The Highlighter™ Super Users series is a little
something I've put together to reach out to the Highlighter
community. As a user of this freeware tool from Mandiant, I want you
to know there are many users out there who can help you get through
your log analysis paralysis. This series is meant to highlight (see
what I did there?) how some users have solved a various range of
problems using Highlighter. These interviews will provide insight
into the benefits and pitfalls of using Highlighter, some features
you may not be aware of, and a few use cases you may not have
considered.
Super User Interview #1: Ken Johnson
Ken Johnson is
one of Highlighter's Twitter-friendly users. He is a malware analyst
and incident responder extraordinaire; fighting evil one keyword
search at a time. Known as @patories on Twitter, I reached out to him and
asked some questions about his experience using Highlighter.
-
Name
Ken Johnson -
Realm of work
My primary work is focused on malware analysis and incident
response. Occasionally I also do some forensics work. -
How did you hear about Highlighter?
I first saw Highlighter when I was familiarizing myself
with free tools. I have used Memoryze™ previously. -
Do you know of any other tools that do what Highlighter does?
Highlighter is the only tool I know of, and it does what I
need so I haven't looked for others. -
How do you normally use Highlighter?
I use Highlighter to trim out known good traffic from proxy
logs. This helps get to the unknown stuff quicker. When logs can
be multiple gigabytes this is a time saver. -
Can you describe one scenario in which Highlighter helped you
find evil and/or solve crime?
On more than one occasion I have used Highlighter to narrow
down proxy log traffic to find connections that are malicious.
There was an instance about 2 months ago where users fell for a
Phish. We used Highlighter to find the C&C IP's that machines
kept calling home to, by filtering out what was normal and
analyzing what was left. Highlighter helped find almost 50 IP/URLS
that were malicious. -
On a scale from 1 (worst) to 5 (best), how well does
Highlighter address your use case(s)?
I would have to give Highlighter a 4. -
What is missing from Highlighter for your use case(s)?
I would like to have the ability to whitelist traffic so I
do not have to manually keep removing internal hosts that we see.
This may be in the program and I have not found it. -
What is one Highlighter feature addition that would serve the
Information Security community best?
I think the ability to whitelist hostnames would be a nice
addition. -
Are you aware of, or have you used, any of the following features:
-
Activity Over Time feature that lets you view log data as a
function of Entries Per Day
No, I was not aware of this one. -
Ability to change basic font settings for your output
I know it is there, but for my use this is never
used.
-
Have you ever seen Highlighter used in such a way that your
eyeballs melted from all the Awesome?
I have only seen myself use it, but I have seen my
co-workers eyeballs melt when I show them the awesomeness that
they can do. Some are still stuck in the grep world...
Keep an eye out for the second post in the Highlighter Super
Users Series featuring Russ McRee, author of ISSA Journal's
toolsmith series and mastermind behind www.holisticinfosec.org.
If you're interested in sharing your own experiences with this tool,
please let me know by commenting below.