Okay, let's go, let's go for the last ball for today.
I'm Peter Tick and today I'm here to talk about the DSD-order.
So, it was system-end and some other system-end changes.
I used to like the DSD.
First of all, I used to put a half-stranded-day-end DSD with a C-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S
and then Oswo had a really-haves with a really-haves using the DSD-S-S-S-S-S-M-GOS
I'd like to give you a pick of all of those right now.
OK.
Ogasol.
OK.
The idea for the, uhh,ossip-Ede-CD, the Disreasprobable Freeman Arcure Unit,
SON feel like the S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-P-P-M-G-C-S-S-S-S-S-S-S-S-S-S-S-S-H-I-I-S-B-Today-Min formation and I-I-B-D-V-A test team.
couple of phone figures and I did it in the coming days. So today I will introduce you to sister
genji, few works also about the previous the audit subsystem, then how I will show you how to
work with audit logs within the surgery and finally I will show you a couple of more
sister genji news related to previous day. But first of all, what is login? Logging is a
recording of event, like an SSH, login message and sister genji is a login demon with a strong
focus on portability and high-performance center of collection. Polygium info is developed in C but
now you can extend it in Java and Python as well. It has four major roles, it can collect
logmasities, it can process macities, it can filter them and finally store them either locally
or to remote destination. Sister genji can collect system and application logs together which
can provide Python useful contextual data for either side. It's a portable software so it can
collect logmasities from wide variety of platforms, specific sources like download, journal,
sound screens, and so on. As a one of the world has still in use sister genji implementations,
it can work with the legacy in sister logmasities or the news using the new sister protocol
where UDP, PCT, or NPT connectivity connections, and it can collect all kinds of
decades later from applications through five socket spikes and application output.
That's what we will use today for our uploads. But there are many more possibilities
as you can easily extend sister genji in Python and implement an HTTP source, Kafka source
or many other. In my view the most important role of sister genji that it can process
of logmasities, it can classify and organize structure logs using built-in parsers,
the part-time DDP parser, CSC parser, JSON parsers, and many others. It can also
divide the cities and not just, and you do not have to think about the falsifying logmasities.
But for example, anonymization is required by various compliance regulations.
It can also enrich the log data with NGIT or reformer term to the requirements of
various destinations using JSON, formatting, or ISD, or whatever.
And I already mentioned Python. You can create
implement any of the above features in Python, but you can also use it to enrich
logmasities from databases or do filtering, which leads us to next topic.
If you are trying, it has two main uses. Discutting surface logmasities, like making sure
that you do not store any debug logmasities as that can be pretty expensive quite quickly,
or for message routing, like making sure that all your authentication related events reach
your CINC system. There are many possibilities. It can be based on message content various
message parameters. You can use comparisons, white card, various filtering functions,
and best of all, you can combine all of these using Boolean operators.
Finally, you have this stored logmasities somewhere. Traditionally, you either stored logmasities
local to a text file, or for what the logmasities using the CIS log protocol and saved logmasities
there to to text files. But nowadays, there are many more possibilities.
You can forward messages in various formats to a CINC system, various log analytics applications,
but also stored them to databases, big data destinations, like Hadoop,
document stores, like LSD, search, MongoDB, various message filtering systems, like Kafka.
And here we have two generic solutions as well. I often mention Python. You can use Python to write
destinations, but you can also use the HTTP destination, and we try as APIs using the HTTP
destination. This is actually used for error stick search, telecom, Slack, and some other.
Here, I want to emphasize a system, an important system again to feature. It's message parsing.
It creates names that you pass from interesting message parts. Why is it important? Because
normally, when a logmasit arrives, this is a huge string, and doesn't know anything what is
inside it. But if you parse these logmasities and create name value parts, these name value parts
and be where you use for later on. For unstructured logmasities, you can use the port nptb message
parts are. For structured logs, we have parts that are commasaparated values, JSON, XML,
key value parts, and others. And you can combine these new parts, and we have quite a few examples
for this in the system and the configuration library. So we have parsers for pseudo logmasities,
Apache logmasities, Cisco logmasities, as they look like systemmasities, but where they do not
really compliant. They are not really compliant. So some additional parsing helps to get the
information out of them. So why in the UPRs are so important? Because they help in filtering a lot,
just consider the previous mentioned SSH logmasit. If it's just a long long string,
then you cannot re-fill their based on the content of this logmasit. But if you parse it,
then you can see that it's using a root, trying to connect from a given IP address from
the user in the given port, and an authentication method, and you can create an all-art,
for example, based on the user name. It's also useful for discard being served as full-considering.
And for storage, it's also useful as you can re-format logmasities to the needs of a given
destination, like sending the UPRs to Rustic Search, or one of my favorite examples is
one of our users is sending VMware logmasities or at the network. But those are really
long logmasities with lots of content, but from those only very minimal information,
what is really necessary for security analytics. So they forward only the parsed logmasage
and forward only those two fields, which are necessary for security analytics, and this way,
they save the robots of network, traffic, and storage costs each day.
Overuse the name that UPRs are also very useful outside of system energy, for reporting,
or reporting, and dashboard, just think of elastic search and kibana.
Now, let's change to FreeBSD audit. It's a security subsystem within FreeBSD, which can
log circulate in Iran. It's highly configurable what is included in these logs, and these
logs can be used for intuition, detection, or postmark them analysis of security incidents.
These are binary files and compatible with the macOS audit logs, as well.
You can enable audit logs in RC.com, or you can start it from the command right as well.
And configuration is under the ETC security directory, where you can find
you in what is logged, what is not included in the logs. By default, these logs are stored in
where audit current. The content of this file can be displayed using PR audit.
When freeBSD guys, you will be as the contacted me. I thought that we need to try to
base on C, but that's quite a long process. Luckily, when I checked how the freeBSD
audit subsystem works, I realized that we can use the PR audit command, the output of the PR
command within C, and that way creating a new source fiber for C, plus a few hours, including
writing the documentation instead of much longer times. What you need to be careful when creating
the driver for C, that even should be on a single line. The application showing the output
should be able to work from input from pair, or be able to continuously run.
And in a good case, it can each of us provide a structured output. In case of
PR audit, these are the command lines, command line options I used, a minus r for single line,
output, minus p to be able to work from the input from pair, command, and minus x for
axonal output. And if you want to integrate something else, which is again G, you should check
for signal options. This was my original sysloganges source freeBSD audit sysloganges source,
it works, but it has all of the implementation details, and it's not really nice.
And if you want to use it multiple times, then you copy and paste, that's also not
going to be nice.
So instead of that, what I did was creating that reuseable configuration block for
CISO GenG, this is something quite clear to be part of the next CISO GenG release.
This will hide the way of the implemented, well, most of the implementation details
from the users as you will see in later slides.
Here, what we did, we defined, we use, we are outed.
And for that, we defined some default command light options.
Here, we use the options shown on the previous slide.
So single line, use is still and has XML output.
Note that XML output is very nice.
It works with CISO GenG, but only if you compile CISO GenG or
have from ports, it's not among the default options.
So here is how you can use it.
As you can see, it's much nicer than seeing all of the command light options and
the findings and everything.
Instead, just write 3D as the audit and that's all.
Next, we defined an XML parser and all of the fields are expected with a prefix.
So we can easily identify what is coming from the XML parser.
We also defined JSON format output.
This way, you can see all of the name that you pass extracted from the audit logs.
And finally, we have a log statement, which connects all of these building blocks together.
The source, the XML parser and the file destination.
And here, you can see a log message written by CISO GenG.
And you can see that it's SSH, login message found by the audit,
out in 3D as the audit subsystem.
You can also work with a plain output if you do not have XML support included in CISO GenG.
In this case, you need to define parameters for,
without XML support.
So it's just minus p minus r.
Here, we simply write the results to a text file.
And the log statement at the end connects these two building blocks together.
Here, you can see plain text output.
And here, the CISO GenG message header.
So the date, the host name.
And after that, you can see the VBS, the audit log, a spring text.
There are a couple of limitations of this solution.
We are most likely fixed, some of these, but some of these are outside of the scope of CISO GenG,
which means that if a field coming from the audit logs has a space in it,
then CISO GenG adds double quotation marks to the given field.
For text, the actioner parts are actually leading underscore to techniques,
which cannot be changed or removed.
And as we do not read log 5 directly, we cannot bookmark where we are,
which means that when CISO GenG is restarted,
that there might be duplicate audit logs or some of these single logs,
depending on the amount of log messages.
And finally, some good news for CISO GenG.
These are some VBSD. And actually, I'm trying actively push VBSD related improvements
within CISO GenG, as next to Ratatly Nox.
VBSD is our second largest CISO community.
So I'm very happy to share that the latest CISO GenG release fixed,
long-standing programs with code compatibility,
which means that we can compile a lot more diverse on CISO GenG.
And CISO GenG, we have open terminally and BigQuery support,
and a few more, you know, adderable on VBSD.
We also fixed a few.
Configure related box, which means that NQTT support is no available on VBSD.
And we have a brand new implementation for directory monitoring,
based on KQ, which means that reading files,
especially if you have many files in a directory,
it's now much faster, and it's using a lot less resources on VBSD.
And actually, it's much better on VBSD than on any other operating systems.
So let me summarize my talk.
You can easily integrate application output,
which CISO GenG in just like VBSD audit logs,
if the application runs continuously,
and can print single-line messages preferable in a structured format.
There are several new drivers available for CISO GenG on VBSD.
So you can start working on open terminally, for example,
and file reading and directory monitoring became a lot more efficient
on VBSD with latest release.
So thank you for your attention, and I look forward to some questions.
Thank you.