ハニーポットをパワーアップさせた。 - birabiraのめも
AWSのLightSailが少し安くなっていた。 RAM 1Gでも$5なのでとてもおすすめ。 前回のハニーポットはRAM 500Mで制限がとても多かったのでいっそのこと最初から作り直した。 作るのに4日くらいかかった。その代わりSystemdやrsyslogとか若干わかるようになった。うれしい。 便宜上、suricataとufwもハニポってことにしてるけど許してくださいな。 構成 AWSのVPSに各ハニーポット等を設置して、それらをS3にいったんアップロード。 自宅のPCにインストールしたELKにてログを収集して分析する。 前回と比べてufwとdionaeaが追加された。 使用したもの Suricata IDSとして動作。 アクセスを一般的なシグネチャにマッチさせることでどのような攻撃が来たかをパッとで判断できる。 Dionaea 様々なポートに対するアクセスをキャプチャできるハニーポット
How I Discovered Thousands of Open Databases on AWS
My journey on finding and reporting databases with sensitive data about Fortune-500 companies, Hospitals, Crypto platforms, Startups during due diligence, and more. Table Of Contents OverviewBackgroundMy HypothesisScanningBI & Automation: From thousands to hundredsExamples of data I foundConclusionOverviewIt is easy to find misconfigured assets on cloud services, by scanning the CIDR blocks (IP ra
Using Nmap + Logstash to Gain Insight Into Your Network
Search and analytics, data ingestion, and visualization – all at your fingertips.
masscan meets ELK - hml.io
Using Logstash, ElasticSearch and Kibana to visualize masscan findings Posted by Emre Bastuz on January 21, 2016 Introduction Let's say you did a masscan of your internal network and ended up with hundreds of thousands of findings and now you want to get some data visualization. This post describes how this can be achieved by using a combination of Logstash ElasticSearch and Kibana4 Before we star
GitHub - Cyb3rWard0g/HELK: The Hunting ELK
The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed primarily for research, but due to its flexible design and core components, it can be deployed in larger
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
GitHub - edepree/certstream-elk-ingestor: A transport script for moving data from a certstream server to Elasticsearch instance.
Offensive ELK: Elasticsearch for Offensive Security
GitHub - outflanknl/RedELK: Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
GitHub - monwolf/fail2ban-logzio: This Action for fail2ban allow recover information from shodan and send it to logzio elk.
GitHub - BRomans/IoTVulnerabilityAnalysis: A software to retrieve and analyze data from IoT devices all over the world. Built on the ELK stack and powered by Shodan engine.
GitHub - marco-lancini/docker_offensive_elk: Elasticsearch for Offensive Security
GitHub - Cyb3rSn0rlax/ELK_Health_Check: Script for automating basic health check tasks
GitHub - einyx/elasticscan: A docker stack to index results of masscan into ELK - DYI shodan.io
GitHub - shaanen/osint-combiner: Combining OSINT sources in Elastic Stack