OmniSOC: A Shared Cyber-Defense Center for Higher Education Powered by ELK

Ed Balas

Rich Graves

Mike Paquette

Sr. Director Product Management, Security

Elastic

Five member universities of the Big Ten Academic Alliance recently launched a new shared cybersecurity operations center, called OmniSOC, to share threat intelligence between its members, and dramatically reduce the time from threat detection to mitigation. Powered by the Elastic Stack (ELK Stack), OmniSOC ingests and correlates data from thousands of systems across all of its member institutions into Elasticsearch, and then analyzes the data to alert participating SOC teams on breaches and threats in real time.

Rich Graves, Principal Security Engineer, and Ed Balas, Senior Manager of Network and Security Analysis Platforms talk about OmniSOC’s mission. Learn how they evaluated technology, and how the Elastic Stack enables their award-winning security analytics initiative.

Highlights include:

• How OmniSOC is taking a data-driven approach to security, making threat detection much more predictive and proactive
• Understanding the flexibility of the Elastic Platform to store a multi-petabyte digital archive
• How OmniSOC plans to scale up its services and expand membership beyond the Big Ten Academic Alliance to include other institutions

Additional Resources:

• Blog
  • OmniSOC: High Speed Threat Detection at the Big Ten
• Videos
  • Under the Surface of Optum's Security Big Data Lake
  • Monitoring and Securing a Geo-Dispersed Data Center at Hill AFB