so what if I told you that is a way to
monitor different Windows Linux and OS X
tables which are scattered through the
premises called in the count will be
going - what's to say something here oh
nothing because it's speak hi my name is
from Doncaster never talked of it before
that has been already mentioned and then
working with the stock now I'm working
as I was into an engineer for the past
years so this will be only in three
parts first of all talk about what is
covered and how to get it up and running
and then how to use it so what is wrong
how about is modular open source agility
and compliance framework it's like one
the link must postpone during
capabilities and it leverages the OS
Queen easy mobility it's a lot of songs
back therefore F is called it by Adobe
in the mid 2016 it's publicly available
think it and
which is the auditing engine and like
was sister security and compliance of
Viki you're not my baseline and then
check against that base might be where
your host and and can be useful see
honest compliance as well as one CD
standing and it integrates with all of
the cardboard CDs and you can see that
you can write as a one-off point is
different but on whenever you want
they whatever it will tell you the check
whether it
and Eddie ever get why they want to get
the CDs of of chicken dishes I wanted to
be packages is the system
let's move it the next John which is all
time in fact I'm thinking when the QT
events system it might be like wait and
can notify you of file changes in real
time to this part is immutable what your
changes as we only to issue the complete
management process it wouldn't be so
sure about that
this I'm not referring only to the
malicious actors as an athlete who
doesn't follow procedures and make
changes when
can they induce a lot of operational
issues and the 100 mountain this one is
also customizable you can check I mean
you can point that different directories
and excluded I think that is you do not
want it to look at and then look at our
dog and my dog has application
constantly with Linux logging stuff also
we can change the type of attributes the
file attributes avoided where check
silence hashes whatever this is its
positive psychology and it's time to
query the system it's tied in to always
spin and those of you unfamiliar with OS
body is which was open sports my
facebook and after at 14 which took a
very different approach to closely
monitor basically if the reviews your
system as one of eight happens and you
can create that database
with SQL life and get a lot of fully to
all of them and then processes
computation memory all that type of
thing for which is pretty useful to
analyze when it is looking for malicious
activity this Oh always lady has a lot
of people's which gather information
which are able to pull the information
out from the system but you can even
either already existing in the air query
it can be done in street oh my back
it comes with OS VI which is an
interactive shell where you will find
your queries for us be for a one time on
test and then you can skip all those
queries to always believe which is a and
what that demon is people that drive all
different intervals it perhaps the info
is log them and then you can use it for
that but we recording if we provided
being to get everything going but we
thought that fully forward always one
cat has maybe not basically does all
that work for me for you it comes with
- I hear on a daily symphonies already
people trying on different Cadence's and
also it ties in nicely with an important
system quasar of which will pop off next
so this is basically and delivered feet
of water processing it's the glue that
ties everything together it gathers the
data from all the previous modules and
it delivers it to your existing plumbing
infrastructure from there you can export
holiday stuff everything you want to it
also these notifications can be
forwarded also to your email or
blackboard other people collaboration
tools by just two years game
infrastructure we have all these
features before you get everything from
the way you you are the wanted to but
with some of it is between and if I get
put into this one I will share a short
story of how Apple what and any project
it will to the someone when this project
of building environment and the content
I was reading my but my Khalifa me Nia
had wanted me as a she's a very
experienced she was awesome at this was
a which was a cloudy stop the really
knew what she was with I put many string
so yeah with this up of the way let's do
anything sorry come on limits only need
to do is login and why to identify then
you need to download the latest release
from the page and then you modify the
multi client which is located in safety
haha there you need you have
instructions and in the config file
and they turn and even where you wanted
to with the index open
you you get the phone
it has again for your for your scamming
okay you're going to see they talking
injures here there is which one existing
szostak infrastructure and leverages a
nice name minion agents and a subpoena
packet we used to have one agent and are
both full of agents you kind of only
should use it if you have small stack as
your existing Orchestrator and you want
to maximize performance and deeper into
this but it is by which one can
customize things globally people in
Europe and existing claims for the
finest it was I know
yeah just like the chicks in there and
you're gonna get what you want
modify the file path on which you want
to be looking at in and all that so yeah
that's me now that I've given you a
short overview example let's go into
what it is and what it is it is a great
addition to any security infrastructure
for only information it provides and not
all the truth I know is always simple it
was no operation issues publishing those
people is it provides and might have a
point
oh isn't that boom get much love from
the security industry and innocent or
since that's my husband early in my my
facebook and help with company
suggestions and PVE detection but what
it isn't as you can see it doesn't cover
any of the capabilities of maybe you
should
in conjunction with those and you should
also scan with a vulnerability scanner
as that things are going active socially
just matches the packages to Qualcomm so
so let's look at a nobody magic in the
Pentagon this is basically how you call
it
Papa and then the modulation - follow me
and it's a one-off scam you're going to
get about the percentage the Vengeance
the Stags numbers air decision and also
the successful basis by the devil for
nebula you can work with the same atom
problem the module which you are calling
let me know please
and then you have an argument for the
car you schedule it we called at the
hour in place now and I am thankful to
comment and switches over there you can
see the commands which I can and the
crumbs
it will here it is the chrome files what
all that talking is beneath the process
ID the username which which usually with
the other arguments which and we have
day for 15 minutes these this is the way
is fine for schedule
let's prove it that always be just a
show
and then all the data is split into
sports type so we don't do that much at
the end this is the slack for Jesus to
be said
my slack work changes
look at the nice one because here you
can positive property so they're gonna
see the compliance percentage this is
the shortest one and then you gotta get
the different line on each of those
chicks though I have successful chicks
I have permissions enable not in the
past one this is the default education
so funny and the name of the check and
the table and yeah base people can
execute from them and that's the big no
that should be seized and also SSH
configure the best way
yep so these things this thing should
gives us in love and acted upon in a
normal environment let's look at
something that we're not looking at this
morning's plug I just punished whether
the show house ask but they travel too
soon
so it's good either the big plan and
then whatever stage to spunk and see the
changes there so now this is writing in
video I'm in the finals with I'll shoot
up in anything now
so the first guy actually comes with the
files created by fighting those that
were captured the world before you save
it it in therapy seek an order for
interventions to happen
so here you have only three what are
between the part of the user the object
at the fire - the three a time
the file name so yeah maybe at 8,000
whatever you get all of it these are
some of the Queen's and I'm gonna show
interesting this is the canonical repeat
it's you the device documents the small
packets of your kernel your hash
whatever this is good for detecting
which samples with you colonel and then
we're going to move it at the loading
history so this is from if I remember
correctly again we're gonna see the for
a society and when when it was and and
which is not just a tea pickers yeah so
the command line which was that which
was and we have my documents in there
again users hashes sometimes whatever
process is process
which it was if you see like Michael
starting something without learning a
command-line argument a connection as a
batting your fighting was hijacked and
speaking of that we estabished hawkins
lady this one - let me get it looks at
processes with stablished a connection
outbound to the finishing part to the
internet but you look for that with
external IP that is what actually
connects outside of my environment it's
the division again we're seeing - spinal
processes process IDs and basically you
can see how we can correlate alerts
based on what I need to do is I
basically put only four into one that
what as in lettuces a system bitch so
we're gonna have the compliance
percentage Furniture Mart I'm Colonel
network interface look the user accounts
one switch
place the user throw jabs my processes
as an established connection and only
the architects so this would be a good
starting project if someone says hey
this won't respond just anything here
the only program that's a bit of a
spoiler last one for the leader in the
devil in a few minutes so very upfront
the window smart is not as developed it
because it was focused to ports linux
and os waiting but this is what I did
for my video shows again the summary
network interfaces but you see with the
running processes and classes
established outbound connection once was
- whatever you get installed prepares
here to find posting and posting also
the only checks and so the next post
which I gotta actually tested who
sanitation saying what open source it's
all smoke yeah was open source while
Kevin mastic at same time and basically
what it does it mimics what what an
actor
so it just it is and then of that they
wanted car like faculty chicks like with
what was in the week so yeah this was
why