1
00:00:00,000 --> 00:00:12,260
Thanks for waiting, everybody. First off, really quick, this is a non-important warning. If you're an expert, just leave. Seriously, you're not going to offend me. Don't, you know, stay here.

2
00:00:14,400 --> 00:00:18,980
Basically, what I want to talk about is data forensics, incident response, and open source

3
00:00:18,980 --> 00:00:25,760
tools, or, excuse me, open source intelligence tools. And if you saw Rhett's talk, go eat

4
00:00:26,320 --> 00:00:30,060
and bring me some beer or cider or something, because I'm pretty nervous standing up here

5
00:00:30,060 --> 00:00:34,880
right now. And if you're a noob and you know it, clap your hands.

6
00:00:40,560 --> 00:00:41,220
All right.

7
00:00:42,700 --> 00:00:47,960
So, as I said, this talks about DFIR automation orchestration tools for open source intelligence

8
00:00:47,960 --> 00:00:56,580
and reconnaissance. And since Jay Haddix had the slide of basically doing OSN like a boss

9
00:00:56,580 --> 00:00:59,720
or something like that, I had to switch my slide. Didn't know that he actually had that,

10
00:00:59,840 --> 00:01:01,820
so I switched it to collecting evidence like a robot.

11
00:01:05,340 --> 00:01:09,480
Typical disclaimer. Opinions are mine or borrowed and may not represent my employer.

12
00:01:09,960 --> 00:01:11,200
They're really just concepts.

13
00:01:11,200 --> 00:01:12,720
And opinions are nothing more. I'm not a lawyer.

14
00:01:14,720 --> 00:01:24,320
Who am I? Okay. So, my name is Tyler Rohrbaugh. I have 14 years in cyber. Yes. You know.

15
00:01:24,760 --> 00:01:32,480
I said cyber. Primarily, my work's been in vendors, consulting, and contracting. And

16
00:01:32,480 --> 00:01:37,140
I've tried stuff in a variety of different areas, but I'm not an expert in anything at

17
00:01:37,140 --> 00:01:38,180
all. Okay.

18
00:01:38,280 --> 00:01:39,360
So that's why I said.

19
00:01:39,360 --> 00:01:45,460
If you're a noob, this is great for you, because I'm definitely a noob. This is also

20
00:01:45,460 --> 00:01:46,680
my first talk. So.

21
00:01:52,060 --> 00:01:59,480
Okay. So, if you guys have been in any of the other talk for OSN, there's

22
00:01:59,480 --> 00:02:06,700
a lot of tools that exist. There's DataSploit and Tree.io, which was talked about. NetGlobe,

23
00:02:06,720 --> 00:02:09,340
Recon, NG, Palantir, which is a very big one. But, you know, there's a lot of tools that

24
00:02:09,340 --> 00:02:15,160
exist, but it's very expensive. Maltego, Hunchly, which I think is pretty new. And there's

25
00:02:15,160 --> 00:02:21,040
a really cool website called Awesome OSN on GitHub, if you haven't already seen it. It's

26
00:02:21,040 --> 00:02:25,680
pretty useful. It's got a lot of information. And then, from that standpoint, you can just

27
00:02:25,680 --> 00:02:30,180
keep going and going and going. And part of this talk goes actually about that, is

28
00:02:30,180 --> 00:02:35,280
that, from what I've seen about a lot of OSN gathering, you either have pen testing or,

29
00:02:35,820 --> 00:02:39,120
like, human int or open source intelligence gathering for people and things like that.

30
00:02:39,340 --> 00:02:44,320
And the thing is, is that some of it, there's a process, and some of it, there's not. I've

31
00:02:44,320 --> 00:02:48,440
seen a lot of different talks. I've seen a lot of different people over the years talk

32
00:02:48,440 --> 00:02:53,940
about things. And I'm really interested in feedback around a process. What I mean is

33
00:02:53,940 --> 00:02:59,320
not just a manual step process, but is it possible to basically break this down into

34
00:02:59,320 --> 00:03:03,980
a playbook or be able to do something where you can do this in a step-by-step process

35
00:03:03,980 --> 00:03:08,240
that can be automated to some degree. And I'm not talking, like, use tool one, tool

36
00:03:08,240 --> 00:03:12,320
two, tool three, tool four, et cetera. I'm talking be able to automate it, end to end,

37
00:03:12,460 --> 00:03:15,860
and then basically break up in pieces where you can't actually automate it.

38
00:03:17,280 --> 00:03:27,180
So, who in here knows much about data forensics? Anybody? Cool. Okay. So the reason why you

39
00:03:27,180 --> 00:03:32,740
want to use data forensics instant response tactics for open source intelligence is it

40
00:03:32,740 --> 00:03:36,520
allows you to understand and reduce your attack service. You can gain awareness of threat

41
00:03:36,520 --> 00:03:36,940
actors.

42
00:03:38,240 --> 00:03:39,600
Answer, answer, response to investigations.

43
00:03:40,260 --> 00:03:41,740
Now, are you doing this today?

44
00:03:41,880 --> 00:03:42,300
Just wondering.

45
00:03:42,840 --> 00:03:43,200
Okay.

46
00:03:43,380 --> 00:03:44,120
So that's what I said.

47
00:03:44,180 --> 00:03:46,620
Experts, you know, just, you know, go ahead and bounce out.

48
00:03:48,820 --> 00:03:49,900
Or you can just use it for fun.

49
00:03:50,920 --> 00:03:51,940
And everybody's seen this.

50
00:03:51,980 --> 00:03:52,820
Everybody's probably done this stuff.

51
00:03:53,340 --> 00:03:56,720
But in my case, it was, you know, like getting to know your CEO.

52
00:03:57,760 --> 00:03:59,400
And everybody's seen this kind of information.

53
00:04:01,520 --> 00:04:03,720
That's actually my CEO for the company I work for.

54
00:04:05,060 --> 00:04:10,440
And at the very last minute, I was told not to basically put his information out there,

55
00:04:10,500 --> 00:04:11,560
which is understandable.

56
00:04:12,260 --> 00:04:17,200
And a lot of other targets that I went to go after said the same thing.

57
00:04:18,980 --> 00:04:23,700
So the next thing is something that's kind of interesting to me.

58
00:04:23,800 --> 00:04:27,080
And I don't know how many of you think about this.

59
00:04:27,180 --> 00:04:31,260
But when it comes to pen testing, it's one thing.

60
00:04:31,320 --> 00:04:33,520
You go out and you start basically gathering.

61
00:04:33,720 --> 00:04:36,240
And reconnaissance, you start gathering intel around a particular target.

62
00:04:36,360 --> 00:04:42,180
And then after that, you start, you know, determining what kind of information you can use to exploit, et cetera, et cetera, et cetera.

63
00:04:43,000 --> 00:04:49,460
But for me, the question is, if you're in OSN land and you started doing, gathering information about an individual,

64
00:04:49,980 --> 00:04:55,340
and they were your friend or something like that, could you automate a way to respond to them and help them out?

65
00:04:55,900 --> 00:04:57,540
And that may sound kind of weird.

66
00:04:57,620 --> 00:05:01,920
But what I mean by that is to be able to say, hey, here's some information out there on you.

67
00:05:01,980 --> 00:05:03,080
You might want to check that out.

68
00:05:03,720 --> 00:05:11,060
And do that in a way that's, you know, basically do that in a way that allows them to kind of improve themselves or whatever, right?

69
00:05:12,900 --> 00:05:16,160
So for me, I want to just point up a quick thing.

70
00:05:16,260 --> 00:05:19,800
I want to compare the differences between attacking response and OSN.

71
00:05:20,180 --> 00:05:23,260
So how many of you are basically do pen testing?

72
00:05:24,560 --> 00:05:24,920
Okay.

73
00:05:25,000 --> 00:05:25,540
Just got a handful.

74
00:05:25,680 --> 00:05:27,720
How many of you are new to all of this?

75
00:05:28,960 --> 00:05:29,320
Okay.

76
00:05:29,400 --> 00:05:29,740
Cool.

77
00:05:29,900 --> 00:05:30,360
All right.

78
00:05:30,440 --> 00:05:30,980
Next slide.

79
00:05:32,980 --> 00:05:37,020
How many of you, incident response, you're pretty much the only person to raise your hand for that part?

80
00:05:37,240 --> 00:05:37,360
Okay.

81
00:05:38,820 --> 00:05:41,120
So you'll obviously rip a hole through this next slide.

82
00:05:43,200 --> 00:05:46,320
But basically, I kind of looked at it from a lot of different places.

83
00:05:46,340 --> 00:05:47,280
I've studied CEH.

84
00:05:47,280 --> 00:05:48,320
I've studied a bunch of different things.

85
00:05:48,480 --> 00:05:54,780
And I wanted to put this into a process that kind of made sense that also seems that, like, everybody breaks it down into.

86
00:05:55,960 --> 00:06:00,440
And so basically from an attacking side, you have planning and reconnaissance.

87
00:06:00,440 --> 00:06:04,700
Threat modeling and vulnerability analysis, exploitation, and then you process that information.

88
00:06:04,700 --> 00:06:08,780
You start to do lateral movement within a network, et cetera, et cetera, et cetera.

89
00:06:09,640 --> 00:06:11,300
You persist, and then you report.

90
00:06:11,660 --> 00:06:12,100
Okay.

91
00:06:12,140 --> 00:06:16,620
Now, any pen testing people can clarify that's kind of summarized, right?

92
00:06:17,080 --> 00:06:17,520
Okay.

93
00:06:18,460 --> 00:06:21,180
From a response standpoint, you do the same kind of thing.

94
00:06:21,340 --> 00:06:22,540
You start to plan or prepare.

95
00:06:23,440 --> 00:06:30,420
You identify and you contain, and then you remediate, and then you recover, and then you basically learn and disseminate that information out to the team.

96
00:06:30,440 --> 00:06:31,960
Does that sound about right?

97
00:06:32,060 --> 00:06:32,360
Just curious?

98
00:06:32,480 --> 00:06:32,860
Cool.

99
00:06:34,080 --> 00:06:36,340
And OSN is kind of like that, right?

100
00:06:37,180 --> 00:06:38,680
Plan, prepare, identify, and collect.

101
00:06:39,340 --> 00:06:40,200
Process the information.

102
00:06:40,440 --> 00:06:41,440
Do analysis on it.

103
00:06:43,740 --> 00:06:48,000
Determine how you're going to deal with the production of that information, who you're going to give it to.

104
00:06:49,120 --> 00:06:51,940
And, you know, learn and disseminate that information.

105
00:06:54,300 --> 00:06:57,040
But it seems like everything's a five-step process.

106
00:06:58,080 --> 00:06:59,280
What happened to 12 steps?

107
00:07:00,440 --> 00:07:01,760
Does anybody have a beer?

108
00:07:01,920 --> 00:07:03,780
I'm, like, really egging for one right now.

109
00:07:06,160 --> 00:07:10,140
So why use a data forensic incident response automation orchestration tool?

110
00:07:11,200 --> 00:07:12,780
Because it's built to gather evidence.

111
00:07:13,140 --> 00:07:16,780
If you've used any kind of DFIR tool, they're really built around that.

112
00:07:16,880 --> 00:07:17,640
It's case management.

113
00:07:17,840 --> 00:07:19,400
It's built around gathering evidence.

114
00:07:19,880 --> 00:07:21,080
Maltego does this, of course.

115
00:07:21,840 --> 00:07:22,940
And it does it pretty well.

116
00:07:23,180 --> 00:07:25,680
And the big guys like Palantir, I think, do that.

117
00:07:25,780 --> 00:07:30,420
But the other thing that DFIR tools do really well...

118
00:07:30,420 --> 00:07:32,300
...is they can integrate with a ton of shit out of the box.

119
00:07:32,920 --> 00:07:34,420
That, to me, is really useful.

120
00:07:36,000 --> 00:07:40,880
Unfortunately, for my demo, you're not going to see quite much for that at the moment.

121
00:07:41,140 --> 00:07:43,480
But new tools can easily be added.

122
00:07:43,760 --> 00:07:46,380
You can pull data from one place to another, which is pretty cool.

123
00:07:46,500 --> 00:07:49,920
So you can ingest information into these new types of DFIR tools.

124
00:07:50,520 --> 00:07:53,940
And then you can push into other systems from one centralized place.

125
00:07:55,060 --> 00:07:59,620
A lot of the OSN tools, it's a lot about ingestion.

126
00:08:00,420 --> 00:08:03,760
But it's not a lot about going out and doing anything after the fact.

127
00:08:05,340 --> 00:08:06,380
And why else?

128
00:08:06,480 --> 00:08:08,120
Because we need to automate or die, right?

129
00:08:11,560 --> 00:08:12,900
There's no snake oil reason.

130
00:08:13,980 --> 00:08:14,380
Well...

131
00:08:16,760 --> 00:08:18,680
Because playbooks make it easy to automate.

132
00:08:19,440 --> 00:08:21,100
How many of you know what a playbook is?

133
00:08:22,640 --> 00:08:23,280
Okay, cool.

134
00:08:25,020 --> 00:08:29,600
So you don't know much about data forensics and its response, but you know a lot about playbooks.

135
00:08:30,480 --> 00:08:30,980
Hmm.

136
00:08:32,600 --> 00:08:33,100
Okay.

137
00:08:33,400 --> 00:08:36,920
Well, the next question it would be is...

138
00:08:38,600 --> 00:08:40,900
You've seen a lot of these DFIR tools then, right?

139
00:08:42,660 --> 00:08:43,160
So...

140
00:08:45,640 --> 00:08:46,800
Obviously, there's Demisto.

141
00:08:46,900 --> 00:08:47,760
That's who I work with.

142
00:08:49,060 --> 00:08:50,140
There's the Hive project.

143
00:08:50,320 --> 00:08:50,920
There's LogRhythm.

144
00:08:51,040 --> 00:08:52,580
The Hive project's also open source.

145
00:08:53,520 --> 00:08:56,500
Demisto's product line is partially open source.

146
00:08:56,660 --> 00:08:57,440
Their content's open source.

147
00:08:58,180 --> 00:08:58,960
There's Phantom.

148
00:08:59,120 --> 00:09:00,300
And they're, I believe...

149
00:09:00,420 --> 00:09:01,860
Some of their stuff's open source as well.

150
00:09:03,100 --> 00:09:09,960
There's Swimlane, Resolent, Simplify, CyberTourage, and Command, I think, just got acquired not too long ago by Rapid7.

151
00:09:10,520 --> 00:09:11,960
So that might be something to check out, too.

152
00:09:13,120 --> 00:09:15,740
All of those have automation frameworks built in.

153
00:09:16,080 --> 00:09:21,480
And most of them are in Python or JavaScript and allow you to kind of start gluing in all of these tools right in the frameworks.

154
00:09:21,660 --> 00:09:24,460
Or, excuse me, into their ecosystem and things like that.

155
00:09:27,040 --> 00:09:28,800
So, I have a question for everybody here.

156
00:09:28,940 --> 00:09:29,120
This...

157
00:09:29,120 --> 00:09:30,400
I'm trying to really make this a little bit more...

158
00:09:30,400 --> 00:09:30,720
More interactive.

159
00:09:30,900 --> 00:09:32,760
What is the standard of building a playbook?

160
00:09:32,900 --> 00:09:33,400
Does anybody here know?

161
00:09:35,980 --> 00:09:37,380
So, everybody's heard of playbooks.

162
00:09:37,500 --> 00:09:38,020
They've seen them.

163
00:09:38,180 --> 00:09:39,640
Everybody knows what a playbook is.

164
00:09:39,740 --> 00:09:43,040
But has anybody here heard of the standard?

165
00:09:44,760 --> 00:09:46,220
Well, I actually found one.

166
00:09:46,280 --> 00:09:47,080
There is a standard.

167
00:09:48,980 --> 00:09:50,920
The ICD standard says...

168
00:09:50,920 --> 00:09:52,960
And this is from, like, John Hopkins University or some shit.

169
00:09:54,220 --> 00:09:54,620
Oh.

170
00:09:56,320 --> 00:10:00,140
Has anybody in the room ever read, like, incident response policies?

171
00:10:01,460 --> 00:10:04,980
It's more legal-speak than it is actually what you need to do.

172
00:10:06,220 --> 00:10:08,560
And that's kind of what this standard says.

173
00:10:09,100 --> 00:10:11,460
And I'm not trying to diss on it or anything like that.

174
00:10:12,480 --> 00:10:13,760
Yes, I said diss.

175
00:10:13,780 --> 00:10:14,440
I'm that day and age.

176
00:10:15,040 --> 00:10:23,440
But basically, when I look at that, I was like, this is really academic for really explaining what a playbook does.

177
00:10:23,880 --> 00:10:27,560
Because it's really just a step-by-step process to glue shit together.

178
00:10:27,820 --> 00:10:28,120
Okay?

179
00:10:28,160 --> 00:10:28,680
That's it.

180
00:10:28,940 --> 00:10:30,240
So, the thing is...

181
00:10:30,240 --> 00:10:31,760
The thing is that when you have...

182
00:10:31,760 --> 00:10:32,900
Like, Maltego has transformations.

183
00:10:35,080 --> 00:10:39,080
But can you glue those together, you know, from end to end is what I'm asking here.

184
00:10:39,220 --> 00:10:41,440
Can you actually take Maltego transformations?

185
00:10:41,660 --> 00:10:44,680
Or can you take, like, Palantir?

186
00:10:44,740 --> 00:10:45,900
I've seen it.

187
00:10:45,940 --> 00:10:46,740
I've played with it.

188
00:10:46,780 --> 00:10:47,800
But I don't know it well enough to know.

189
00:10:47,860 --> 00:10:54,460
Can you glue, you know, tasks together from that and take the information and start to do things with it?

190
00:10:54,580 --> 00:10:56,220
Is that something that's possible?

191
00:10:56,420 --> 00:10:56,920
I don't know.

192
00:10:57,640 --> 00:10:58,780
So, that's kind of what I'm asking.

193
00:11:01,780 --> 00:11:04,400
So, this is an example of a playbook.

194
00:11:04,580 --> 00:11:05,560
And it's not...

195
00:11:05,560 --> 00:11:06,740
This is in a graphical form.

196
00:11:07,360 --> 00:11:08,620
You could write it down.

197
00:11:08,980 --> 00:11:11,500
An incident response plan should be written down.

198
00:11:11,820 --> 00:11:13,340
And you should have several of them.

199
00:11:15,040 --> 00:11:16,880
I've actually gone out and written some.

200
00:11:17,860 --> 00:11:18,460
Embarrassingly enough.

201
00:11:19,220 --> 00:11:24,080
And the thing is, is that some of those plans are not specific enough to what you really need to do.

202
00:11:24,480 --> 00:11:24,780
Okay?

203
00:11:26,340 --> 00:11:29,760
So, I mean, for example, how exhaustive are your incident response...

204
00:11:29,760 --> 00:11:30,220
Excuse me.

205
00:11:30,240 --> 00:11:31,560
Your incident response plans today?

206
00:11:31,940 --> 00:11:33,180
Are they pretty exhaustive?

207
00:11:33,200 --> 00:11:38,720
Are they book deep and they explain, okay, for example, if something happens, social media started going out,

208
00:11:38,840 --> 00:11:40,180
what you're supposed to do about that?

209
00:11:41,500 --> 00:11:44,040
Or do they just really say, well, contact Joe?

210
00:11:44,280 --> 00:11:45,300
Or contact Bob?

211
00:11:45,380 --> 00:11:46,180
Or contact Lacey?

212
00:11:46,260 --> 00:11:46,860
Or anything like that?

213
00:11:46,960 --> 00:11:50,000
Is that kind of what you hear or see?

214
00:11:50,920 --> 00:11:51,320
Anybody?

215
00:11:53,420 --> 00:11:53,820
Okay.

216
00:11:56,520 --> 00:11:59,900
Well, before we begin, and like I said, I've got some bugs.

217
00:12:00,240 --> 00:12:00,940
That's going on right now.

218
00:12:01,000 --> 00:12:01,760
I had to reboot a server.

219
00:12:01,960 --> 00:12:04,980
So I'm just going to show you kind of the process and the tool a little bit.

220
00:12:06,860 --> 00:12:14,860
And then what I will do after this is I'll make a video or I'll get a team of people to make me, you know, basically make a video of the process that I want to go through.

221
00:12:14,960 --> 00:12:26,520
And the other thing that I'm trying to do is really go back to the community and gain process information for different strategies that they would use for OSN gathering of information.

222
00:12:26,920 --> 00:12:27,240
Okay?

223
00:12:27,620 --> 00:12:28,620
That's kind of why I'm here.

224
00:12:28,740 --> 00:12:29,980
What I'm here to do is kind of explain.

225
00:12:29,980 --> 00:12:30,980
Okay, you have playbooks.

226
00:12:31,080 --> 00:12:31,940
Everybody understands them.

227
00:12:32,080 --> 00:12:33,860
Maybe I'm a noob and I just don't know.

228
00:12:34,300 --> 00:12:35,240
And that's certainly possible.

229
00:12:35,780 --> 00:12:42,840
But what I'd like to see is ways, a process to go through that says, okay, here's what you can do.

230
00:12:42,920 --> 00:12:47,420
And I want to build that out so that I can automate that from multiple different tools that are out there.

231
00:12:47,540 --> 00:12:50,440
And if you've seen, like, Intrigue.

232
00:12:51,160 --> 00:12:52,140
Intrigue is a great tool.

233
00:12:52,200 --> 00:12:55,640
It has a lot of different integrations.

234
00:12:55,960 --> 00:12:57,860
Maltego's got a lot of different integrations.

235
00:12:58,160 --> 00:12:59,820
But what I want to see is playbooks.

236
00:12:59,980 --> 00:13:02,340
It's on how to actually use those integrations.

237
00:13:03,180 --> 00:13:18,180
And for me, I have ideas, but I'm going to start pulling people on both sides, from the pen testing side, from the data forensics incident response community, and from the open source intelligence community, and start to actually gather information around those playbooks.

238
00:13:18,340 --> 00:13:29,280
Because to me, that allows you to automate things end to end, or at least to the point where a person gets information not just in one place, but is able to take action on it.

239
00:13:29,340 --> 00:13:29,960
I think that's something.

240
00:13:29,960 --> 00:13:30,940
I think that's something with OSN data.

241
00:13:31,120 --> 00:13:33,360
It's like, well, you create a report, and you just hand it to somebody.

242
00:13:33,960 --> 00:13:34,700
I don't know.

243
00:13:34,760 --> 00:13:35,520
That's kind of what I've seen.

244
00:13:37,500 --> 00:13:41,160
So before we get started, let's ask a couple basic questions.

245
00:13:41,320 --> 00:13:46,660
And the reason I said this is for noobs and stuff is because, for me, I've gone through a lot of online stuff.

246
00:13:46,760 --> 00:13:48,360
I've gone through a lot of reading and things like that.

247
00:13:48,480 --> 00:13:57,440
And I was like, okay, I need to kind of process this in a way that I can kind of break it down to my simple terms.

248
00:13:58,440 --> 00:13:59,440
I'm like Forrest Gump.

249
00:13:59,960 --> 00:14:00,100
Slow.

250
00:14:00,620 --> 00:14:03,100
So I have to break things down really slowly, right?

251
00:14:07,100 --> 00:14:07,820
So planning.

252
00:14:07,960 --> 00:14:12,640
The big thing is you want to start out and you want to ask the question of is, do we have a plan, purpose, or target?

253
00:14:12,740 --> 00:14:27,360
Now, out of all the talks I've seen in general and books I've read and things like that, there seems to be a lot of bouncing around when it comes to having a plan for the purpose of what you're trying to do with a target.

254
00:14:27,420 --> 00:14:29,880
Unless you have a mission or goal.

255
00:14:29,960 --> 00:14:31,640
Or what you're trying to do with the information.

256
00:14:32,660 --> 00:14:46,080
And so that, to me, is something that's like, okay, having an idea for what you're going to do with the information, I think, is much bigger than what you're trying to target or what the purpose is of what you're trying to target, if that makes any bit of sense.

257
00:14:49,340 --> 00:14:53,720
Then you want to identify what kind of information are we going to collect, like I said.

258
00:14:54,220 --> 00:14:55,660
What's the kind of information you want to go for?

259
00:14:58,420 --> 00:14:59,880
Is this ethical or legal?

260
00:14:59,960 --> 00:15:02,940
As you can see, I've got a really big flaw in my slide there.

261
00:15:05,700 --> 00:15:08,640
And how we're going to process the information and what tools.

262
00:15:11,960 --> 00:15:14,480
Who can collaborate and do analysis with you on it?

263
00:15:14,580 --> 00:15:26,080
And so this is a big piece of why I'm trying to show you this type of tool that does data forensics and answer response for OSN is because, has anybody here done OSN on CTF and things like that?

264
00:15:28,940 --> 00:15:29,380
Basically.

265
00:15:30,360 --> 00:15:32,440
How do you collaborate today, right now?

266
00:15:32,540 --> 00:15:37,900
Do you use any kind of tool right now to collaborate, like Slack, for the CTFs or anything like that?

267
00:15:38,560 --> 00:15:41,140
Okay, so if you use Slack, then this is kind of a quick demo, okay?

268
00:15:43,320 --> 00:15:44,440
How long do we have to investigate?

269
00:15:44,660 --> 00:15:46,360
Well, I have about five minutes, so I've got to hurry.

270
00:15:47,240 --> 00:15:48,940
And I'm going to show you a quick example demo, okay?

271
00:15:53,360 --> 00:15:55,960
So, this is the tool of the company I work for.

272
00:15:57,020 --> 00:15:57,940
It's called DEMISTO.

273
00:15:58,420 --> 00:15:59,940
And if you want a really fun project, you can go to DEMISTO.com.

274
00:15:59,940 --> 00:16:07,740
There's a little tiny QR code over there in the left-hand corner that would be kind of cool to take home and look at.

275
00:16:08,640 --> 00:16:14,560
It's a nice open source intelligence, you know, fun thing to do.

276
00:16:15,020 --> 00:16:22,580
Anyway, so the way this tool works is it has integrations and everything is pretty much command line driven or it's driven by playbooks.

277
00:16:23,140 --> 00:16:29,640
And a simple playbook, like I was trying to show, is, if I can get the load.

278
00:16:46,100 --> 00:16:46,460
And this code is going to be input.

279
00:16:46,460 --> 00:16:50,600
Well, basically, let me see if I can get any of these to load.

280
00:16:51,980 --> 00:16:57,940
On the outside, you see here, you have settings, automations, playbooks, indicators, reports, dashboards, jobs, incidents.

281
00:16:58,300 --> 00:16:59,820
And what ends up happening?

282
00:16:59,940 --> 00:17:02,620
And as you go through and you create a new incident,

283
00:17:02,880 --> 00:17:04,860
you start to associate it to a playbook.

284
00:17:05,100 --> 00:17:07,840
And from that point, then, what happens is

285
00:17:07,840 --> 00:17:11,820
it allows you to assign that incident to somebody,

286
00:17:11,940 --> 00:17:15,320
just like a data forensic incident response tool does today,

287
00:17:15,500 --> 00:17:17,080
allows you to assign a case to somebody,

288
00:17:17,180 --> 00:17:18,260
or like if it was a JIRA ticket,

289
00:17:18,440 --> 00:17:20,220
or if it was a different type of ticketing system

290
00:17:20,220 --> 00:17:21,280
or case management system.

291
00:17:22,820 --> 00:17:26,120
From that point, though, what's neat about this tool,

292
00:17:26,300 --> 00:17:27,700
it's not loading at the moment,

293
00:17:27,700 --> 00:17:32,340
but is that you can go and actually, from the incident,

294
00:17:32,520 --> 00:17:34,300
you can start to invite people in

295
00:17:34,300 --> 00:17:37,420
and collaborate on a goal or a mission

296
00:17:37,420 --> 00:17:39,200
or on a particular topic

297
00:17:39,200 --> 00:17:44,000
or the type of target that you're trying to go after.

298
00:17:47,080 --> 00:17:49,640
I'm sorry, I don't have a connection at the moment.

299
00:17:54,240 --> 00:17:55,920
Well, that's it, right?

300
00:17:56,040 --> 00:17:57,420
I mean, that's pretty much all I've got.

301
00:17:58,060 --> 00:17:59,640
So what I will tell you is this.

302
00:17:59,800 --> 00:18:01,280
If you want to check the tool out,

303
00:18:01,440 --> 00:18:03,520
you can go on demisto.com.

304
00:18:03,680 --> 00:18:04,360
It's free.

305
00:18:05,020 --> 00:18:05,900
It's downloadable.

306
00:18:05,980 --> 00:18:07,260
The content's open source.

307
00:18:08,280 --> 00:18:11,260
And from there, you can start to look at,

308
00:18:11,300 --> 00:18:13,320
there's a ton of videos out there online about this.

309
00:18:13,520 --> 00:18:15,660
And I'll put together a video that'll show

310
00:18:15,660 --> 00:18:17,300
actually a full demonstration end-to-end

311
00:18:17,300 --> 00:18:20,980
of how to use this for open source intelligence.

312
00:18:21,320 --> 00:18:22,400
Does that sound reasonable?

313
00:18:22,880 --> 00:18:25,780
Yeah, it's called demisto, D-E-M-I-S-T-O.com.

314
00:18:25,960 --> 00:18:27,140
We also have a community

315
00:18:27,140 --> 00:18:30,440
for about 1,400 different data forensics

316
00:18:30,440 --> 00:18:33,440
and incident response people today on Slack.

317
00:18:34,640 --> 00:18:37,600
And if anybody wants to connect with me afterwards,

318
00:18:37,760 --> 00:18:39,280
just let me know, and I'll get you a free copy

319
00:18:39,280 --> 00:18:40,420
and all that stuff and set up.

320
00:18:40,580 --> 00:18:42,100
But I do want to show a video of this,

321
00:18:42,220 --> 00:18:44,360
and I'm sorry that it's not,

322
00:18:44,440 --> 00:18:46,460
you know, I'm not able to connect right now at this moment.

323
00:18:47,680 --> 00:18:48,480
But that's it.

324
00:18:48,520 --> 00:18:48,980
That's all I have.

325
00:18:50,600 --> 00:18:51,320
Thank you.

326
00:18:51,340 --> 00:18:51,920
Thank you.

327
00:18:53,460 --> 00:18:53,820
Thank you.

328
00:18:55,720 --> 00:18:56,080
Thank you.

329
00:18:56,080 --> 00:18:56,280
Thank you.

330
00:18:56,740 --> 00:18:57,100
Thank you.

331
00:18:57,100 --> 00:18:57,120
Thank you.

332
00:18:57,140 --> 00:18:58,520
Wait for the package to come.