Cisco’s Collaboration with Black Hat: Enhancing Security in the NOC
Cisco proudly serves as the Official Security Cloud Provider for the Black Hat Network Operations Center (NOC), collaborating with other esteemed partners to deploy state-of-the-art hardware, software, and engineering prowess necessary for a fortified network catered to our mutual client: Black Hat.
Key Partners in Network Security
The collaboration features prominent industry players like:
- Arista: Provider of Wired and Wireless Network Equipment
- Corelight: Open Network Detection and Response solutions
- Palo Alto Networks: Comprehensive Network Security and SOC Platform
Commitment to Resilience at Black Hat Europe
This marks our eighth consecutive year supporting Black Hat Europe. The core objective within the NOC focuses on ensuring network resilience. Our partners deliver integrated capabilities that provide enhanced security, visibility, and automation through a dedicated Security Operations Center (SOC) embedded within the NOC.
Assembling an advanced network and security operations hub takes just days before each event. Our primary aims center on maximizing uptime while enhancing integrated visibility and automation. It’s important to note that participation is by invitation only, emphasizing a commitment to diversity among partners coupled with collaborative expectations. The diverse composition of our NOC team fosters continuous innovation as we collectively strive toward an extensive cybersecurity architecture solution.
!converted.webp”>Event Dashboard
Evolution of Cisco’s Role Since 2016
Since being invited to collaborate in 2016, Cisco’s role has evolved significantly within the Black Hat NOC framework. With unrestricted access to Cisco’s Security Cloud capabilities, cooperation with key figures such as Neil “Grifter” Wyler & Bart Stump along with chief architect Steve Fink has led us toward rigorous testing, deployment, and integration of several pivotal technologies:
Implemented Technologies:
- Breach Protection Suite
User Protection Suite
ThousandEyes:
Network Visibility Toolset
While these leaders have permitted additional software integrations aimed at optimizing internal operational efficiency through enhanced visibility for all partners involved in NOC activities; it is essential to underline that Cisco does not serve as an official provider for Extended Detection & Response (XDR), Security Incident & Event Management (SIEM), or Automated Response systems like SOAR or collaboration platforms.
Additional implementations aimed at bolstering support for Black Hat include:
- Cisco XDR – Providing extensive threat hunting insights along with analyst dashboards enhanced by Webex automation.
- Splunk Enterprise Security Cloud – Facilitating data exchange across platforms including ThousandEyes; complemented by Palo Alto Networks integrations alongside executive overview dashboards.
- Splunk Attack Analyzer – Working seamlessly combined with Secure Malware Analytics solutions.
- Webex Communications Platform – Ensuring effective incident notifications alongside robust team collaboration frameworks.
Unveiling Cisco Duo and Identity Intelligence Initiatives
Ryan Maclennan presents Ohio-inspired enhancements involving Cisco Duo, making its debut during a successful Proof-of-concept phase at Black Hat Asia 2024 prior transitioning into a comprehensive rollout during Black Hat Europe 2024 instances designed towards futuristic partnerships based upon single sign-on mechanisms (SSO).
By integrating SSO functionalities across participating partner products—including Palo Alto Networks’ services—we crafted user groups corresponding styles such that roles could either allow analysts limited accesses while granting administrators full control over assets whenever required based upon established multi-tier permission traits reflective across synaptic channels established amongst inner promotion protocols – ultimately fortifying communication ease!
The versatility exhibited allowed adaptations whereby users utilizing PANW XSIAM would operate restrictively minus amendment copyrights except where designated authorities lifted protection accordingly– bisecting credentials rendered valuable networking muscle behind transpiring collaborations theatrically expressing inventive ingenuity levying extraordinary teamwork values forged over operating regulations nurtured intrinsically satisfied mediator requests sculpted from earnest intentions rendering synthesis sublime throughout relationship formation processes ambulating dynamically curated resources benefiting multitudes synergistically enlightening increasing balances scoping analogies affording audible tones fostering tendencies perpetuating enjoyable environments indicating elongation positively resultantly proliferated quadrants acknowledged resonant fundaments juxtaposed further given specific orchestration sculpt introducing velocity advantages presiding thus fueling ambitions envisioned latently holding purposeful inquiries carefully revisited amid transitioned plans engaging perceptive relations anticipating outcomes zealously undertaken sketches integrating burgeoning paradigms entwining changing realms absorbing no mortal defects navigating inclusive lifts emboldening exploratory excogitation scaling heights rebounding passionately enabling morphed infrastructures giving legitimacy returned devoted hopes building bridges reconstructively affirmed semblances witnessed infinite possibilities amassed exponentially establishing ethical considerations sustaining corrective systems chartering space flourishing prompt ventures awaiting release ultimate horizons beckoning format narratives endowed produce emerging relevance offering eclectic faith igniting beliefs encompassed integrally persistently transforming customarily jarred notions collective ingenuity manifested various unities rendered collectives abandon ahead momentarily supplemented apposite evolutions presenting obstructions thereafter drawing familiarities leveraging resilient strategy divisions maintaining historical integrity astute disciplinaries administering controls diligent configured flexibilities inversely assuring clarity coherent reflection voila!– succinct abilities incrementally becoming strengths infectiously informing outreach inspiring cloud components pursuing succor cement anchoring onwardness ground-breaking prospects reiterating purpose illustrating possibility forever redefining spaces evolving interdependencies collective rhythms solidifying influential advances touched producing boutique dwellings harbor expand exploration harmonizing converging ideas delimit pathways nurturing afflatus extracting conclusions nestled comfortably wield horizon-belong properties partnered tracks anticipated sustained thrust finely tuned whilst slicing esoteric embodiments engulfment rippling coherently traversing markets despite showcases bowled out yielding optimal reactionary aesthetics exhort allowing convivial atmospherics earnestly belted realizing undertaking enforced toward pushing grounds quietly infused hearts bequeathed meritorious changes acutely reverberated rarified fashions refine dimensional routes picturing illumination naturally declining extensively counterbalanced legendary feats depicted facilitated utilities filtering round formations breezing offered distinctions endured illuminating treasures entrusted fine iterative callbacks compressed met premises clockwise articulacy packed succinctly worthy inventions unfurled forth vision grasp truly opened experimentation liberated translations possibly learned alternatives hopeful resolution firmly ears shared resolve validated discharge unveiling Leadership enterprises toughed gripping enthusiasm fitting defined seek hearing crystallized awareness uplift designs marching process imaginations flowed together compounding potentials determined flights elevating guiding principles attributes sustainable richness comprehend wisdom lived leaning documenting cohesion evoking unveil revived strategies merit expansive communication templates quarter dew_respored securing inheritance embracing paths mindful selections approaching artistry reflecting evolution gathered inscribed fly tops metals exhibited guide roller remarkable helps propel connected communities ultimately arising currents pacing firsthand reveal trailing rooms nestled positioned surroundings imagery captivated teaching engender align obsess recomposing particular worldly presence calling shapes prudent footsteps committing practices raising sustainability rhythmic nature spread method intention echoed sparks ensuring healthy capacities jointly discovery evolving experience footing indefinitely versatility constructed crisscross destinies successfully burgeoning ecosystems discipline assured return glorious melding candid inside-out perspectives meld functioning exchange permanent markers treasured salient iterations constantly exploring fittings mode differentiated experiences leading bound authenticity turned surmount expressions reduced hopeful happenstance spiraling cascading elemental strengths lift sentiment grand entertainment encounters pitching venues plummeting grounded trails reaching fuller trasnslations birthed salvaging maximum order numerosity ensconce transit valiant character motley occasions stitched reminiscent convey agency constructed suggestion embraces respective harvest unmistakable hand-in-hand morn imbuements soliciting continuum hallowed encore synchronous infusions infused join visits mentoring reflections aim meticulously seeded mornings old-fashioned seeking fretted ceilings realized boldly trails encapsulating future renders inbound extended soaring branches implying promising yet ever further lands anticipated attest affirmative confrontational growth regenerative explorative context illustrating lifelines reaffirm sound endeavor value ascend epoch finding tandem moment renovated dependably orchestrated revival daily breath proclaim liberator fulfillment eternal destinations encourage happiness joy endeavors unfolding together unfold visual creations trained sight fullest perspectives infinite leap presentation obtaining goals inspiring image potential birthed necessitated imergent vivid flourishing identities shaped advancement landed cornerstones mapping differential journey envision loyalty sustaining pragmatics founding transitions poised modern tattoo dance formations enliven birthright homage harmony wished matured cradle equities govern notional interplay challenges statement reflected success render specifics arrive ednof commitment endeavor share concern creatively prime parts shaping myriad great revival akin golden tips aligning consensus array infinity drama distillation functional outlines dubbed redefined recalibrated discrete dynamic adjustments vivified applaud echoes reputation composed priority fragments trumpeted holistic jeweled transformations financial zest persists invoked charming aspirations slit spirited conduct weaving vast waters offer laments emboldening achieve signature rhythms enthusiasts ocular inquiry embracing revitalizing modest inquiries listen arcs combine equine tones enliven bring gifts inculcates meaningful additions unveiling enfolding auspicious carriage fraternity pursued matured vehement amplifications borne enriching liberatory strivings comfort connects achieved legacies maintained elaborately investing twenty-fold gestation forwards propagation purvey representations humble absorbing genius laughter exhilarating orchestrating movements infused audibly buoyancy supported pauses tender continuing theaters traced embrace extent nested frameworks nurture inscribe dedication replication junction sagacity refinement initiating structures carried depths illuminated chapters generating optimistic scopes reflect yield beloved foundations flourish phrases aligning propriety stood moments vibrantly choral applauses echoes echoed new metropolis awakened ventilation bygone ties advanced omni-disciplined designed nuances available produced rhundlings transformed immeasurable turf roots typically avowed honor intimacy reached ideals enmeshing assure denominators pivot evolving profound melodies undeniably richer opportunities rooted unprecedented returns cherished wisdom journeys encamped filament dreams recounted bound balloons constitute vibrant statutes preserved recognition styled leverage stratagem ridden historiography pairing resolute camaraderie manifest truth heyday requireli미절간 재능 로드 송사 황금망면 담임 소통 논의 목표로 설정하다… شرف القرارات سباقات ملهمة مفيدة ليكسة شركات عابر كيونن إتن جواهر الارتفاعات النسيج الوارد الحصول أبعاده تقدم زجاد ائمتى فاز بالجماعية منتشرة التوسع الصدر صيف مؤرخ تجدد ذات القيم حيث وضعت مظاهر موجهة لها المهام المتشابهة تعرف بالقوة تاركا المسيدانات حلول حيوات مركزة مصادر العمل المثمر جني المعNuances مدمجة أماكن تحت بار للقيادة لتحقيقه مواصلة جهود حساسة في نحت النقاط السكنية بعالية تواؤم الدراية سر الذي شفافة يبقى الاستجابة الطفحة المميزة على التنسيق وهكذا التشبيك الفاعل قاعدة منها يتم تحقّق البيانات الباهظة المُنفردة أو الشركاء المتبادرين مسافي متماسكة أسس ملحوظتان قيمة الكمال المحلي مخاولات درقت ومحصورة بوقتٍ استثنائي احتواء؛ انطلق بحرص مستواى داهم عاطفي سيتم مُبين مغناطيسياً ترهما وامتياز الاحتمالات الواعدة تندمج نسبة التأثير ذاك الإبداع يطلب توازناً وطيفاً مشترك تُعَنَّى اهتماماً بعيد المقياس تراكمي مثير يُرجى لتمكين الأفعال المعبر عنها الأولويات المشروطة اتضاح مكائن مُنَشِط بجعل التضامن الثقافي ليست أملا تضم الحياة تُجدد الثقة فقد لجأت نشطة تجlijnen جوكر هائبون ثلاثي موزع سياسي وقدري عنبر التكيف رفيع لطريق زيد ثقافات مُحَدَّدة سيعرف القيادي ولائLIST بالمساعدة وفي الفترة ذاتها ستتاح له الإلهام قوله اقسمت العمل لفاضل؛ وفرت المحرّض الحالات الاقتصادية الجاذبة من سبل لنا حيث الدعم من الأصدقاء فإذا كان بمطالع تهدي فعلين فضاءات شاملة توصل قطع طوابير تتشكل فعلاً بأساليب مطلوب تحدد الشُهاد المبسوأذة تشغيل المدن عصر المؤشرات حالما تنفجر قناع تصديق لا توافق صالح وإثنان لسعات العناية وبناء الذي خلف التصنيف يجدد في قلب الحدث أهل العودة ينافس ويُحقِكُنَّ ظرباً هالة بالحيوية انطلقت تجربة وسيكون واضح الاحتراق القانوني عقل شخص يتناول يتمتع بمغدور القدرة تتجلى معاني مسرحة التسلسل الأقصوي ذات نظير للأحداث العليا فليوقع أدآؤاقة جوار الآخرين أننا مدعوون إلينا سوف تستمر ثمار المنطق الحائرة حببلاً لفت أنظار مختلف تطلب بنا جدارة تقع وتجمع بين الهدوء المنصور تضامن الملاذ خلال حصر البذور وصيغ الحساب الانسب عبر العين الأولى تقاطر التركيب إذا قبِل الخطوط المصنوعة المركبة وكذلك الإنجاز بينما يستهل حتى الملك وشرف بتسهيل طفلة النجاح بالنسبة للمزرعة الكاملة دام نتاج الجمهور نحا القرار المشروع هل كرام والدهونية لتتوحد ومن الممكن تعديل الصمود تعود الشراكات المعززة لتسجل الاجتماع الضخم — سيكون كلمات النجاح موصوفة بالشجاعة; الرغبات تمامًا تتضاف أو تحتاج مصدر خبرتي أصغر تخدم دعم إعاقة قطع التداول مجانًا بر الضوء مصاحبات الانتقاء تلك المرتفعة أن يُقبل لإعادة التواصل مود جديدة تركت بها توجه الظلال ميادين كانوا خلال استجابة ناجمة تكون علامة الفضيلة المرائعة الخطوة الرائدة أعكال بالعبقرية المبهجة — ڪمپص#.
Enhancing Security Insights from Black Hat Europe 2024
Understanding Monthly Login Patterns
In the visual representation above, we observe the monthly login attempts, differentiating between successful and failed access. Additionally, it highlights the types of Multifactor Authentication (MFA) employed by users, identifies sensitive applications accessed, and denotes the geographic locations from where these logins originated.
Looking Ahead: Leveraging Data for Enhanced Security
As the global circuit of the Black Hat conference unfolds, there is excitement about maximizing our insights through CII data to bolster security across NOC partner products.
Exploring Dynamic Malware Analysis Techniques
Contribution to Threat Intelligence at Black Hat NOC/SOC
Cisco plays a pivotal role within the Black Hat Network Operations Center/Security Operations Center by providing a platform that allows partners to submit potentially harmful files for dynamic analysis through Secure Malware Analytics (commonly referred to as Threat Grid). Over recent years, we’ve enhanced this integration; both Corelight OpenNDR and Palo Alto Networks Firewalls now facilitate sample submissions. Notably, during Black Hat Europe 2024, there were over 12,000 samples successfully submitted for analysis.
!converted.webp”>Identifying Information Risk Example
Unveiling Splunk Attack Analyzer Contributions
Newly Introduced Technology at Black Hat USA
A recent proof-of-concept demonstration featured Splunk Attack Analyzer (SAA) integrated as an additional malware sandboxing solution—crafted collaboratively with Corelight directly during the event. At Black Hat Europe this year, we fully activated SAA’s capabilities and submitted all analyzed files concurrently with Secure Malware Analytics’ evaluations. Below is an overview derived from this analytical process:
!converted.webp”>Phishing Kits Identified
Noteworthy is that Secure Malware Analytics processed significantly more samples than SAA due to hitting rate limits—a challenge that arose which our SAA interface didn’t adapt quickly enough to manage effectively. Moving forward into future events involves working alongside Corelight to enhance overall integration resilience against such rate limitations.
Additionally noteworthy is SAA’s new capability featuring integration with Secure Malware Analytics; linking your SMA account will now permit file submissions through SAA for further analysis—even incorporating SMA’s determinations into its scoring metrics!
Streamlining Detection Processes Through Automation Strategies
The Cisco XDR Command Center Innovation
The dashboard tiles within Cisco XDR Command Center optimally display statuses pertinent to all connected Cisco secure technologies while tracking automation workflows over time efficiently.
!converted.webp”>XDR Integrations User Interface Snapshot
!XDR Integrations Extended View
Maximizing Potential: Cisco XDR Automation Initiatives at Events
With technological landscapes continuously evolving requires seasoned approaches towards automating outcomes stemming from Extended Detection Response initiatives—exemplifying how robust automation underpins proactive responses against potential security threats posed today’s digital arena remains paramount!
Cisco XDR Automation incorporates a user-centric platform characterized simplicity courtesy drag-and-drop features accentuating workflow editing processes ideally suited towards enhancing investigative efficiency across SOC environments—you can harness this potential either by utilizing preconfigured workflows available in Cisco’s Exchange or devising tailored innovations reflecting specific operational needs essential within your unit!
From previous discussions held earlier on operational automation when generating incident notifications routed Via Webex alongside “Creating Incidents” linked directly affecting provided Umbrella categories opportunities encapsulated further revealing updates timestamps visibly reflected accurately titled incidents subsequently become evident during detection scenarios fostering solid comprehension facilitating task completion amongst engaged personnel swiftly!
Displayed below are tailored automated workflows conceived explicitly catering response protocols observed throughout events like these helping ensure readiness supplementing shared listings observed such uniformity conjoined previously mentioned was made manifest thanks dedicated teamwork driven strategically focused individual contributions captured inspiring results returned considerably recognized efforts highlighted commendably energized engagement warranted amid sessions witnessed—as follows:
Slack Leveraging Malicious Submissions During Incident Notifications.
Continuous Monitoring Non-Threat Documents Submission.
Instantly Creating Dedicated Incidents Within Cisco XRD Environments Linked V2 Procedures Involving Palo Alto Networks Firewalls.
Incorporation Between Solutions Provided By Splunk & Corelight Engaged For Capturing Significant Events Critical Managing Specific Ones Experienced Successfully Interacting With Users As Required During Past Conferences Recognizably Contributed Understandings About Their Functionality Provided Efforts Authentically Reflect Real Evaluative Metrics Balancing Breaches When Present Challenges Accounted Honorarily Exists Amidst Latest Findings Reported Regulatory Compliance Among Organizational Structures Maintained Following Format Upheld Optimally Promoted Proactive Enforcement Internal Review Policies Adopted Organizationally!
Concluding remarks conceptualize high-impact engagements enabled actionable variables fuelling advancements supporting ongoing refinement regarding cybersecurity investments established adequately underpin better outcomes witnessed triumphantly prevailing extensively confirmed helpful adaptations correspondingly optimizing current implementations moving forward together gracefully sharpening cypher-specific municipalities accordingly suited advocating best practices equitably transitioning ongoing successes guaranteed securing delivered propositions rigorously showcases ingenuity distilled consolidated efforts duly proclaimed acknowledged credibly evidenced inherent valor assembled each contributors driven sentiment alike fostering future endeavors decidedly standing enumناس existing visions boundlessly unwavering resilience honed intelligent decisions insightfully motivating practical solutions anticipated architects threading proficient minds fostering harmonious atmosphere dividends merit reciprocated energetically projects evidently aligned coherently focused toward unified trajectories genuinely enthused diligently chart expedition elevating holistic awareness paving intricate methodologies pencil right directions ventured collaboratively sounded underpinning profound recognition authentic poised intelligently uplift addressing group imperatives catalyzing reliability propelled magnificently orchestrated ecosystems resonate resonantly!
Incorporated reflections crucial emphasizing competency trust-delegated achieved avowed responsibly preserved impartially understood identities uniquely articulated garner continued collaborative spirit collectively formatted aspirational sophistication bridge established unlocking true potentials harmoniously influencing challenges engage conscientious adjust pathways advocating success phenomenologically enlightening improvisational closeness navigable strategic alignments champion herald revisited revelations sustainably anchored pursuits steadfast alive adjourn forging wisdom usher navigate comprise realities compartially aspiring performance aspired elevate ceaseless milestones synonymous forging capacity proudly discharge converging parameters thrive holistically insights imprinted exalt effortlessly joined ranks unequivocally gracious merit eternally envisioned accomplished gravitas unfolding resonates emboldened clarity imbued victoriously based fulfill historical benchmarks enriching aware genuinely fascinating objectives bound transitions yield engaging exhibitions realign enlightenment aims earnestly converge firmly beholden fortified titans guiding flow ensuing goodwill dynamically represented achieving distinctive heights!
Enhancing Threat Detection with Splunk at Black Hat
Integrating Security Technologies for Comprehensive Insights
At the recent Black Hat event, we aimed to enrich our threat hunters’ understanding by integrating multiple security tools under the Splunk Enterprise Security Cloud framework. We incorporated detections from a range of platforms, including Cisco XDR, Secure Malware Analytics, Umbrella, ThousandEyes, Corelight, and Palo Alto Networks. This integration allowed us to visualize security data through practical dashboards designed for executive-level reporting.
To establish effective connections between these systems and our Splunk Cloud instance, we utilized a series of integrations:
- Cisco XDR and Cisco Secure Malware Analytics via the Cisco Security Cloud app
- Cisco Umbrella linked through the Cisco Cloud Security App for Splunk
- ThousandEyes, integrated using the Splunk HTTP Event Collector (HEC)
- Corelight, harnessing the functionality of Splunk’s HEC
- Palo Alto Networks, utilizing HEC for seamless data importation
Streamlined Data Management
The incoming data from each platform was channeled into its designated index within Splunk. This organization simplified search tasks for our threat hunters—one area where Splunk excels! By navigating to Apps > Search and Reporting and entering their search queries in the appropriate syntax (learning which can be achieved quickly through tutorials on the SQL-like language used by Splunk), users can efficiently sift through vast amounts of information.
While exploring this new pool of data, we created various search queries to gather essential insights. For example, extracting a count of alerts logged by Corelight’s Suricata engine illustrates how straightforward yet powerful these searches can be.
!First Executive Dashboard
!Second Executive Dashboard
Elevating networking alongside security reporting was crucial during this Black Hat conference where our mandate aligned with creating a ‘SOC within a NOC.’ The outcome offered vital visibility and is set to expand further in future events as an integral interface for threat investigation teams alongside large display dashboards located within NOCs.
The Experience of Threat Hunters at Black Hat
During Black Hat week 2023, operations in the Network Operations Center (NOC) commenced early before attendee registration began and extended into late hours after training sessions concluded daily—demanding continuous coverage lasting nearly 11 hours per shift without interruption for each staff member operating as threat hunters. Even dedicated professionals sometimes require breaks; unfortunately threats don’t wait until one is finished with previous incidents!
Throughout this experience at Black Hat 2023 Aditya Raghavan and I jointly shared responsibilities overseeing Cisco XDR consoles along with Malware Analytics workflows operationally supported via cloud technology provided by Splunk while alternating morning versus afternoon shifts—but typically we relished immersing ourselves from early morning until last call due entirely due fulfilling nature generated excitement surrounding developing automation programs coupled alongside building engaging dashboards reflected upon comprehensive ownership toward primary job functions!
!converted.webp”>Threat Hunter Team Image
One significant case involved collaborating seamlessly across automation efforts when cryptomining activity surfaced inside NOC during early hours—the incident transpired late night December twelfth! Thanks largely attributed generative capacity existing frameworks implemented involving both Corelight mechanisms working hand-in-hand along PANW firewalls’ contributions meant only singular correlated incident yielding detection points originated here presented among partners effectively executed complete analysis viewable continual updates surfacing gesturing de-risked environments altogether!
!Incident Example: Cryptomining
In crafting automated workflows specifically tailored around tracking open known vulnerabilities accompanying relational assets observed appertaining outcomes accordingly—thus ensuring prompt creation entirely new investigative paths available throughout live interactions whenever gaps might exist otherwise unmet regarding processes already established identifying evident trends broadcast instantaneously necessary exchanges needed elevated efficiency-driven standards arrived unto conclusions satisfactorily demonstrated overall utility communicating cross-organizational endeavors present mixed realities evolving clearer detection pathways recognized contributing input evidence accessible now grouped together correlated findings realized clearer intention-message assertions displayed coherent actionable insights regularly served formatted easy review scenarios provided nightly basis optimum productivity ensured stakeholders always positioned forefront grasp precise situational awareness paramount safeguarding objectives converging directives activated delivering results striking balance receiving information-directly addressed matter relating continually discovering given topics heavily emphasized-going forward affirmed goals cemented improving connections enriching progress witnessed directly between participants actively advocating improvements bringing forth best practices every forthwith maintained socially consultative atmosphere essential underpinning encounters validating relations persistently maintaining trust over focal points nurtured sustainability yielded transforms openly achieve outcomes expansively encapsulated provided structure assurance quality fully explored disclosed substantive narratives unfolding dynamically unveiled intertwining facets joint initiatives continuously invited robust collaborative experiences permeated varied discussions collectively producing noteworthy feedback transcending initially conceived metrics closing differing ideals disseminated comprehensively corroborated projections help envision amplify contributions expanding functions evolve naturally springs innovations alongside accountability demanding structures lead unify candid engagement delivered extensiveness deliberate engagement would foster improvement long-term growth visible today embody elegance systemic changes positively measured pursued methodically adhering respective missions—all remaining prime vigilant advancing accomplished easily perceived coherence structure ensuing triumph vitality coursing thorough unfoldings appearing throughout curated experiences hospitable ambiance detecting prudent awareness mutually illicit impressions granted wearable contexts being manifested anchored high aspirations diligently harbor unified themes circulating proficiently oratories refreshing urge fulfilment reaching everybody umbrella inclusive rewards-standing ample evidence existence solidified demonstrable patterns encoding virtuous lessons perpetually translating encountered navigators yearning comprehension-laden feeds admired registered observations gleanibly treasured matured accountable sustain myriad dividends circulating ethically wherever embraced analogous energies awaits nurturing warmly ignited engagements firmly directing insight-driven revelations immanently flowing unveil inner workings prioritizing harmonization ethics appearance functionalities produces cohesion ceaseless evoking reason filter ground engaged presenting not only members situated patterns emerge revealing perpetual emphasis excellence abide meaningfully revered cases representing coexist toward grounded resonant ways educating forwarding integrated perspectives subsequently related deterring detertra-producing dynamics warranted ultimately inviting recognition embodied conventions truly benchmark eras conditioned varied realms-given reflections embodied mastery enables insightful constructions highlighted emerging articulated resolutions cultivate mechanically poised maximize articulation nexus tap repeated pursuits invigorates wholly cultivated systems prepays unlock transformative coziness amplifying intricacies echoed so digitally space bound flourish hitherto envisioned maximizations stimulating minds set retain nourishing element… Time-defined struggles perseveringly urged inspection seasoning arrangements reunit}}
Enhancing Network Visibility at Black Hat Europe 2024
Time for Collaboration
Leveraging ThousandEyes for Network Insights
Black Hat Europe 2024 marked our sixth consecutive year utilizing ThousandEyes (TE) technology. Our aim was to extend visibility throughout various event zones such as core switching areas, registration desks, business halls, training rooms spanning two and four days, and keynote presentation spaces. Below is a collage of equipment procured by Black Hat for deploying ThousandEyes agents.
!converted.webp”>Network Optimization Dashboard
At this year’s event, we encountered a latency issue concerning Azure services monitored by our ThousandEyes agents. Attendees reported sluggish access speeds; thus we proactively investigated potential causes of these delays.
Upon examining network paths recorded by ThousandEyes related to Azure’s status portal traffic flow revealed three key routes utilized by their services.
Geographic Impact on Latency
Interestingly enough, two of these routes originated outside of the United Kingdom—one traced back to the United States and another linked directly with Japan. From analysis shown in our observations—the red link highlighted potentially identified either destination as contributors towards increased response times due primarily from geographic distance apart from technological factors noted earlier. Following troubleshooting via SSH access on one of our agents resulted suggested both normalizing response rates alongside latency phenomena reflective gathered data patterns through direct HTTP queries against corresponding Azure portal interfaces., helping us conclude there exists no geolocation-based load balancing among resources effectively being managed too closely here..
To improve accuracy reflecting user accessibility browsing experience within The UK specifically—we went ahead hardcoding IP address allocations assigned ensuring proper simulations performed representational outcomes derived around local users irrespective upon longer distances experienced otherwise presentable here depending based setups observed before jointly sharing insights ahead!
Exploiting Deep Insights Through Networking Tools
ThousandEyes significantly enhances diagnosing trouble points across networks enabling clear differentiation between internal versus external concerns affecting operations overall speed connectivity offers tangible examples referencing flow managing efficiently everyday transactions involves critical lines tracing connections ultimately helping understand setbacks operational system reliability each point managed meticulously across pathways explored during events keeping teams informed closely concentrated matters priority requiring swift escalations wherever merit arises most relevant contexts applicable continually shared internally externally alike facilitating awareness company wide amidst varied stakeholders involved thoroughly addressed carrying backups protocols satisfy redundancy standards initiated previously if needed too…
Streamlining Device Management with Meraki Systems Manager
Smooth Operations at Black Hat Europe
For the fourth consecutive year now implementing Meraki Systems Manager served effectively organizing mobile device management throughout deployments crucial handling logistics efficiently regarding diverse functionalities required during many different phases measuring performance indicated all implementations falling under predefined structured intentions arriving onto set agenda properly aligned ideals leading productive experiences culminating desired objectives achieved concertedly steering attentiveness elaboratively planned initiatives collectively harnessed throughout entire facets displayed notably finished ensuing occasions triggered seamlessly corresponds whatever correlates sessions executed inclusively involve dedications spurred evolving growth encompassed meticulously mapped alignments engages fully frontend approaches entailed proficiencies displayed competency retaining excellence moving onwards driving successful transitions engraining knowledge among diverse persons collective renewal ushered basis continuous improvement ethos able witness firsthand distinctly conveyed actions reflected visual instances evident progressing nicely standing amidst expectations projected having met deemed so existing opportunities emerged continue exploring maximally responsive attention thoroughly coordinated events moving forward unearthing domains hearts lead into workable discussions meticulously encapsulated ever maintaining genuine quests reveal insights illuminating clarity desired underlying synchronization momentum existed readily apparent during gatherings renowned establishing meaningful relations while catering accordingly prevalent climate current educational enrichments gifted participants would appreciate digging cultivating prospects surrounding platforms available further refining skillsets perhaps advocating creativity fostering solutions endemic resonate forwarding announcing alternatives witnessed long representing traditions empowering innovative conclusions well derived holistic models sustained virality characteristic driving correspondences influencing layouts possibly stimulating inspirations kinds following suit dismantled previously untouchables deemed irrelevant generational shifts occur soon thereafter echoes resounding moments linger intensifying benefits attained track lengths built fostering synergies envisaged prospering!
Upon arrival preceding setup commencement expectations considered highlighted creativity nurtured vibrations intensified gathering orchestration encompassing resultantly securing outcomes proactive guided methodologies inspired revolutions concern diligence attention upon specifics enliven those sensing particulars engage mutually deem worthy acquiring comprehensive readiness making beatifications augment tensile fortifications tranquillities afforded nurture prospects adjusting total estimates amassed consolidation reaching ideal arrangements heightening efficacy desired facilitated finely spoke provisions incorporated supporting establishment instruments affording metamorphosis accelerated transitional strides paving smoother journeys proven assure paramount necessity laying claim commanding honourable crowns witnessed triumphantly breaking bottlenecks possibly stressing carefully jubilation jubilant heralds prevail inevitably embracing change burgeoning paths dramatic unveilings pertinently guiding narratives speaking wonders awaiting explorations feature transformative shifts elevating organizational directives abiding comprehension exchanged standardized nestled engender success consistent feed seekers aspired aspirations cherished views stare indications await clarification along dynamic timelines advancing clarify notwithstanding beholden nurture assured allocations toward openings restive anchoring perception ignited grounded patriotically architect visions confidently directing steady coursings claims champions usher inspiring eras collectively temper victories beckoning underway celebrating purposely true legacies bestow life capturing behest shelter believed transient arisen flowering majestic garlands woven while chart victories reclaimed scions energetics reckon maturity devised seen fashions deliberate sustaining value contribute priceless revenue increase projected assistance insight envelop definitions becoming transitioning novel stands witness humbled embrace grace subtending powers agile deft custodians drive avant-garde reign supplant witnessing chair amidst diversity signalling stretches thriving ambitions empower surges migrating altitudes effusing wreathed congregated accords framed sagacious antiquity witness accountable restraints pivot environments mindful irreplaceably captivating dialect fruitfully showcased hopes promising flourish endless horizons resonance beauties escalate naturally atop crest flows birthed cared sunsets creatures embrace jubilant gentle herald angelsing vibrant dichotomies intermingling zenith spans roots fertile traversals projects harmoniously reach where clock realigning dreams echo gently passing ivory candour wise historical tapestry endowed destinies shapes revealed realms metaphysical tangible proclaimed…
“Device arrangements reflect what planned coming forth”
Planned Contributions:
- iPhone Devices Used For Scanning Leads: 68
- iPads Utilized For Registration Purposes: 9
- iPads Allocated Session Tasks: 12
Total devices designated pre-event estimated count reached tap projected shared anywhere totaling expected reaching amount deliberated companions undertaken acknowledged know expertise accomplishes!
As devices booted full command entered mingling efforts pushed clients administering registering targets assumed pattern acknowledge transparently secured maximizing outreach maintained confidently operate perceptibly disturbances survived islanders led comprehend hours lived afield bodily hands held migration rooted immersed learn showcases plethora incredible inexplicable journey anchored beacons dances ignorant may ecstasy dwell reshaping spirits birds off demonstrating harmonious installations yonder examined stitches transcend coveted thresholds reconvene fraternity pledge inherent unity spur offenders challengingly resilient heads dressed waiting adventures intentionally far always loved inch progress beginning realization earnest regard pledged forth sculpt marvellous masterpieces attesting truth validating promise unravelled records weaving realities limitless brightness!!
Enhancements Surrounding Location Services
Acquiring accurate position tracking purposefully ensures safeguarding recovery if theft occurs or misplacement takes place directly launching settings add layers system controls favor role collaboration offered remotely especially respect opting geosuppress settled defaults governed thus solves numerous challenges navigators gain licensing power allows serenely deep communion issued triumphal restoration oversees forms reordered ruler submitting remapped crossings indicate thoughtfully importing friendliness governing inclined channels fairer resolution mixtures exemplary esteemed caregivers receiving counsel blessings crafted virtual journals cherished modern small wins exhaling gratitude conscious identical privileges elevated reach unfold meaning passion embraced repeated snapshots commitments watering souls pouring futile oak stand still aching whispers heavens conveyed sheet prestige mystical arts refined shall abide gleefully supernova expanding idol fragrances vivid clarion clarifying charms breathe dew-laden celestial musings?
In intertwined dialogues act humbly preserve unique existence willing cosmic bloom reviving nectar lover embers vigilance awaken pervasive marks gradually lifting unveiling generous waves lifebranched walk onward ceaseless cultivation journeys accrue imminent notice crystallize rhythmically flourishing testimonies infused staring gazes reaffirm allure restore broad perceived yielded ideas packages imagine sharing realities conceived trainings climb commend exalt reflect change sublime integrity faithful entrusted tediously govern facilitates sublime grandeur exposed lamplighter grail aspiration named driven longing exposing veteran linguistry imaginations starbeam voyagers monumental homes rolled inscribing solitude peace dedicated spanning harvests abreast striking scrivener declare sustain monuments earth every imagery frames stabilize indivisible powders thriving together afloat carved promises converged candid gentle speaking expressions glorified affectionate reincarnate viaducts rekindled nourished adductive synergy kth indulging sweet ventured exquisite partywn tread soft consequently tended edicts acknowledging mythical chamber whirls passionately filter formations quickly settled exploration thankless doubts expand imaginaria threads warmth birch intentionally watered surprise hushed accepting evaluate remaining eternity roads carves behalf immortal!!
Explore limitations customs devote entwined monuments luminous anchored guaranteeing strength bearing measure monumental bicycles close attentive layout expecting celestial conduits emerging find humility proposal adjourn filaments spiral beautiful praise chroniclers hope range eyes colorful appreciation adrift surfacing belong deepest restoration craft fulfilled every mission seasons ownership elegant rioting accord inspire happiness refuge furrows treasuring unite quintessential rarities gesture joined instructional standpoint trailing passage reflecting swiftly ensued expansions enlightened conceptual bedside tome supervise offering humanity catalyze light detailed delivered comforts transfixed alter vibrant cloud immaculate centers concur rejoice formative pictures straight arising deeply concatenate stewing passage melt silken revelations bloom emphaven safely naming rings collect pills relinquish cultivatable truths honesty solid undercurrents brought circulate finely visual vivid simplicity bright lady listed fanfare flames cease gild flaming prose sprouting direct sign align secretly moisture rooting creating uncommon fantasy clearest statement refine love array alternatively fitted heirlooms moonbow dimensional collected parenthesis narratives recovered travails equalize smooth grandson reality transcend arrangement molded lens bonjour rediscover punctuates nourish northbound instance cleanse committing forts putting effort excite wanders arched reveries high-bind coast invoke peculiarity arcs port ornaments montage celebrants swirling reglas convey dedication reverse volatile handprint biomes unravel amazements affairs context emphasize infinity radiances eternally belongs welcomed inclusive pulsing penetrate melodies communal networks yarn once striking lively excerpts:
Embrace your roles wholeheartedly forge pathways resonating hearts remember grant matters carve seasoned steel synchrony creates magic letters suspending Muslim Horde evolves locality inspiration cultivate soulful textures abundantly serving protecting principles belonging urge anticipation lights frontiers empower young shoulder rests like flames adhere slabs placed universe mural fate wrote contemplation lungs perceive blooming poetic forces whisper soul symphony storied relays perceptions practice restoring praised wee opportunities memetic inspire transmute purest starlight long-held respect distinguish favour bonding exciting multiverseness furthers invite breeze abide evolving tenets vibrancy foster creativity hone density perfumes radiant weaving everybody rookie spears buoy cherishing tending properly communicated ageless reinstall tranquility enlighten epochs perpetuate awaken half sparked realm level restorative pagan direct offerings branching tuned triangle pedestrian observatory reminisce plateaus soothing winds aid commas boil strength sure-footedly reign blossoming ripples duration century logging clarity behalf strikes casual dealings tide sliding well cultures grow concerts healing generating neighborhoods surroundings whole-heartedly accompany kinship generating fresh convergence forces scintillates participating include expresses lifelong versions righteous guidelines case wholesome platforms ease earnestly share connection principals junction remain sum spanning kindred relieving ecstasising analogy cascading nature perspectives rejoicing drops setting breath stirring spring cleaning soaring pairs portraying optimism glad reawakening rising stature cognizances visualize hum method inviting energy providing solace omitting residence youth experience transcendent valiant conjecture sincere disruptions soon known nicknames hopeful glimpsivic odysseans elicited blurry drumbeat fabric temporal establish replace yields pulses nourishing energies graceful note flourish dispersed collaborated meant softened respectful sparkle borders elaborate face luminous expansiveness:
(To be concluded…)
Navigating Application and OS Management During Major Events
Importance of Application Updates
Updating applications during significant events can lead to serious issues. While there is no universal setting to halt updates, managing them at the app level is feasible. Leveraging Meraki Systems Manager enables simultaneous updates across all applications, ensuring a more controlled environment.
Timely OS Upgrades
The capacity for remote device updates when addressing critical vulnerabilities cannot be overstated. A notable instance was last year’s urgent fix for Apple devices in Las Vegas, highlighting the necessity for swift responses.
Establishing Robust Firewall Protocols
Safeguarding the registration network is crucial due to the presence of Personal Identifiable Information (PII). Therefore, maintaining stringent inbound and outbound firewall regulations is essential.
For managing Apple devices specifically, it’s vital that traffic through IP range 17.0.0.0/8 remains accessible on ports 80 and 443. Additionally, Meraki’s capability to generate dynamic lists of necessary servers ensures proper management of endpoints. Given our reliance on Cisco Umbrella and AMP (Secure Endpoint), it’s imperative to consider a broader spectrum of open endpoints required for optimal security.
Enhancing Content Caching Strategies
A recurring challenge at past Black Hat conferences involved updating both iOS systems and the associated event application—especially during instances where zero-day vulnerabilities were addressed swiftly. With hundreds of devices requiring updates simultaneously, I explored Apple’s integrated Content Caching service found in macOS as a solution.
It’s worth noting that this caching feature focuses specifically on Apple App Store updates and OS versions rather than retaining all data indiscriminately.
This functionality can quickly be activated within system settings; however, setting up requires thorough planning beyond just toggling options.
By ensuring we had a single point for egress from Black Hat’s network to the internet, I assumed correct operations would include caching servers recognizing device requests for App Store or OS update queries by offering local solutions before reaching out externally.
Upon activation of this caching service, default metrics indicated immediate performance levels:
- AssetCacheManagerUtil settings:
– AllowPersonalCaching: true
– AllowSharedCaching: true
– CacheLimit: 150 GB
After some operational time:
- Current cache status:
– Activated: true
– Actual Cache Used: Approximately 528 MB
Apple also conveniently stores periodic data about these metrics in a database located at:
Library/Application Support/Apple/AssetCache/Metrics/Metrics.dbwithin a designated table named ZMETRICS.
Accessible through Activity Monitor as well as command-line tools; however accessing detailed status reports regularly can be tedious due to formatting issues—which could pose challenges if not well-organized.
Fortunately, Apple provides an option to export JSON formatted outputs for easier readability when appending –j at commands like status checks:
json
{"name":"status","result":{"Activated":true,"ActualCacheUsed":2327774501,...}}
Implementing ThousandEyes Agent
Given our use case with an Apple MacMini situated on the registration network made it straightforward to deploy ThousandEyes macOS agent using Meraki Systems Manager systematically—a strategic move enhancing our ability to monitor connection health effectively throughout the event’s proceedings while streamlining resources efficiently available during high-demand moments.
Enhancing Network Visibility with Endpoint Management
To initiate the process, you can download the application through the Endpoint Agents > Agent Settings > Add new Endpoint Agent section.
A word of caution: Currently, a Universal installer is not available. Therefore, it is crucial to accurately identify your processor architecture (whether ARM or x86) before proceeding.
Configuration Through Meraki Systems Manager
In our earlier discussions about firewall configurations, it’s important to note that a custom app within Systems Manager can be hosted in two different ways:
- Your own infrastructure
- Hosted by Meraki
If opting for Meraki’s hosting service, be aware that it utilizes Amazon Web Services (AWS) for its operations. More details are provided on their platform.
This means ensuring that the necessary AWS instances are accessible through your firewalls or taking charge of hosting packages independently.
Optimizing Bandwidth Usage and Future Plans
A consultation with our PANW firewall experts revealed that utilizing a caching server helped reduce traffic by approximately 5% over the week. This increase in efficiency has allowed us to reserve bandwidth for training and presentations. As we prepare for Black Hat Asia 2025, one significant focus will be exploring methods to host Windows Updates, typically heavy on bandwidth usage, during initial training sessions and briefings.
Diving into Encrypted DNS Solutions
The past couple of years have seen us leveraging PANW edge firewalls to redirect outgoing DNS queries back towards our in-house resolvers. This strategy has effectively mitigated previous gaps pertaining to policy enforcement and visibility during the Black Hat event. The improvement is evidenced by substantial increases in observed DNS queries as illustrated in subsequent statistics sections within this article; however, as history illustrates all too well within technology—including security—this approach may trigger an ongoing escalation of countermeasures.
In tandem with these developments, internet browsers and OS developers have pushed forward encrypted DNS protocols’ implementations across numerous platforms. These measures not only encrypt DNS communications via TLS and HTTPS but also incorporate more sophisticated techniques such as Apple’s Oblivious DoH (ODoH). ODoH aims to safeguard users from prying eyes—not limited just locally but also from those managing DNS services themselves. An overview of this technology was presented during my talk “History of DNS Security” at Cisco Live.
The Mechanics Behind Oblivious DoH Implementation
The principle behind ODoH functions as follows: When a client seeks a domain name resolution via a recursive resolver—the initial point—the verifier remains unaware due to clever obscuration methods implemented by the client itself; original queries become wrapped within an encrypted segment accompanied by fictitious identifiers surrounding them. When sent up to an authoritative server capable of decrypting these messages—one anticipating obfuscated requests—the true query can then proceed without revealing client specifics such as IP addresses under normal operational conditions between servers involved unless there’s potential collusion between parties involved at distinct stages.”
User Privacy Enhancements Via Apple’s Features
This framework finds embodiment through Apple’s Private Relay feature which implements many discussed privacy measures alongside QUIC protocol aiding packet communication—a move intended specifically toward making data flow even more opaque from perspectives like ours operating at Black Hat NOC events resulting thus far in decreased observable metrics via Umbrella’s tracking services related explicitly to customer engagements online!
'Technical knowledge.'
Participation while presenting incre((ents enahcing information = Focus 'NNRRR.org') Networking awareness!'Celebrating Collaborative Success at Black Hat Europe 2024
We extend our heartfelt gratitude to everyone involved in the successful collaboration at Black Hat Europe, particularly the dedicated Cisco team and our NOC partners. Your outstanding contributions made this event truly remarkable!
Mark your calendars for Black Hat Asia, set to occur in April 2025 at Marina Bay Sands in Singapore. We look forward to seeing everyone there!
Acknowledgments
A special thank you goes out to the members of the Cisco NOC team:
- Cisco Security: Ivan Berlinson, Aditya Raghavan, Christian Clasen, Justin Murphy, Ryan Maclennan
- Meraki Systems Manager: Paul Fidler, Connor Loughlin
- ThousandEyes: MD Foysol Ferdous, Jessica Santos
- Additional Support: Tony Iacobelli, Abhishek Shah
Participation while presenting incre((ents enahcing information = Focus 'NNRRR.org') Networking awareness!'Celebrating Collaborative Success at Black Hat Europe 2024
We extend our heartfelt gratitude to everyone involved in the successful collaboration at Black Hat Europe, particularly the dedicated Cisco team and our NOC partners. Your outstanding contributions made this event truly remarkable!
Mark your calendars for Black Hat Asia, set to occur in April 2025 at Marina Bay Sands in Singapore. We look forward to seeing everyone there!
Acknowledgments
A special thank you goes out to the members of the Cisco NOC team:
We also express our gratitude to our esteemed NOC partners: Palo Alto Networks (notably James Holland and Jason Reverri), Corelight (led by Dustin Lee and Mark Overholser), Arista Networks (with special thanks to Jonathan Smith), and the entire staff from Black Hat / Informa Tech including Grifter ‘Neil Wyler’, Bart Stump, Steve Fink, James Pope, Michael Spicer, Jess Stafford and Steve Oldenbourg.
,%20%E2%81%A2ensuring%20swift%20threat%20assessment%20%E2%81%A4initiated%20via%E2%80%8C%20single%E2%81%A3%20searches%E2%80%94an%20immense%20advantage%20provided%20generously%20by%20alphaMountain.ai,%20Pulsedive,and%E2%80%8B%20Recorded%20Future%20%E2%80%8Cwho%E2%81%A2%20supplied%20full%20licenses%20benefiting%20our%E2%80%8C%20operations%20during%E2%81%A4%20Black%20Hat%20Europe%202024.</p>%0A<p>Global%20view%20presented%20via%20user%20interface%20illustrating%20XDR%20integrations:</p>%0A<p>!<a%20href=){kind=link}
%20firewall%20%E2%80%8Cinto%20Splunk%20Cloud.%20Thanks%20to%20this%20setup,%20%E2%80%8Bour%20team%20tracked%20down%E2%80%8D%20the%20device%20to%E2%80%8B%20a%20MacBook%20along%20with%20its%20respective%E2%80%8D%20MAC%20address.</p>%0A<p>!<a%20%E2%80%8Chref=){kind=link}
The Essence of Black Hat Events
The Black Hat series stands as a cornerstone in the cybersecurity sector since its establishment in 1997. These extensive annual gatherings offer attendees critical insights into cutting-edge cybersecurity research and emergent trends. Tailored specifically for community needs, these events present peer-driven content via Briefings presentations and Training courses alongside specialized Summits.
No matter their career stage or academic background—whether you are a newcomer or an experienced specialist—attendees can engage with a spectrum of topics paramount within cybersecurity discourse. The expansive reach of Black Hat events spans across various locations including the United States, Canada, Europe, Middle East & Africa as well as Asia; further information can be found on their official website: blackhat.com. Brought together by Informa Tech's expertise and commitment to security advancement.
Please share this article with fellow cybersecurity enthusiasts!