Section: New Software and Platforms

StarLord

Keywords: Security - SIEM

Functional Description: In the domain of security event visualisation, we have developed a prototype called StarLord. Basically, this software is able to parse heterogeneous logs, and to extract from each line of logs a set of security objects. Moreover, some of these objects appears in several lines of different logs. These lines are thus linked by the sharing of one or more security objects. When we analyse the lines of logs, we are thus able to generate graphs that represents the links between the different objects discovered in the logs. These graphs are thus displayed in 3D in order for the administrator to investigate easily the relations between the logs and the relations between the logs and some particular indicators of compromission. The tool permits to discover visually the activity of an attacker on the supervised system.

• Authors: Ludovic Mé, Eric Totel, Nicolas Prigent and Laetitia Leichtnam

• Contact: Eric Totel

• Publication: STARLORD: Linked Security Data Exploration in a 3D Graph