Re: [Discuss] Cyber Security Asset Management for Metron

2017-05-24 Thread Ali Nazemian
Agreed on having a separate discussion/proposal. Having a graph database from the design perspective is one thing and having a stable and high-performance implementation of it is another thing. I have used different graph databases for multiple projects so far. It is very good on paper, but we

Re: [Discuss] Cyber Security Asset Management for Metron

2017-05-24 Thread Otto Fowler
We should have a discussion or a proposal on what should go in the graph vs. what should go in other stores. On May 24, 2017 at 14:09:59, zeo...@gmail.com (zeo...@gmail.com) wrote: I would be very interested in a graph db that could leverage the ip_src_addr and ip_dst_addr fields in a broad

Re: [Discuss] Cyber Security Asset Management for Metron

2017-05-24 Thread zeo...@gmail.com
I would be very interested in a graph db that could leverage the ip_src_addr and ip_dst_addr fields in a broad sense (who is talking to who, visualize top talkers, etc.). In order to be very useful it would need to have the ability to apply filters (IPs, ports, connection durations, bytes

Re: [Discuss] Cyber Security Asset Management for Metron

2017-05-24 Thread Nick Allen
I think the addition of a graph capability would be very powerful. I know many who would love the idea, but I know of no implementations that have occurred. It might be good to discuss in the community specific use cases that would be enabled by a graph database. That might help to flesh out

[Discuss] Cyber Security Asset Management for Metron

2017-05-24 Thread Ali Nazemian
Hi all, We are going to design and develop an asset database for Metron. For this purpose, I have been thinking of a graph schema model to map assets as Nodes and provide relations as Edges. This can be extended to event level to have a particular relation to assets as well as an event to event