Using BRO to tattle on other tools Patrick Cain The Cooper-Cain - - PowerPoint PPT Presentation

using bro to tattle on other
SMART_READER_LITE
LIVE PREVIEW

Using BRO to tattle on other tools Patrick Cain The Cooper-Cain - - PowerPoint PPT Presentation

Using BRO to tattle on other tools Patrick Cain The Cooper-Cain Group. Inc. pcain@coopercain.com (@BC @APWG) Using BRO ZEEK to tattle on other tools Patrick Cain The Cooper-Cain Group. Inc. pcain@coopercain.com (@BC @APWG) I dont do


slide-1
SLIDE 1

Using BRO to tattle on other tools

Patrick Cain The Cooper-Cain Group. Inc. pcain@coopercain.com (@BC @APWG)

slide-2
SLIDE 2

Using BRO ZEEK to tattle on

  • ther tools

Patrick Cain The Cooper-Cain Group. Inc. pcain@coopercain.com (@BC @APWG) I don’t do BIG data, I do LARGE data!

slide-3
SLIDE 3

A hypotethical environment…

Br Zeek ES Kafka

slide-4
SLIDE 4

An environment…

Br Zeek ES Kafka

Windows servers Linux servers DHCP/802.1x, Apache/IIS Nginx/APEX Etc.

Arcsight ESM

slide-5
SLIDE 5

An environment…

Br Zeek ES Kafka

Windows servers Linux servers DHCP/802.1x, Apache/IIS Nginx/APEX Etc.

Arcsight ESM ACTION

slide-6
SLIDE 6

An environment…

Br Zeek ES Kafka

Windows servers Linux servers DHCP/802.1x, Apache/IIS Nginx/APEX Etc.

Arcsight ESM ACTION

slide-7
SLIDE 7

An environment…

Br Zeek ES MSS Kafka

Windows servers Linux servers DHCP/802.1x, Apache/IIS Nginx/APEX Etc.

Arcsight ESM ACTION FWs

slide-8
SLIDE 8

An environment…

Br Zeek ES MSS Kafka

Windows servers Linux servers DHCP/802.1x, Apache/IIS Nginx/APEX Etc.

Arcsight ESM ACTION FWs

slide-9
SLIDE 9

Normal Event ‘flow’

  • Taps feed br zeek
  • Zeek feeds elasticsearch (ES) via a kafka buffer
  • Analyst can search in ES using kibana
  • ES sends filtered things to the SIEM
  • SIEM does correlation, add user detail, etc
  • No sense in rebuilding the SIEM
  • SIEM alerts on “bad things” and sends alert to tix
slide-10
SLIDE 10

We have an MSSP, too

  • “they will watch stuff as we sleep” 
  • They run snort; we get tickets when they see “stuff”
  • Snort is uni-directional; there are a lot of false positives in “stuff”
slide-11
SLIDE 11

We have an MSSP, too

  • “they will watch stuff as we sleep” ☺
  • They run snort; we get tickets when they see “stuff”
  • Snort is uni-directional; there are a lot of false positives in “stuff”
  • We wrote a script to log into their ticketing system:
  • 1. Grab IP, port, timestamp
  • 2. Search ES for the zeek conn log
  • 3. If connection not blocked -> generate a ticket for us.
  • 4. If port is 80 and http_resoonse is 200 -> generate a ticket to us.
  • 5. Else, close vendor ticket
slide-12
SLIDE 12

We have an MSSP, too

  • “they will watch stuff as we sleep” ☺
  • They run snort; we get tickets when they see “stuff”
  • Snort is uni-directional; there are a lot of false positives in “stuff”
  • We wrote a script to log into their ticketing system:
  • 1. Grab IP, port, timestamp
  • 2. Search ES for the zeek conn log
  • 3. If connection not blocked -> generate a ticket for us.
  • 4. If port is 80 and http_resoonse is 200 -> generate a ticket to us.
  • 5. Else, close vendor ticket
slide-13
SLIDE 13

We have an MSSP, too

  • “they will watch stuff as we sleep” ☺
  • They run snort; we get tickets when they see “stuff”
  • Snort is uni-directional; there are a lot of false positives in “stuff”
  • We wrote a script to log into their ticketing system:
  • 1. Grab IP, port, timestamp
  • 2. Search ES for the zeek conn log
  • 3. If connection not blocked -> generate a ticket for us.
  • 4. If port is 80 and http_response is 200 -> generate a ticket to us.
  • 5. Else, close vendor ticket
slide-14
SLIDE 14

We have an MSSP, too

  • “they will watch stuff as we sleep” ☺
  • They run snort; we get tickets when they see “stuff”
  • Snort is uni-directional; there are a lot of false positives in “stuff”
  • We wrote a script to log into their ticketing system:
  • 1. Grab IP, port, timestamp
  • 2. Search ES for the zeek conn log
  • 3. If connection not blocked -> generate a ticket for us.
  • 4. If port is 80 and http_response is 200 -> generate a ticket to us.
  • 5. Else, close vendor ticket
slide-15
SLIDE 15

We’re slowly adding new things

  • Hey! We run snort, too!
  • Let’s verify other snort alerts
  • Did the RDP actually succeeed? (Nope -> blocked at FW)
  • Was the remote shell attempt successful? (# bytes in conn.log)
  • Did the exploit actually succeed?
slide-16
SLIDE 16

We’re slowly adding new things

  • Hey! We run snort, too!
  • Let’s verify other snort alerts
  • Did the RDP actually succeeed? (Nope -> blocked at FW)
  • Was the remote shell attempt successful? (# bytes in conn.log)
  • Did the exploit actually succeed?
  • Put zeek behind the F5 (SSL-decryptor)
  • Did bad stuff seen in decrypted traffic hit other servers encrypted?
  • Zeek to the rescue.
slide-17
SLIDE 17

We’re slowly adding new things

  • Hey! We run snort, too!
  • Let’s verify other snort alerts
  • Did the RDP actually succeeed? (Nope -> blocked at FW)
  • Was the remote shell attempt successful? (# bytes in conn.log)
  • Did the exploit actually succeed?
  • Put zeek behind the F5 (SSL-decryptor)
  • Did bad stuff seen in decrypted traffic hit other servers encrypted?
  • Zeek to the rescue.
slide-18
SLIDE 18

We’re slowly adding new things

  • Hey! We run snort, too!
  • Let’s verify other snort alerts
  • Did the RDP actually succeed? (Nope -> blocked at FW)
  • Was the remote shell attempt successful? (# bytes in conn.log)
  • Did the exploit actually succeed?
  • Put zeek behind the F5 (SSL-decryptor)
  • Did bad stuff seen in decrypted traffic hit other servers encrypted?
  • Zeek to the rescue.
  • Can we skim 10% off the coin miner traffic?
  • Keep tuition low ☺
slide-19
SLIDE 19

We’re slowly adding new things

  • Hey! We run snort, too!
  • Let’s verify other snort alerts
  • Did the RDP actually succeed? (Nope -> blocked at FW)
  • Was the remote shell attempt successful? (# bytes in conn.log)
  • Did the exploit actually succeed?
  • Put zeek behind the F5 (SSL-decryptor)
  • Did bad stuff seen in decrypted traffic hit other servers encrypted?
  • Zeek to the rescue.
  • Can we skim 10% off the coin miner traffic?
  • Keep tuition low ☺
slide-20
SLIDE 20

Always looking for more ideas ☺

Pat Cain pcain@coopercain.com