everybody's had a a great day listening
to all the great talks and
uh hopefully um you know participating
in some other workshops i'm super glad
to be here and thankful to be here today
cloud village presenting on security
onion and using it in the cloud and uh
you know making that cso or that ciso
proud right um or if you are a cso um
you know learning how you can leverage
security and in the cloud to get better
visibility over all your cloud resources
and uh and really just better visibility
over your entire enterprise because we
do like to kind of pitch the notion of
uh enterprise security monitoring to
include things like authentication data
cloud data and then all the other
network and host data that you might
find in an enterprise
so uh again my name is wes lambert i'm a
principal engineer at security indian
solutions and
you can find me on twitter at the real w
lambert and um you know feel free to hit
me up if you have any questions after
this workshop but otherwise we'll
continue through and get this thing
going
all right so on the agenda what we have
today is an introduction to
well the cloud this is cloud village so
we're going to talk a little bit about
the cloud right
we're going to give an introduction to
security onion itself and then how it
can be leveraged in the cloud to
increase that visibility
and so when we talk about the cloud and
you know kind of all of the data that it
contains and uh you know where things
are stored and
um you know how things happen how data
flows and communication happens between
applications
typically
these are just some examples just kind
of get the brain flow in but
in aws you might have things like s3
buckets or dynamodb
you might have azure blob storage or use
event hubs for uh you know forwarding or
storing data
and then in google cloud platform or gcp
you might uh you know again storage
buckets um just buckets usually um and
then you know there may be other
mechanisms uh in addition to the
you know the application
or uh a machine or an instances uh
network traffic uh the data that's going
back and forth between those systems
right so
talk about all this data and all this
stuff going uh back and forth in the
cloud
and you know a lot of times
obviously this is why we talk about
security monitoring the cloud this data
is exploited and and can be abused right
or the access to this data can be abused
uh for example in aws uh s3 scanner is a
popular one or has been in the past for
looking for open s3 buckets uh as well
as a
saw another one uh called i'm not sure
how you pronounce it um
pacu or paku
um
it's an aws exploitation framework right
where uh you know maybe you're looking
for those open cloud buckets or you're
looking for weak permissions
and things like that and kind of going
from there and and really you know
breaking into someone's cloud
infrastructure from that point
and similarly with azure we have uh
micro burst and you know with microverse
you can perform things like azure
services discovery uh look for weak
configuration and let me see where uh
some post exploitation could occur
and uh you know get into some other
frameworks as a result of that
in gcp uh gcp i am privileged escalation
uh these by rhino security labs uh is
great for things like permissions
enumeration uh you know also um you know
looking for that privacy moment uh the
gcp bucket break
you know enumerating those cloud buckets
determining what access is there
and uh determining the best place to get
a foothold in that infrastructure and
pivot from there
into you know more maybe more sensitive
components or you know
something more valuable
and we also talk about you know aside
from getting at the data
you know how credentials like aws
credentials you know these things can
can really uh
pretty easily be obtained by by phishing
efforts right
by going after folks administrators i.t
admins
you know trying to get im account
credentials or root account credentials
or trying to get those access keys right
to
basically not have to log into the
environment right but have programmatic
or have
you know
kind of a more silent method
of uh access right or something a little
bit easier especially if uh otherwise
these are accounts are locked down with
mfa
you know we can get by that obviously if
we have the access keys the root access
keys or things like that
uh similarly uh you know creating new
policy policy versions uh is is one way
in which uh you know those credentials
could be used for privileged escalation
uh you can create user access keys for
yourself or you know for your friends
right um you could even add like a
malicious lambda layer to an existing
function
and if that's not well audited and you
know it'd look pretty normal if you have
these
pre-existing lambdas uh that you already
use and that just function normally
if you're not paying attention and
tracking uh auditing activity
uh like you should be or or could be
um you know those things could be pretty
sneaky and get past the door
and so you know we have all these ways
to kind of exploit or potentially
exploit and abuse this data
and um you know how do we how do we
monitor for that or what are some
challenges um with monitoring for that
um you know typically
uh you know from my uh you know from my
experience uh but kind of before the
cloud was as popular right and still uh
even some folks maybe not as much in the
cloud
traditionally we use platforms that
perform network security monitoring
and we're able to tap that network
infrastructure
and get a copy that traffic you know via
span port or via tap
and copy that off and be able to monitor
that pretty easily
well there are some monitoring
challenges when you come into the cloud
with nsm
uh you know that have to be addressed in
some way shape or form
and some of those challenges are going
to include things like vxlan
encapsulation right some applications
are not going to be able to
decapsulate that traffic we can record
the traffic maybe
in some form
but you know will those applications be
able to handle it will they be able to
know what is inside of this vxlan tunnel
that's you know this data that's all
wrapped up in another package
then there are things like segmentation
and ephemerality uh you know services in
the cloud frequently spin up and spin
down so sometimes that's difficult to
monitor if certain characteristics of
those instances change uh you know
unique uh identifiers we may lose that
instance or where the instance was what
instance it was when something happens
so that's that's kind of another thing
that we run into
uh when we start to monitor these things
sometimes
and then in some cases
there's no native really scalable
mechanism for monitoring the network and
i highlighted azure here and i'm not
trying to poke fun at azure um but you
know i know back in the day they had the
virtual tab preview that never really
went anywhere
to now
um you know hopefully that gets revived
and going you know public soon
but you know for some cloud platforms
that capability is just not there
i know azure does have
uh some other there's some partners that
do this through like a set of agents and
suddenly sending it through their own
vxlan tunnel and that sort of thing but
again there's no native mechanism to do
that and you know there are many other
services like that
so this is where security engine kind of
comes in right
so security ending was created by doug
burtz in 2008.
uh doug is my boss he's super nice dude
make sure to check him out on twitter at
uh doug burks um
but uh so what doug did he created
security in and out of a need of his own
and analysts that he knew that um you
know they were trying to get a sensor
platform up and running quickly
and you know back in the day you were
compiling all this stuff
uh you know trying to get all these
dependencies right and um what doug want
to do is was really make that into a
nice little neat package to be able to
click and deploy
and go from there and you know spend
more time monitoring your network and
less time administering it or setting up
the
mechanism to do so
so
uh in doing that uh security onion
became this uh this free and open
platform for intrusion detection
enterprise security monitoring and log
management
so
we record that traffic off the network
we can also pull in host telemetry and
then also just perform if you're just
you know using it for log management you
can send different types of log data via
firewall and other stuff there as well
and it can be installed from right now
we have a centos 7 based iso image
and packages are also available for
ubuntu 1804 or centos 7.
so if you want to install it
install your own ubuntu or your own
centos 7 install and then install
security and on top of that you can
absolutely do that
and we completely support both methods
so that's a little bit about security in
itself and and i'll get into some of the
the components of security in here
and one of those uh one of those types
of data that we get out of security i
mean uh is going to be alert data and
this is some of that uh you know that
data that tells us that something is
wrong here or that something could be
wrong right and some of the mechanisms
or tools that we use to gather that
alert data are going to be wazoo which
is a host-based intrusion detection
system
formerly known as osec and some of the
binaries even are still called osec so
you may know that already
but it does things like sit does things
like sit on the host and it can do file
integrity monitoring um you know
pick up windows logs ship those ship
application logs other things like that
but that's going to be the host-based
component of that alert data that's
generated and provided in security
circada right now in
security and in provides that needs
functionality so
there's alerts that you get you know
from ids
that's circada um well at least in this
case so
if you see some network traffic or if
circada sees it and thinks it's bad
based on the signatures that it has
loaded then it will generate a nits
alert and that's what you see here
uh along with these source and
destination ip addresses and i just
realized this is actually an older image
that i've not updated to ship but
uh playbook is another way that we can
alert on
uh log data that we pull in or even
network data just events that are in
elasticsearch uh we can generate
elastomer queries and then alert on that
uh using playbook what playbook does is
take in native sigma rules from the
sigma repo and then we can convert those
to a last alert rules and use those for
detections and alerting inside of
security
stroke is going to provide the file
based component so if you've uh if
you've worked with the aura before you
know that it works with files strobe
code can also use yara to
take those files that are extracted from
network streams
and
perform some analysis on those and also
run your rules against those files
and then generate an alert based on that
so that's super useful to be able to
have that type of data at our fingertips
and speaking to some other types of data
that we collect and that provide
available to you in security and in are
going to be that of network metadata via
ciracada or zeek
zeke formerly known as bro has been a
pretty popular
way to policy neutral ids uh way to get
that network metadata and be able to
stack it and really see what's going on
in the network
uh lots and lots of different logs there
from zeke and both cerakata sirikata can
now perform that same kind of collection
so things like dns activity http smb
dc rpc tons and tons of protocols
available for both of those
along with the full content or full
packet capture data from google
stenographer we use google stenographer
to record that data off the wire
and we store that as indexed pcapp so
it's very
it's it's a little more efficient than
storing raw pcap files so
the files on disk are stored as an index
or
are indexed and then we go and retrieve
that via our
pcap application and security in it and
we can carve that pcap pretty quickly
since it's indexed and we're able to
refer to that
and with that pcap we get that complete
transcript or the complete goings-on
of whatever unencrypted traffic that we
can see obviously things that are
encrypted we're not going to
peer into unless you're performing some
type of inspection beforehand right
excuse me let me get some water
all right
so continuing from that full content
data that full packet capture
we have other supplementary data that we
can feed security in it
and
we recently made this a lot easier but
we can use filebeat modules from elastic
and what those 5b modules allow us to do
is pull in a ton of different already
supported
log sources or you know other forms of
telemetry
things like
you know fortinet logs
let's see you can pull in threat data
you can pull in gcp logs aws
um all sorts of stuff there
in addition to i mentioned wazoo for
host data as well as when log be the
elastic uh you know windows log beat for
uh elastic itself the elastic stack
and then also os query so with os query
you can query those hosts uh like kind
of like a relational database seeing all
different types of things about the host
what's going on processes users uh all
sorts of good stuff there and we manage
that with fleet dm here in security
now let's talk a little bit about um you
know traffic mirroring itself in the
cloud and how that might occur
so with aws uh traffic mirroring kind of
happens like this right so we have these
mirror sources
which are going to be these elastic
network interfaces and these are going
to be
essentially those instances they're
nitro based instances in aws
and what's going to happen with those is
entire inside of a thing called a mirror
session those e and i's are going to
flow through a mirror filter
and this mirror filter basically tells
us uh or tells aws um what do you want
to see right so i only want to see
you know dns or i only want to see http
or i want to see everything
right and then once that filters in
place
that traffic flows through and then hits
that mirror target which is going to be
our security in an instance which is
comprised of a management interface and
a sniffing interface and this right here
this mirror target is going to be that
sniffing interface so it's going to
listen to all of that traffic all that
goodness and pull that in the security
engine excuse me and make it so that we
can review that data and see you know
real attackers and all sorts of things
like that
so you know this is again a brief
diagram of how that aws traffic
mirroring works and we'll dive into that
in just a little bit
so here's an example um you know you can
run security engine in the cloud uh we
do have a security and an amazon machine
image now that you can use so you can
run it as a standalone instance or a
complete distributed install in the
cloud
all by itself all on zlonesum
or you can also set up security and in
as a cloud node
so
when i say a cloud node i'm meaning a
sensor
in the cloud right so
we essentially have we can have a
manager that's local
to our you know maybe we have an on-prem
environment where we have a manager and
a search node which is going to house
most of the elastic data
and then we have a local sensor maybe we
have local traffic that we're monitoring
but we also want to have that cloud
traffic brought in we want to perform
that traffic mirroring capture that
we can absolutely do that using you know
something like direct connect or openvpn
we can connect a tunnel up there
and then we can have that
in our deployment essentially as if it
were a local node and see that data all
the same
so it's super awesome to be able to do
that right it's
so you get the best of both worlds
you're getting uh you know the local
coverage you're getting the cloud
coverage and you're able to view that
through that single pane of glass
so it's super
uh super useful to have that capability
now going into that uh that bpc
mirroring or that traffic mirroring aws
a little bit more
uh i mentioned one of the components is
that traffic mirror target uh one of
those components of that mirror session
right and that traffic mirror target
again is going to define the target
interface where we want to send that
traffic
right and in our instance it's going to
be the interface that's associated with
security engine
so here's just a screenshot here of what
that looks like when you go into the
console we'll dig into that in just a
little bit here
but you can see the target settings
there you can add a tag if you want to
and then
you can choose typically it's going to
be the network interface and the target
of the security onion sniffing interface
right there
and then another component that traffic
mirror filter which is
filtering what traffic is actually going
to be sent
to security and in
data's here as well so um
basically you're defining those
protocols and that traffic that you want
to be mirrored and then you can filter
anything else out
or you can just again take it all and
send it all to security engine
and then that traffic mirror session
again is comprised of that source
interface
um that you know that nitra instance
maybe a linux box maybe a windows server
and that target interface that security
and sniffing interface
and again that mirror filter which is
filtering the traffic
whatever you're determining you want to
have in there
now some notes on traffic mirroring with
aws um ciracata we we run these versions
above these versions but i just wanted
to note that circada uh you know 4.1.5
and above can natively decapitate vxlan
traffic
so because it can support that and we're
recording network data off the wire uh
it's able to inspect that and generate
alerts accordingly if it needs to
and the same wizik
3.0.x and up can also natively decap
vxlan so we have that capability as well
and again that traffic mirroring is
capable only with the nitro based
instances so you cannot use just any
instance or you cannot mirror traffic
from just any instance it would need to
be one of those natural based instances
so that's something you want to be aware
of if
you know you're building out your cloud
infrastructure or you're considering a
reorganization or
if you have these plans to go monitor
this traffic you need to keep that in
mind that
it is supported only for those nitro
based instances
now let's talk a little bit about gcp
also known as google cloud platform
so with gcp
we can also perform traffic mirroring or
they call it packet mirroring
um
and those components uh it's going to be
a little bit different than aws but the
end goal is essentially the same
right so get that traffic from one point
to another
and it consists of a packet mirroring
policy which determines basically which
interfaces or
which instances are going to be
participating in that traffic mirroring
and that traffic will be mirrored
accordingly
when that traffic gets mirrored it has
to go to a tcp udp load balancer and
what this load balancer does is it
distributes that traffic that's mirrored
from those instances
and it takes it and splits it up across
a collector destination
and that collector destination it can be
one
instance or it can be multiple it can be
an instance group right where you have
these instances that spin up and
each handle a certain part of the load
that's what the purpose of this is it's
to allow you to distribute that across
the nodes equally or to be able to have
some priority in that if you need to
so again it's a little bit different um
as far as is how you do it uh for the
packet mirroring policy
this is going to essentially take those
source interfaces and
that
filter that i mentioned before and
combine that into one
and this collector destination is going
to take the place of that other mirror
target that i mentioned before
and this load balancer is actually just
a kind of a different concept altogether
right you can use a load balancer on aws
i'm just not covering that at the moment
so here is a diagram of what that might
look like
here we have a single project and a
single vpc network and this is taken
straight from their documentation
so i have the link there if you want to
check that out
but uh it is again in a single region
and you can see that this mirrored vm
here
is you know there's traffic traversing
the internet and an on-prem network and
some google services
and all of this stuff right here this
subnet right here is basically via that
packet mirroring policy is going to be
mirrored because this vm is in here
it's going to mirror that traffic and
according to the map packet mirroring
policy it says it needs to go to uh
we're going to send it to this internal
tcpdp load bouncer and then this
distribute yeah distributes it
into all of the collectors or instances
we have here in the collector subnet
and this is where the security union
instances sniffing interface would come
into play
so
um something to note is that you know in
google cloud or in tcp
you cannot have two interfaces in the
same network on the same instance
so you would have
that one interface in this network
performing this function the snipping
one
then you would have another interface
for the security engine box in a
separate network uh which really would
be best practice anyway uh and then
controlling it from there managing it
from there
so that's how that would look and come
into play there with the gcp packet
mirroring
and i mentioned that here just kind of
again mentioned that an instance in gcp
cannot have more than one network
interface that resides within the same
network in vpc
right
so that security engine management
interface again should reside in its own
network or vpc
now some ways um you know
you might spin these things out in the
cloud and you might be wondering okay
well how can i test to make sure this is
working uh make sure my packet nearing
is working my traffic mirroring is
working as i think it is
tm nids is a great way to do that
it's traditionally used with you know
you can use it on-prem or in the cloud
um but it would test circuit alerts
basically for you so you can use it
it's basically a command or a script
written by thiago farya super great guy
um
three-quarter second tiago they put out
a ton of great open source tools you
should make sure to check those out on
the github check them out on twitter
um
but you can use tnids or test my nids
kind of a supercharged version if you
used test my ids back in the day
of that so you can run the command and
then
hopefully if all your packet mirroring
is set up correctly it will generate
alerts like you see here
and we'll we'll go through that here in
just a little bit
another tool that's really cool really
awesome to use with aws if you're
performing that traffic mirroring uh and
it's again another open source tool by
thiago and team is uh three corsac auto
mirror
and what this does
is it's an application uh previously it
was a lambda function but i think now
it's an app a serverless app and the app
repository that you can install
and what you do is you install that and
you tag your instances you can have this
come up as part of your instance
creation procedure if you want to
monitor it right so that way when people
are rolling out your team it is rolling
out instances you can append this mirror
true tag and what auto mirror will do it
will see that and it will create a
corresponding
configuration a corresponding mirror
session for that automatically that
means you don't have to go to the mirror
session
go manually add all these interfaces
it knows basically um you know based on
those tags what to add um to the mirror
session that you have and if you need to
uh you know configure a new mirror
session if you hit the limit
for mirror sessions and
that's another thing entirely there are
some considerations there that you'll
want to look at
make sure to review aws documentation on
the limitations for mirror sessions but
i digress
so
we'll continue from there but uh be sure
to check out tm nids and auto mirror
because they are again very useful tools
to have in your
toolkit
all right so
kind of poured through that i wanted to
get to the lab uh you know in somewhat
decent time so give me just a second
here and we'll get started with that
hopefully you guys have
had the prerequisites in place and aws
accounts and uh you don't necessarily
need the access key
for this workshop since
i'm not sure if we're going to be
performing that just yet or not but
you will need an aws account and
you will need to sign up for the
security onion ami if you want to do
that
you don't necessarily have to
in the documentation if you look at the
prerequisites guide there
you can absolutely set up an ubuntu 1804
or centos 7
install and then secure install security
engine on top of that if you're
comfortable with that but for the
simplicity of the the lab and everything
and getting everything going quickly we
are going to use the ami
so yeah just feel free let me know if
you have any questions about that but i
will spin that up here in just a second
let me get one more drink
all right
so this lab
let's see see if i get any questions
comments
all right cool
okay so wrong way
all right so if we're going through here
again this is if um the link should be
uh should be provided already but this
is the
uh instructions here if you want to get
set up with aws
and then if you scroll down
to follow along with the step-by-step we
have uh instructions here
and then
let's see
let me see okay sorry i was just making
sure i was still sharing there
we have uh some other stuff here that
will follow through in just a little bit
but i'm gonna have this opened up on my
side so let me make sure i get that
okay got that ready to roll
and now i am in
aws right now so let me go ahead and
delete this this is just an old vpc i
don't need this thing
get out of here
all right so if you're starting from the
vpc dashboard this is where we're going
to start and create our vpc
and we'll go through the wizard here oh
actually let me go back
sorry
let me get back you don't want to start
here it's a little bit easier if you
actually launch the vpc wizard
and we're going to do for simplicity's
sake for this demo we're going to launch
with a single public subnet
all right and i'll give you guys a
second there and what we're gonna do
here is specify our um
our cider for the uh for the public
subnet and actually that's
let's see
i don't think you actually need to do
this but
this okay
all right and then what we'll do from
there is we'll just go ahead and create
the vpc
and take a minute here
okay
it's been successfully created there
then we'll take a look at that we see it
in here
our vpc just some basic details here so
now let's just go over to security
groups
and i actually have this modified if i
remember correctly
already let me see oh no that's right
deleted vpc all right so what we'll do
here is we're going to add exceptions
for ssh and https for your ip address
there
i'm just going to add it for a range
here i'm going to edit the default
security group click edit inbound rules
and i'm just going to delete this
default one it has here
and
add ssh
and
i'm just going to do custom
double check this always
okay and you'll be adding yours here you
will not be adding this range
and you you really can just click my ip
there
to uh to use your own ring too
whoops
i
right so
that's
we'll also add another rule for http
let's
there see
i'm sorry https not http what am i doing
there we go
alrighty
and i'll just do the same thing here
alrighty
let's save those rules
all right so now we're just modifying
again so we can have that ssh and web
access from
externally from our
uh own machine
and what i'm gonna do here i'm going to
go over to the ec2 instances
and spin up a security enemy box
all right so i've got zero instances
running here
and i will click launch instances and
again all of this is
uh in this documentation
and uh you know this will be recorded so
you should be able to refer back to this
if you feel going a little too fast
all right and you'll search security
engine and you'll see three results in
the aws marketplace
we're going to choose security on in2
here
all right and you can review the pricing
details if you wish
we charge it's 15 cents an hour but um
it's 30
30 days first 30 30 days are free please
make sure to delete your vms after this
so you're not charged unnecessarily
but again it is 30 days uh free for that
image and
again feel free if you want to spin up
your own ubuntu or centos image
you're more than welcome to do that
for my purposes i'm going to choose the
t2 2x large you should be able to
choose that one or you can choose the x
large if you wish both of them should
work
just uh just adding a little extra
horsepower there for this demo so
i'm going to go to configure instance
details and most of these defaults
should be good um since we only have one
public subnet here
but otherwise let's see we'll scroll
down to network interfaces
since we have everything else here in
place
and we're going to add a network
interface
and we'll just leave it like that
it's going to go with that you know just
like that
and then from there what we're going to
do is we're going to click add storage
and i believe with this image it does
require that you specify a throughput
value you can specify as little as like
two uh you know 200 megabytes or i'm
sorry yeah megabytes per second or i'm
just going to specify a thousand here
it's completely up to you
i will say that the installer prefers
that you use 200 gigs but uh you know
you can certainly get by using 100 gigs
with this
i'm just going to use 200 for the time
being but you should be fine just using
uh 100 if you choose to do so
i'm just going to click add tags oops
i guess i can't choose that many
okay
so we'll go there i'm not going to add
any tags here um
you know i'll just continue without
adding the tag there i'm going to
configure the security group
and then i'm going to select that
existing security group for that
instance
and select default because again i want
to be able to reset the ssh in
https so that's what we're going to do
here i'm going to review and launch that
instance
and it's going to pull up the summary
here and i'll have to click launch once
again
and now it's going to prompt me for a
key pair to use with this
now what you'll want to do is if you
don't already have an existing key pair
as you want to create one and then
download that
keep here
and then from there
uh you know you can we can perform that
ssh access that we'll get in to in just
a minute but
i'm going to choose an existing key pair
for mine
i've got this security demo cv right
here
and this is one that i created before
and i'm just going to use it again
um and this is what tells the instance
what keypair to use so please make sure
you use the appropriate one
that you're intending to ssh with um
so i'll choose that and i'll acknowledge
that if i don't use the right key pair
or if i don't have that i won't be able
to access the instance at least in a
traditional fashion
we'll click launch instances
all right so it's launching that
instance right now
okay we can view the launch log or we
can go look at the instance itself
okay
so it shows that it's running
right and we can scroll down to the
bottom of the pane and uh if we click on
the instance
and click on where is it
networking
let's see
view instances like the security an
instance going down the bottom
okay
where is the
interface
there we go all right
so the interface uh that we're going to
look at here the primary network
interface
what we're going to do here is we're
going to actually assign an elastic ip
to this
and so you can see here
if you click there if you go to actions
manage ip address for that interface
and then
we must allocate an elastic ip address
and associate it okay so we're going to
allocate an ip and actually have some
here already but um
so you can you can go there right
in the documentation there if you need
to refer to that and then click allocate
elastic ip address i'm going to use
amazon's pool of ip addresses right
allocate
and then i'm going to go back here
and
hit cancel
i'm going to click manage ip addresses
again
okay and allocate
whoops i guess i should have done that
already okay whoop my bad
okay
wait let me get back oops sorry wrong
one
keep going back and forth okay so we
need to actually get an actions and
associate elastic ip address i'm sorry
and we'll choose this instance
choose that and then associate that
let's see oh okay i think i have that
already associated with something
all right let me go back
and just close this
go to network interfaces
okay
so
you need to go to one that's not
allocated i've already had some of these
uh
available before so
just need to use one that's not
allocated
okay
there we go
all right so now my public ip address is
going to be 3.13.20.208
okay
and now so if we go down we should be
able to ssh to that box now
so if i go over here
i'm just going to paste that it's not
the right one
go back and copy that ip address
ah
okay we'll copy that
and now i've already copied that uh
security engine pen file so if i look
here you can see that and one thing that
you'll need to do is you'll need to do a
chmod 400 on that file uh more than
likely when you first start using it
because the permissions will be to open
so make sure you do that before you try
to use it but otherwise we'll do an ssh
dash i
and we'll specify the pen file and the
default user for that onion user will be
uh onion i'm sorry oops
here we go see if i can go back and get
that
come on now
oh my goodness
there we go just making sure it's my
copy paste buffer
being difficult
okay
now
i'll take that
off you know it could be so hard ssh all
right
so yes
and now what will happen it'll pop us
into setup here in our security in an
instance and we're going to go ahead and
run through this
so we'll say we would like to continue
yes we would like to continue
and we'll choose a standalone note
and all of this um it's fairly
straightforward so again uh you know if
you feel like i'm moving kind of fast
feel free
uh if you um
i feel like you can
i feel like it's moving a little too
fast it will be recorded again
okay it's gonna call this box security
onion aws and i'm gonna map a host file
entry after this
okay
we're gonna
assume all this other stuff like dns h
you know everything else is already set
up we'll just select yes here
and because we use dhcp in here we're
just gonna let amazon handle all of that
and we're going to specify e0 as our
management interface
and then setup's going to go through and
it's going to initialize some networking
components there
we're going to choose the direct option
here
hit enter
all right so it's just going to check a
couple of things real quick and it's
going to go back to the rest of setup
let's use our monitor interface this is
that sniffing interface here that we'll
be using
to sniff that network traffic
and we'll pretty much tab through most
of these
and
so some of these i'm going to disable
for the time uh just because we're not
going to be using these but these are
some other components that we run so i
mentioned some of these already but the
hive is another component that we run
with security
and um
and that is available for escalating
cases and doing that kind of thing uh
super powerful tool if you haven't
heard about it or checked it out already
but uh i'm gonna actually i'm just gonna
keep wazzu but i'll do the rest right
here
okay
and i'll select yes for the default
docker range
and you can specify anything here for
the username i'm just going to do user
test.local
and i'm going to enter in a password
and for this this web access portion
this is pretty important you'll want to
choose other here because this is how
it how the web application knows to
refer to itself and other components so
we'll need to be able to point it to a
dns name or something that we have
mapped a name like security in aws
because otherwise the external ip and
the internal ip there can be some
confusion there so we'll do security in
aws for now
and we'll specify a password for the so
remote user
and this is really only used if you uh
use a distributed deployment but it's
there in case you extend yourself your
deployment to one so that's available to
you
it's going to tab through a number of
these
and now we get to the esso allow
component and what esso allow does is it
opens up some ports on a local
host-based firewall for you to be able
to access components of security onion
and what we want to do here is because
i'm letting
amazon handle the firewall here
i'm actually not going to
go against best practices here and
for simplicity's sake and demo god's
sake i'm gonna do
quad zero here and hit okay
and then
it's gonna hit yes and then it's gonna
go through setup uh that's gonna take a
little bit so we're gonna continue on to
some other things as it goes through
setup
and uh you know we'll continue from
there and continue on with the workshop
as that's going in the background
so let me get back
over here into aws
and catch up on these notes here
okay
all right so once setup's running we're
going to go back to the instances tab
that we have here
all right we can see our one security
engine instance
and we're gonna add another instance uh
i think maybe just an amazon linux
instance
um and then we'll go with uh because now
um
t3 i believe
if we go to the
ws supported nitro
let's see if
intro instances
let's see natural system okay so again i
mentioned this here all the instances
based on the nitro system so we'll start
with the lowest of those a t3
and we'll go over here and launch our
instance with a t3 micro uh pretty much
the smallest that we need here
we'll configure those instance details
right and uh it'll be pretty
straightforward here we're just going to
set up some some basic things here
allow the auto assignment of a public ip
address and it's being able to auto
assign now because we only have one
interface here
so that's what we're going to do we're
going to click add storage
i'm going to click just make it you
don't really need to add storage here
i'm just gonna do 20
for fun
um i'm gonna click configure security
group and again all this is inside of
that documentation
and i'm gonna select an existing group
i'm sorry now i'm going to create a new
security group and what we're going to
call this
is security
onion
snipping group
right and this will be the the group
that the network interface
belongs to
um that's uh and we want to be able to
route all internal traffic to security
and be able to monitor all that traffic
so what we'll do is add an inbound rule
here
and we're going to specify it for all
traffic here
all right and then the custom source
here what we're going to use is that uh
ip range that we use for our
subnet so if i go back here and i go to
there's a subnet here
let me check the
go back to instances
check the internal ip
click on this
yes okay so i may have transposed it in
the documentation but it will be either
in your case 100.0 or 0.100 um okay so
uh in my case uh 10.0.100
right so i want to do that here it's not
zero that 100.
zero at 24.
right or what was it
yep
[Music]
okay and then what we'll do there is for
the outbound rules we'll also specify a
rule there but we're going to do is
and roll whoops
actually hold on
and make sure
oh you know what okay let me let me get
out of this i'm sorry i'm probably
confusing people um
i'm just gonna review and launch this
instance oops with the default security
ending group or the default security
group
and then we'll go back to the instances
dashboard here
so if we go back here
do it oh i didn't actually want to see
it since i'm sorry
okay i'm going to choose the same keep
here here
under choose an existing key pair i'm
going to choose the security and demo cv
the launch instances
okay and if we flip back over to our
instances we should then see that
running
okay so now what we're gonna do is under
the ec2 security groups
we're gonna create that security group
for security onion
smithing
group right
okay we're gonna add a rule for all
traffic here
then we're going to use
sorry that 10 dot
i'll just do the 10 dot
here just to be good
you would do the corresponding subnet
here
all right so all traffic here
i'm sorry that's not not 24.
yeah let's do that
it's all right cool all right
so we'll do that there and then we'll
just click uh create security group
right here so this is allowing all
traffic essentially to go across
uh you know these internal um internal
traffic you would
you would tighten this down a little bit
in your environment obviously
if you were to go do this in a
traditional case
but whoops need to specify the
description
security onion sniffing right here
create that security group
all right and now what we'll do is we're
going to
select the security in instance right
here
so we go back to instances
and we look at the security onion
instance here
we get a networking we'll see these two
network interfaces right here
and where is
trying to see where it says like east
one and
see if i can bring this up a little bit
it's a little easier to view uh
so right now we see the primary network
interface and then we see the secondary
interface we want to select that
secondary interface and then we'll
take that interface and we will change
the security group on that
so we'll change that to the security and
sniffing group
because that's what we want it to be
able to do we want to be able to get
traffic from the other
uh
the i'm sorry the other note
right the linux instance that we
launched there
okay so we'll close out of that
and we'll just do this right here
and we'll go back we'll view the
instances it's trying to consolidate
tabs here
all right so
now we've got both instances running um
we've associated the security union
sniffing interface to the sniffing group
and we need to do the same thing with
the interface for
uh for the other instance right so
click on that
let's see all right
and we'll click let's see all right so
we did the one for each one
oh i'm sorry let me go back to the the
mirror session okay so okay so so far
what we've done is we've created these
two instances
this
linux instance here i'm sorry there's a
linux instance here and this security
instance right here
and we have this two uh you know those
interfaces the one with the security in
an instance in that uh sniffing group
and then we also have uh from the the t3
micro in the regular group here so we
want to be able to access that from the
internet
all right and so all the security groups
and everything are good to go now we're
going to go configure the vpc mirroring
and let's check on that instance okay so
security engines still go on the install
there
and on the vpc uh dashboard under
traffic mirroring
what we're going to do is we're going to
go to create a traffic mirror filter
and actually have one created here
already but what we can go do is click
create traffic mirror filter
right and then we would specify in here
for all protocols so we would add an
inbound rule
and an outbound rule for all protocols
here
oh protocols
right
and then for the source and destination
cider
just like that and then you would create
that there
all right so because i already had that
here i can go and
oh that's not what i want
you gonna show me
i guess i can't do that all right well
so i've got that anyway in there so i'm
going to use that mirror filter
and then what we're going to do here is
we're going to create a mirror target
right and so for the mirror target
um we're going to create a traffic
mirror target here
and we're going to call it
security
let's see we call it mirror target
and you can add a description if you
want to you don't necessarily have to
i'm going to choose network interface
and then we're going to choose that
primary interface i'm sorry the
secondary interface of the security
engine instance and that's going to be
the only one here that is not a primary
network interface
so we'll select that there
all right and we'll click create
all right so security mirror target is
the one that we're going to use here
and in your case it would be sa demo
mirror target one that's uh i already
have created there but i just wanted to
go through the process here again
all right so we created that and now
what we're gonna do is create the mirror
session
and we'll click create traffic mirrors
session here
all right and i'm just gonna call it uh
you know you can call it essay demo
mirror session i'm going to call it
security in a mirror session
right and what we're going to do here is
we're going to do the mirror source is
going to be that
network interface of that
instance there that's uh linux instance
so if we go back
let's see if i can actually
go back to the instances here
go back and
look we see this t3 micro right here i'm
just going to label these to make these
little easier
clinics
and security
alright
so we can see if we click on this linux
instance here we can get the
the id for the network interface by
clicking networking and going down and
grabbing that right if we just want to
grab that and copy and paste that or
just make note of that one
now i'm just going to enter that here
just to make sure that i got the right
interface
and then we're going to point it to that
mirror target
okay so again that mirror source is
going to be that linux instances primary
uh
network card and the mirror target is
going to be that uh security and
sniffing interface
and we have to specify something here
for the session number you can just put
one for priority
um and then everything else you can
really just leave blank unless you wish
to uh to populate that
oops i'm sorry now you have to specify
the filter yeah so you actually have to
specify the mirror filter that's going
to be applied
to this session here
and create
all right so now we've got that mirror
session created we have the mirror
target that mirrored filter the mirror
source all inside of that mirror session
okay
and so what we'll do here
is just go through my notes here
all right
we created that now let's flip back over
to security engine it's verifying setup
right now
but while it's doing that
what we can do is open a new tab
and i'm just going to go to my host
where i am sshing uh to all these boxes
and i'm gonna log on there real quick
okay
all right so
here i am i'm just gonna do this i'm
going to prep my command to log into the
linux box and again we're going to
specify our key file our pin file here
and this will be a little bit different
if you're using windows or um or
something else you may not be able to
use a pinball directly you may have to
convert it with putty
and
if you did look at those prerequisites
the instructions were there to
to do that as well
okay so i'm going to grab the public ip
address and go back to the
instances and the ec2 dashboard
i'm going to grab the ip for the linux
instance
and did i not choose i guess i did not
choose auto assign
because
i am down okay so i'm going to allocate
an ip address for this
so let me go
and do that but if you had chosen
according to the directions follow the
directions like you should like i did
not
then you should not need to do this but
um i'll go to the network interface for
this instance
and okay a ip
d d
68
all right are we in business or what
okay
now i will take this
and we'll move on so over here again at
the terminal
uh the amazon linux
the default user is ec2 user for uh for
linux
i'm sorry for amazon linux and uh we'll
paste in that ip address or host there
and just select yes
we logged in and uh we're in our amazon
linux now an instance now
um
and let's flip back
just prepping that up okay so our
standalone install finished uh hopefully
yours finished hey
yeah
uh would you be able to uh increase the
font size on the terminal oh yeah yeah
sorry i did that on the other one i just
forgot to do that on this one yeah
absolutely perfect um
let me do that
sorry i know it's probably tiny
um
there we go
is that better
yep thanks
cool
all right so
finish that
i'm gonna let that reboot for a minute
okay but we're gonna go back over here
and so
this this tool that i mentioned before
uh let's see tm needs so
we go over here
to the github repo it's github.com and
the link again is in the
slides and i guess you don't have the
slides but if you go to github.com and
slash zero xtf slash testmynids.org
uh you can get that there and i will
paste that actually into
uh into here
make it easier um
okay
so that's there and what we'll do here
is copy this command and i'll actually
paste this in here as well
well that didn't oil me
there all right so you can copy and
paste that into the
terminal all right and so we got tm nids
right so um
we've got that ready to roll i'm not
going to fire it off just yet i want to
wait for that security in an instance to
come up but um you know once that's up
and running we can fire that off and
then test and make sure that z consumer
kata and everything else are are looking
good for security ending
let's see
ssh back in oh yeah so you may get this
too because it changes the host key
uh so you might just have to run the uh
ssh keygen dash f
to remove that from the known host file
so it's not associated with that anymore
and then just go back and ssh into it
after doing that
so ssh into there
and just run an essay status
and because it's going to take a minute
here for everything to start up uh so
i'll give that a minute there
but um i will i guess i'll pause for
just a moment
and see if there are any questions c629
not any questions as of 10 minutes ago
approximately
but i will give the chance now
okay just for a minute or two as we wait
and i'll get a sip of water
all right
and again um so this is all orchestrated
by salt and what it's doing it's
applying different states and starting
these services right now
and uh we'll see that status change so
they come up
again you can see some of them changing
already hitting okay
and once we have uh let's see nginx and
sock up we'll try to hit that web
interface um so i guess in the time
being while we wait uh if you don't have
dns resolution or anything like that
you will want to add the ip address of
the
quizzes again
uh the ip address of the security and
inbox
um
let me exit out of here to that host
file as security i mean aws and i'll
give an example here
okay
so
i'm just editing my localhost file
and i've got quite a few in here as you
can see because i'm crazy and
unorganized
so
put that there in our host file so that
we can resolve that
and uh so everything will be kosher
whenever we go to try to access the web
interface
and we've already run so allow or so
dash allow remember to allow that web
access from the host base firewall
perspective
and we should be allowed from the amazon
firewall perspective based on the you
know ip address that you've given and
the range that i've given
so let me ssh back in
see where those services are again it
can take a few minutes uh looks like
sock is up
so what we'll do here is actually pivot
back over to the web
and
three onion
all right that looks good it's returning
so it means the firewall firebrick's
working
and we'll click advanced and uh you may
need to do some mumbo jumbo here with
your browser depending
uh i'll just log in with those creds
that i specify during setup
in my case that was user at test.local
and if you've specified the same you can
use those credentials here
and now we're logged in to the security
engine interface uh this is called sock
and it's the main interface of security
and in security
or uh you know really the next
generation of security
and you can see here we've got a lot of
different things here on the side we've
got things like alerts a place where we
can hunt a place where we can pull pcapp
uh we see an alert on grid
uh this is uh probably this is a known
uh
none little bugger at the moment but uh
so we can just ignore that for now but
um
this downloads right here is where we
can download
uh any clients things like that um but
for the time being i'm just going to uh
you know just kind of go back to this
overview and then we're going to pivot
back over
uh and and try to generate some traffic
with tm heads and see if that's
witnessed by security in it
so let's make sure that everything is up
we're getting scragglers no scragglers
all right everything looks good we're
all green
ready for a go
so we're going to run test eleven we're
gonna cause some chaos and i mean not
really any causing the chaos but
uh this is what it's called and what it
does is essentially runs all of these
tests that you see here right so one
through 10. we'll do that
and actually before we do that from a
network perspective let's see this um
so let's perform a tcp dump
on the interface so in our case it
should be east one for the sniffing
interface
and we want to specify the ip address
the local ip address
our internal ip so for the ipa here
it's going to grab the ip address of
this instance right here
it's linux instance
and
paste that in here
we're going to type oh so you can speed
down this all right
what am i doing oh host johnny okay yeah
you need host i'm being silly um so you
need to host there
and then if we go back here run the tmid
command
back see if we see anything
it's going to give you a little bit
there and it may not necessarily
be that we're looking for it may have
been the external ip but let's see if we
go into smd and if we configured
the traffic mirroring correctly
and
i don't think i have let's see
let me go back
all right so now if you've configured it
correctly you should be seeing that
traffic but uh what we're gonna do here
is double check our mirror config
okay
so if we go back here we're gonna look
at this uh interface here
the where is it
all right and let's go to the linux
interface and make sure
that it's part of that security group
i'm going to go to the instances
networking
network interfaces
okay and we're going to change security
groups
okay so it looks like
maybe we did not add
this see the correct security group
after all
so let me do that
didn't i just change it hold on
oh i need to remove it okay
that's cute
i can't read
okay
so now if we go back
and this is uh you will run into this
more than likely that you did not add it
to the correct security group and things
of that nature so
um to confirm we will look at those
interfaces again
and i'm actually going to look here
because a little bit easier
and yes we confirm that that's in there
okay
so now
we go back here
and we'll do a little stuff there there
we go
sweat from the brow good
all right so we now see some traffic all
right it's coming across it's being it's
hitting that security and an interface
uh that sniffing interface um being
mirrored from that other amazon linux
instance
and you know when you start doing this
at scale um you can see how something
like auto mirror would be very helpful
so you're not going in here and manually
adding stuff and then making mistakes
potentially and that kind of thing so um
i would definitely take a look at auto
mirror if you're using aws so make sure
you check that out
and you will also see some cool stuff at
the near the end of the presentation
that you can leverage with that
okay
so now let me get out of here
all right look at that all right we've
got some more logs okay much better
we've got connection records we've got
files going across dns http
lots and lots of good stuff here
and if we go over it may take a minute
or two before we're able to view it in
security
but now if we go to alerts we can
actually see alerts uh you know
generated from that network traffic in
mcleod from that vxlan encapsulated
traffic we're able to appear through
that tunnel and see that traffic you
know see what's going on
so it's really super powerful to be able
to do that
if we want to drill down we can drill
down into a single event
and look at some other details i'm not
going to go into that a whole lot
but you know just really trying to give
you an idea of how you might be able to
to leverage this right so if i go from
this alert and i pivot on the community
id which is basically a hash of you know
the network
source destination ip
uh port uh you know source port
destination port and protocol
uh then
if i actually hunt for this value
you can do this in security and it's
going to give me all of the records that
were associated with this so i can see
there was a circle alert that we just
saw
i can see there was some z traffic a
connection record and then also some z
http traffic and you know if i wanted to
pivot the p cap uh maybe i'll look at
the con record
and see
you know i can review those various
details
then if i want to go look at the pcap
i can go pull that right there and this
is in the cloud right that's amazing
we're we're looking at this traffic
we're performing that vxlan
encapsulation and behind the scenes
we're having to do uh kind of some crazy
stuff uh tying back zeke uh parent and
child connection relationships and the
tunnels and everything but it's awesome
that you're able to see
the full transcript you know in the
cloud with this kind of traffic in aws
so it really shows you
um you know the power that you can have
in your investigations and how you can
leverage these tools
right
so um again that's that's just one of
the ways that you can monitor that
traffic and perform that traffic
mirroring with that linux host
okay so uh if we go back let's see let
me move back to the slides here
and i'll break for just a minute we're
going to go over to cloud logs here i'm
going to play that from the start oh no
wrong one
allow logs
all right play from current slide
all right and grab a sip of water
and actually let me get back and check
um
there any questions no questions okay
uh why don't i keep doing that
misery is my companion
okay cloud logs
okay
so let's talk about cloud logs and one
of those being azure data
um i mentioned azure briefly and you
know kind of the difficulty without a
kind of a licensed um partnered solution
in azure for that network uh you know
recording and
um network metadata and things like that
but there are lots and lots of logs in
azure that you can tie in and that you
can bring into things like event hubs
and then pull in via security engine
that's pulled in using those file b
modules
now there's activity logs in azure
tracking the activity of
um action by management personnel uh
along the control plane
we can bring that in right that's a
another layer to our context uh
diagnostic or auditing logs for the
platform um if there's some reason you
know i've used security in the past many
times for not just threat hunting or
intrusion detection but actually you
know helping to resolve issues in the
network or with applications and that
can help do that as well
or clue you in onto into something uh
that an attacker might be doing and
cause those kind of issues
um so we can bring those in as well as
sign in logs so if they're
authenticating signing in
and then also azure id audit logs uh
things from the ad perspective that we
can bring in we can bring all of that in
uh using that file beat module in
security
and i'm not going to go through this a
whole lot but here's really a summary
and some links if you want to go off and
do that on your own
you can absolutely do that um but again
it would be using that azure file beat
module once you have everything set up
you can pull all of that data in have
that alongside your on-prem data or your
other cloud data if you have azure and
you know
gcp and aws you can have them all in
there in the same single pane of glass
so it's really they also be able to do
that
and same thing with gcp data
audit logs right those can be published
to uh pub sub topic uh same thing with
vpc flow logs right looking at not
necessarily packet capture but
uh you know just some flow data some
kind of back and forth connections z
connection style records that you can
look at from the authoritative source
right from the vpc
itself and
you can pull that in using the fopi
modules
and here's some here's some
configuration here i'm not going to go
over that a little bit but if you want
to review the slides later which i'll
have posted
you can absolutely do that and set that
up with 5v modules as well
similarly with aws in addition to all of
the great traffic mirroring you can pull
in stuff like cloudtrail logs cloudwatch
ec2
vpc flow
all of it into s3 and sqs pull that in
using those 5v modules that are tied in
with security and the elastic sac
let's check in time
okay
[Music]
and so
here's some example cloudtrail
configuration um
let's see what was
sorry uh so yeah you can configure
cloudtrail to send obviously to s3 and
then
um you know from there s3 would notify
sqs and then you can kind of use sqs as
a pointer to get that data from um from
s3 right and then we can sift through
all of that data and hunt and uh maybe
if we want to alert on certain data from
there we can absolutely do that
and we have some documentation there
down at the bottom for you to walk
through if you want to walk through that
as well
all right so now i've got another lab
here
what we're going to do is we're going to
stay in aws
we're going to configure
the cloudtrail logs and see if we can
pull those in the security engine and
get some additional context uh so again
this is just another way to besides the
traffic mirroring if you're not able to
see the traffic
or you simply want more telemetry right
you want more contextual data
we can pull in those cloudshare logs and
uh and go from there we can see stuff
you know if there have been keys deleted
or users added
management functions things like that we
can see that through cloudtrail
all right and so we'll pivot over to
there
and what we'll do is
i'm going to paste this let me double
check the requirements doc here
okay so get to the cloud log ingestion
now
that will be
let me make sure that's the one i have
yeah okay so on that cloud log ingestion
doc um what we're doing is let me make
another millions tab
we're going to create an im user and
that user is going to be used instead of
a root user to delegate access
to those cloudtrail logs in sqs
okay
so we're going to create that user we're
going to go over here to
iam
and search iam over here
all right and you can see we have users
here
all right and so what i'm going to do
here is i'm just going to i've got a
couple users here i'm going to say cloud
trail well actually let me just click
add users first i'm done all right there
we go all right so add users
cloud trail
demo user right you can specify your
name whatever whatever you wish to add
there i'm going to click enable
programming
programmatic access right this will
allow us to programmatically access uh
stuff instead of having to log into the
console
i'm going to specify permissions here
i'm going to search for that aws lambda
execution role
oh okay i'm sorry create group and then
search for it
i'm going to add that keep that selected
for this group
and then i'm going to
add
amazon s3 read only access and again
uh these are in that dock so be sure you
refer to those oops uh available
okay so
cloud
trail
users is going to be the name of my
group
create group
all right
okay so we can see that group is now
created we can choose if he wants uh and
selected for the user that we're
creating
let's click that in tags if we want i
don't really care
um let's click create user for the
cloudtrail demo user
then it's going to give me an access key
and a secret access key and
i'm going to ask obviously that
you guys this will only be used for this
demo presentation but um
you know be sure to uh use your access
key into your access key only
and uh
and we should be good from there
right
so
we're gonna keep those i'm gonna save
this offer i'm just gonna keep this page
pinned right here
so i'll come back to that in just a
moment
all right and then what we're going to
do we're going to follow along
with this document right here
so we haven't walked through here
on aws cloud
cloud trail logs and uh cai and shang
and elastic had a really great uh
document that kind of tied in with this
that you can review right there
um but
since we have our iam user and
everything set up
we're gonna go create our queue
all right
so we're gonna go to amazon sqsqs and
create a queue
so let's just search for sqs
and we're going to create q
and now we'll have a prompt we're going
to keep the standard queue
and we're going to name it uh ccd demo
cube
put our name on
and then i'm going to change this policy
here because there are some things that
need to happen for s3 to be able to
publish to this queue
okay and that's where i'll go over here
if i go to
filebeat page
and i copy
this right here so i'm going to copy
this and i'm going to edit it here in
just a moment so copy
and just paste that in there and what i
want to do i'm going to take my account
id and i'm going to put it in there
and my region is going to be us east 2
so you would enter yours accordingly
enter my account id here
and the queue name here which is going
to be cbgmoq
let me just grab that count id
yep
okay again these are all for demo
purposes
okay so that's kind of how i'm going to
choose to do that so basically anything
from the account right now at this
moment can send to this queue uh you may
choose to change this in your
organization um you know back down the
hatches a bit make it a little more um
you know
tight-knit uh so
i'm gonna save that and click create
queue
and then go back here all right so after
it's created you'll be redirected to the
summary screen
and we'll want to save the url value
here we'll use that for our filebeat
configuration on security
but first we're going to create a trail
so make sure you save that right here
this url
all right i'm just going to keep the
page up and pinned
okay
so if we go back we are going to create
that trail using the aws cloud trail
console
so we'll go
search for cloud trip
whoops what am i doing i'm not even in
the console i'm being silly
all right
we'll go to
you can search for this up above
um
let me go ahead and copy this off
actually this url
copy that over here to the side just for
fun dudes
and
we'll search for cloudtrail here
all right now let's create a trail
right and we can name it whatever we
want you know for my purposes i'm just
going to say tv demo trail
it's going to create an associated
bucket and folder with that and you can
see what the name is going to be here
so just click create trail
and then
so if we go here and click that
we can edit the trail if we want so i'll
just click edit to see the details
and
we can see that
you know
stuff right here we're using this s3
bucket
right
just some general details
and management events
we click on this
we'll see that uh we are auditing uh
read and write api activity events and
management events so we'll just save
that so we should be good to go from
that perspective
right
and then if we go back
just depending on you know how we
created it it may ask us uh certain
things right so we just created that one
and we're not using a key with that one
but
uh we'll just take the defaults there
and so we see the status now if we go
back
not here
but to here
we should see the status as logging
which we do
okay
all right and now what we'll need to do
is we'll need to ensure bucket is
configured correctly right so we're
going to go to s3 now
okay
and we're going to select the bucket
right and we're actually uh
what we'll do here is we'll just click
on the bucket
and then we'll select properties
and we'll drill down
we want to know
if the bucket is accessed and
we'll do here is just choose our bucket
we'll publish to our own bucket
that's accessed you could alternatively
publish to a different bucket for uh you
know server access and that kind of
thing
all right and then uh what we'll do here
is
we'll add an event notification
let's say cv event
notification here
okay
and we can add additional details if we
want but you don't necessarily have to
and we'll select all object create
events here
okay so anytime basically
something is added to that s3 bucket
will be notified
okay
and now this is important we're going to
choose our destination here and our
destination is going to be an sqs queue
the one that we set up so we'll we don't
have to enter the arn we can actually
choose
choose cv demo queue here
we'll save changes and assuming the
permissions were correct and everything
and it can actually
send to the queue it will actually fail
at run time here um if it's if it cannot
um
at least i believe it will so
um
we'll go from there as far as um you
know
hopefully for now it should be working
well
or working as intended
right so
now what we'll do since we've configured
that is we'll configure the security
image configuration
right so we'll take that access key and
then access key id
and some other details like the queue
the queue name
and we'll go over here
to security engine
and
backup
you can opt so salt stack
oh you actually might need to
elevate so
so salt stack
and inside the local directory there
there is a pillar directory and this is
where
we house and salt configuration and
where you would uh configure certain
things in security in it
so i'm just going to
go into the minions directory this is
where uh configuration for a specific
node security in a node would live so
even the manager if you have a manager
node would have this configuration
and then i'm going to go down all the
way to the bottom
i'm going to paste in
some configuration here
and so
i'm just going to copy this right here
i'm going to paste that in there
and it's wrapping a little bit just
because of the fonts but rest assured
what we'll do here is
we'll
specify our account id and demo queue
here
and then our access key id and then our
access key here
okay so i'm just going to paste this in
first since i have those available
at least i have the url available i'm
sorry
i'll have to go back and get those
that url that you copied before you
would simply paste that into here
and then i will go and grab
the key and candy
okay
copy
i'll paste that key id here
all right
and i will
cappy
all right
save that all right so let's double
check let's go back to this dock here
okay so we added this uh we modified
that configuration
now we need to restart file b uh on the
node so
let's do that
so file be restart and depending on if
other commands are being run sometimes
it may take a few minutes to
to run this and for this to complete
so uh that went pretty well so far so uh
you know we're we're good there
um
now what we'll do here
is we'll just do an esso status which
everything looks good
okay everything's still running good
i'm actually gonna check from the data
perspective
um
and so
this is one command that you can run to
check and see what indexes are
actually in
um you know for inelastic search from
the command line
pasted that there into the
dock
all right so i see a whole bunch of
stuff it's kind of hard to read though
so
i can sort or i'm going to grab
this okay
cool so i see an aws
index was created
okay i don't see any documents just yet
but uh i do see that uh you know it was
started to pull that data in and it may
take a few minutes before we start
seeing anything we may have to perform
some activity
but actually see some there now so
let me actually back off
this font a little bit so be a little
bit easier to see
so this is actually the doc count here
the document counts
that you would have in that index so
that shows us that there are some
documents in that elastic search index
so then if we go over here
to something like hunt
research event dot module
aws
we should see some data okay cool
and then we can
also group similarly kind of like splunk
uh we can group by the event action
there
and then we can see all of these actions
that are occurring
right and we can slice and dice that all
day right so if we wanted to add
additional fields to that
we can go up and put that in the uh in
the group i
up there in the search bar
or
uh if i want to go through and let's see
you know filter on something else i can
you know i can filter on the key
whatever
i can include that well that's actually
a filter i'm sorry that's not a group by
um so that would actually be an
inclusive filter
but if i wanted to group by something
else like the key
um you know the cipher suite is a pretty
bad example but you would just add that
to the group eye
right and then you can see that
alongside it right there
and then you can also pair this
right with that other traffic right so
if you wanted to see
a certain activity you can
cross-correlate that with the other
traffic
so again it's really super powerful to
be able to do that and
you know be able to essentially
aggregate all of that traffic and all of
those logs
within security engine
okay
so i know that was a quick lab i'll stop
there for a minute maybe to to let uh
folks catch up if they're still working
on that um if they're following along
or if there are any questions let me go
ahead and check the stream yard here
okay
all right no questions
let me get so it's a little scratchy
here
all right
now
let's see if i can do it this time play
from current slide look at that
learn something new
all right so let's talk about some
additional tools
um
i'm just going to touch on these briefly
i mentioned uh you know the
auto auto mirror
right uh three quarter sec auto mirror
um definitely check that out um in
addition to
um you know tm nids
but other additional tools you might
check out
uh vxlan to pcap
is a tool that i actually wrote a little
while back
when we didn't have the ability to pull
pcap like we do now
with security engine but
in some cases
you know there's still going to be many
environments where
you're not able to you know maybe tools
don't know vxlan
or um
or you know you have to be able to kind
of unwrap that tunnel um and this allows
you to do that basically you run the
command just like this
and then it will output
a pcap that has been stripped of that
the excellent encapsulation
so if you're on a case or uh you're
pulling pcapp from a box in the cloud
and it's aws or another partner solution
that does the excellent encapsulation
that can absolutely help you in that
case
and it's pretty pretty nifty tool to
have
also uh not necessarily a tool but maybe
i would say it's a tool just maybe not
software um it's
the cloud matrix for miter attack right
is a great way to kind of map your
coverage across the cloud platforms
you can create detections i mentioned
playbook so
i know thiago and three corsec have some
cloud trail rules out there
that they use i think these are a little
bit different maybe with like the
elastic detections but you can still use
that relevant sigma rule and uh and map
those um across you know
or map your detection coverage using
that right so
again another useful tool to have
so i'm not going to cover this in the
workshop but feel free if you want to
explore on your own
some automated deployment or testing of
security ending
uh one of the ways that we can do that
is going to be using terraform
and so we have a repo here just at this
link
and again these slides will be sent out
but i'll i will put that oh
[ __ ]
so i can actually copy that right here
i'll put that
in
here as well
the appendix for you if you want to
check that out that's a huge font these
louise
all right
so i'll flip back here
okay and so if you want to test that out
what it does is it spins up
an optional ubuntu node and a security
in a node and it automatically
configures auto mirror so that uh those
instances come up already ready to be
mirrored or already mirroring traffic
and then you're ready to do your testing
or or whatever right do your lab
so it's pretty cool to have that that
capability uh and do that really quickly
and easily
this way all right and the same thing
you can do the exact same thing with gcp
um right now although
i will say the
the terraform config does by default uh
use the
um the ami so
you know after after that trial period
if you don't want to continue using that
i would make sure that anything you spin
up
you change the uh
the ami used and that's you can do that
within the terraform config described in
the repo
and then so with gcp you can do the same
thing again
now we don't necessarily have a
an official google image or azure image
at the moment but um you know there are
lots of cloud things that we're working
on uh very diligently so um you know i
would keep an ear out for that good news
at some point
um but be sure you know if you're a gcp
shop if you're aws try and spin it up
and and check it out if you can
and that is pretty much it unless there
are questions that that we can uh you
know direct towards more
uh lab time or activity that's that's
pretty much all i had i know um it was
kind of fast-paced i just wanted to make
sure that's um you know we're good on
time here and i wanted to make sure that
um you know you guys have the resources
uh to go back and review this later so
again you should have everything you
need um you know if you want to replay
the video or go back to the slides all
of the resources should be there for you
to be able to do all of this
on your own and be successful doing that
and
obviously if you still need help feel
free to reach out to the real w lambert
on on twitter or
if you think security engine is cool
make sure to hit up security engine or
doug burks on twitter um you know if you
want to download it or uh you know want
to see the documentation
all that's there as well as well as the
link to the ami and cloud resources
again i just want to say thank you for
allowing me to present here today and
and perform this brief workshop with you
guys and kind of get you exposed to
security and in the cloud and how you
might leverage it
um again if you guys have any questions
i'll be glad to answer those now or
later if you prefer so thank you guys
again