Slide 1
Slide 2
Slide 3
Learn about a breach From the press or users
Slide 4
Learn about a breach Attackers asking for a ransom
Slide 5
Learn about a breach Cloud provider's bill
Slide 6
Learn about a breach Yourself after the fact
Slide 7
Learn about a breach Yourself but unsure about harm
Slide 8
Learn about a breach Yourself & you can prove no harm
Slide 9
Slide 10
No silver bullet
Slide 11
uditd https://github.com/linux-audit
Slide 12
"auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities."
Slide 13
Monitor File and network access System calls Commands run by a user Security events
Slide 14
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing
Slide 15
Demo
Slide 16
Understanding Logs https://access.redhat.com/documentation/en-us/ red_hat_enterprise_linux/7/html/security_guide/secunderstanding_audit_log_files
Slide 17
More Rules https://github.com/linux-audit/audit-userspace/tree/master/rules
Slide 18
Namespaces WIP https://github.com/linux-audit/audit-kernel/issues/ 32#issuecomment-395052938
Slide 19
Slide 20
Problem How to centralize?
Slide 21
Developer
Slide 22
Disclaimer I build highly monitored Hello World apps
Slide 23
Slide 24
Slide 25
Slide 26
Slide 27
Slide 28
Slide 29
Filebeat Module: Auditd
Slide 30
Demo
Slide 31
!
Slide 32
!"
Slide 33
https://cloud.elastic.co
Slide 34
Auditbeat
Slide 35
Auditd Module Correlate related events Resolve UIDs to user names Native Elasticsearch integration
Slide 36
Auditd Module eBPF powers on older kernels Easier configuration Written in Golang
Slide 37
Docker metadata enrichment
Slide 38
Demo
Slide 39
File Integrity Module inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)
Slide 40
hash_types blake2b_256, blake2b_384, blake2b_512, md5, sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512, xxh64
Slide 41
Demo
Slide 42
Conclusion
Slide 43
Slide 44
Auditd Auditbeat Logs, Dashboards,...
Slide 45
Try https://dashboard.xeraa.wtf SSH: elastic-user@xeraa.wtf secret
Slide 46
Code https://github.com/xeraa/ auditbeat-in-action
Slide 47
Questions? Philipp Krenn PS: Sticker @xeraa
