FIM and System Call Auditing at Scale in a Large Container Deployment

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:
#RSAC
Ravi Honnavalli
FIM AND SYSTEM CALL AUDITING AT
SCALE IN A LARGE CONTAINER
DEPLOYMENT
CSV-R14
Staff Engi...

#RSAC
Disclaimer
2
NOTE: All content discussed here are
out of self learning and not related to
the work I do at Walmart.

#RSAC
Ever increasing amount of logs
3

#RSAC
Overwhelming amount of choices
4
Too many
options!!
Static
rules?
ML?
Event
source
?
Agent vs
Agentless

#RSAC
Flood of OSS tools
5
Elasticsearch
osquery
journald
ElastAlert
TensorFlowUnstructured datastores
fluentd

#RSAC
GOAL: Demystifying the choices we have
6
•Classifying event sources
•Understand event source type
•Evaluate open sou...

#RSAC
Quick poll
7
Use audit logging to
detect anomalies?
How may implement it
only to meet
compliance?
Take it further to...

#RSAC
• kauditd
• Inotify
Kernel
Possibilities of tools evaluated
8
• auditd
• go-auditd
• go-audit-container
• osquery
Da...

#RSAC
Classification of event sources
9
Event
sources
Event
based
syscall inotify
Scheduled
query
agent

#RSAC
Security insight based on event source type
10
syscall
Looking for specific
outliers among
mostly normal
dynamic eve...

#RSAC
SYSTEM CALLS

#RSAC
Why syscall?
12
Fundamental transit
points between user land
and kernel
Every process makes system
calls disclosing ...

#RSAC
Audit component
13
User land
Kernel land
Kauditd
Syscall interfaceNetlink
socket
Reporting
daemon
User space
applica...

#RSAC
Audit log to gain insights at scale
User land
Kauditd
Syscall interfaceNetlink
socket
go-audit-
container
User space...

#RSAC
Demo
15

#RSAC
INOTIFY

#RSAC
Inotify component
17
User land
Kernel
landInotify component
User space application
Inotify_add_watch
Watch list
Inot...

#RSAC
Why inotify?
18
Lesser CPU
consumption on
an average
Missing details
in the reports
Another
parallel stack,
a new an...

#RSAC
Demo
19

#RSAC
inotify based stack for FIM
User land
Kernel
land
Elasticsea
rch
Grafana
Kibana
Pre-
Processsink
Email
Pagerduty
Sla...

#RSAC
AGENTS

#RSAC
osquery
22
osquery osqueryosqueryosquery
Fleet Manager
OS OSOS OS
Distributed
Query

#RSAC
Osquery stack to get insights at scale
Elasticsea
rch
Grafana
Kibana
Pre-
Processsink
Email
Pagerduty
Slack
TensorFl...

#RSAC
Demo of tracing a ‘Dirty COW’ exploit
24

#RSAC
Learning from using fixed queries in Kibana,
Grafana and custom tools
25
Robust rules
need a lot of
queries
Fixed qu...

#RSAC
MACHINE LEARNING

#RSAC
High level differences
27
Unsupervised
Elasticsearch ML
Anomaly detection
Time series data
Supervised
Pre-processink...

#RSAC
Picture credit: https://unsplash.com/@ripato
28
Elasticsearch ML: Detecting outliers

#RSAC
Demo of ElasticSearch ML
29

#RSAC
Use case: Classifying disparate data
30
Classifying data from different event sources
Broad classification into RED/...

#RSAC
Supervised learning: Building a training set is
key
31
Elasticsearch
Preprocessink-
osquery
Labelling TensorFlow

#RSAC
Pre-processink-osquery stages
Stage 0
• Query one probe at a time from ES
• Label into RED/YELLOW/GREEN
• Write to s...

#RSAC
ML choices if you are building your own
solution
33
Activation
function
Learning
rate
Depth of
the network
Batch siz...

#RSAC
Results of our experiment
34
ReLU for hidden layers and softmax for activation
Epoch vs Batch Size vs Iterations
Ada...

#RSAC
Lessons learnt
35
With system call auditing, inotify, os level querying agents as foundations, combined with
ability...

#RSAC
Apply
36
Start with a simple File Integrity monitoring implementation using
audit log. Observe load of FIM events on...

#RSAC
AuditNG suite
37
https://github.com/auditNG/preprocessink-osquery
https://github.com/auditNG/go-audit-container

#RSAC
Questions?
38
You can also reach out later:
Twitter handle: @ravi_Honnavalli
LinkedIn:
https://www.linkedin.com/in/r...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1042022 views
Storytelling For The Web: Integrate... by Chiara Aliotta 954721 views
Artificial Intelligence, Data and C... by OECD Directorate ... 880306 views
How to Leverage AI to Boost Employe... by SocialHRCamp 370586 views
2024 State of Marketing Report – by... by Marius Sescu 210442 views
Everything You Need To Know About C... by Expeed Software 229923 views

View on Slideshare

1 of 38 Ad

View on Slideshare

1 of 38 Ad