Auditd for the Masses Philipp Krenn @xeraa Learn about a breach - PowerPoint PPT Presentation

Nov 14, 2023 •428 likes •942 views

Auditd for the Masses Philipp Krenn @xeraa Learn about a breach From the press or users Learn about a breach Attackers asking for a ransom Learn about a breach Cloud provider's bill Learn about a breach Yourself after the

Auditd for the Masses Philipp Krenn �� @xeraa
Learn about a breach From the press or users
Learn about a breach Attackers asking for a ransom
Learn about a breach Cloud provider's bill
Learn about a breach Yourself after the fact
Learn about a breach Yourself but unsure about harm
Learn about a breach Yourself & you can prove no harm
No silver bullet
Questions: https://sli.do/xeraa Answers: https://twitter.com/xeraa
uditd https://github.com/linux-audit
"auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities."
Watching file access Monitoring system calls Recording commands run by a user Recording security events Monitoring network access
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing
Demo
More Rules https://github.com/linux-audit/audit- userspace/tree/master/rules
Namespaces WIP https://github.com/linux-audit/audit- kernel/issues/ 32#issuecomment-395052938
Problem How to centralize?
Infrastructure | Developer
Disclaimer I build highly monitored Hello World apps
Filebeat Module: Auditd
Demo
Auditbeat
Auditd Module Correlate related events Resolve UIDs to user names Native Elasticsearch integration
Auditd Module eBPF powers on older kernels Run side by side with Auditd Easier configuration
Docker metadata enrichment
Demo
File Integrity Module inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)
hash_types blake2b_256 , blake2b_384 , blake2b_512 , md5 , sha1 , sha224 , sha256 , sha384 , sha512 , sha512_224 , sha512_256 , sha3_224 , sha3_256 , sha3_384 , sha3_512 , xxh64
Demo
See moar Kibana visualizations & dashboards
Demo
PS: Machine Learning
Conclusion
Auditd Auditbeat Logs, Dashboards,...
!
!"
https://cloud.elastic.co
Next Steps https://dashboard.xeraa.wtf SSH: elastic-user@xeraa.wtf secret
Questions? Philipp Krenn �� @xeraa PS: Sticker

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Aspects of neutrino masses Jessica Turner UCL 13 December 2019 Outline Neutrino masses and

Aspects of neutrino masses Jessica Turner UCL 13 December 2019 Outline Neutrino masses and mixing Consequences of neutrino masses Neutrino masses from gravity, what has been done Neutrino masses from gravity: the Schwinger Dyson

741 views • 52 slides

SOFTDRIVE.NL, SOFTDRIVE.NL, CVMFS FOR THE CVMFS FOR THE MASSES MASSES DENNIS VAN DOK DENNIS

SOFTDRIVE.NL, SOFTDRIVE.NL, CVMFS FOR THE CVMFS FOR THE MASSES MASSES DENNIS VAN DOK DENNIS VAN DOK Generic Components of the eScience Infrastructure Ecosystem 14th IEEE eScience Conference Amsterdam, Monday 2018-10-29 1 GRID

815 views • 18 slides

Pancreatic Mass: Solid or Cystic? Solid Pancreatic masses Cystic pancreatic masses -

Workshop -ROSE in EUS guided FNA of Pancreatic Lesions Guys Hospital, London, 16 April 2018 Laxmi Batav Imperial College NHS Trust Pancreatic Mass: Solid or Cystic? Solid Pancreatic masses Cystic pancreatic masses - Ductal

332 views • 11 slides

MassBrowser Unblock cking the Censored Web fo for the Masses, by the Masses Milad Nasr, Hadi

MassBrowser Unblock cking the Censored Web fo for the Masses, by the Masses Milad Nasr, Hadi Zolfaghari, Amir Houmansadr, Amirhossein Ghafari University of Massachusetts, Amherst 1 Internet Censorship 2 Censorship Circumvention Tools 3

827 views • 30 slides

Neutrino Masses from TeV Scale New Physics -- Tests of Neutrino Masses at the LHC Mu-Chun Chen,

Neutrino Masses from TeV Scale New Physics -- Tests of Neutrino Masses at the LHC Mu-Chun Chen, University of California at Irvine GGI Whats Nu?, June 26, 2012 Theoretical Challenges (i) Absolute mass scale: Why m << m u,d,e ?

543 views • 29 slides

Recursion for the Masses TCS Seminar WS19/20 Christoph Rauch Dec 10, 2019 Recursion for the

Recursion for the Masses Recursion for the Masses TCS Seminar WS19/20 Christoph Rauch Dec 10, 2019 Recursion for the Masses Introduction of Recursion to Students Early Stage (FAU) students are more or less expected to "know" what

603 views • 29 slides

Pole masses of Neutrinos in the GrimusNeufeld model Vytautas D ud enas Vilniaus

Pole masses of Neutrinos in the GrimusNeufeld model Vytautas D ud enas Vilniaus Universitetas In collaboration with Thomas Gajdosik, Darius Juriukonis September 6, 2019 1 / 16 Outline Model for masses 1 Pole mass calculation 2

427 views • 18 slides

Extended double seesaw model for neutrino masses and low scale leptogenesis. International

Extended double seesaw model for neutrino masses and low scale leptogenesis. International workshop on neutrino masses and mixing Decmeber 17-19 2006, Shizuoka, Japan Sin Kyu Kang (Sogang University) in collaboration with C. S. Kim

1.25k views • 25 slides

Slide 1 / 67 1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are

Slide 1 / 67 1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are separated by a distance of 25 m. Find the gravitational attraction between them. Slide 2 / 67 2 Two spherical objects have masses of 1.5 x 10 5 kg and

773 views • 23 slides

Slide 1 / 66 1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are

Slide 1 / 66 1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are separated by a distance of 25 m. Find the gravitational attraction between them. Slide 2 / 66 2 Two spherical objects have masses of 1.5 x 10 5 kg and

537 views • 22 slides

1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are separated by a

968 views • 67 slides

Models for Neutrino Masses and Physics Beyond Standard Model Salah Nasrj The 2nd Toyama

Models for Neutrino Masses and Physics Beyond Standard Model Salah Nasrj The 2nd Toyama International Workshop on Higgs as a Probe of New Physics 2015 (HPNP2015), Toyama, Japan February 12, 2015 1 / 27 . Salah Nasri Neutrino masses and

671 views • 27 slides

Landell - live streaming for the masses Luciana Fujii Pontello Landell - live streaming for the

Landell - live streaming for the masses Luciana Fujii Pontello Landell - live streaming for the masses 1 / 12 Introduction Landell Landell: Software to capture, record and stream audio and video in a simple way. Landell - live streaming

598 views • 12 slides

E Example l CSE 541 Numerical Methods Suppose we have three masses all connected by

E Example l CSE 541 Numerical Methods Suppose we have three masses all connected by Linear Systems y springs. i Each spring has the same constant k. constant k. Simple force balance gives us accelerations in terms of

353 views • 10 slides

PI ICR technique for high precision measurements of nuclide masses (development at

PI ICR technique for high precision measurements of nuclide masses (development at SHIPTRAP) Sergey Eliseev K. Blaum, M. Block, S. Chenmarev, A. Drr, C. Droese, T. Eronen, P. Filjanin, M. Goncharov, M. Hcker, J. Ketter, E. Minaya

1.16k views • 54 slides

Objective Taking recommendation technology to the masses Helping researchers and

Objective Taking recommendation technology to the masses Helping researchers and developers to quickly select, prototype, demonstrate, and productionize a recommender system Accelerating enterprise-grade development and deployment

820 views • 40 slides

Introduction to Fitwel Alex Spilger Director of Sustainability, Cushman Wakefield Founder,

Introduction to Fitwel Alex Spilger Director of Sustainability, Cushman Wakefield Founder, GreenStep Making the case for healthy buildings Employee Health as an ROI Fiwel Ratings Fitwel User Groups Fitwel Costs The 12 Fitwel Sections

941 views • 28 slides

Having problems? Email: sara@supplychainschool.co.uk Tips for Zoom Chat Use gallery view Hand

H OUSE R ULES Cameras and mics off please. Get involved in the poll. Keep your mobile phone handy Raise your hand or use the chatbox for questions Share your feedback at the end Slides will be shared and session will be

1.53k views • 114 slides

please turn all mobile devices to silent whilst in the conference room Thank you Social Media

Welcome Out of respect to Colleagues, please turn all mobile devices to silent whilst in the conference room Thank you Social Media Hashtag #YotB2015 Tweet at @EU_Brain Dr. Mary Baker Welcome address Objectives of the conference President

997 views • 81 slides

Welcome to Today's Web Seminar Sponsor Content From Hosted By Kathryn Mayer Kathryn Mayer is

Welcome to Today's Web Seminar Sponsor Content From Hosted By Kathryn Mayer Kathryn Mayer is Editor-in-Chief of Employee Benefit News. She previously served as EBNs Executive Editor after joining SourceMedia in January 2016. She has been

442 views • 19 slides

Summary of High Brightness Beams Workshop Erice 2005 G. A. Krafft Jefferson Lab Applications of

Summary of High Brightness Beams Workshop Erice 2005 G. A. Krafft Jefferson Lab Applications of High Brightness Beams: Energy Recovered Linacs G. A. Krafft Jefferson Lab Erice 2005 HBB Workshop 11 October 2005 Operated by the Southeastern

1.26k views • 125 slides

1 LOGO LAB 4&5 PCM Modulator & Demodulator Block diagram of PCM modulation LPF is

1 LOGO LAB 4&5 PCM Modulator & Demodulator Block diagram of PCM modulation LPF is used to remove the noise in the audio signal 3 PCM modulation is a kind of source coding. is commonly used in audio and telephone transmission Source

1.03k views • 56 slides

Pipelined Compressor Tree Optimization using Integer Linear Programming International Conference

Pipelined Compressor Tree Optimization using Integer Linear Programming International Conference on Field Programmable Logic 03.09.2014 Martin Kumm, Peter Zipf University of Kassel, Germany C ONTENTS 1. Introduction to Compressor Trees 2.

461 views • 44 slides

Facial Action Unit Detection Using Kernel Partial Least Squares Tobias Gehrig and Hazm K.

Facial Action Unit Detection Using Kernel Partial Least Squares Tobias Gehrig and Hazm K. Ekenel | November 13, 2011 INSTITUTE FOR ANTHROPOMATICS, FACIAL IMAGE PROCESSING AND ANALYSIS GROUP Institute for Anthropomatics 1 KIT University

668 views • 43 slides