um, traditionally we're known as the very cheap way to grab a ton of security logs, chuck them into something, search through them fast, and that's it, right? And that was kind of the case six or seven years ago really. That's what we had. You spin up an elastic stack uh and you chucked all your events from whatever they may, your
2:01firewall logs, your system events, you name it. because we saw so many many people doing that and we saw so many people having to roll up their sleeves and then build kind of a sim on top of that uh you know data storage threat hunting facility we're like hey we could do this we could do something for our
2:17users we can build an out of the box security analytics platform and experience there so we kicked off that journey literally like a month after I joined elastic it was uh pretty amazing timing and now we have a fullyfledged security analytics platform and what that means is just as you'd expect you get detections out of the box so looking
2:33for threats. You get a way to hunt way easier. We have new query languages. You get case management. You get alerting. You get all that stuff. And most of that is still free and open. We are still an open source company. So all our code is open. But more importantly, uh we really believe in transparency. So if we
2:51publish detections, they're all in the open for you to view, comment on, do whatever you need to do. And more importantly now, uh as part of that six, sevenyear journey, along the way, we made quite a few acquisitions. One of those acquisitions was uh an Endpoint company back then known as Endgame. Phenomenal team, phenomenal tech. Uh and
3:09now that's baked into the product. So you get that as well and you get a free version of that as well. So uh it's not just the logging part which is free, but there's a ton of stuff that you get. So yeah, I mean that's that's the gist of like how we ended up here, how I ended
3:24up doing this just because um you know we've been investing so much time and effort into building the best uh platform that anyone can get their hands on. And that's also really important like you can spin up Elastic on your laptop. You can use our cloud environment these days. You don't even have to worry about scaling or anything
3:41like that because we take care of all of it. And you if you don't want to, you never need to speak to a salesperson which is also uh advantageous, right? Of course, you can, but if you don't want to go to a cloud, chuck in a credit card, and get all the enterprise features. So, nothing is gated. Nothing
3:56is gated behind the sales call, which is, I think, pretty cool, personally. >> No, I love that without a doubt. I uh I know hey in past videos on on my YouTube channel I've tried to showcase bits and pieces of hey playing with elastic getting an agent up and running using that elk stack and that's always just
4:12been so accessible so available that it's yeah something I can show to everyone cuz anyone could just dive in and I think even that maybe helped spark some of the conversations to get us to chat. So glad we got together. What else is there? I don't know. Can we dive in? Is there anything that you'd love to
4:28show and tell or is there more to chat and banter about for >> sure I mean we can chat and banter for hours John I'm sure but um I'd be happy to walk people through like the actual experiences that get today right so let's let's get nerdy man let's do it all right so first of all I'll start
4:43with how can you even kind of get started like what so let's say you didn't want to run something on your laptop which you could and that's never been easier docker whatever you or whatever we call it podman or whatever it might be you can still do that if you just wanted to try Hey, I just want to
4:56see what Elastic offers without having to lift a finger. Um, you would go to Elastic Cloud, which is this portal here. You can see if any of you are familiar with my malware project, this is where I run that cluster that I give you all for free. Uh, but you can create as many uh environments here as you
5:11want. And there's kind of two flavors. You can either spin up what we call the traditional cloud variant where you have a bit more control over the architecture, the size, the version. But these days to get started like there's full SAS like a whole versionless solution which if you ever were concerned about things like shards or uh
5:32having to know hot nodes warm node all all that goes away now. So you can literally just create a serverless project select elastic security select complete which gives you pretty much access to everything select your cloud region and you're pretty much good to go. That's that's literally all it takes. And then within 5 minutes you have a fully managed version of the
5:51product. Uh, and then when you want to pop into it, you go to open and you're going to get everything. So, usually we we kind of send people into this like landing page where we tell you to like, hey, here's all the things you could do or get started with. I guess the most important thing for people to be aware
6:08of is how much you get as soon as you start. So, like we said, like historically, again, back in the days of just the ELK stack, you didn't get any content, right? You didn't get things like detection rules. You didn't get uh an endpoint. You didn't get integrations. So if you wanted to bring data in, you had to build parsers and
6:28all that stuff. These days, you get all of that. And again, most of this stuff is completely free. So like all these detections, there's this misconception that this is part of like a paid component. Uh it's not. Uh and even if you did pay something, we don't have different like SKUs or anything like that. You pay one price, you get
6:45everything. So you don't have to say, I want this component, I want that. you get everything like then uh use it or not, you still have it. So you can see here variety of detections and um if you wanted to see actually what is powering these of course we show you all the kind of query and logic right within the
7:03product itself. But all of these are actually in a GitHub repo. So our research team Elastic Security Labs the people do do all the amazing work to put these things together. They've put everything in this repo and you can inspect all of this at any time. Come, comment, you know, you can contribute if you like. Uh so really really powerful
7:24stuff. We don't we don't like hiding anything. So you can see all of these toml files basically represent a rule that sends up in the product. You can click any of these and hey this is exactly what we're shipping. So again in all the nature of being as transparent as we can, these are all here and the
7:39team constantly keeps these up to date. So you can actually see all the revision history. you can see everything which is pretty amazing right um and even like if you just even if you're not ready to get started with the product just to get an idea about how we detect certain behaviors whatever you go check how elastic does things just pop in here and
7:56you're pretty much good to go so I definitely want to highlight that because I think the team does an incredible job and then again they just end up uh in the product like we were seeing here that is my wrong tab this is what I was looking at um they also publish things like investigation guides and again they give you like Hey, if
8:13this did trigger in your environment once you start pumping data in, here's how you can try and investigate this particular alert, right? So, these are all part of what the team build and offer, which is which is awesome. And they constantly keep these up to date. Uh, which is pretty amazing. So, yeah, if you wanted to start running any of
8:31these rules, you can go ahead select the ones you want to run and you're good to go. We don't make any assumptions. So we don't the only one that is turned on by default is the elastic uh the endpoint security rule. We'll get into that. That's the rule that looks for events happening within elastic defend which is
8:47kind of our EDR integration. Uh but then it's up to you to decide which one of these are relevant to you. You know I'm sure you see this a lot John you speak to people like hey we turned on all our rules and a bunch of noise. We don't make that assumption. We don't assume everything is relevant for you. So we
9:01give you the opportunity to select and we tag everything to make it easy for you. So if you say, "Hey, I'm really only interested in, for example, detecting stuff that happens in GCP," go ahead, select, filter, turn them on, and you're pretty much good to go. So this is all like I I'm sure there are many watching who wouldn't be familiar with
9:21the fact that we even have this stuff. And you can see there's almost 1500 of these as as of today. Uh, and we keep pushing out more and more. And more importantly, a big thing that's changed for us over the years is okay, rules are great, but rules with no data is useless, right? So we even have that
9:39concept for data integrations and you know people might be familiar with beats, they might be familiar with log stash and there are people might have hundreds of thousands of these deployed which are great but these days we also ship um what we call integrations. Uh so we have a more consolidated way to get data in. It's called elastic agent.
10:01Elastic agent is kind of think of it like a centralized beat where you can deploy as many agents as you want and then you define a policy based off of the integrations. And these days there are like I think something like 400 integrations. So if you look at the policy here, you can add kind of any integration that
10:21you'd like and there's like hundreds of these. So these take care of all the parsing, all the data normalization. So you basically just select what you want to add, distribute it, and you're pretty much good to go. So it's it's literally that easy. And you can have as many endpoints, agents as you need, and you can update these on demand, which is
10:41also a big deal because if you're in an enterprise or in deploying hundreds of these, the last thing you want is to go and have to update all of those things individually. you can just centrally not only manage the integrations but also manage the any binary updates and stuff like that. So this is also a big difference to how we used to do things a
10:59few years ago, right? Like it's really important for us to give you everything kind of you need to to get started as easily as possible. So yeah, that's kind of the like just to make people aware that all of this is here. Um if hey, what does it look like to add kind of an agent? So let's say we wanted to go
11:14through that process. I spun this up. Um how do we actually get deployed? So, I have a little not a little I have a Windows box here. I'm just bring this up on the screen. And let's say you literally just started right now. You spun up a a cloud project or whatever. You have this machine and
11:35you wanted to let me see what elastic can detect. Basically, you'd go and say, okay, I'm going to go ahead and add an agent now. So you pick your policy and again this is the the policy would have previously created. I already added two integrations to this policy which is elastic defend and the system integration. And that's pretty much all you need to
11:55do. It just gives you all the instructions about how to get it up and running. So in my case I have a Windows machine. So I just need to copy this little PowerShell scriptlet here. Paste it in and I'm pretty much good to go. it will go ahead. It will download the binary, run it, execute it, and then
12:16apply the policy. That's all it takes. So, this typically is like two minutes worth of work, and you're you're good to go. >> Normally, I would like totally nitpick of, oh, make the display resolution bigger and text and font size, but I I think I love the like genius simplicity of this. It's just it's one command. You
12:37copy and paste it, and that's the manual deployment. So easy enough >> pretty much. And if if you want there's also you can get like MSI installer, whatever you prefer. Uh so you could do that. That's that's also so if you're distributing this and you want it a bit more managed, maybe you have a uh GPO policy or whatever, you could definitely
12:57do that as well. Uh you can see it identified that the agent has been enrolled and then it might wait a minute or two just to just confirm that it actually sees incoming data. But if we had to go look at here, you can see this is my host that I just added. Uh it's applying that policy. Uh then if you
13:13look at the host, it will tell you kind of all the status. So it's healthy, it's stable, and then for each integration, you kind of get the the status of each of these. So just in case, you know, something fails or whatever, you can go ahead and uh immediately get a look into that. So if anyone's watching and you've
13:29previously deployed beats and that's all you know like this is going to feel very very different and hopefully much better because you know I've used to do that before myself and this is way way easier and the nice thing is when it comes to the actual uh defend so defend is our uh edr integration uh that is also really
13:48configurable which we probably should cover right so what do we actually offer from that perspective uh so pretty much everything you'd expect from you know an PDR provider. So we do things like uh malware protections on all three operating systems. Um various different mechanisms here to detect malware. We have supervised models for things like Windows and Mac OS. But we also throw in
14:09some Yara signatures in there. And again those signatures are all actually uh published in the open. So you can go and see exactly what we have um by like and they're very wellleled and stuff like that. So these are actually all the ones that dump in there and the malware protection aspect of what we're seeing here is free as part of the free thing.
14:31So you get the kind of enterprisegrade um malware prevention with the supervised models and the signatures included there. Uh but then we do of course some more sophisticated stuff. So we have ransomware pro protections. This looks at heristics of a file. It looks at we distribute canary tokens uh to try and detect malware behavior. There we have MBR protection as well. So that's
14:53all included. Threats in memory. This is a mix again of uh looking at certain stuff in memory but also applying Yara in memory as well. Uh malicious behaviors. So these are looking at basically queries we run on the endpoints themselves to look for specific types of behavior. Uh so particular like sequences of events that we see happening. Uh and again these are
15:14all open in that same repo. So if anyone wants to take a look at what those actually are, you can go in here and take a look at those behavior rules. So again, distributed across the oss, but if you want to take a look at what these actually are, it's a very similar syntax to the rules that we would ship in the
15:33product, but these run on the endpoint. So we're looking for this behavior at the end point because then we can prevent it from happening and that would basically kill a process or whatever response action we've we've kind of taken there. >> That's super cool. I know there's always kind of the conversation of oh do this thing on the endpoint whatever resources
15:51might be available then is kind of usually a question or pull this thing back to kind of the cloud understanding and analysis there. Uh but you were all on endpoint right? >> Yeah. So you have a mix of both right if you have the rules that run on the endpoint because you know the the quicker we can stop something the better
16:09and then you get notified within this interface. But then if um because the towards the end here you'll see even if we just wanted to collect telemetry coming out of this events and forget all the protections we then have the rules on the SIM side that would look for behavior in this data. So you kind of get the two levels and it's totally up
16:29to you which ones you want to use which is really powerful. So and again all this uh event collection is uh free. So even if you just use this for the really rich way uh of how we hook into these. So some of these are using ATW, some of them are using our our kernel drivers and stuff like that. Um it's it's a lot
16:49more like temper resistant in that way. You know, we we've seen people mess around with with Windows event logs and stuff like that. But even just across operating systems, um it makes it really easy. On Linux, we use things like ebpf. Uh Mac OS we have our own system extension which is looking at this sort of stuff as well. So it's a really
17:06robust way even just purely for data collection right so you have a you have a mix of both you have things that will detect and prevent on the endpoint side uh and then with the data we're collecting if we find stuff uh within the sim you can of course detect it that way I would say I guess the advantage of
17:21doing things in elastic security as a sim is you can correlate with other data sources that's the biggest thing right so if you have you know events coming from your cloud events coming from other edr vendors because I should make a note that even though we have our own we will never stop you using your EDR vendor of
17:37choice. So if you have Microsoft Defender, Crowd Strike, Sentinel One, we'll allow you to bring in all of that data. And not only that, we actually inter interact with those systems. So you can actually take response actions on those systems right within Elastic, which is pretty cool. So if you wanted to respond to a crowd event and execute
17:55a script on that crowd endpoint, you can actually do it right within here, which is really powerful. So we are the kind of company which will give you the complete freedom of choice. We're not going to force you into anything. Um, you have this completely at your disposal. Use it if you wish, ignore it if you wish. That's that's that's
18:11totally your choice. So, so yeah, that's um I just wanted to dive in kind of some of the configuration options you have for defend. Of course, you can do things like trusted apps and filters and block lists and stuff like that, but from the protection side, it is a really rich set of features. So um and you know please
18:30any I really encourage anyone to just go ahead and just try it and try and you know break it try and get around it like we openly encourage that we're not the kind of vendor who say oh don't do any of this please go ahead and do your worst kind of thing and because it's so accessible it's easy even for you know researchers
18:50like yourself John like just being able to get access to this immediately without any kind of red tape or blockers is it's completely in your hands, right? Uh we'll never tell you no. And there's no also no minimum limit. So having one endpoint versus having 10,000, you never hear like a minimum for us. >> I think that's been the coolest thing,
19:11especially in like a home lab because as folks are learning, as folks are playing, as folks are just studying and trying to get a little bit smart on all the cyber security stuff. Um, just again, I don't want to sound like a broken record by any means, but I just love how easy it is now because I'll
19:27admit, you know, hey, learning and trying to understand and just get more into the industry and the community here, uh, ELK, even on its own as like, oh, this three acronym kind of thing and all the bells and whistles here can sometimes be a little overwhelming because there are a lot of options and that's awesome. But I mean honestly it
19:47it it looks gorgeous in how we could do so much while we just got to oh experiment play try and tinker with some of all those options there. >> Totally man and like uh again we're we're used very heavily in education. So again we have colleges offering courses on elastic >> and you know they get access to all of
20:04this. We have you know people like Sans Institute use us as well just because of how easily accessible and you you'll never hear no from us right and like that that's that's what we love. We love seeing if we can help you uh learn, get educated about these things. That's that's the kind of like music to our
20:20ears, right? Uh so look, we have this running. We installed it together. Everything's applied successfully. No issues. And like we give you a very in-depth kind of view into that. Uh what does it mean now? Like what what are the things we can actually pick up and like what's the experience if something does get detected? So what I will do is I'll
20:39turn some of these on. Just get rid of this tag here. For the simplicity of this call, I'm going to go ahead and turn all of them on. So, we'll go ahead and enable all the rules. And by the way, one thing I should mention is Oh, I enabled too many at once. That's that's that's a good problem to have, I guess.
20:58Let me just turn on the Windows ones. Let's do that. Yeah. Cool. Uh, one thing we do allow you to do even for like our pre-built rules that we ship, uh, you have full control over those. So if you wanted to edit anything, please go ahead and do so. So um I I'll let these turn on. But once
21:18they do, like we just saw here, let's say I'm looking at this, I'm like, uh maybe I want to slightly modify this query so it is a bit more adaptable to our environment. You can absolutely do that. So if you hit edit rule, you can change the definition, you can change whatever you want. And what's even better is if our team pushes out an
21:37update to this particular rule, we'll let you know and we'll let you know if there's any like conflicts to what you've changed. >> So you can you can um you can still make get take advantage of the updates, right? This is actually something relatively recent we put out because we wanted you know we had a lot of people
21:56who wanted to make these changes, but we really wanted to make sure we offered at least some opportunity for you to get all the updates our team pushes out. uh you can now do that and we'll kind of give you like a sidebyside diff of what that looks like if we notice hey you you made this change to the query we just
22:11push this change out do you want to keep yours or do you want to accept any of our changes so we kind of give you that that sideby-side view uh so yeah I just wanted to highlight that as well everything is editable and change things to your heart's content so we have stuff running now if we go back to our VM for
22:28example and let's run some malware right so I have this little, you know, I'm sure John, I'm sure you'll recognize this the second I run it, but um very uh very distributed far and wide uh little Excel sheet here. Um and it's doing its thing. We hit enable content there. We immediately saw something get prevented
22:51like in this case straight away like didn't have time to do anything else. Uh and then we can go ahead and in just a couple of minutes we'll see the rule trigger within within this view as well. Actually here you go. So already get getting brute force attempts on that machine. So like this is coming up like
23:09crazy. H and we'll see that that malware prevention. If we I thought we actually changed it to detection. I probably didn't save it. That was my intention. So we can we can actually try that again just to see what even more we we find. But uh yeah, you also have the free that's that's also really good in a
23:25scenario where you want to check the difference like here we just saw it immediately blocked but if you're in a lab and want to say hey what's the difference like what would have elastic picked up if it didn't prevent right so you can kind of change that policy on demand and distributed so it's really really easy to do h you can also have
23:41multiple versions of this right maybe you have your canary hosts that you use in like purple teaming exercises or whatever easily swap out these policies uh and it's literally just a matter of seconds before they get applied. So, so yeah, that's a really powerful thing. Uh I might Yeah, you can see actually here all the preventions that we got. So, we
24:02we can group these. Let's group them by rule name just to make a little bit easier. But you saw um not only the malware prevention, but we also prevented some other things from happening. So, suspicious Microsoft child process uh that was run out of Excel. We can take a look at the process tree if we wanted to real quick. So,
24:21Excel would have tried to launch 30 till we immediately stopped that, right? Um, so all of that is there. >> Can I say just to nerd out, I love the visualization that you all have here. I see it all the time because obviously, you know, it's running around. It makes the waves across the internet, but I love it is gorgeous. I love the process
24:40visualization. >> Thanks, man. No, like a lot of work goes into these. Um we even have for Linux machines I don't have an example here but we have a session viewer >> which is which essentially we will if you if you want it can be quite noisy so we do give users the choice we will capture not only what's happening in
25:00your terminal as literally like the full session and stitch it all together if you want us to we also capture the output so you can play back the output which is really cool so um I actually I I'll spin up example from from here. Um, and by the way, for educational purposes, we we also have this site.
25:19This is something I run on my malware, where if you don't want to go through the exercise of running the samples yourself, but you want to see kind of the output from elastic, I actually make all of these available. I have a bunch of different episodes, but also I make the cluster available. So, like as a learning exercise, you have full access
25:35to all all that data. >> Oh my goodness, we got to do this. I got I got to do this for videos. Um, but like if we I have a Linux episode here, so I just want to quickly show kind of that terminal output. Um, because it is really powerful, especially if you have more kind of uh
25:52Linux environments than Windows. So you kind of see this little session viewer here. So not only do you get kind of the process lineage, but you also get this kind of view. So for for a session, you could see how how child processes spawned off of each other, if there was any like elevation of privilege. And again here you can see output that was
26:12captured. You can literally play back the full session if you want. I was running H2. >> Oh, cool. >> So um so yeah, we do all of that um included. And the nice thing about this this is this is elastic. So all of this is searchable, right? That's the whole goal here. So this is all data that
26:29we're just stitching back that you don't even have to, you know, build this out yourself because, you know, having that view is really powerful. And um we also empower this on things like audit d. So if you're running a d uh we will give you the same view which is really cool. So like and the same thing we offer like
26:49this analyzer graph for sysmon and other things even for other edr vendors. So if you have like a crowdstrike sent one microsoft defender will give you the same view with their data. So it's not just if you're running that elastic defend component. So uh we again we try and we try and really make everyone's life simple by adapting to you like we
27:07don't want to force you into anything. So we offer this pretty much for for every kind of of data that you have. So uh hopefully people see the power of it because it really is right. So it's >> we were jamming just a little bit, you know, before we got a chance to start recording and I was asking James like,
27:23"Hey, hey man, what do what do you want to what do you want to cover? What should we talk about?" And he's like, "Do you want to do dig into Windows? Do we chat about Linux? Do we do we dig into Mac?" And he's like, "No, all of it. Everything." He's like, "Yes, that is so cool how adapt." And I love that
27:36word adaptive. How adaptable you are and elastic is totally right in that. And like it's all searchable, it's all flexible and it can be whatever you use. So yeah, >> I love it. >> And uh I guess one more thing on the EDR angle. Um you know there's the R in EDR, right? So of course um you can take
27:55response actions and there's like a full response console as well. So uh you can see here it takes you into this response console and then you can do various things. You can isolate the host, kill a process, retrieve a file, execute a command. So these are all things you could do. Um and again across all operating system types. So we we try not
28:14to um be biased towards one OS like we we want to make sure usually as much as we can if we release a feature we released across the board. uh and again we will even allow you to um run these commands on thirdparty endpoints uh depending on uh the openness of the APIs that they offer so we can build against
28:34uh but uh you will see this kind of same experience with this like response console uh whether it's again central one Microsoft defender crowd strike you get kind of a very similar view uh depending again how how busy systems might be might take a while but this can uh operate entirely async as well so we can come back to it and we keep a full
28:51history as well So if people want to check if anyone's doing anything suspicious like this all really important audit logging stuff like that. Uh it's all kept. So really important for us to be able to offer that. >> That's awesome. Um I mean it would be a miss if I don't uh talk about AI like we kind of have to
29:14right. >> Okay. Yeah. No can of worms I know it. >> Yeah. So first before we dive into features like because features for features sake doesn't make sense. I I really like to talk about our philosophy about how we think about AI and kind of the the the some of the stuff we've built and how we built it. Uh it's
29:30funny, it was perfect timing for me cuz the second I moved to product management, generative was coming into full swing and it kind of I was eased into it almost like it was like a natural thing for me to to start tinkering with. Uh but there's various things we do. Uh one of them uh well the my favorite is
29:50something we call attack discovery which essentially leverages uh large language models to do uh like a first pass triage analysis. So if you're dealing with like all these alerts that we have at the moment since we ran turned on those rules we have 400 similar like really typical right basically what we'll do is we'll leverage LLM and some searches in
30:11the back end for elastic to actually triage what might be going on here. Uh again in the interest of time uh I'll just show you what what that looks like after it runs and I make all of these again available in that on my malware environment. Uh you kind of get this view now. So if we looked for example uh
30:31there's kind of a a finding for all the eight episodes I have uh and when attack discovery ran it looked at the alerts for that episode and try to identify like what the attack might have been there. Uh and you can see here it found pretty much perfect. So if you put yourself in the position of hey I'm a
30:48I'm a user. I I really don't have the time to go through every single alert that was generated. Can you give me like a leg up? Can you give me like a first pass of what you would have seen? That's what the tax discovery is attempting to do here. And we we stitch this interface together to look and feel like an
31:03analyst uh something analysis an analyst would want to use. You see it's not conversational, right? I'm not chatting even though we're using a large language model here. Uh and you can see it goes through the whole finding. So in this case it was a BPF Trojan execution from shared memory. It tells me kind of the host and user involved. Uh, and then it
31:20goes through the full chronological order of events of what happened. And if you read through this, if if anyone watching, uh, this is spot on. This is on point. This is exactly what happened. So, we went from not only having alerts generated to fully understanding what happened, if any attacks were actually detected. And that's we identified that
31:40as a problem we've seen all over the years. And John, I'm sure you've seen this, you've probably seen it and deal with it at the Hunter side. Um, dealing with a ton of alerts is really hard, especially if you're not too uh familiar with the landscape. Maybe you're just starting out your career in cyber. Even if you're more seasoned, you can't
31:56really expect everyone to know every single bit of in and out of every alert you have, right? So, just giving you that leg up to understand, hey, we looked at your alerts. Here's what we found kind of thing. Um, and some things we we feel we do a bit differently is we give you the choice kind of of what
32:10model to use. So, we don't lock you to an into an LLM. So you can pick whatever model you prefer, including open source ones if that's something you wanted to do. Uh we make everything really transparent. We track tokens for you. So all of that's really good stuff. So uh really really powerful. We've been uh very heavily focused on identifying
32:27areas within the full ecosystem of elastic of where AI would apply. So not just triage and investigation, but also things like uh data ingestion. So we have a way to generate like those data integrations that I was showing you, we have a way to generate them with AI. Uh even for example detecting issues uh on defend for example is a really
32:50powerful thing. So especially if you live in environments where you might end up with two uh EDR products and we know what kind of conflicts that could cause. So we actually give you a way to identify if there are any conflicts with AI which is really cool. We call this like automatic troubleshooting. you can basically say, "Hey, I want to be able
33:10to detect if I have any conflicting AV or EDR software on that same machine I'm running Defend. And if we do detect something, we'll actually suggest kind of what you could whitelist to fix it." Uh, as opposed to you having to go through all your logs and identifying that, go to the vendor like, "Hey, what I should what should I be whitelisting
33:28here?" In this case, I only have defend. Uh, but that's also like an area we identify that's usually really troublesome. So how can we use AI a bit more clever there? So yeah, we do all of these things. We have uh basically five different areas where we've applied AI. Of course, we have an assistant uh that you can leverage. You can ask about your
33:45alerts in natural language. You can generate queries, which I'll get to right after this. But really just that helping hand to guide you along the way for pretty much anything you want to do with an elastic. Uh and we also allow you to bring kind of supplemental data to provide to the assistant. So, uh, it's really powerful in incident
34:03response scenarios to be able to ask about like, hey, what's our remediation guidance for this type of attack or what's our hunting playbook for doing X Y and Z? So, you can do all of that with the assistant. It's a it's a really really powerful thing for us to offer and we can offer that again because of
34:18our roots in search because we have this concept of semantic searching which is really powerful and it's like the best friend to LLMs. So, that's kind of all built in and again we don't charge more for AI. it's just there like you use these features. Uh bring your own LLM, use the one we provide because we do
34:34offer like a managed one in case you're not able to bring your own. But uh it's not it's not extra. It's not it's not bolted on. It's like inbuilt. >> I'm still blown away by how much stuff you all put out for free. It's banana town. That's awesome. >> Yeah, man. It's uh we we really want to
34:50like help like our goal really is we want people to make the world a safer place and we want to give them the tools to do that, right? Yes, we have enterprise features because you know we need to keep the lights on and like it takes very talented engineers to kind of build the stuff. But that is that is
35:05your call. Like it is your call if if that's something you want to use and leverage. If you find value in what we're offering and you you're happy to pay that price, absolutely. But if you want to start slow and start with the free stuff and then gradually grow, your call as well. So um that's uh being able
35:19to give you the choice is is really important for us. Um I do want one more thing I want to kind of highlight from my end at least is there used to be this perception in elastic that hey it's yes I can throw data into elastic and I can uh it's there I can search it but the searching
35:39capability ironically wasn't the best for people who are used to like uh Splunk's SPL or even Microsoft custo languages are extremely powerful hats off to them for like kind of redefining how we do thread hunting and that sort of stuff. So we have been on a mission to make that better. So uh last year we introduced a brand new query language
36:00called ESQL. Very cleverly named the elastic search piped query language. The the pipe is is deliberate. Um so now we have this piped query language. It supports things like joins, aggregations, like you name it. Pretty much whatever you're used to wanting to be able to do with this kind of query, data manipulation, that sort of stuff, you can absolutely do it. uh no
36:20limitations in terms of what data you can query with it. Even like federated searches across multiple different environments of elastic that's totally supported. So I like there's a lot of people who who still don't know that this is the thing like you can of course now do this. Um and we're constantly making this better. So again this
36:39language is only about a year old but um we the the amount of finalies we heard when we announced this was pretty tremendous. I I agree like even myself as a you know previous user of other platforms this this was a big gap. So just want to make people aware that it is also a gap we've closed like this is
36:56now a language that you could also use not just for hunting but also for for detection scenarios. >> We've been chasing that truth be told we we were wrestling around EQL KQL X whatever starql but I'm I love seeing this thing uh especially because of correlation. I know you mentioned it and threw it in there, but like that gives
37:17so much awesome power because it's one thing, okay, cool. We we define whatever rule set and have something pop and fire, but like I want that across the context of well, what about all the other things that could have happened and what else might have fired? So having that ability to do broadstroke correlation, realistically one thing in
37:37context of another is awesome. So I was super happy. I'm glad I I am a fellow finally when ESQL hit the street. >> I I I hear you, man. And um it's it's also refreshing because we're able to offer you more detections, more capabilities, right? So um like a lot of the new detections we put out are all
37:58using ESQL now uh because it's so much more powerful. >> Uh and by the way, this goes without saying. Uh we we spoke a lot about the pre-built rules. You can of course create your own. So like I just wanted to make sure that people are aware like we have this really nice interface to use the SQL or whatever you want to
38:14craft your own detections and gets alerts and stuff like that. So that's all there of course. Um and uh one of the things we've been experimenting with is you know we spoke we spoke a bit about AI we spoke about the assistant we spoke about discovery the assistant is able to like generate these queries for you and have like a full validation loop
38:31which is really awesome. But one thing we've been recently experimenting with is hey what about using LLM as part of a query language itself. So what if we offered you the ability that within the query syntax you could call an LLM and then use that output as part of your hunts. And I was putting this together yesterday. I'm like hey let me think of
38:52a cool idea I could use this for because this is this is still relatively new. We call it the completion command. But um I'm sure you face this all the time, John. Like a situation where you have a really incredible rich source of information to detect against or hunt against like in my case like PowerShell script blocks, right? Usually can be
39:12extremely noisy, but when something does happen, having that ability to inspect a malicious script is phenomenal. But the problem is, you know, these scripts can be short, they can be long, they can be offiscated, they could be a bunch of stuff in one. And usually it's really hard to kind of build a pattern to like there's like a million different regixes
39:31you'd need and like to try and identify some form of aiscation in there and stuff like that. So what I did in this case is I'm actually leveraging uh like an LLM within my hunt query, right? to look at that text uh identify if it's potentially malicious. Give it a score and then tell me if the score is
39:51like greater than 90 then 10 will happen. Uh, in this case, we went from having to understand a script like this, which is hundreds of lines of obfiscated gobblegook to this, a really easy to read plain English description, and right where I'm hunting, you know, so I
40:12didn't have to break my workflow. uh which is really powerful thing to be able to give anyone right of any skill level because I there's no way one just finding this would have been really especially in bigger environments where you have hundreds of thousands of windows generating these script locks but then identifying like the the maliciousness with inside it and then
40:31understanding the content so like I was just experimenting with this yesterday I'm like oh this is such a powerful use case so so yeah having that ability now even to call like LLMs within your hunt itself is just it's just crazy the world we live in these days. It's it's it's amazing >> because that dumps the whole explanation
40:50of like what this does, right? Like that's almost done enough of an analysis to be like, hey, this is this was our investigation. This is part of the triage and like that's done >> part of everything you were already doing. That's so cool. >> Yeah. And then of course you can keep you know expanding on your hypothesis
41:09whatever but right I I I mean I I really empathize in people just starting out in this field someone who's new like analyst just starting out like you tell them hey we have we have all this incredible data we have script block logging and whatever and then they see something like this and like oh what the heck is this like how am I supposed to
41:27find anything within this right um and now we've just made their life so much easier and really that goes to like uh one of our main points on on like how we think about AI at Elastic. We are not in the business of replacing humans. We we want to make everyone better. Like we just really want you to have fun doing
41:47your job. Enjoy doing things like thread hunting and analysis and stuff like that without feeling the burnout and the the headache of going through m mundane stuff and just make you better so then you can grow your career, excel yourself, give yourself more opportunities. That's really kind of our main mission. Excellent. I love it, my friend. Well,
42:08can I ask I don't know if there's for one thing, are there anything else? Oh, we should dig into we should take a look at. But if we are wrapping up, uh, well, what's next? What else is on the horizon? Is there anything you can share? Any sneak peek or Oh, just a quick hint of >> what are you doing now?
42:23>> For sure. So, before I dive into that, uh, a few other resources that maybe people who are interested in learning more. So, uh I know there'll be a bunch of links in the description here, but also uh we have this nice little portal. Um if you don't want to go to the GitHub repo and search for what rules we have,
42:40you can go ahead and say, "Hey, what does Elastic do in AWS for detection for example, you can actually search and hunt and even like we have hunting guides that you can search through." So, here's another resource for you which is really powerful in case you wanted to be aware. Uh but I can talk very briefly about what things are coming next but uh
42:57definitely some other big gaps that we're closing. Um automation is the name of the game. Uh you know that's been we have very basic ways of doing very basic automation and elastic. Uh but we joined forces with the company a few months ago at the the time of this um and we're working full steam ahead to have like
43:16full native automation with elastic security. um when we say automation like the you know what people might call traditionally sore I'm personally not a fan of the acronym but uh so I like saying the a part of that so uh automation is something people can uh definitely expect um sooner than sooner than later uh and you know we spoke
43:37about AI today everyone's speaking about AI agents and that sort of stuff we have these like pre-built agents like attack discovery and the assistant but the ability to craft kind of your own agents is also something that is on the horizon very very soon. So, uh hopefully that keeps people excited. >> Yeah, that sounds very cool. I'm
43:56excited. We'll have to chat again when that rolls around. >> Let's do it. >> Well, fantastic, James. Thank you. Thank you. Thank you. We'll get a whole lot of those links and resources down below included with the video. Uh any last call to action? Any last sweet stuff? How can folks get started? How can they dive in? Is it just elastic.com?
44:16>> Uh it's actually elastic.co. co, you know, we were too late to buy the.com domain, whatever company has that elastic.com, you know, damn it. Uh, but elastic.co, cloud.astic.co, to try the cloud stuff. Again, you have a 14-day free trial. You don't have to pay a dime. Uh, for anyone who's like doing incident response operations, whatever you need something really quick, spin
44:36something up in the cloud, shut it down when you're ready, never have to pay anything again. Um, uh, and yeah, just I really encourage people to try uh, join us in our community Slack. like we are all there our research team uh myself a bunch of others of my peers uh there'll be the link in the description but yeah
44:53please come ask questions come share issues I I I also want to hear what's not working right like it's as much as we try and do our best and push everything out really nicely like some things do you know slip through the cracks so let us know what's not working for you and yeah like just just please
45:08give us a shot like >> well I know my marching orders I got to go play with all my malware and get a cluster and everything spun up for it. So, thank you. Thank you. Thank you. Can't say it enough. No worries. No worries. Happy to do it. >> All righty. We'll see you again, James. Until then, hey, everyone, jump into
45:24Elastic. Get a chance to play. Thank you.