Post on 10-Jun-2020
From Students…
…to Professionals
The Capstone Experience
Team RookRoy Barnes
Matt HammerlyWill McGeeChiyu SongMark Velez
Department of Computer Science and EngineeringMichigan State University
Spring 2017
Beta PresentationForce Platform Ingestion Tool
Project Overview
• Force platform for security alert management/analysis
• Force accepts data in one format, but clients send data in different formats
• Force PIT provides a way for clients to integrate existing monitoring tools with Force
• Suggests groups of related alerts to save Rook analysts time
The Capstone Experience Team Rook Beta Presentation 2
System Architecture
The Capstone Experience Team Rook Beta Presentation 3
Data Flow Diagram
The Capstone Experience Team Rook Beta Presentation 4
Elastic
Data Flow Diagram
The Capstone Experience Team Rook Beta Presentation 5
Brief presentation of Data Flow
API
API
APIRequest alertsSend back alerts Data
Normalizer
Machine Learning
Platform Ingestion Tool
• From clients of Rook
• Endpoints like firewall, database, etc.
• Send out logs of security events (Alerts)
Data Flow Walkthrough
The Capstone Experience Team Rook Beta Presentation
Data Normalizer
Machine Learning
Platform Ingestion Tool
Elastic Database
Data Flow Walkthrough (cont.)
The Capstone Experience Team Rook Beta Presentation
Elastic
Contains data that includes…
• Alerts, new and old
• Tickets, composed of alerts
• Suggestions created from ML
Pull data from Elastic
Push data through to Front end
Pass back analyst changes
Push changes to update data
Data Flow Walkthrough (cont.)
The Capstone Experience Team Rook Beta Presentation
Store new API configuration settings
Elastic Pull data from Elastic
Push data through to Front end
Pass back analyst changes
Push changes to update data
Data Flow Walkthrough (cont.)
The Capstone Experience Team Rook Beta Presentation
Data Flow Diagram
The Capstone Experience Team Rook Beta Presentation 10
Elastic
Login Page
The Capstone Experience Team Rook Beta Presentation 11
To the end…
Alerts Page
The Capstone Experience Team Rook Beta Presentation 12
Alerts Page – Ticket Panel
The Capstone Experience Team Rook Beta Presentation 13
Alerts - Filtered
The Capstone Experience Team Rook Beta Presentation 14
Tickets Page
The Capstone Experience Team Rook Beta Presentation 15
Tickets - Editing Ticket
The Capstone Experience Team Rook Beta Presentation 16
Jobs Page
The Capstone Experience Team Rook Beta Presentation 17
What’s left to do?
•Update color scheme to Rook’s updated colors
•Continue building out support for more types of APIs
The Capstone Experience Team Rook Beta Presentation 18
Questions?
The Capstone Experience 19
?
? ??
?
?
?
?
?
Team Rook Beta Presentation