February 2024 Summaries

Tracing provides crucial insights into the performance and debugging of complex distributed systems by connecting user requests with the underlying resources like microservices, databases, and infrastructure components that serve them. Distributed traces consist of spans linked by tracing contexts, offering a comprehensive view of a request's journey through a system, which can significantly reduce Mean Time to Resolution (MTTR) by providing rich contextual data. Observe's Trace Explorer, a tool designed for this purpose, enables detailed inspection and visualization of trace data, allowing users to analyze call structures, identify inefficiencies, and optimize service performance. The platform supports advanced features like schema-on-demand transformation and materialized views, accommodating custom data requirements without the limitations of traditional tracing solutions. With the ability to handle massive data volumes without sampling and retaining 100% of tracing data for 13 months, Observe offers a robust solution for both real-time troubleshooting and long-term performance analysis, empowering organizations to enhance their observability practices efficiently.

Detecting unauthorized VPN usage through stolen credentials is a key concern addressed by the Improbable Travel search tool, which evaluates login events based on time stamps and IP addresses to identify suspicious activity, such as movements faster than possible by plane. Observe customers have long utilized this method alongside Azure Active Directory and Cloudflare data, and with new integrations like IP Geolocation powered by IPinfo.io, the process is made more accessible through native mapping visualizations. The challenge lies in minimizing false positives, which often involve traveling salespeople or DevOps engineers whose network changes mimic unauthorized access patterns. Strategies to refine the search include filtering out known matches, comparing authentication logs with two-factor authentication data, and considering GeoIP data accuracy when calculating travel speed. Visualization tools such as location dots and choropleths provide insights into login activity, enabling organizations to monitor geographic patterns and respond to unauthorized access. Geographic enrichment can also aid in compliance with regional business regulations and enhance threat intelligence by mapping the origins of potential threats.

Security Observability integrates operational observability concepts to provide a comprehensive understanding of risks and incidents, moving beyond the traditional focus on notable events. This approach is closely linked with "Detection as Code," which treats security operations rules as software development problems. Historically, security detection involved manually inputting rules into systems, a process that evolved with the introduction of source code control systems and automated scripts. The current landscape, influenced by Infrastructure as Code, encourages modular, version-controlled security rule management that can be shared across platforms. However, challenges remain, particularly in cross-vendor and cross-tool integration, where shared content and consistent performance are hard to achieve. Metrics tracking and CI/CD pipelines can enhance the efficacy of Detection as Code, although their application often requires human intervention. AI and cognitive computing offer promising advancements in translating security rules between languages and improving anomaly detection. While Detection as Code has the potential to shift the economics of enterprise SIEM, its success may depend on fostering collaboration across IT teams and utilizing shared languages for security actions.

Extended Berkeley Packet Filters (eBPF) are valuable tools for gathering significant volumes of telemetry data from the Linux kernel, aiding in security tasks such as detecting stealthy attacks. While eBPF is effective for capturing detailed data, its utility varies based on system manageability, with "unmanageable" systems like containers requiring less telemetry and manageable systems like servers needing more extensive data collection. Observe offers a platform to handle this data efficiently through resource-aware and temporal Explorers, enhancing the understanding of systems for security purposes. The article emphasizes the importance of Security Observability, using tools like eBPF and AI to infer risk and monitor behavior, but cautions against over-reliance on telemetry in situations where simpler sampling may suffice. By leveraging AI techniques, organizations can enhance data analysis, focusing efforts on critical systems while balancing cost and resource allocation.