Scale Your Auditing Events

Slide 1

Scale Your Auditing Events Philipp Krenn @xeraa

Slide 2

Slide 3

Slide 4

No silver bullet

Slide 5

Questions: https://sli.do/xeraa Answers: https://twitter.com/xeraa

Slide 6

uditd https://github.com/linux-audit

Slide 7

“auditd is the userspace component to the Linux Auditing System. It’s responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities.”

Slide 8

Monitor File and network access System calls Commands run by a user Security events

Slide 9

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing

Slide 10

Demo

Slide 11

Understanding Logs https://access.redhat.com/documentation/en-us/ red_hat_enterprise_linux/7/html/security_guide/secunderstanding_audit_log_files

Slide 12

More Rules https://github.com/linux-audit/audit-userspace/tree/master/rules

Slide 13

Namespaces WIP https://github.com/linux-audit/audit-kernel/issues/ 32#issuecomment-395052938

Slide 14

Slide 15

Problem How to centralize?

Slide 16

Developer

Slide 17

Disclaimer I build highly monitored Hello World apps

Slide 18

Slide 19

Slide 20

Slide 21

Slide 22

Slide 23

Slide 24

Filebeat Module: Auditd

Slide 25

Demo

Slide 26

Slide 27

!”

Slide 28

https://cloud.elastic.co

Slide 29

Auditbeat

Slide 30

Auditd Module Correlate related events Resolve UIDs to user names Native Elasticsearch integration

Slide 31

Auditd Module eBPF powers on older kernels Easier configuration Written in Golang

Slide 32

Slide 33

go-libaudit https://github.com/elastic/go-libaudit go-libaudit is a library for communicating with the Linux Audit Framework

Slide 34

Demo

Slide 35

System Module Easier configuration for host, process, socket, user Added in 6.6 — not based on Auditd

Slide 36

Demo

Slide 37

File Integrity Module inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)

Slide 38

hash_types blake2b_256, blake2b_384, blake2b_512, md5, sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512, xxh64