Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Situational Awareness with Open Source Tools

paulh
June 13, 2010

Situational Awareness with Open Source Tools

CANHEIT, Memorial University. 2010.

paulh

June 13, 2010
Tweet

More Decks by paulh

Other Decks in Technology

Transcript

  1. • 20+ Sites (13 Campuses) • 5500 IP Devices •

    25,000 Full-time/Part-time & Online Students • 1,800 Employees About The Nova Scotia Community College
  2. Warm Warm Warm Cold Cold Cold Session Data and PCAP

    Metadata Event and alert Data Awareness About This presentation
  3. • Easy to collect and process(SIAFI) • Clearly defned and

    concise • Results should be consistent and verifable • Cheap (resource wise) • Preferably not proprietary Rules for data sources The rules I try to follow anyway
  4. Links to sections within this tab Section Content (a graph

    or stub or both) Section note Section Title … FLOW IDS NESS US URL ZABB IX 1 2 3 4 5 SH
  5. Control #1 Control #2 Control #3 Section content A graph

    created with RRDTool that shows Internet Trafc FLOW
  6. A Section in action Suspicious activity 10.11.12.13 - - [29/May/2010:00:24:58

    -0300] "GET /MaV2XmZP8T6Y2Us29ae3c2a404357831ccd07fc6a0aec04d18g HTTP/1.1" 404 122 "http://daybreak.com/key/? qs=52db268891d044c4fa128d4e06b660870c2fe9c4ca138597ad60562136102f407d68b576f42d29c7e 60320ff28a9667d&t=daypro+testimonials" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; InfoPath.1)" 10.11.12.13 - - [29/May/2010:00:42:19 -0300] "GET/? xurl=http://cdn.mfdclk001.org/6vQ11Ovp8f7J1NO2fca2fef53de5ef21823110c774f7972617c&xref=http:/ /www.dogfleatreatment.com/default.pk? tsearch=auto+credit+loan+poor&search_button.x=48&search_button.y=12 HTTP/1.1" 200 1870 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; InfoPath.1)" 10.11.12.13 - - [29/May/2010:00:42:26 -0300] "GET/? xurl=http://cdn.mfdclk001.org/VKw2IN5L7g4JXpS8460217bb4f66f154be9a6e568412b24f38h&xref=htt p://bagging.org/key/? qs=52db268891d044c4fa128d4e06b660870c2fe9c4ca138597ad60562136102f407d68b576f42d29c7e 60320ff28a9667d&t=auto+credit+loan+poor HTTP/1.1" 200 1870 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR
  7. • Be consistent and conscious of fow • Be clear.

    Use helpers • Be mindful of loading time • Don’t “dead end” the user • Think ahead Rules for data presentation Ok, maybe just suggestions
  8. Tab C O M P L I A N C

    E : Contains compliance related information
  9. Nessus HTML output • BIG! 300K to 1.5M in size;

    redundant • Difcult to navigate • Single option for host representation
  10. Modifed HTML output • Small! Under 10K • Just report

    relevant info • Sort option on column headings • Hostname and IP
  11. Tab D E V I C E S : Contains

    maps created by Zabbix
  12. Tab E M A I L : Contains SPAM summary

    data and Exchange environment information
  13. Tab N E T W O R K : Contains

    high level network information
  14. SH

  15. Tab S I T E S : Acts as a

    loader for sensor content
  16. SH

  17. SH

  18. SH

  19. SH

  20. SH

  21. Tab S T U D E N T V L

    A N : An example (last one, promise) of grouped content
  22. IDS

  23. • URELLS • Visuals with more depth • New types

    of visuals: - Wordmaps (tag clouds) - Circos • Hints in link area The Future? Where are we going