Join me today for a webinar of how integrating Open Source Intelligence within ArcSight ESM using ArcOSI.
If you would like to register: http://www.arcsight.com/webinars/watch/integrating-open-source-intelligence-osint/
Topics we will cover:
What is OSINT and how has it become a powerful SIEM use cases for 2011. The following webinar will cover:
• Why A/V does not cut it anymore
• How to detect the new threat: APT, client-side, malware
• What OSINT is
• An introduction to ArcSight Open Source Intelligence (ArcOSI)
Tuesday, February 22, 2011
Thursday, January 13, 2011
ArcOSI 2.1 Released!
Just uploaded the newest version of ArcOSI Open Source Intelligence Utility for use with ArcSight ESM. I've added several new malware domain feeds and improved the code to handle connection errors, etc. I'm making time for this project now and will soon add support very soon for proxy and proxy-auth as this has been requested numerous times!
Thanks to everyone who has tested and just a reminder feel free to reach out directly if you have any issues, feedback or requests.
http://code.google.com/p/arcosi
-Greg
Monday, October 25, 2010
Monday, October 18, 2010
Security B-Sides DFW Nov 6th
The very first B-Sides security conference in Dallas, TX is coming up Nov 6th and I will present early morning on mass exploitation using Metasploit a cucumber and an iPhone.
Please bring your friends and co-workers who are interested in Security as these conferences are completely free and typically loads of fun.
Hope to see you there, cheers.
http://www.securitybsides.org/BSidesDFW
Monday, September 6, 2010
Amun Honeypot with ArcSight CEF support
Playing around this weekend and created a CEF syslog output plugin for Amun honeypot, here is the sample output (dst IP scrubbed):
Sep 6 19:44:30 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=222.186.27.82,dst=76.78.17.74,msg=DCOM Vulnerability,dpt=135,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Now need to feed these into an ESM active list...
To be nice, I packaged up the CEF enabled Amun honeypot into a 200MB Ubuntu VM so you can try this out in your ArcSight lab or production. Follow the easy directions to re-IP and setup syslog out. You will be nabbing attackers and the latest malware in no time!
***update: I Googled the attacker IP's in the post above and found no mention of them in any open malicious IP lists, this highlights the effectiveness of using honeypots to gather the absolute latest intelligence on hosts attacking your perimeter (and others).
***update 2: VM boot issue fixed, sorry about that!
Sep 6 19:44:30 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=222.186.27.82,dst=76.78.17.74,msg=DCOM Vulnerability,dpt=135,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Now need to feed these into an ESM active list...
To be nice, I packaged up the CEF enabled Amun honeypot into a 200MB Ubuntu VM so you can try this out in your ArcSight lab or production. Follow the easy directions to re-IP and setup syslog out. You will be nabbing attackers and the latest malware in no time!
***update: I Googled the attacker IP's in the post above and found no mention of them in any open malicious IP lists, this highlights the effectiveness of using honeypots to gather the absolute latest intelligence on hosts attacking your perimeter (and others).
***update 2: VM boot issue fixed, sorry about that!
Saturday, August 28, 2010
MIT Courseware: Learn to program in Python
Just wanted to share this excellent resource as I have been mentoring new security professionals and a majority of them have never written a script before. Open course ware is one of the greatest things to come out in recent years and I understand this is one of the best intro programing lectures:
http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-00-introduction-to-computer-science-and-programming-fall-2008/lecture-videos/
http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-00-introduction-to-computer-science-and-programming-fall-2008/lecture-videos/
Thursday, August 12, 2010
ArcOSI - ArcSight Open Source Intelligence
Just in time for the ArcSight annual users conference I will be presenting on integrating Open Source Intelligence in ESM and have updated the original malwarefeed.py script with a version which can pull from multiple configurable sources!
If you want to give it a spin on your own environment now, download the python script version below and start streaming thousands of known malicious IP's right into ESM via CEF syslog.
http://code.google.com/p/arcosi/
usage: ./arcosi.py 127.0.0.1
If you want to give it a spin on your own environment now, download the python script version below and start streaming thousands of known malicious IP's right into ESM via CEF syslog.
http://code.google.com/p/arcosi/
usage: ./arcosi.py 127.0.0.1
Subscribe to:
Posts (Atom)