Auditd for the Masses Philipp Krenn @xeraa Learn about a breach - - PowerPoint PPT Presentation

▶
auditd for the masses
SMART_READER_LITE
LIVE PREVIEW

Auditd for the Masses Philipp Krenn @xeraa Learn about a breach - - PowerPoint PPT Presentation

Nov 14, 2023 428 likes •945 views

Auditd for the Masses Philipp Krenn @xeraa Learn about a breach From the press or users Learn about a breach Attackers asking for a ransom Learn about a breach Cloud provider's bill Learn about a breach Yourself after the

slide-1
SLIDE 1

Auditd for the Masses

Philipp Krenn@xeraa

slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4

Learn about a breach

From the press or users

slide-5
SLIDE 5

Learn about a breach

Attackers asking for a ransom

slide-6
SLIDE 6

Learn about a breach

Cloud provider's bill

slide-7
SLIDE 7

Learn about a breach

Yourself after the fact

slide-8
SLIDE 8

Learn about a breach

Yourself but unsure about harm

slide-9
SLIDE 9

Learn about a breach

Yourself & you can prove no harm

slide-10
SLIDE 10

No silver bullet

slide-11
SLIDE 11

Questions: https://sli.do/xeraa

Answers: https://twitter.com/xeraa

slide-12
SLIDE 12

uditd

https://github.com/linux-audit

slide-13
SLIDE 13

"auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities."

slide-14
SLIDE 14

Watching file access Monitoring system calls Recording commands run by a user Recording security events Monitoring network access

slide-15
SLIDE 15 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing
slide-16
SLIDE 16

Demo

slide-17
SLIDE 17

More Rules

https://github.com/linux-audit/audit- userspace/tree/master/rules

slide-18
SLIDE 18

Namespaces WIP

https://github.com/linux-audit/audit- kernel/issues/ 32#issuecomment-395052938

slide-19
SLIDE 19
slide-20
SLIDE 20

Problem

How to centralize?

slide-21
SLIDE 21

Infrastructure | Developer

slide-22
SLIDE 22

Disclaimer

I build highly monitored Hello World apps

slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25
slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29

Filebeat Module: Auditd

slide-30
SLIDE 30

Demo

slide-31
SLIDE 31

Auditbeat

slide-32
SLIDE 32

Auditd Module

Correlate related events Resolve UIDs to user names Native Elasticsearch integration

slide-33
SLIDE 33

Auditd Module

eBPF powers on older kernels Run side by side with Auditd Easier configuration

slide-34
SLIDE 34

Docker metadata enrichment

slide-35
SLIDE 35

Demo

slide-36
SLIDE 36

File Integrity Module

inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)
slide-37
SLIDE 37

hash_types

blake2b_256, blake2b_384, blake2b_512, md5, sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512, xxh64
slide-38
SLIDE 38

Demo

slide-39
SLIDE 39

See moar

Kibana visualizations & dashboards

slide-40
SLIDE 40

Demo

slide-41
SLIDE 41

PS: Machine Learning

slide-42
SLIDE 42
slide-43
SLIDE 43
slide-44
SLIDE 44

Conclusion

slide-45
SLIDE 45
slide-46
SLIDE 46

Auditd Auditbeat Logs, Dashboards,...

slide-47
SLIDE 47

!

slide-48
SLIDE 48

!"

slide-49
SLIDE 49

https://cloud.elastic.co

slide-50
SLIDE 50

Next Steps

https://dashboard.xeraa.wtf SSH: elastic-user@xeraa.wtf secret

slide-51
SLIDE 51

Questions?

Philipp Krenn@xeraa PS: Sticker