Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... ·...

21
Security Onion Network Security Monitoring in Minutes Doug Burks

Transcript of Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... ·...

Page 1: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Security  Onion  Network  Security  Monitoring  in  Minutes  

 Doug  Burks  

Page 2: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Feel  the  pain  Does  your  tradi;onal  IDS  give  you  all  the  data  you  need?  

Page 3: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

The  Beauty  of  Network  Security  Monitoring  l  Mul;ple  data  types  (not  just  IDS  alerts)  

l  Sguil  is  the  de  facto  reference  implementa;on  of  NSM:  l  Alert  data  (NIDS  alerts  from  Snort/Suricata  and  HIDS  alerts  from  OSSEC)  l  Session  data  (SANCP)  l  Transac;on  data  (HTTP  logs  from  Bro)  l  Full  content  data  (daemonlogger)  

Page 4: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Lots  of  pieces  in  the  jigsaw  puzzle  

hNp://nsmwiki.org/images/e/ea/Sguil-­‐0.7.dfd.png  

Page 5: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Setup  wizard  puts  the  jigsaw  puzzle  together  for  you!  Takes  only  2  minutes!  

Page 6: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Snorby  Web  interface  •  Web  2.0  •  AJAX  •  Ruby  on  Rails  •  Buzzword  compliant!  

Page 7: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Squert  web  interface  

Page 8: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

The  Ul;mate  Analyst  Worksta;on  l Security  Onion  in  a  VM  on  your  Desktop  

l Sguil  client  connects  to  Sguil  server  

l Pull  pcaps  back  to  your  VM  for  extended  analysis  

Page 9: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Sguil  client  designed    by  analysts  for  analysts  

Page 10: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Right-­‐click  Src/Dst  IP  and  Query  SANCP  table  (Session  Data)  

Page 11: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Right-­‐click  Src/Dst  IP  and  query  Event  table  to  access  HTTP  logs  (Transac;on  Data)  

Page 12: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Right-­‐click  Alert  ID  to  pivot  to  Full  Content  (transcript  in  Sguil  or  pcap  in  Wireshark)  

Page 13: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

PCAP  Tools  We  haz  them  

Page 14: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

NetworkMiner  There’s  gold  in  them  thar  PCAPs!  

Page 15: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Mul;ple  Sguil  sensors  

hNp://securityonion.blogspot.com/2011/04/security-­‐onion-­‐20110321-­‐distributed.html  

Page 16: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Bro  IDS  Bro  records  a  tremendous  amount  of  ac;onable  intelligence  about  your  network  traffic.    The  logs  can  be  found  in:  /nsm/bro/logs  

Page 17: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Hunt  for  Evil  User  Agents  zcat  /nsm/bro/logs/*/hNp*  |bro-­‐cut  -­‐d  user_agent  |sort  |uniq  -­‐c  |sort  -­‐nr  

Look  for  malicious  user  agents  like:  Bob’s  Evil  Clown  C&C  Agent    or  just  outdated  and  vulnerable  sohware  like:  zcat  /nsm/bro/logs/*/soh*  |bro-­‐cut  -­‐d  name  version.major  |grep  Firefox  |grep  -­‐v  12  |sort  |uniq  -­‐c  |sort  –nr  

110  Firefox  3      71  Firefox  11      53  Firefox  10  

hNp://pauldotcom.com/2011/10/in-­‐search-­‐of-­‐evil-­‐user-­‐agents.html  

 

 

Page 18: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Argus  

Page 19: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

NIDS  is  great,  but  what  about  HIDS?  l  OSSEC  monitors  local  logs  and  can  receive  logs  from  OSSEC  Agents  and  standard  Syslog  

l  OSSEC  alerts  are  stored  in  /var/ossec/logs/alerts/  

l  Sguil  OSSEC  Agent  transmits  those  alerts  to  the  Sguil  server  

Page 20: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

One-­‐man  bands  make  crappy  music  Interested  in  joining  an  open  source  project?  

Security  Onion  needs:  

l  Documenta;on  

l  Artwork  

l  Web  interface  

l  Performance  benchmarks  

l  Package  maintainers  

hNp://code.google.com/p/security-­‐onion/wiki/TeamMembers  

 

Page 21: Security)Onion) - George Mason Universityastavrou/courses/ISA_674_F12/Security Onion... · Feel)the)pain) Does)your)tradi;onal)IDS)give)you)all)the)datayou)need?)

Where  do  we  go  now?  hNp://securityonion.blogspot.com    

Updates  are  announced  here  and  it  also  has  the  following  links:    

l  Download/Install  l  FAQ  l  Mailing  List  

l  IRC  #securityonion  on  irc.freenode.net  


Onion & Garlic - Home - OLAM SVIolamsvi.com/downloads/market-report-onion-garlic-feb-2016.pdf · marketreport FEBRUARY 2016 Onion & Garlic Dehydrated Onion Market Summary 2016 US

Onion & Garlic - Home - OLAM SVIolamsvi.com/downloads/market-report-onion-garlic-feb-2016.pdf · marketreport FEBRUARY 2016 Onion & Garlic Dehydrated Onion Market Summary 2016 US

Onions Powder Making, - WordPress.com...How to Make Onion Powder, Onions Powder Making, Onion Processing Introduction The onion, also known as the bulb onion or common onion, is used

Onions Powder Making, - WordPress.com...How to Make Onion Powder, Onions Powder Making, Onion Processing Introduction The onion, also known as the bulb onion or common onion, is used

ONION...• Onion seeds, onion sets (young onions), green onions, or onion scrap with roots • Good quality potting soil made for growing vegetables Instructions 1. Select your starter

ONION...• Onion seeds, onion sets (young onions), green onions, or onion scrap with roots • Good quality potting soil made for growing vegetables Instructions 1. Select your starter

Onion Agmark

Onion Agmark

Onion Routing.ppt

Onion Routing.ppt

onion cells

onion cells

Operating Systemsʼ Security - George Mason Universityastavrou/courses/ISA_673_S13/Introduction.pdf · Operating Systemsʼ Security ... Provide hands-on experience with fundamentals

Operating Systemsʼ Security - George Mason Universityastavrou/courses/ISA_673_S13/Introduction.pdf · Operating Systemsʼ Security ... Provide hands-on experience with fundamentals

Onion NRCOG_15.2.2014

Onion NRCOG_15.2.2014

Onion Routingppt226

Onion Routingppt226

Onion experiment

Onion experiment

onion dehydration

onion dehydration

Pakistan onion: the informal regulation of the onion ...

Pakistan onion: the informal regulation of the onion ...

TYPO - Onion

TYPO - Onion

ONION - OIL

ONION - OIL

Pre-breeding research in onion: screening an onion ...

Pre-breeding research in onion: screening an onion ...

7 Examples Of Structured DataYou Can Implement Today By Samuel Edwards

7 Examples Of Structured DataYou Can Implement Today By Samuel Edwards

Wireless Security - George Mason Universityastavrou/courses/isa_656_F08/...Wireless Security Wireless Security Confidentiality Integrity Wireless Architecture Access Points Which

Wireless Security - George Mason Universityastavrou/courses/isa_656_F08/...Wireless Security Wireless Security Confidentiality Integrity Wireless Architecture Access Points Which

Network Security - ISA 656 - George Mason Universityastavrou/courses/isa_656_F08/ISA_656_L1-Intro.pdf · The Security Lab Network Security Network (in)Security Course Outline Angelos

Network Security - ISA 656 - George Mason Universityastavrou/courses/isa_656_F08/ISA_656_L1-Intro.pdf · The Security Lab Network Security Network (in)Security Course Outline Angelos

Dehydrated Onion

Dehydrated Onion

BLOOMIN’ ONION

BLOOMIN’ ONION