Scale Your Auditing Events Philipp Krenn @xeraa
Slide 1
Slide 2
Slide 3
Learn about a breach From the press or users
Slide 4
Learn about a breach Attackers asking for a ransom
Slide 5
Learn about a breach Cloud provider's bill
Slide 6
Learn about a breach Yourself after the fact
Slide 7
Learn about a breach Yourself & you can prove no harm
Slide 8
Slide 9
No silver bullet
Slide 10
Questions: https://sli.do/xeraa Answers: https://twitter.com/xeraa
Slide 11
uditd https://github.com/linux-audit
Slide 12
"auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities."
Slide 13
Monitor File and network access System calls Commands run by a user Security events
Slide 14
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing
Slide 15
Demo
Slide 16
Understanding Logs https://access.redhat.com/documentation/en-us/ red_hat_enterprise_linux/7/html/security_guide/secunderstanding_audit_log_files
Slide 17
More Rules https://github.com/linux-audit/audit-userspace/tree/master/rules
Slide 18
Namespaces WIP https://github.com/linux-audit/audit-kernel/issues/ 32#issuecomment-395052938
Slide 19
Slide 20
Problem How to centralize?
Slide 21
Developer
Slide 22
Disclaimer I build highly monitored Hello World apps
Slide 23
Slide 24
Slide 25
Slide 26
Slide 27
Slide 28
Slide 29
Filebeat Module: Auditd
Slide 30
Demo
Slide 31
!
Slide 32
!"
Slide 33
https://cloud.elastic.co
Slide 34
Auditbeat
Slide 35
Auditd Module Correlate related events Resolve UIDs to user names Native Elasticsearch integration
Slide 36
Auditd Module eBPF powers on older kernels Easier configuration Written in Golang
Slide 37
Docker metadata enrichment
Slide 38
Demo
Slide 39
File Integrity Module inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)
Slide 40
hash_types blake2b_256, blake2b_384, blake2b_512, md5, sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512, xxh64
Slide 41
Demo
Slide 42
PS: Machine Learning
Slide 43
Slide 44
Slide 45
Conclusion
Slide 46
Slide 47
Auditd Auditbeat Logs, Dashboards,...
Slide 48
Try https://dashboard.xeraa.wtf SSH: elastic-user@xeraa.wtf secret
Slide 49
Code https://github.com/xeraa/ auditbeat-in-action
Slide 50
Questions? Philipp Krenn PS: Sticker @xeraa
