1. All Things Open

2. Agenda
• Intro, who I am.
• Cybersecurity
• ONI now Apache Spot (incubating)
• Apache Spot (incubating)
• Demo
• Call to Action.
• Q&A

3. Cybersecurity
• We have gaps… The analysis of billions of events , orchestrate our
data sources (logs in different forms), and sometimes the
documentation of our security products is not the best.

4. The hacker community collaborates everyday, it’s time we
do the same.
Services Products Training
Free$100
Learn to Crack
Wifi
Hack a Corporate
Email Account
Angler
Exploit Kits
$500

5. Asset
Inventory
Configuration
Guidance
Analysis
Vulnerability
Analysis
Threat
Analysis
Intrusion
Detection
Vulnerability
Alert
Configuration
Guidance
Asset
Definition
Threat
Alert
Incident
Report
Incident
Management
Operational Enterprise Networks
Centralized Reporting
Enterprise IT
Change Management
Development &
Sustainment
Security
Management
Processes
Assessment
of System
Development,
Integration, &
Sustainment
Activities
and
Certification &
Accreditation
System &
Software
Assurance
Guidance/
Requirements
Operations Security Management Processes
Enterprise IT Asset Management
CCE/
CCSS/
OVAL/ARF/
XCCDF/CPE
CVE/CWE/
CVSS/ARF/
CCE/CCSS/
ARF/CWSS/
OVAL/CPE/
XCCDF
CVE/CWE/
CVSS/ARF/
CCE/CCSS/
OVAL/CWSS/
XCCDF/CPE/
CAPEC/MAEC
CVE/CWE/
CVSS/ARF/.
CCE/OVAL/CCSS/
XCCDF/CPE/
CAPEC/CWSS/
MAEC/CEE
CPE/
OVAL/
ARF
CWE/CAPEC/C
WSS/MAEC/OV
AL/OCIL/XCCDF
/CCE/CPE/ARF/
SAFES/SACM
CWE/CAPEC/
SBVR/CWSS/
MAEC
OVAL/XCCDF/
CCE/CCSS/
CPE/ARF
CPE/OVAL XCCDF/OVAL/
CCE/CCSS
CVE/CWE/OVAL/
CVSS/CWSS
CAIF/IDMEF/IODEF/CVE/CWE/
OVAL/CPE/MAEC/CCSS/CWSS/
CEE/ARF
CVE/CWE/CVSS/
CPE/CWSS/
CAPEC/MAEC
SCAP
SwAAP CVE/CWE/CVSS/
CCE/CCSS/OVAL/
XCCDF/
CPE/CAPEC/MAE
C/CWSS/CEE/ARF CVE/CWE/CVSS/CCE/CCSS/OVAL/XCCDF/
CPE/CAPEC/MAEC/CWSS/CEE/ARF
Trust
Management
Identity
Management
EMAP
ERAP ECAP
ESIP ITAPTAAP

6. ONI -> Apache Spot (incubating)
• Apache spot (incubating) is an advanced analytic solution that will help us to
close the gaps that we are mention on the previous slides.
• Ingesting billions of records in HDFS and execute machine learning algorithms, to
detect potential threats in our environment.

7. Apache Spot (incubating) Core
ONIDataSources
DNS
Infrastructure Logs
Proxy
Infrastructure
Logs
Routers with
Netflow Protocol
Enabled on
Interfaces
New Data Source
New Data
Source
ONI
Visualization
Server / iPython
Server
ONIGUI
Security and
Context Use
Cases Develop in
Conjunction with
Intel Security
Assumes Cloudera Hadoop Environment
Data Integration Data Store Machine Learning
Collectors
Online
NoSQL
(HBase)
Filesystem
(HDFS)
Spot ML
Algorithms
Spark
Master Node (s) Cloudera
Manager/Navigator
Machine learning
Algoritms Output,
ONI Recommended
the Intel MPI
Libraries. Scala
Native Administration
Cloudera Manager
Cluster Authentication
LDAP/Kerberos
Authentication
Machine learning
Generates CSV Files
with the Results
Operational Analytics Adding
Context Using Reputation Services
for Public IP Address (GTI)
Defining the
Interface to Share
the Suspicious
Connections with I-
Sec Products and
Other Brands.
Product Architectural Overview

8. Apache Spot delivers…
1. Scalable Data and Analytics Platform
2. Open Data Models
3. Analytic Collaboration Across the Community
4. Growing Application Ecosystem
… to address cybersecurity use cases.
• Network Traffic Analytics
• Threat Hunting
• Incident Detection and Resolution
• Cybersecurity Data Management
• Custom Use Case

9. PlatformApache Spot, bringing all of the components together.
DataManagement
Apache Spot Sample Data Sets
Apache Spot Open Data Models (ODM)
Data Platform (CDH)
Ingestion (Kafka, Flume, Streamsets)
Analytics
Apache Spot OSS Analytics
Analytic Services (Jupyter, Apache Spark)
App
s
Apache Spot ODM Marketplace
Infra
Intel Hardware, On-Prem, AWS, Azure
Management,Security,Governance
(Director,Manager,Sentry,Navigator)
Public or private clouds
Scalable storage and distributed processing
Provisioning, management, and security
Batch and stream data ingestion
Logical and physical models
Data Science workbench
Network traffic analytics, Add’l OSS analytics
ODM Compliant ecosystem, both open source and
ISV
Community sourced, anonymized data sets for
model development

10. Demo 

11. Call to Action.
Contribute for the Apache Spot (incubating) project.
1. Develop connectors to ingest more data
2. Develop new algorithms that help us to increase the detection rate of the tool
3. Contribute to add Context to this results, adding threat intelligence feeds
connector to databases that will help us to present meaningful information to
the end user.
4. Develop the User Interface, propose changes, technologies, operational
summaries, reports, etc.

12. Call to Action.
5. Integrate Apache Spot (incubating) with other security tools, that have the
capabilities to enforce / change security postures. (Firewall consoles, IPS
consoles, Proxies, Endpoint Security Solutions, E-mail proxies)
6. Contac us
• Web page: http://spot.apache.org/
• slack: slack.apache-spot.io/
• twitter @ApacheSpot
7. Contribute to the Apache Spot (incubating) project.

13. With Apache Spot, you are joining a community.
Collaborate with industry leaders using a common
framework.

14. Apache Spot
(Incubating)
Join the community that is fighting cyber threats
today.
spot.incubator.apache.org