Scale Your Auditing Events Philipp Krenn @xeraa
Slide 1
Slide 2
Slide 3
Slide 4
No silver bullet
Slide 5
Questions: https://sli.do/xeraa Answers: https://twitter.com/xeraa
Slide 6
uditd https://github.com/linux-audit
Slide 7
“auditd is the userspace component to the Linux Auditing System. It’s responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities.”
Slide 8
Monitor File and network access System calls Commands run by a user Security events
Slide 9
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing
Slide 10
Demo
Slide 11
Understanding Logs https://access.redhat.com/documentation/en-us/ red_hat_enterprise_linux/7/html/security_guide/secunderstanding_audit_log_files
Slide 12
More Rules https://github.com/linux-audit/audit-userspace/tree/master/rules
Slide 13
Namespaces WIP https://github.com/linux-audit/audit-kernel/issues/ 32#issuecomment-395052938
Slide 14
Slide 15
Problem How to centralize?
Slide 16
Developer
Slide 17
Disclaimer I build highly monitored Hello World apps
Slide 18
Slide 19
Slide 20
Slide 21
Slide 22
Slide 23
Slide 24
Filebeat Module: Auditd
Slide 25
Demo
Slide 26
!
Slide 27
!”
Slide 28
https://cloud.elastic.co
Slide 29
Auditbeat
Slide 30
Auditd Module Correlate related events Resolve UIDs to user names Native Elasticsearch integration
Slide 31
Auditd Module eBPF powers on older kernels Easier configuration Written in Golang
Slide 32
Slide 33
go-libaudit https://github.com/elastic/go-libaudit go-libaudit is a library for communicating with the Linux Audit Framework
Slide 34
Demo
Slide 35
System Module Easier configuration for host, process, socket, user Added in 6.6 — not based on Auditd
Slide 36
Demo
Slide 37
File Integrity Module inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)
Slide 38
hash_types blake2b_256, blake2b_384, blake2b_512, md5, sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512, xxh64
Slide 39
Demo
Slide 40
Conclusion
Slide 41
Slide 42
Auditd Auditbeat Logs, Dashboards,…
Slide 43
Slide 44
Code https://github.com/xeraa/ auditbeat-in-action
Slide 45
Similar Solutions https://github.com/slackhq/go-audit https://github.com/Scribery/aushape
Slide 46
Questions? Philipp Krenn PS: Sticker @xeraa
