Re: EDR
Gil ANDRE via slackware <[email protected]> Mon, 31 Oct 2022 17:31:47 +0100
| Newsgroups | gmane.linux.slackware |
|---|---|
| Message-ID | <[email protected]> |
--===============3389948419159337661== Content-Type: multipart/alternative; boundary=----POTUNSDOGGWQEASPV746XCKTXMEDK8 Content-Transfer-Encoding: 7bit ------POTUNSDOGGWQEASPV746XCKTXMEDK8 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hey Thomas, (Removing a boatload of people to make it a bit less noisy) This is a tough question, because it really depends on your *needs*=2E All of these products complement each other and each has its utility=2E If= you are working in a high security environment, all of these could be usef= ul or even mandatory, based on your level of certification, or desired leve= l of certification=2E Here is a short explanation for each=2E=2E=2E But before I start rambling,= remember the golden rule: updates, updates, updates!! Slackware is very go= od for this, so apply *all* the updates=2E Remember: slackpkg is your frien= d=2E All right, on to the explanations: - Samhain, OSSEC (forked by Wazuh), AIDE, Tripwire: all of these are HIDS = or integrity control=2E They check if a file, a binary, or a directory has = been modified suspiciously, and they also check if suspicious activity has = been recorded in the logs of the machine=2E - You usually combine these with an antivirus, such as ClamAV, to check if= files have been infected by a virus, especially if Windows generated files= circulate on your machines=2E ClamAV is very easy to install and update on= Slackware=2E - You can also combine them, optionally, with a Linux Trojan horse checker= , such as chkrootkit and rkhunter, as well as, on Slackware, 'sscs' to chec= k the general security configuration of the system (GitHub=2Ecom/mbroek/ssc= s)=2E - If your machine is exposed on the internet, automated response is a good= thing to have, so I recommend protecting *at least* SSH with either DenyHo= sts or Fail2Ban=2E If you are happy with the automated response of OSSEC, y= ou can use that as well=2E For instance, if an IP address from China tries = to login into your machine using "Thomas" as user name, all of these soluti= ons will automatically block that IP for a week (or more)=2E - Having firewall rules on all machines is critical, so I recommend writin= g yours with firewall builder, which is a nice GUI that runs under KDE (fwb= uilder=2Esourceforge=2Enet)=2E All of these are installed on your server(s), so they provide "local" secu= rity, so to speak=2E - If you want to test the security of several machines on the same LAN, th= en snort or greenbone are an option=2E The 1st one, snort, will sniff the t= raffic on your network and analyze it for suspicious activity=2E The 2nd one, greenbone, will scan and probe your machines from the outside= looking in, and will report on outdated software and configuration issues= =2E Both snort and greenbone have a community and a professional edition, a= nd snort has a slack package on slackbuilds=2Eorg=2E - Another good thing is to check the traffic that comes *out* of your netw= ork for suspicious activity=2E For this, you can use either suricata or zee= k, which will analyze the outgoing packets by acting like a filtering proxy= =2E Both have a Slackware package through slackbuilds=2Eorg=2E - And finally, we reach the EDR stage, where we pull all this together int= o a coherent whole, by gathering and analyzing everything=2E This is where = Harfang, Dark Trace and others come into the mix=2E - Of course, this is the just beginning, because we haven't done anything = on the supervision part, the IAM (Identity and Access Management) part, you= r SSH configuration, data replication, high availability, disk encryption, = etc=2E=2E=2E etc=2E=2E=2E So=2E=2E=2E I am afraid what I wrote is going to be even more confusing th= an before=2E Think of it as onion layers: OSSEC and friends are the very bo= ttom layer, and you slowly go to the outside from there=2E OSSEC > Antivirus > DenyHosts > Firewall > Snort/Greenbone > Suricata/Zeek= > EDR/Dark Trace/Harfang, etc=2E=2E=2E Hope this helps! I design that kind of thing for a living, so there is a lot I am brushing = off under the carpet=2E=2E=2E :-/ On October 29, 2022 12:53:48 PM GMT+02:00, Thomas Altfather Good via slack= ware <slackware@mailman=2Elug=2Eorg=2Euk> wrote: >Gil, > >One of my mates recommended AIDE, another: snort=2E > >What do you think? > >(I'm a database guy and our paid consultant is pushing Sentinel - he was >not able to install it, not being a unix person, so I did it but now he >can't configure it=2E=2E=2Eso I'm trying to offer alternatives=2E I insta= lled OSSEC >and it works fine but he apparently doesn't like this=2E=2E=2E) > >On Fri, Oct 28, 2022 at 7:34 PM Gil ANDRE <andre=2Eg@wanadoo=2Efr> wrote: > >> Most of these EDR solutions are for Red Hat or Debian only=2E Dark Trac= e >> sells appliances only, including virtual appliances, which may - or may= not >> - work under Slackware=2E >> >> As far as I can tell, most "Enterprise" EDR solutions are not open sour= ce=2E >> >> Depending on your needs, you may be able to approximate an EDR solution >> using open source software under Slackware=2E A combination of ClamAV, = OSSEC >> or Samhain, Zeek or suricata will cover 90% of an EDR perimeter, and th= ese >> are all open source solutions that can run under Slackware=2E >> >> The real issue here is the time and budget needed to integrate all thes= e >> solutions=2E >> >> On October 27, 2022 3:12:55 PM GMT+02:00, Thomas Altfather Good < >> thomasaltfathergood@gmail=2Ecom> wrote: >>> >>> Hi, thanks much=2E >>> >>> Do any of the EDRs install relatively easily with Slackware? >>> >>> >>> >>> -- >>> >>> Thomas Altfather Good >>> thomasgood=2Ecom >>> >>> >>> Washington-Baltimore News Guild, CWA Local 32035 >>> National Press Photographers Association >>> >>> Level 6, Google Guide: google=2Ethomasgood=2Ecom >>> >>> >>> =E2=80=9ELeben Sie jetzt die Fragen=2E=E2=80=9C -- Rainer Maria Rilke >>> >>> >>> >>> >>> On Thu, Oct 27, 2022, 08:57 Gil ANDRE <andre=2Eg@wanadoo=2Efr> wrote: >>> >>>> OSSEC works very well on Slackware, I have been using it for a long t= ime=2E >>>> >>>> Wazuh is also very good, is a fork of OSSEC, but it requires a lot mo= re >>>> work, since it drags a whole ELK stack=2E >>>> >>>> Both are not EDR, though, you should look at things like Dark Trace, >>>> Tehtris or Harfang Labs if you really want an EDR=2E >>>> >>>> On October 27, 2022 2:13:45 PM GMT+02:00, Thomas Altfather Good via >>>> slackware <slackware@mailman=2Elug=2Eorg=2Euk> wrote: >>>>> >>>>> Thanks Gabriel, this is very helpful=2E >>>>> >>>>> Cheers >>>>> >>>>> -- >>>>> >>>>> Thomas Altfather Good >>>>> thomasgood=2Ecom >>>>> >>>>> >>>>> Washington-Baltimore News Guild, CWA Local 32035 >>>>> National Press Photographers Association >>>>> >>>>> Level 6, Google Guide: google=2Ethomasgood=2Ecom >>>>> >>>>> >>>>> =E2=80=9ELeben Sie jetzt die Fragen=2E=E2=80=9C -- Rainer Maria Rilk= e >>>>> >>>>> >>>>> >>>>> >>>>> On Thu, Oct 27, 2022, 08:02 Gabriel D=C3=ADaz L=C3=B3pez de la Llave= via >>>>> slackware <slackware@mailman=2Elug=2Eorg=2Euk> wrote: >>>>> >>>>>> hello >>>>>> >>>>>> Wazuh is open source and can be integrated with many environments= =2E It >>>>>> does not support Slackware natively, but I=E2=80=99m sure it can be= adapted=2E >>>>>> >>>>>> https://github=2Ecom/wazuh/wazuh >>>>>> >>>>>> There is a very active slack community where you can interact with >>>>>> other people using it=2E >>>>>> >>>>>> https://wazuh=2Ecom/community/join-us-on-slack/ >>>>>> >>>>>> gabriel >>>>>> >>>>>> >>>>>> >>>>>> El 27 oct 2022, a las 13:54, Thomas Altfather Good via slackware < >>>>>> slackware@mailman=2Elug=2Eorg=2Euk> escribi=C3=B3: >>>>>> >>>>>> >>>>>> Hi All, >>>>>> >>>>>> Has anyone gotten SentinelOne to work with Slackware? >>>>>> >>>>>> Or - can someone recommend an EDR? >>>>>> >>>>>> Thanks! >>>>>> -- >>>>>> >>>>>> Thomas Altfather Good >>>>>> thomasgood=2Ecom >>>>>> >>>>>> >>>>>> Washington-Baltimore News Guild, CWA Local 32035 >>>>>> National Press Photographers Association >>>>>> >>>>>> Level 6, Google Guide: google=2Ethomasgood=2Ecom >>>>>> >>>>>> >>>>>> =E2=80=9ELeben Sie jetzt die Fragen=2E=E2=80=9C -- Rainer Maria Ril= ke >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> slackware mailing list >>>>>> slackware@mailman=2Elug=2Eorg=2Euk >>>>>> https://mailman=2Elug=2Eorg=2Euk/mailman/listinfo/slackware >>>>>> >>>>>> >>>>>> -- >>>>>> slackware mailing list >>>>>> slackware@mailman=2Elug=2Eorg=2Euk >>>>>> https://mailman=2Elug=2Eorg=2Euk/mailman/listinfo/slackware >>>>>> >>>>> -- >>>> Sent from my Android device with K-9 Mail=2E Please excuse my brevity= =2E >>>> >>> -- >> Sent from my Android device with K-9 Mail=2E Please excuse my brevity= =2E >> > > >--=20 >Thomas Altfather Good >thomasgood=2Ecom > >Washington-Baltimore News Guild, CWA Local 32035 >National Press Photographers Association >Level 6, Google Guide: google=2Ethomasgood=2Ecom > >=E2=80=9ELeben Sie jetzt die Fragen=2E=E2=80=9C -- Rainer Maria Rilke --=20 Sent from my Android device with K-9 Mail=2E Please excuse my brevity=2E ------POTUNSDOGGWQEASPV746XCKTXMEDK8 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body>Hey Thomas,<br><br>(Removing a boatload of people = to make it a bit less noisy)<br><br>This is a tough question, because it re= ally depends on your *needs*=2E<br><br>All of these products complement eac= h other and each has its utility=2E If you are working in a high security e= nvironment, all of these could be useful or even mandatory, based on your l= evel of certification, or desired level of certification=2E<br><br>Here is = a short explanation for each=2E=2E=2E But before I start rambling, remember= the golden rule: updates, updates, updates!! Slackware is very good for th= is, so apply *all* the updates=2E Remember: slackpkg is your friend=2E<br><= br>All right, on to the explanations:<br><br>- Samhain, OSSEC (forked by Wa= zuh), AIDE, Tripwire: all of these are HIDS or integrity control=2E They ch= eck if a file, a binary, or a directory has been modified suspiciously, and= they also check if suspicious activity has been recorded in the logs of th= e machine=2E<br><br>- You usually combine these with an antivirus, such as = ClamAV, to check if files have been infected by a virus, especially if Wind= ows generated files circulate on your machines=2E ClamAV is very easy to in= stall and update on Slackware=2E<br><br>- You can also combine them, option= ally, with a Linux Trojan horse checker, such as chkrootkit and rkhunter, a= s well as, on Slackware, 'sscs' to check the general security configuration= of the system (GitHub=2Ecom/mbroek/sscs)=2E<br><br>- If your machine is ex= posed on the internet, automated response is a good thing to have, so I rec= ommend protecting *at least* SSH with either DenyHosts or Fail2Ban=2E If yo= u are happy with the automated response of OSSEC, you can use that as well= =2E For instance, if an IP address from China tries to login into your mach= ine using "Thomas" as user name, all of these solutions will automatically = block that IP for a week (or more)=2E<br><br>- Having firewall rules on all= machines is critical, so I recommend writing yours with firewall builder, = which is a nice GUI that runs under KDE (fwbuilder=2Esourceforge=2Enet)=2E<= br><br>All of these are installed on your server(s), so they provide "local= " security, so to speak=2E<br><br>- If you want to test the security of sev= eral machines on the same LAN, then snort or greenbone are an option=2E The= 1st one, snort, will sniff the traffic on your network and analyze it for = suspicious activity=2E<br><br>The 2nd one, greenbone, will scan and probe y= our machines from the outside looking in, and will report on outdated softw= are and configuration issues=2E Both snort and greenbone have a community a= nd a professional edition, and snort has a slack package on slackbuilds=2Eo= rg=2E<br><br>- Another good thing is to check the traffic that comes *out* = of your network for suspicious activity=2E For this, you can use either sur= icata or zeek, which will analyze the outgoing packets by acting like a fil= tering proxy=2E Both have a Slackware package through slackbuilds=2Eorg=2E<= br><br>- And finally, we reach the EDR stage, where we pull all this togeth= er into a coherent whole, by gathering and analyzing everything=2E This is = where Harfang, Dark Trace and others come into the mix=2E<br><br>- Of cours= e, this is the just beginning, because we haven't done anything on the supe= rvision part, the IAM (Identity and Access Management) part, your SSH confi= guration, data replication, high availability, disk encryption, etc=2E=2E= =2E etc=2E=2E=2E<br><br>So=2E=2E=2E I am afraid what I wrote is going to be= even more confusing than before=2E Think of it as onion layers: OSSEC and = friends are the very bottom layer, and you slowly go to the outside from th= ere=2E<br><br>OSSEC > Antivirus > DenyHosts > Firewall > Snort/= Greenbone > Suricata/Zeek > EDR/Dark Trace/Harfang, etc=2E=2E=2E<br><= br>Hope this helps!<br><br>I design that kind of thing for a living, so the= re is a lot I am brushing off under the carpet=2E=2E=2E :-/<br><br><br><br>= <div class=3D"gmail_quote">On October 29, 2022 12:53:48 PM GMT+02:00, Thoma= s Altfather Good via slackware <slackware@mailman=2Elug=2Eorg=2Euk> w= rote:<blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0=2E8ex= ; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> <div dir=3D"ltr"><div>Gil,</div><div><br></div><div>One of my mates recomm= ended AIDE, another: snort=2E</div><div><br></div><div>What do you think?</= div><div><br></div><div>(I'm a database guy and our paid consultant is push= ing Sentinel - he was not able to install it, not being a unix person, so I= did it but now he can't configure it=2E=2E=2Eso I'm trying to offer altern= atives=2E I installed OSSEC and it works fine but he apparently doesn't lik= e this=2E=2E=2E)<br></div></div><br><div class=3D"gmail_quote"><div dir=3D"= ltr" class=3D"gmail_attr">On Fri, Oct 28, 2022 at 7:34 PM Gil ANDRE <<a = href=3D"mailto:andre=2Eg@wanadoo=2Efr">andre=2Eg@wanadoo=2Efr</a>> wrote= :<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0= =2E8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Most o= f these EDR solutions are for Red Hat or Debian only=2E Dark Trace sells ap= pliances only, including virtual appliances, which may - or may not - work = under Slackware=2E<br><br>As far as I can tell, most "Enterprise" EDR solut= ions are not open source=2E<br><br>Depending on your needs, you may be able= to approximate an EDR solution using open source software under Slackware= =2E A combination of ClamAV, OSSEC or Samhain, Zeek or suricata will cover = 90% of an EDR perimeter, and these are all open source solutions that can r= un under Slackware=2E<br><br>The real issue here is the time and budget nee= ded to integrate all these solutions=2E<br><br><div class=3D"gmail_quote">O= n October 27, 2022 3:12:55 PM GMT+02:00, Thomas Altfather Good <<a href= =3D"mailto:thomasaltfathergood@gmail=2Ecom" target=3D"_blank">thomasaltfath= ergood@gmail=2Ecom</a>> wrote:<blockquote class=3D"gmail_quote" style=3D= "margin:0pt 0pt 0pt 0=2E8ex;border-left:1px solid rgb(204,204,204);padding-= left:1ex"> <div dir=3D"auto">Hi, thanks much=2E<div dir=3D"auto"><br></div><div dir= =3D"auto">Do any of the EDRs install relatively easily with Slackware?<br><= div dir=3D"auto"><br></div><div dir=3D"auto"><br><br><div dir=3D"auto">--<b= r><br>Thomas Altfather Good<br><a href=3D"http://thomasgood=2Ecom" target= =3D"_blank">thomasgood=2Ecom</a><br><br><br>Washington-Baltimore News Guild= , CWA Local 32035<br>National Press Photographers Association<br><br>Level = 6, Google Guide: <a href=3D"http://google=2Ethomasgood=2Ecom" target= =3D"_blank">google=2Ethomasgood=2Ecom</a><br><br><br>=E2=80=9ELeben Sie jet= zt die Fragen=2E=E2=80=9C -- Rainer Maria Rilke<br><br><br>  = ; </div></div></div></div><br><div class=3D"gmail_quote"><div dir=3D"= ltr" class=3D"gmail_attr">On Thu, Oct 27, 2022, 08:57 Gil ANDRE <<a href= =3D"mailto:andre=2Eg@wanadoo=2Efr" target=3D"_blank">andre=2Eg@wanadoo=2Efr= </a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:= 0px 0px 0px 0=2E8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex= "><div>OSSEC works very well on Slackware, I have been using it for a long = time=2E<br><br>Wazuh is also very good, is a fork of OSSEC, but it requires= a lot more work, since it drags a whole ELK stack=2E<br><br>Both are not E= DR, though, you should look at things like Dark Trace, Tehtris or Harfang L= abs if you really want an EDR=2E<br><br><div class=3D"gmail_quote">On Octob= er 27, 2022 2:13:45 PM GMT+02:00, Thomas Altfather Good via slackware <<= a href=3D"mailto:slackware@mailman=2Elug=2Eorg=2Euk" rel=3D"noreferrer" tar= get=3D"_blank">slackware@mailman=2Elug=2Eorg=2Euk</a>> wrote:<blockquote= class=3D"gmail_quote" style=3D"margin:0pt 0pt 0pt 0=2E8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex"> <div dir=3D"auto">Thanks Gabriel, this is very helpful=2E<div dir=3D"auto"= ><br></div><div dir=3D"auto">Cheers<br><br><div dir=3D"auto">--<br><br>Thom= as Altfather Good<br><a href=3D"http://thomasgood=2Ecom" rel=3D"noreferrer"= target=3D"_blank">thomasgood=2Ecom</a><br><br><br>Washington-Baltimore New= s Guild, CWA Local 32035<br>National Press Photographers Association<br><br= >Level 6, Google Guide: <a href=3D"http://google=2Ethomasgood=2Ecom" r= el=3D"noreferrer" target=3D"_blank">google=2Ethomasgood=2Ecom</a><br><br><b= r>=E2=80=9ELeben Sie jetzt die Fragen=2E=E2=80=9C -- Rainer Maria Rilk= e<br><br><br> </div></div></div><br><div class=3D"gmail_q= uote"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Oct 27, 2022, 08:02 Gab= riel D=C3=ADaz L=C3=B3pez de la Llave via slackware <<a href=3D"mailto:s= lackware@mailman=2Elug=2Eorg=2Euk" rel=3D"noreferrer" target=3D"_blank">sla= ckware@mailman=2Elug=2Eorg=2Euk</a>> wrote:<br></div><blockquote class= =3D"gmail_quote" style=3D"margin:0px 0px 0px 0=2E8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div>hello<div><br></div><div>Wazuh is o= pen source and can be integrated with many environments=2E It does not supp= ort Slackware natively, but I=E2=80=99m sure it can be adapted=2E </di= v><div><br></div><div><a href=3D"https://github=2Ecom/wazuh/wazuh" rel=3D"n= oreferrer noreferrer" target=3D"_blank">https://github=2Ecom/wazuh/wazuh</a= ></div><div><br></div><div>There is a very active slack community where you= can interact with other people using it=2E </div><div><br></div><div>= <a href=3D"https://wazuh=2Ecom/community/join-us-on-slack/" rel=3D"noreferr= er noreferrer" target=3D"_blank">https://wazuh=2Ecom/community/join-us-on-s= lack/</a><br></div><div></div><div><br></div><div>gabriel</div><div><br></d= iv><div><br><div><br><blockquote type=3D"cite"><div>El 27 oct 2022, a las 1= 3:54, Thomas Altfather Good via slackware <<a href=3D"mailto:slackware@m= ailman=2Elug=2Eorg=2Euk" rel=3D"noreferrer noreferrer" target=3D"_blank">sl= ackware@mailman=2Elug=2Eorg=2Euk</a>> escribi=C3=B3:</div><br><div><div = dir=3D"auto"><br>Hi All, <div dir=3D"auto"><br></div><div dir=3D"auto"= >Has anyone gotten SentinelOne to work with Slackware?</div><div dir=3D"aut= o"><br></div><div dir=3D"auto">Or - can someone recommend an EDR?</div><div= dir=3D"auto"><br></div><div dir=3D"auto">Thanks!<br><div dir=3D"auto">--<b= r><br>Thomas Altfather Good<br><a href=3D"http://thomasgood=2Ecom/" rel=3D"= noreferrer noreferrer" target=3D"_blank">thomasgood=2Ecom</a><br><br><br>Wa= shington-Baltimore News Guild, CWA Local 32035<br>National Press Photograph= ers Association<br><br>Level 6, Google Guide: <a href=3D"http://google= =2Ethomasgood=2Ecom/" rel=3D"noreferrer noreferrer" target=3D"_blank">googl= e=2Ethomasgood=2Ecom</a><br><br><br>=E2=80=9ELeben Sie jetzt die Fragen=2E= =E2=80=9C -- Rainer Maria Rilke<br><br><br> </div></= div></div> -- <br>slackware mailing list<br><a href=3D"mailto:slackware@mailman=2Elug= =2Eorg=2Euk" rel=3D"noreferrer noreferrer" target=3D"_blank">slackware@mail= man=2Elug=2Eorg=2Euk</a><br><a href=3D"https://mailman=2Elug=2Eorg=2Euk/mai= lman/listinfo/slackware" rel=3D"noreferrer noreferrer" target=3D"_blank">ht= tps://mailman=2Elug=2Eorg=2Euk/mailman/listinfo/slackware</a><br></div></bl= ockquote></div><br></div></div>-- <br> slackware mailing list<br> <a href=3D"mailto:slackware@mailman=2Elug=2Eorg=2Euk" rel=3D"noreferrer no= referrer" target=3D"_blank">slackware@mailman=2Elug=2Eorg=2Euk</a><br> <a href=3D"https://mailman=2Elug=2Eorg=2Euk/mailman/listinfo/slackware" re= l=3D"noreferrer noreferrer noreferrer" target=3D"_blank">https://mailman=2E= lug=2Eorg=2Euk/mailman/listinfo/slackware</a><br> </blockquote></div> </blockquote></div><div style=3D"white-space:pre-wrap"><div>-- <br>Sent fr= om my Android device with K-9 Mail=2E Please excuse my brevity=2E</div></di= v></div></blockquote></div> </blockquote></div><div style=3D"white-space:pre-wrap"><div>-- <br>Sent fr= om my Android device with K-9 Mail=2E Please excuse my brevity=2E</div></di= v></div></blockquote></div><br clear=3D"all"></blockquote></div><div style= =3D'white-space: pre-wrap'><div class=3D'k9mail-signature'>-- <br>Sent from= my Android device with K-9 Mail=2E Please excuse my brevity=2E</div></div>= </body></html> ------POTUNSDOGGWQEASPV746XCKTXMEDK8-- --===============3389948419159337661== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- slackware mailing list [email protected] https://mailman.lug.org.uk/mailman/listinfo/slackware --===============3389948419159337661==--