Zentral is a framework to gather, process, and monitor system events and link them to an inventory.

1. journeys from logging
towards manage clients
for incident response
zentral

2. @head_min
Henry Stamerjohann
consultant, systems engineer
Apfelwerk GmbH & Co. KG, Germany
whoami

3. where are we going
• logging
• events
• tools
• zentral ?

4. • central
• centrally
• pivotal
• polar
[zen-t-ral], adj.zentral

7. open source tool to gather,
process, and monitor events

8. basics

9. Client management
Events
Computer Admin
Filter Action
Tools
log controlaudit

10. aggregate system state, logs,
and enforce management

11. collect records, store event data
• system
• user
• applications
logging

12. • know about errors
• early warning of suspicious activity
• evidence to find what went wrong
• reduce event data with filtering
• aggregate/forward logs from multiple sources
logging

13. • examine system.log & other log files
• Apple System Logging facility (ASL), Syslog APIs
• error or status events
• system processes
logging (pre Sierra)

14. tools like tail, grep
for keyword search

15. syslog
NOTE: Most system logs have moved
to a new logging system.
See log(1) for more information.

16. • new Unified Logging
• very little goes to system.log file now
• new Console.app and command line tool "log"
• logs stored in a compressed binary format
• different persistent settings configurable
logging (in Sierra)

17. log shipping not (yet)
implemented

18. why ?

19. events are everything,
and everything is events

20. Google Santa

21. • binary black-/whitelisting system for macOS
• keeps track of binaries in macOS
• event logging (hint: log aggregation)
• local-only rules or sync with server
• developed by Google
https://github.com/ google/santa
Google Santa

22. • client mode MONITOR
• client mode LOCKDOWN (defaults deny)
• WhitelistRegex/BlacklistRegex for paths
• Zentral is a log & configuration server for Santa
Google Santa

23. full audit trail on
binary executions

24. osquery

25. • ask questions about infrastructure
• query system state with simple SQL syntax
• low-level operating system analytics
• multi platform support (mac, linux, windows)
• developed by Facebook
https://osquery.io
osquery

26. • distributed queries
• file integrity monitoring
• osquery Packs
• import as feeds to Zentral
• Zentral is a log & configuration server for osquery
osquery

27. customize audit trail

29. • log data aggregated from infrastructure
• traditional log collection (modernized aproach)
• shipped to Logstash, ingested by Zentral
• multi platform support (mac, linux, windows)
• Logstash, Beats by Elastic
https://elastic.co
ELK / Logstash + Beats

30. • Logstash ecosystem available
• ElasticSearch is the datastore for events in Zentral
• Kibana is used for event visualization
• full ELK stack is integrated in Zentral
ELK / Logstash + Beats

31. centralized log events
from infrastucture

33. • robust infrastructure monitoring
• traditional server monitoring
• uptime, downtime, and performance
• Nagios instances push host & service events
to Zentral (event handlers)
Nagios / Icinga

34. infrastructure state
monitoring

35. Inventory

36. Inventory
to link events with clients
• multiple inventory sources
• background sync
• push / pull

37. Push inventory Pull inventory
Munki
osquery
Santa
Zentral
?

38. ActionsEvents
gather, process,
and monitor
events

39. Actions
Email
Events
osquery
Santa
Munki
gather, process,
and monitor
events

40. Configuration
osquery
Santa
Munki
osquery
Santa
Inventory
Munki
Munki
Events
osquery Santa
gather, process,
and monitor
events
Email
Actions

41. Zentral is a open hub
for your deployed tools

42. Demo
Objective:
connect inventory to Zentral
Inventory Events

43. Scenario
• Filebeat log shipping already configured
• configure and use Jamf Webhooks
• create Events Probe w/ filter
• inspect client events & server logs

47. scope of work goes beyond a single host there are tons of engineering and security considerations
Summary
• Jamf Pro connects with Zentral
• Jamf Webhooks push events to Zentral
• Filebeat aggregates logfile data from JSS
• Probe filters scope to specific events

48. combine endpoint events
& server logs

49. Munki:
• Munki events from endpoints
• Logfile from MunkiRepo web-server
Jamf Pro:
• Logfiles from Jamf distribution points
Variations

50. Probes

51. Probes are
• filters
• configuration
• actions

52. Demo
Objective:
osquery audit / compliance
Events Configuration Actions

53. Scenario
• remove MDM profile
• osquery Probe for change detection
• automate remediation
• review event history

58. Summary
• osquery detect config change on client
• Probe is triggered back by osquery
• Jamf group change action trigger by Zentral
• Jamf policy scoped for mitigation, re-installs
MDM profile

59. audit trail for management
frameworks

60. Incident response

61. the quality of response can make a difference
• find weak spots
• search for more information
• not only focus on things that are broken
• look also at the big picture
• review change events over time
because incidents happen…

62. @llauren
To protect ourselves against the
incompetent and the malignant…
Be a sysadmin. What a life.

63. Demo
Objective:
Control privileged accounts
Events Configuration Actions

64. Scenario
• User with admin privileges
• Santa in LOCKDOWN mode
• binary execution: defaults deny

71. Summary
• Santa config controlled by Zentral
• Santa blocks unknown binaries by default
• developer tools are usable and behave well
• admin privileges with security belt

72. control and monitor
endpoints

73. Client Enrollment
• Settings
• download .pkg

74. Zentral

75. combine powerful existing
tools to meet your
operational requirements

76. deployment

77. simple Zentral all-in-one
• Amazon AWS (prod. / eval.)
• GoogleCloudServices (prod. / eval.)
• Vagrant box (evaluation)
• VMware .ova (evaluation)
• docker-compose (dev. / eval.)
deployment

78. support options

79. (free) community support via github
paid support contract on request: dev@zentral.io
• SaaS (cloud based service)
• professional services, custom development
• integration support (on premise)
• Munki manifests management (on request)
support options

80. info & doku

81. GitHub: https://github.com/zentralopensource
Website: https://zentral.io
Tutorials: goo.gl/qsIVkl
Ebook: https://leanpub.com/zentral
info & doku

82. We run 1/2 day workshops at some MacAdmin
meetups in Europe during Q1/Q2 2017
talk to us
workshops

83. thank you !

84. Q & A