A security analyst at Orange Business Services shares how they integrated Elastic into their existing SIEM, resulting in faster investigations and saving their engineers’ time

I’m a security analyst at Orange Business Services in Paris, and one of my current projects for the Orange Group is implementing a new SIEM based on the Elastic Stack. In this blog post, I’ll share why we chose Elastic and how we were able to integrate Elastic into our existing SIEM, resulting in faster investigations and saving our engineers’ time.So follow along:Orange Group is a multi-service network operator and digital service provider in 26 countries and serves about 253 million customers with 147,000 employees. Orange Business Services, the unit dedicated to businesses and organizations, focuses on digital services. From connectivity, the Internet of Things (IoT), and the cloud to artificial intelligence (AI), application development, and cybersecurity, Orange Business Services works with its clients to harness the true value of their data, helping them every step of the way.<h2>Integrating the Elastic Stack into our SIEM strategy</h2>The Orange International Network Infrastructure (OINIS) department, which is in charge of building the Orange group’s international network, identified the need for a modern security monitoring solution capable of keeping up with the constant changes in the fast-paced world of security. As a result, two of our departments recently decided to collaborate on redesigning and modernizing the Orange Business Services SIEM infrastructure, which has been dubbed “EYES.” The key criteria for selecting our new solution were speed, simplicity of data integration, and better visualization tools.Elastic had piqued our interest as early as 2018. We were finally convinced to take the plunge with Elastic after the ElasticON Tour Toronto and hearing the feedback from the security team at <a href="https://www.elastic.co/elasticon/tour/2018/toronto/security-events-logging-bell-canada">Bell Canada</a> (before Elastic introduced its own turnkey SIEM solution, which we will be rolling out soon). Finding themselves in a similar situation to our own, the team at Bell Canada had quickly taken the initiative of completely replacing their SIEM with the Elastic Stack, which was capable of ingesting all of their security logs, automatically detecting threats, and standardizing the format of their logs. We were also interested in Elastic’s machine learning features, which promised to help us modernize our SIEM approach.We decided to implement the Elastic Stack for a functional proof of concept (POC) in less than three months. However, we took a slightly different approach than Bell Canada, in that our SIEM solution is still being used for its correlation engine. Following our three-month-long POC, we copied all our logs into the new infrastructure and enabled the Elastic Stack’s security features to protect access to our clusters. We started by learning to use the Elastic Stack ourselves; we were able to find all the necessary information to get started on the Elastic blog. Later on, we started working closely with the teams at Elastic in order to roll out new features. Elastic’s Support team has always proven to be very responsive, whether we came to them with application debugging questions or requests for advice on integration, or even our security architecture.Our infrastructure evolved very quickly as a result:<ul><li aria-level="1">We separated the Dev, Preprod, and Prod environments, allowing us to quickly test the new features offered by Elastic and determine whether we wanted to go into production with them.</li><li aria-level="1">Logstash also quickly went from a simple parsing tool to an essential tool for enriching our logs.&nbsp; <img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt9a37b648de42db12/60f0ab59b86fce146acbe04a/blog-orange-business-architecture-diagram.png" data-sys-asset-uid="blt9a37b648de42db12" alt="blog-orange-business-architecture-diagram.png"/></li><li><figcaption>Architecture diagram</figcaption></li><li aria-level="1">We also applied the hot/warm/cold formats for managing the lifecycle of our indices, allowing us to improve both performance and security.&nbsp;</li><li aria-level="1">Finally, we added a monitoring cluster to collect the metrics for the various components of our systems and keep a close eye on the performance of our clusters.</li></ul><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltefc777c7144bd385/60f0abcb487cea2ee9e6530a/blog-orange-business-server-distribution-diagram.png" style="background-color: initial;" data-sys-asset-uid="bltefc777c7144bd385" alt="blog-orange-business-server-distribution-diagram.png"/><figcaption>Server distribution diagram</figcaption>In these architectures, we use the products in the Elastic Stack (Elasticsearch, Logstash, Kibana) and have implemented Beats for a handful of very specific needs (application logs, NetFlow) that have not yet been standardized. We now have around 20 Elasticsearch nodes spread across two geographic sites. With all components included, this makes for a total of 80 servers, nearly 100 billion logs indexed, and several dozen terabytes of data.<h2>A comprehensive overview of the speed and performance of Elastic Stack</h2>Following the integration of the Elastic Stack, we quickly saw an improvement in our SOC investigation abilities. Thanks to our new infrastructure, we can retrieve the results of our investigations much more quickly, and also benefit from all of the data regarding the security of our information systems (inventories, network mapping, management of computer equipment, alerts for external equipment, etc.) being centralized. This in turn gives us a greater degree of control over the ingestion of our logs, and we have implemented a dashboard that allows us to view the quality of our various pipelines so our SIEM engineers no longer have to waste time investigating whether a log format has been modified following the introduction of a new application or version.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blta63bdb6b10784dd7/60f0ac2b487cea2ee9e6530e/blog-orange-business-ingestion-pipeline-performance.png" data-sys-asset-uid="blta63bdb6b10784dd7" alt="blog-orange-business-ingestion-pipeline-performance.png"/><figcaption>Dashboard displaying the performance of our ingestion pipelines</figcaption>We are now capable of detecting network anomalies more quickly and no longer have to query multiple databases to obtain a single piece of information. Since Orange Business Services has over 1,000 pieces of internal network equipment (LAN), the enrichment of the information taken from IPAM (IP address management) allows us to plot all of our equipment on a map and track the communications that have occurred.Adopting the Elastic Stack also proved to be quick, as our users make use of Kibana on a daily basis to view their data, and Spaces also allows us to take that one step further by separating out the various workspaces according to their use case (for example, providing access to anonymized logs or masking IP fields).<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltd601ba3dbaa43cf4/60f0ac6136954912f039ac48/blog-orange-business-kibana-spaces.png" data-sys-asset-uid="bltd601ba3dbaa43cf4" alt="blog-orange-business-kibana-spaces.png"/><figcaption>Diagram of distribution of workspaces with Kibana Spaces</figcaption>We have also integrated the <a href="https://www.elastic.co/guide/en/ecs/current/index.html">Elastic Common Schema</a> (ECS). We realized the importance of having data that follows this model before being able to get started with machine learning and SIEM. Once ECS had been implemented, we were able to work on new security scenarios based on Elastic machine learning features. In the space of just a few weeks, this proved to be successful, allowing us to detect anomalies that were previously undetectable with a traditional correlation engine. The ease of creating machine learning jobs also made it easier for us to implement these “dynamic” rules.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt01f6fbcc2b27ccaa/60f0aca836954912f039ac4c/blog-orange-business-siem-process.png" data-sys-asset-uid="blt01f6fbcc2b27ccaa" alt="blog-orange-business-siem-process.png"/><figcaption>Process followed by our SIEM engineers</figcaption>This is now the default process followed by our SIEM engineers. The SOC comes into play at stage 5, analyzing and making use of the alerts raised by the various machine learning jobs.<h2>Next steps: Integrating Elastic Security</h2>Our first steps with the Elastic Stack proved to be successful, and we wish to continue improving our anomaly and intrusion detection techniques by implementing additional tools offered by Elastic. We intend to increase the number of servers and the types of logs collected with the Elastic Stack. We’re also migrating our cold nodes to a new infrastructure based on the Amazon S3 API, which will allow us to use the snapshot features of Kibana — allowing us to increase our data retention capacity without increasing our storage costs. What’s more, we will continue to improve the enrichment of our security logs so as to better identify all the individuals on our intranet and detect intruders. We are also currently developing a “control tower” interface to take our use of Kibana even further with <a href="https://www.elastic.co/blog/getting-started-with-canvas-in-kibana">Canvas</a>.We would also like to improve our use of machine learning and make use of <a href="https://www.elastic.co/security">Elastic Security</a>. For one, we will be testing <a href="https://www.elastic.co/siem">Elastic Security for SIEM </a>— and, more specifically, the correlation rules — in an effort to improve the automation of threat detection, and we would also like to implement Elastic Security for <a href="https://www.elastic.co/endpoint-security/">Endpoint security</a>. Pairing the SIEM tool with endpoint security will allow us to improve our security orchestration, automation, and response (SOAR) capabilities, thus providing us with a welcome boost in productivity. Concentrating all our security tools into a single solution will also allow us to simplify investigations. We hope that the data generated by machine learning and endpoint security will supplement the data collected by our security equipment in a helpful way. Finally, this will strengthen the security perimeter monitored by EYES, particularly on our servers.Jocelyn Renouf has been a security analyst at Orange Business Services in Paris for over two years and is currently focusing on implementing a new SIEM based on the Elastic Stack.

blog-banner-gears-close.jpg

blog-thumb-gears-close.jpg

How Orange Business Services is building a better SIEM with Elastic

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Analyste Sécurité

Jocelyn Renouf

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

O conteúdo desta página não está disponível no idioma selecionado. A Elastic está trabalhando para garantir que o conteúdo esteja disponível em vários idiomas. Agradecemos a compreensão.

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

Ao enviar a confirmação, você reconhece que leu e concorda com nossos <a href="/pt/legal/elastic-cloud-account-terms" target="_self">Termos de Serviço</a> e também concorda em receber <a href="/pt/legal/privacy-statement#how-we-use-the-information" target="_self">comunicações especiais</a> por meio dos dados de contato que forneceu acima. Consulte a <a href="/pt/legal/privacy-statement/" target="_self">Declaração de Privacidade da Elastic</a> para saber mais detalhes ou para cancelar a qualquer momento.

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

Ao enviar a confirmação, você reconhece que leu e concorda com nossos <a href="/pt/legal/serverless-preview-terms" target="_self">Termos de Serviço</a> e que a Elastic pode <a href="/pt/legal/privacy-statement#how-we-use-the-information" target="_self">entrar em contato com você</a> para divulgar nossos produtos e serviços relacionados usando os dados que você forneceu acima. Consulte a <a href="/pt/legal/privacy-statement/" target="_self">Declaração de Privacidade da Elastic</a> para saber mais detalhes ou para cancelar a qualquer momento.

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

Ao enviar, você concorda com os <a href="/pt/agreements/global/cloud-services-monthly" rel="nofollow">Termos de Serviço do Elastic Cloud</a>. Seus dados pessoais serão tratados de acordo com a <a href="/pt/legal/privacy-statement">Declaração de Privacidade da Elastic</a>.

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

Ao enviar a confirmação, você reconhece que leu e concorda com nossos <a href="/pt/legal/terms-of-use" target="_self">Termos de Serviço</a> e que a Elastic pode <a href="/pt/legal/privacy-statement#how-we-use-the-information" target="_self">entrar em contato com você</a> para divulgar nossos produtos e serviços relacionados usando os dados que você forneceu acima. Consulte a <a href="/pt/legal/privacy-statement/" target="_self">Declaração de Privacidade da Elastic</a> para saber mais detalhes ou para cancelar a qualquer momento.

Explore similar demos

Explore outras demonstrações semelhantes

Overview

Load More

Speakers

Close

See more insights

Author

Articles by

Learn more

Watch now (no PT)

Watch now

See all top stories

All (no PT translation)

Contact information

Press Release

Share on Reddit

Share this story

Share by Email

Thank you for your interest!

Contact Info

Follow us on Youtube

Share on LinkedIn

Follow us on LinkedIn

Search Integrations

All Solutions

Video for

Follow us on Twitter

See when this webinar starts in my time zone

Consultar a hora de início do webinar no meu fuso horário

Register to Watch

Register now

See All Posts

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

Não vai conseguir participar? Inscreva-se e nós lhe enviaremos a gravação. Você também receberá um email com conteúdo relacionado.

Author

Articles by Jocelyn Renouf

Analyste Sécurité, Orange Business Services

How Orange Business Services is building a better SIEM with Elastic