Auditd for the Masses Philipp Krenn 44444 @xeraa
Slide 1
Slide 2
Slide 3
Slide 4
Learn about a breach From the press or users
Slide 5
Learn about a breach Attackers asking for a ransom
Slide 6
Learn about a breach Cloud provider's bill
Slide 7
Learn about a breach Yourself after the fact
Slide 8
Learn about a breach Yourself but unsure about harm
Slide 9
Learn about a breach Yourself & you can prove no harm
Slide 10
No silver bullet !
Slide 11
Questions: https://sli.do/xeraa Answers: https://twitter.com/xeraa
Slide 12
udit d https://github.com/linux-audit
Slide 13
"auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities."
Slide 14
Watching file access Monitoring system calls Recording commands run by a user Recording security events Monitoring network access
Slide 15
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing
Slide 16
Demo
Slide 17
More Rules https://github.com/linux-audit/audit- userspace/tree/master/rules
Slide 18
Namespaces WIP https://github.com/linux-audit/audit- kernel/issues/ 32#issuecomment-395052938
Slide 19
Slide 20
Problem How to centralize ?
Slide 21
Infrastructure | Developer !
Slide 22
Disclaimer I build highly monitored Hello World apps
Slide 23
Slide 24
Slide 25
Slide 26
Slide 27
Slide 28
Slide 29
Filebeat Module: Auditd
Slide 30
Demo
Slide 31
Auditbeat
Slide 32
Auditd Module Correlate related events Resolve UIDs to user names Native Elasticsearch integration
Slide 33
Auditd Module eBPF powers on older kernels Run side by side with Auditd Easier configuration
Slide 34
Docker metadata enrichment
Slide 35
Demo
Slide 36
File Integrity Module inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)
Slide 37
hash_types blake2b_256 , blake2b_384 , blake2b_512 , md5 , sha1 , sha224 , sha256 , sha384 , sha512 , sha512_224 , sha512_256 , sha3_224 , sha3_256 , sha3_384 , sha3_512 , xxh64
Slide 38
Demo
Slide 39
See moar Kibana visualizations & dashboards
Slide 40
Demo
Slide 41
PS: Machine Learning
Slide 42
Slide 43
Slide 44
Conclusion
Slide 45
Slide 46
Auditd Auditbeat Logs, Dashboards,...
Slide 47
!
"
Slide 48
! "
Slide 49
https://cloud.elastic.co
Slide 50
Next Steps https://dashboard.xeraa.wtf SSH: elastic-user@xeraa.wtf secret
Slide 51
Questions? Philipp Krenn 44444 @xeraa PS: Sticker
