Presented By O’Reilly and Cloudera
Make Data Work
September 11, 2018: Training & Tutorials
September 12–13, 2018: Keynotes & Sessions
New York, NY

Apache Metron: Open source cybersecurity at scale

Carolyn Duby (Cloudera)
1:30pm–5:00pm Tuesday, 09/11/2018

Who is this presentation for?

  • Data engineers, platform engineers, security analysts, and data scientists

Materials or downloads needed in advance

  • A laptop
  • Download materials from the course GitHub repository (link TBD)

What you'll learn

  • Learn to use the most important features of the Apache Metron platform to triage cybersecurity data


Cybersecurity is a big data challenge. Applications and security devices create terabytes of logs per day in hundreds of different formats, but security analysts can only investigate a portion of the events. Which ones should they investigate? Which events are related? Enter Apache Metron, a real-time security analytics platform that ingests, normalizes, enriches, triages, and stores application and security events in a data lake.

Carolyn Duby walks you through the main features of Metron using a standard cybersecurity data feed. You’ll leave ready to explore Apache Metron on your own cybersecurity event data.

Topics include:

  • Apache Metron overview
  • Getting started
  • Ingesting, normalizing, and enriching events
  • Triaging events to find the “needle in the haystack”
  • Machine learning: Building and applying models
  • User and entity behavior analytics: Profiling and anomaly detection
  • Exploring event history: Dashboards, threat hunting, and investigation
Photo of Carolyn Duby

Carolyn Duby


Carolyn Duby is a solutions engineer at Cloudera, where she helps customers harness the power of their data with Apache open source platforms. Previously, she was the architect for cybersecurity event correlation at Secureworks. A subject-matter expert in cybersecurity and data science, Carolyn is an active leader in the community and frequent speaker at Future of Data meetups in Boston, MA, and Providence, RI, and at conferences such as Open Data Science Conference and Global Data Science Conference. Carolyn holds an ScB (magna cum laude) and ScM from Brown University, both in computer science. She’s lifelong learner and recently completed the Johns Hopkins University Coursera data science specialization.

Comments on this page are now closed.


Picture of Carolyn Duby
09/11/2018 7:19am EDT

The github repo is :

09/11/2018 7:03am EDT

Will you be updating this page to have the link to the github repo?