1
00:00:19,670 --> 00:00:21,990
Okay, good morning everybody.

2
00:00:21,990 --> 00:00:24,950
Welcome to DEF CON 28, Blue Team Village.

3
00:00:25,070 --> 00:00:30,590
We are going to start this morning's workshop off with Lennart Koopman from Greylog.

4
00:00:30,590 --> 00:00:33,790
He's going to be doing an introduction to the OpenStock CTF tools.

5
00:00:33,850 --> 00:00:35,450
Definitely worthwhile listening to.

6
00:00:35,450 --> 00:00:36,650
Hope everybody enjoys.

7
00:00:36,650 --> 00:00:40,710
I'm going to turn it over to Lennart now to get to the meat and potatoes of it.

8
00:00:40,710 --> 00:00:41,590
Thank you.

9
00:00:42,130 --> 00:00:43,410
That sounds great.

10
00:00:43,410 --> 00:00:44,710
Thank you so much.

11
00:00:44,930 --> 00:00:49,190
First time I'm doing a talk at a remote conference.

12
00:00:49,190 --> 00:00:52,210
I think we're all learning new things in this year.

13
00:00:52,550 --> 00:01:06,710
I wanted to, before I start with anything else, I just wanted to say thank you to the organizers not only of DEF CON, but also the organizers of Blue Team Village, because I think that's just an amazing job they're all doing.

14
00:01:06,710 --> 00:01:09,990
They're doing that every year, but now this year I think it's even harder.

15
00:01:10,210 --> 00:01:15,750
And I as a speaker, and I think I was the first in the lineup here, so some things were new to them too.

16
00:01:15,970 --> 00:01:18,590
I feel like they did an absolutely fantastic job.

17
00:01:18,590 --> 00:01:26,690
So thanks everyone, and I hope everyone has an absolutely fantastic time at at DEF CON and at Blue Team Village specifically.

18
00:01:26,970 --> 00:01:35,650
So what I'm going to do today is I'm going to walk you through a very, very high-level overview of what Greylog is.

19
00:01:37,230 --> 00:01:41,570
And we're doing that because Greylog is also part of OpenSOC.

20
00:01:41,570 --> 00:01:49,090
And OpenSOC, the CTF of the Blue Team Village, if you're competing in it, you're going to be using Greylog a lot.

21
00:01:49,090 --> 00:01:57,930
So I was asked if I could give an introduction to it, especially I think for everyone, but even a little focused on the people that will be using it during OpenSOC.

22
00:01:57,930 --> 00:02:09,930
So I think it's going to be a fantastic overview if you're new to Greylog, or if you haven't looked at Greylog in a while, or if you're generally interested in open source software, DFIR, block management, whatever.

23
00:02:09,930 --> 00:02:12,730
I'm going to walk you through it, like I said, very high level.

24
00:02:13,130 --> 00:02:18,970
And very important, we're going to have a bunch of time for Q&A and questions at the end.

25
00:02:19,370 --> 00:02:27,390
That means that if you have any questions, we're going to go through them then, and I'm going to make sure that we leave enough time there.

26
00:02:27,630 --> 00:02:39,910
We will also be, when I say we, we Greylog people are going to be around in the Blue Team Village Discord, and there is a Greylog channel there under the Sponsors tab.

27
00:02:40,670 --> 00:02:42,590
And we'll be around there.

28
00:02:42,590 --> 00:02:43,810
We're in multiple time zones.

29
00:02:43,810 --> 00:02:47,430
There's a good chance you're going to meet someone from us over there.

30
00:02:47,430 --> 00:03:03,390
I believe we have a little flag at our username or something that shows that we're part of Greylog, and we'll be happy to also answer any kind of questions that you might have, maybe during the CTF or OpenSoc itself, or maybe in general about Greylog.

31
00:03:03,390 --> 00:03:04,530
So we'll be around.

32
00:03:04,530 --> 00:03:08,610
We'll be happy to answer any questions you have.

33
00:03:09,390 --> 00:03:12,230
Next slide is the agenda.

34
00:03:12,230 --> 00:03:19,590
I'm going to be very careful with not moving around too much and not skipping through slides too fast.

35
00:03:19,590 --> 00:03:24,130
I hope there's not too large of a delay between what I'm saying and what you're seeing.

36
00:03:25,290 --> 00:03:29,130
So that that is all in sync, but I'm going to be careful that that works.

37
00:03:29,130 --> 00:03:33,390
If there are any issues, you can always post in the Discord channel.

38
00:03:33,390 --> 00:03:38,590
There are moderators there, and they can make me aware if there's something going massively wrong in any way.

39
00:03:38,730 --> 00:03:43,190
The agenda for today, you'll see this here on the left, I think.

40
00:03:43,190 --> 00:03:49,670
I only have like three real slides, because I want to really show you Greylog as a product.

41
00:03:49,750 --> 00:03:51,190
I want to show you what it does.

42
00:03:51,190 --> 00:03:53,390
So it's going to be a big focus on a live demo.

43
00:03:53,910 --> 00:03:57,150
But I'm going to go over one slide, just real quick, about me.

44
00:03:57,150 --> 00:03:59,330
Then one about Greylog, give you a little bit of background.

45
00:03:59,970 --> 00:04:03,050
Then we can take a quick look at the Greylog architecture.

46
00:04:04,230 --> 00:04:19,350
Not kind of in the level of detail for when you would get ready to deploy this yourself, but just to give you an idea of how the parts of Greylog are kind of coupled together, so that you can, when you use it later, maybe a few things might make a little more sense.

47
00:04:19,350 --> 00:04:25,130
I just feel we should take a quick, just a minute, at the components of Greylog itself.

48
00:04:25,330 --> 00:04:26,830
Then, like I said, live demo.

49
00:04:26,830 --> 00:04:37,850
We're going to focus on analysis, because I think that's, as a user and as an analyst, that's probably the most important part for you, especially if you're part of OpenSoc this year.

50
00:04:39,090 --> 00:04:44,730
But we're also going to look at some differences if you're used to other tools.

51
00:04:44,730 --> 00:04:49,250
I think that could also be a really important kind of question that you might want to ask.

52
00:04:49,250 --> 00:05:04,230
If you are used to another log management tool out there, maybe if you have questions about how Greylog compares to that, from kind of how you use this, does Greylog do that, is there another way of doing that, so you can apply the knowledge that you have already,

53
00:05:04,230 --> 00:05:10,770
so that you can really apply this in a good way with a new product like Greylog.

54
00:05:11,550 --> 00:05:14,330
And then, like I said, we're going to have a lot of time for Q&A.

55
00:05:14,750 --> 00:05:20,110
For the questions that you have, please use the channel in the Blue Team Village Discord.

56
00:05:20,110 --> 00:05:24,130
If you're not in that yet, it's a good moment to just quickly sign up for that.

57
00:05:24,230 --> 00:05:30,050
Go to the Blue Team Village Discord, and in Discord you see these categories on the left in your sidebar.

58
00:05:30,170 --> 00:05:32,970
There's one that's called the Flamingo Hotel category.

59
00:05:32,970 --> 00:05:35,970
Made me miss Las Vegas very much when I saw that this morning.

60
00:05:36,270 --> 00:05:42,630
But there's the Flamingo Hotel category, and there's a channel in there that's called Text Workshop Track One.

61
00:05:42,630 --> 00:05:46,130
We are here right now, we're Workshop Track One, and that's a text channel.

62
00:05:46,170 --> 00:05:48,110
So that's where you can post your questions.

63
00:05:48,110 --> 00:05:55,590
The moment we're going into the Q&A phase, at the end of this, I'm going to go to that channel, and we can start to look at your questions and start answering them.

64
00:05:55,590 --> 00:05:56,170
All right?

65
00:05:56,570 --> 00:05:59,750
So, like I said, Text Workshop Track One.

66
00:05:59,750 --> 00:06:07,990
If you get lost somewhere in there after you join, like I said, there are moderators swarming that place, and they'll be happy to help you and guide you to the right channel.

67
00:06:07,990 --> 00:06:11,150
So just ask anywhere, and you should find it.

68
00:06:11,750 --> 00:06:13,710
About me, it's real quick.

69
00:06:14,050 --> 00:06:15,450
Lennart Koopman.

70
00:06:15,790 --> 00:06:20,690
My Twitter handle is at underscore Lennart, L-E-N-N-A-R-T.

71
00:06:20,690 --> 00:06:25,270
If you want to follow me on your own risk, you should definitely do that.

72
00:06:25,570 --> 00:06:29,510
My background is actually software development and architecture.

73
00:06:29,510 --> 00:06:36,490
So I've started my career as a software developer, and also started the Greylock project in 2009 already.

74
00:06:36,490 --> 00:06:40,010
I realized with horror that it's been 11 years already.

75
00:06:40,010 --> 00:06:46,910
It's been 11 great years, but 11 years is a pretty long time, and I felt like it was more like three years.

76
00:06:47,350 --> 00:06:59,170
But Greylock as an open source log management product started in 2009, I believe, actually pretty much on the day in 2009, like in early August.

77
00:06:59,270 --> 00:07:09,230
We had a nice little celebration at our last party over in Vegas.

78
00:07:09,810 --> 00:07:10,250
That was fun.

79
00:07:10,250 --> 00:07:11,150
I think there are pictures.

80
00:07:11,490 --> 00:07:16,990
I then started a company behind Greylock in 2013.

81
00:07:17,790 --> 00:07:22,710
That was after the open source project was showing some commercial interest from people out there.

82
00:07:22,710 --> 00:07:25,270
So they asked me, hey, can you give me support?

83
00:07:25,270 --> 00:07:27,070
And I said, hey, I don't know how to write an invoice.

84
00:07:27,310 --> 00:07:29,450
So that was a good moment to start a company behind it.

85
00:07:29,450 --> 00:07:30,790
That was 2013.

86
00:07:31,130 --> 00:07:34,290
I'm currently the CTO over here at Greylock.

87
00:07:34,350 --> 00:07:36,190
That's really what I started as, too.

88
00:07:37,170 --> 00:07:39,390
And I was born and raised in Germany.

89
00:07:39,390 --> 00:07:42,370
That's where my accent is coming from, if you can make it up.

90
00:07:42,390 --> 00:07:49,130
But I am living in beautiful Houston, Texas now, which is also where one of our offices is.

91
00:07:49,130 --> 00:07:55,010
The other offices are in Germany and then also straight out across the United States.

92
00:07:55,070 --> 00:07:57,250
I guess I have to say, we are hiring.

93
00:07:57,470 --> 00:08:05,090
If you want to go to greylock.org careers, there might be something that you could be interested in that's remote in Germany or the United States.

94
00:08:05,090 --> 00:08:06,510
But enough about me.

95
00:08:06,850 --> 00:08:08,370
Real quick about Greylock.

96
00:08:08,730 --> 00:08:16,810
This would be the moment at a conference or at a physical talk where I would ask who knows about Greylock, and then I would see hands go up or not go up.

97
00:08:17,010 --> 00:08:19,570
And then I could adapt this a little to the audience.

98
00:08:19,570 --> 00:08:22,610
So I'm just gonna tell you the whole story real quick.

99
00:08:23,390 --> 00:08:24,970
Open source log management.

100
00:08:24,970 --> 00:08:29,730
So you send Greylock or instruct Greylock to pull logs from somewhere.

101
00:08:29,930 --> 00:08:46,530
It will ingest these logs, it will parse them, and it will make them available for you for searching, analysis, threat hunting, for alerting, and also maybe to filter some out and say I'm actually not interested in these.

102
00:08:46,530 --> 00:08:48,470
Throw them away, route them somewhere else.

103
00:08:48,470 --> 00:08:53,810
Really a way to handle logs that are being generated in your environment.

104
00:08:54,050 --> 00:09:00,870
The three main use cases for that are dev or ops or DevOps, depending on what you're doing.

105
00:09:01,290 --> 00:09:07,390
Definitely very interesting for developers to do root cause analysis, to do monitoring, to do performance monitoring.

106
00:09:07,430 --> 00:09:27,210
Maybe when they know that there's an issue on the platform that they need to research or that they need to investigate, they use Greylock to go into the logs to figure out what exactly happened and to make sure that either it doesn't happen again or to put an alert on it or simply to resolve the issue that's causing it.

107
00:09:27,210 --> 00:09:28,130
Same for ops.

108
00:09:28,130 --> 00:09:32,690
For ops that could be just classic IT system ops.

109
00:09:32,690 --> 00:09:34,450
This could be network operations.

110
00:09:34,630 --> 00:09:36,890
I see a lot of people using it for that.

111
00:09:37,010 --> 00:09:53,110
The fastest growing use case has been for a while now security use cases, which I guess you as the audience here is probably very aware of, which basically means you're using it to keep a track record and a history of everything that's going on in the environment.

112
00:09:53,230 --> 00:10:04,670
That means you need to have a system that is able to really ingest all of your logs and to make sense of them and keep them for long enough so you can run your analysis against it.

113
00:10:05,950 --> 00:10:14,690
And it will then allow you to set up pretty complex alerting, like you would know it from some sim systems out there, for example.

114
00:10:14,790 --> 00:10:19,350
That's a feature that came out, I think, about a year or a year and a half ago.

115
00:10:19,350 --> 00:10:25,690
A new alerting engine that lets you help be a little more proactive about what's going on in your environment.

116
00:10:25,690 --> 00:10:29,630
But one of the other really classic use cases is you need to investigate an IP address.

117
00:10:29,630 --> 00:10:32,990
You need to investigate some kind of indicator of compromise.

118
00:10:33,070 --> 00:10:35,650
Something new came out and there's a new patch.

119
00:10:35,710 --> 00:10:41,270
You want to make sure that that specific file has not been anywhere in your environment in the last six months.

120
00:10:41,430 --> 00:10:44,970
Let's go in and let's see if that happened or not.

121
00:10:45,290 --> 00:10:54,850
And then, of course, classic DFIR incident response, figuring out if there was an attacker, what that attacker did, all of that fun stuff.

122
00:10:54,910 --> 00:10:57,890
And, of course, compliance, just having the logs somewhere.

123
00:10:57,890 --> 00:10:59,710
I think that is a valid use case.

124
00:10:59,930 --> 00:11:01,810
And for that, you need to centralize them.

125
00:11:02,150 --> 00:11:05,070
And I think Greylock is a really good choice for that, too.

126
00:11:05,810 --> 00:11:10,210
Like I said, started in 2009, really constantly grown since then.

127
00:11:10,430 --> 00:11:14,830
Very, very happy to have been a Blue Team Village sponsor really from the beginning.

128
00:11:14,830 --> 00:11:16,950
Like I said, absolutely fantastic people.

129
00:11:17,370 --> 00:11:20,790
Make sure to watch as much of their content as you can.

130
00:11:20,790 --> 00:11:23,930
And next year when we're hopefully all back in Vegas, make sure to stop by in person.

131
00:11:23,930 --> 00:11:25,230
It's always a lot of fun.

132
00:11:26,230 --> 00:11:37,550
And Greylock is also part of OpenSOC, the CTF that runs during Blue Team Village that has got so much positive feedback over the last years.

133
00:11:37,550 --> 00:11:39,950
Also, of course, extremely happy about that.

134
00:11:39,950 --> 00:11:46,510
And like I said, we'll be around to help you with any questions that comes up during your OpenSOC participation.

135
00:11:47,930 --> 00:11:53,450
Now, during OpenSOC or during the Blue Team Village, no booth this year.

136
00:11:53,450 --> 00:11:57,230
I was always happy to spend a day over there and just chat with people.

137
00:11:57,230 --> 00:12:00,050
Maybe give out some shirts and some Greylock swag.

138
00:12:00,110 --> 00:12:02,290
Because that is not happening this year.

139
00:12:02,290 --> 00:12:10,230
Make sure to stop by the Greylock channel in the Blue Team Village Discord, because I hear that we will be sending out swag from there.

140
00:12:11,070 --> 00:12:15,010
And then we'll be there to answer any of your questions.

141
00:12:15,630 --> 00:12:21,890
Very important is that OpenSOC is not running the latest version of Greylock yet.

142
00:12:21,890 --> 00:12:24,810
They're slightly behind it for some very good reasons.

143
00:12:25,530 --> 00:12:28,710
So the demo that I'm going to show you is the latest version.

144
00:12:28,710 --> 00:12:40,930
If you see something that's slightly different, definitely reach out to us in the Discord channel and we'll be happy to give you a maybe a workaround or tell you where that is.

145
00:12:40,930 --> 00:12:44,230
Or if it's simply not there and what else you could do about that.

146
00:12:44,230 --> 00:12:45,490
So just keep that in mind.

147
00:12:45,490 --> 00:12:49,930
But there's some structural differences about where some elements are.

148
00:12:49,930 --> 00:12:52,250
But overall, it's pretty much the same.

149
00:12:52,250 --> 00:13:00,230
And especially the core ideas and the core principles are of course the same, because they simply haven't changed in the last months.

150
00:13:00,830 --> 00:13:02,970
And then most importantly, have fun.

151
00:13:02,970 --> 00:13:03,950
Stay in touch.

152
00:13:03,950 --> 00:13:04,970
It's open source.

153
00:13:04,970 --> 00:13:07,490
So if you get interested in this, just start using it.

154
00:13:07,490 --> 00:13:08,770
Start running it yourself.

155
00:13:08,770 --> 00:13:10,330
It's designed for that.

156
00:13:10,770 --> 00:13:17,910
And there are many ways to install and run Greylock, especially if you maybe just want to try it out really quick.

157
00:13:17,910 --> 00:13:21,050
There's some ways to get something up and running really fast.

158
00:13:21,050 --> 00:13:23,690
There's a big community around this that can always help you out.

159
00:13:24,030 --> 00:13:26,330
So I want to say have fun and open SOG.

160
00:13:26,330 --> 00:13:28,550
I've only heard fantastic things about how much fun it is.

161
00:13:28,550 --> 00:13:30,470
So I'm sure you will have fun.

162
00:13:30,470 --> 00:13:33,690
And even if you're not participating in it, just download it.

163
00:13:33,690 --> 00:13:34,130
Give it a try.

164
00:13:34,130 --> 00:13:34,990
It's open source.

165
00:13:35,290 --> 00:13:36,650
That's what it's all about.

166
00:13:37,590 --> 00:13:42,450
So the next slide here promises a live demo.

167
00:13:42,510 --> 00:13:46,650
Before we do that I want to send you straight to the docs real quick.

168
00:13:46,970 --> 00:13:48,790
So we can look at the...

169
00:13:50,650 --> 00:13:52,070
I have to find where they are.

170
00:13:52,070 --> 00:13:53,510
First link here.

171
00:13:53,690 --> 00:13:55,130
Architectural considerations.

172
00:13:55,130 --> 00:13:57,510
And we will not be detailed.

173
00:13:57,650 --> 00:13:58,930
No worries.

174
00:13:58,930 --> 00:14:05,550
But I want to show you just really quick the parts that Greylock consists of.

175
00:14:05,830 --> 00:14:14,770
If you ever get stuck somewhere with Greylock, always go to docs.greylock.org if you feel like just looking it up yourself.

176
00:14:15,450 --> 00:14:16,610
That is up here.

177
00:14:16,610 --> 00:14:17,970
Docs.greylock.org.

178
00:14:18,010 --> 00:14:20,250
That's where all of our documentation lives.

179
00:14:21,130 --> 00:14:28,690
And if you can't figure it out there because your use case might not be described in there, then, like I said, reach out to us.

180
00:14:28,690 --> 00:14:32,030
But that's always a good place to get started.

181
00:14:32,690 --> 00:14:38,570
And I'm just using... you won't have to deal with the architecture because the open SOG folks are already setting that up for you.

182
00:14:38,570 --> 00:14:43,290
But just so you understand it, Greylock really consists of three big parts.

183
00:14:43,290 --> 00:14:45,210
Or three and a half big parts, I would say.

184
00:14:45,270 --> 00:14:50,110
There's Greylock itself, which consists of Greylock server and Greylock web interface.

185
00:14:50,110 --> 00:14:55,230
But it's really one system that you're running or one executable that you're running.

186
00:14:55,590 --> 00:14:57,330
And it has two dependencies.

187
00:14:57,530 --> 00:14:59,090
It connects to MongoDB.

188
00:14:59,090 --> 00:15:06,530
It does that to store some state, to store some cluster communication, to store some configuration that lives in MongoDB.

189
00:15:06,530 --> 00:15:10,690
And because there's really not much data, that MongoDB is really, really small in the end.

190
00:15:10,690 --> 00:15:15,390
Actually, most people will just run it on the same node as the Greylock server.

191
00:15:16,090 --> 00:15:24,670
And that way, you can almost forget that it's there and set it up in a replica set to make it highly available.

192
00:15:24,990 --> 00:15:29,550
The Elasticsearch part, though, that's what we're using to store the messages.

193
00:15:30,270 --> 00:15:35,730
And so that will, of course, you have to scale that properly because that gets all the load from searches.

194
00:15:35,730 --> 00:15:39,910
And it gets, of course, all the load from actually writing the messages to disk.

195
00:15:40,710 --> 00:15:50,310
And what happens is, if you connect to the Greylock web interface, it will basically execute API calls against the Greylock server.

196
00:15:50,310 --> 00:15:54,790
And it will say, hey, my user of the web interface is trying to search for these messages.

197
00:15:54,790 --> 00:16:05,230
And then the server says, yep, I'm going to search for them, queries Elasticsearch, gets the data back, does all its funky Greylock stuff with it, sends it back to the web interface, and the web interface displays it.

198
00:16:05,770 --> 00:16:15,910
I'm mentioning that because all the communication between the web interface and the Greylock server is really API calls, nothing else happening.

199
00:16:15,910 --> 00:16:21,290
All it is, it's just authenticated HTTP REST API calls.

200
00:16:21,310 --> 00:16:23,610
That means that you can also automate everything.

201
00:16:23,810 --> 00:16:31,690
So if you are getting at a point where you want to write a script to look at data, for example, you can always use the Greylock API.

202
00:16:31,690 --> 00:16:38,570
There's an API browser in Greylock, and you can start to write your Python scripts and start to pull that data out of Greylock and do something with it.

203
00:16:38,610 --> 00:16:44,010
That's kind of my secret sauce tip for if you're working in OpenSoC for sure.

204
00:16:44,010 --> 00:16:48,830
If you're good at Python or another language, then definitely keep that in mind that you can do that.

205
00:16:49,210 --> 00:17:00,030
But overall, Greylock server accepts the messages, you send the messages to the Greylock server, use the web interface to analyze, display, configure, set up alerts, all of that fun stuff.

206
00:17:00,030 --> 00:17:04,350
And then Greylock behind the scenes will do all the management of Elastic Search.

207
00:17:04,510 --> 00:17:07,270
You can define your retention times, all of that.

208
00:17:07,270 --> 00:17:21,170
So if you're maybe used to the Elastic Stack where you have to do a lot of stuff in Elastic Search itself, for Greylock you really just have to tell Greylock where the Elastic Search is and then Greylock takes care of the rest for you so you don't have to become an Elastic Search expert.

209
00:17:21,170 --> 00:17:23,930
I think that's a very important part.

210
00:17:24,790 --> 00:17:32,690
If you want to, you can scroll down here and look at what complex looks like with multiple nodes, clustering, load balancer in front.

211
00:17:32,710 --> 00:17:40,970
I think that is definitely out of scope right now for what you are about to do here or if you just want to give it a try.

212
00:17:40,970 --> 00:17:47,130
But be aware that this is all documented here and then there's also another setup guide that talks you through that.

213
00:17:47,130 --> 00:17:50,050
So it should be a good place to get started.

214
00:17:50,630 --> 00:17:53,770
All right, so now we're going to the real life demo part.

215
00:17:54,530 --> 00:18:02,010
And what I'm going to do is I'm going to walk you through... I made some notes here.

216
00:18:02,010 --> 00:18:05,550
I'm going to work with one, two, three, four areas really.

217
00:18:06,230 --> 00:18:09,130
And I want to spend the most time in the search and analysis.

218
00:18:09,130 --> 00:18:12,930
Like I said, I think that's where most of your time will be spent.

219
00:18:12,930 --> 00:18:20,390
But I just want to show you a few other parts of the system, at least real quick, so you are aware that they are there.

220
00:18:21,590 --> 00:18:24,650
So I always like to start in the system area.

221
00:18:24,650 --> 00:18:30,490
And that is simply because I think that gives you an idea of kind of the philosophy behind Greylock itself.

222
00:18:31,010 --> 00:18:38,470
Our idea is that you should have to set up a Greylock in a config file only initially and only once.

223
00:18:39,050 --> 00:18:42,550
Basically tell Greylock, where's my MongoDB search?

224
00:18:42,830 --> 00:18:49,610
Give it some data it needs to encrypt passwords, to set up TLS on the web interface, kind of this basic setup.

225
00:18:49,810 --> 00:18:54,570
And then from there on, we believe that you should be able to do everything from within the web interface.

226
00:18:55,170 --> 00:18:59,590
Like I said, those web interface calls are really just API calls.

227
00:18:59,590 --> 00:19:04,190
So if you want to use automation, you can just use curl to set up stuff automatically.

228
00:19:05,230 --> 00:19:10,810
But during, I would say, after a base setup, everything is configured in Greylock itself.

229
00:19:10,810 --> 00:19:14,790
And then Greylock keeps the configuration basically in MongoDB for you.

230
00:19:15,050 --> 00:19:17,790
What that means is, I just want to give you a real quick overview.

231
00:19:17,790 --> 00:19:20,130
We're going to go into that very deeply.

232
00:19:20,130 --> 00:19:27,710
But if we look at our pipelines, for example, that is where all of the message processing of Greylock is happening.

233
00:19:27,710 --> 00:19:33,550
This is not some API call where you have to post some cryptic language to.

234
00:19:33,550 --> 00:19:38,870
This is not a huge YAML file or JSON configuration of that.

235
00:19:38,870 --> 00:19:41,030
This is all, no, here we go.

236
00:19:41,030 --> 00:19:42,370
Here comes my Linux syslog.

237
00:19:42,370 --> 00:19:45,390
And I'm going to say, I want to parse some stuff out of it.

238
00:19:45,390 --> 00:19:53,250
And you just basically configure Greylock here with a very efficient and small rule language that then says, OK, everything has Linux syslog.

239
00:19:53,250 --> 00:19:55,010
Apply this regular expression on it.

240
00:19:55,010 --> 00:19:56,430
Extract some fields.

241
00:19:56,650 --> 00:20:00,490
You'll see here on the right, this is all the functions you can execute on it.

242
00:20:00,530 --> 00:20:02,310
You can drop a message.

243
00:20:02,470 --> 00:20:06,290
You can check what a message looks like and then define other actions on it.

244
00:20:06,290 --> 00:20:08,190
You can thread Intel lookups on it.

245
00:20:08,190 --> 00:20:10,350
You can run a Whois lookup on it.

246
00:20:10,350 --> 00:20:12,290
DNS reverse lookup on it.

247
00:20:12,290 --> 00:20:14,570
Run it against your own lookup tables.

248
00:20:14,970 --> 00:20:17,730
You can check if something is in a certain subnet.

249
00:20:17,950 --> 00:20:19,670
All of this processing happens.

250
00:20:19,670 --> 00:20:20,650
And this is very important.

251
00:20:20,650 --> 00:20:24,770
This is a very important thing that you need to understand, especially if you come from other systems.

252
00:20:25,550 --> 00:20:37,250
All the processing happens when the message arrives in Greylock, OK?

253
00:20:37,450 --> 00:20:45,430
That means that once a message has been written, that means that that message basically becomes immutable.

254
00:20:45,430 --> 00:20:47,890
That means that you cannot change it afterwards.

255
00:20:47,890 --> 00:20:52,990
That has some positive side effects and some side effects that you might have to work around.

256
00:20:52,990 --> 00:21:03,010
What that means, most importantly, for you, if you're coming from a system that allows you to transform data while you search, Greylock simply won't do that for you.

257
00:21:03,750 --> 00:21:07,150
Especially not in a way that you can then further search on.

258
00:21:07,150 --> 00:21:10,610
Everything that's in Elasticsearch is in Elasticsearch as it is.

259
00:21:10,610 --> 00:21:13,630
You can't transform the messages during search time.

260
00:21:13,710 --> 00:21:15,210
Very important to keep in mind.

261
00:21:15,210 --> 00:21:22,630
Of course, we've built our whole web interface and the processing in a way that you can still do all the good stuff with it.

262
00:21:23,170 --> 00:21:31,510
And it also means that we're getting a huge usability and performance hit from that in a good way, as in it's much easier to use.

263
00:21:31,510 --> 00:21:37,570
We hear a lot of people who come from these schema-on-read systems who say that is useful for a bunch of queries.

264
00:21:37,570 --> 00:21:50,790
But overall, just being sure what data you're already looking at and not having to mess with super complex queries all the time is actually something that in the long term people really, really start to like.

265
00:21:51,190 --> 00:21:52,630
So just be aware of that.

266
00:21:53,810 --> 00:21:58,530
You'll see in the inputs area, you'll see where all your messages are coming in.

267
00:21:58,530 --> 00:22:03,590
We've got a whole section here for authentication, if you want to connect that to LDAP or an AD.

268
00:22:03,910 --> 00:22:05,890
We have API tokens.

269
00:22:07,070 --> 00:22:10,710
There's all kinds of authentication mechanisms happening here.

270
00:22:11,710 --> 00:22:15,390
And also, that's the last thing I really want to touch on real quick, we have content packs.

271
00:22:15,390 --> 00:22:29,850
So if you want to export any kind of configuration, dashboards, reports, alerts, anything like that, and insert it into a different setup, you can export and import these things here using a feature called content packs.

272
00:22:29,850 --> 00:22:30,970
We've got outputs.

273
00:22:30,970 --> 00:22:35,350
There's a whole index management here, how long you want to keep data.

274
00:22:35,350 --> 00:22:40,930
Then after that data has been deleted, you want to archive, you want to close it, you want to delete it.

275
00:22:41,050 --> 00:22:42,750
All of that happens here.

276
00:22:42,750 --> 00:22:47,790
It's, I think, for you for now, and especially if you're just getting started, not super relevant yet.

277
00:22:47,790 --> 00:22:50,970
Just be aware that Greylock has that, Greylock does that for you.

278
00:22:50,970 --> 00:22:55,310
So always a good idea to maybe just click around in the system area a little.

279
00:22:55,530 --> 00:23:00,050
The other thing I just also really want to tell you, so you know that it's there.

280
00:23:00,050 --> 00:23:09,470
I am honestly not sure how much of that can be used during a CTF, but know that there is an alerting engine.

281
00:23:09,990 --> 00:23:12,470
I have here, this is kind of my small demo setup.

282
00:23:12,850 --> 00:23:21,990
I have an alert setup here that alerts me every time there's a high priority IDS alert, Greylock, and I have another one, and we can actually look at those.

283
00:23:22,390 --> 00:23:30,310
I live in southeast Texas, so we're pretty good at storms, and I live in the United States, so we're pretty good at not burying our power lines.

284
00:23:30,310 --> 00:23:37,110
So that combination will definitely require for you to have some kind of an uninterrupted power supply.

285
00:23:37,110 --> 00:23:54,130
So I'm reading the logs from one of my UPSs, sending those into Greylock, and I'm triggering alerts to my iPhone when the power goes out, because I really want to know about that, because maybe if it doesn't come back up within five minutes, I'm just going to start to shut down some servers remotely real quick,

286
00:23:54,130 --> 00:23:55,890
or do something else.

287
00:23:56,290 --> 00:23:59,290
So I have an alert setup here, let me look at this first.

288
00:23:59,710 --> 00:24:07,170
Under event definitions, I have a condition set up here called UPS without external power.

289
00:24:07,170 --> 00:24:08,370
Click on that.

290
00:24:08,370 --> 00:24:27,490
Really what it does is, it says when you find a message that has its status field set to OB discharge, which is the UPS reporting that it is now discharging, which means it has no power, I say when that happens, I don't need aggregations, I don't need groupings,

291
00:24:27,490 --> 00:24:30,570
I don't need any other further rules and statistics.

292
00:24:30,590 --> 00:24:33,930
Just the moment that happens, I want to be sent a message.

293
00:24:34,150 --> 00:24:44,070
Set this up here on notifications, I'm using Ops Genie, which is the system that Greylock can post these alerts to, and it will then send an alert on my phone.

294
00:24:44,590 --> 00:25:00,410
I say when that happens, send me a notification, and you can actually see here, if I go to my alerts and events, and I filter my events by UPS, you will see, because I'm looking here at the last 360 days right now, usually you would probably look at the last day or so,

295
00:25:00,410 --> 00:25:05,590
you'll see now a history of all the days when my UPS was out of power.

296
00:25:05,590 --> 00:25:16,450
So you see here, for example, just about almost exactly a month ago, my UPS was without external power and it did trigger a notification to my phone.

297
00:25:16,630 --> 00:25:27,130
So you can set up these things, you can set up all kinds of conditions, I can say only send me this if certain events happen in a certain order, all of that is there.

298
00:25:27,130 --> 00:25:37,330
Also, I don't think anything from this demo today, but just something to be aware of and know that it's there if you want to use it.

299
00:25:38,170 --> 00:25:43,230
Then we have the streams, and after that I'm going to go into search and analysis and give you a quick overview of that.

300
00:25:43,230 --> 00:25:45,390
But we have the streams here.

301
00:25:45,450 --> 00:25:51,070
Streams are basically, think of categorization of messages when they're going into Greylock.

302
00:25:51,190 --> 00:25:57,350
They are an important concept for Greylock because, for example, our retention settings are sitting on top of that.

303
00:25:57,350 --> 00:26:08,170
So if I say I want to keep my NetFlow logs for two days and my domain controller logs for two months, I would route them into two different streams with a very simple rule.

304
00:26:08,170 --> 00:26:19,870
This one here, for example, if the field Greylock type matches exactly the value NetFlow, then route this into the stream NetFlow.

305
00:26:19,870 --> 00:26:22,530
Another one here would be this one.

306
00:26:22,530 --> 00:26:30,170
Yeah, if the message matches the regular expression filter log at the beginning of the string, then route it into my firewall logs.

307
00:26:30,170 --> 00:26:36,490
I think here's one for, yeah, this is anything that has a snort process ID in it.

308
00:26:36,490 --> 00:26:38,490
Route that into my IDS alerts.

309
00:26:38,490 --> 00:26:43,790
So you're basically pre-configuring or pre-configuring messages and you put all kinds of stuff on top of that.

310
00:26:44,470 --> 00:27:00,590
Like further processing, extractions, enrichments, you can put access rights on top of that and say only team A is allowed to see my AD controller logs, but my support team is allowed to see, for example, my database debug logs or something like that.

311
00:27:00,710 --> 00:27:02,130
Same for retention times.

312
00:27:02,130 --> 00:27:04,810
A bunch of concepts in Greylock streams.

313
00:27:05,350 --> 00:27:14,450
I think for you, if you're getting started with this or using it during OpenSoC, I think it's just a great way to make certain types of messages available with one click.

314
00:27:14,450 --> 00:27:17,770
Okay, so we're now going into search and analysis.

315
00:27:17,950 --> 00:27:31,170
If I wanted to see all my firewall logs, I just click on the firewall stream and it opens a search page that has the stream selector here on top already pre-configured to only look at my firewall logs.

316
00:27:31,170 --> 00:27:32,450
I can select multiple here.

317
00:27:32,450 --> 00:27:37,310
So if I wanted to see all my firewall and all logs, you just do that.

318
00:27:37,550 --> 00:27:39,310
This thing's going to update.

319
00:27:39,610 --> 00:27:40,370
Here we go.

320
00:27:40,370 --> 00:27:42,430
And now we also got my NetFlow logs in it.

321
00:27:42,430 --> 00:27:45,510
For this example, though, I'm only going to look at my firewall logs.

322
00:27:45,510 --> 00:27:46,730
I'm going to take this out again.

323
00:27:46,730 --> 00:27:55,970
Every time I make a change to a query, you will see that this is... you get this little yellow icon here, which means, hey, you haven't executed your new search yet.

324
00:27:55,970 --> 00:27:59,910
I don't believe this is the case in the version you're going to be playing with.

325
00:28:00,030 --> 00:28:02,750
But if you download it fresh, that's definitely going to be the case.

326
00:28:02,830 --> 00:28:05,010
So I have to manually execute that one more time.

327
00:28:05,470 --> 00:28:07,630
What we're looking at here is our search page.

328
00:28:08,290 --> 00:28:10,810
So I think this is what you're going to spend the most time.

329
00:28:11,130 --> 00:28:14,890
So let me walk through the main areas, and then we can run more.

330
00:28:16,130 --> 00:28:20,890
Maybe execute a search query or two, and then I would say we go into Q&A.

331
00:28:20,890 --> 00:28:26,550
And I will ask a moderator to let me know when we run out of time during the Q&A.

332
00:28:26,550 --> 00:28:28,090
I think we started a little late .

333
00:28:28,090 --> 00:28:32,750
So just let me know what the best time for you as the organizers is.

334
00:28:32,750 --> 00:28:35,930
But you have three main areas here.

335
00:28:35,930 --> 00:28:39,170
You've got the search query bar here on top.

336
00:28:39,170 --> 00:28:48,810
This is basically where you are selecting what exactly you want to be searching for, in which stream, what query, and also in which time range.

337
00:28:48,810 --> 00:28:52,070
That's always the first thing you've got to think about.

338
00:28:52,130 --> 00:28:53,990
Then you've got a site bar here on the left.

339
00:28:53,990 --> 00:28:59,970
I think the important part of this is the fields area that shows you all the fields that are in these messages.

340
00:29:00,050 --> 00:29:04,170
So pre-parsed fields in the message.

341
00:29:04,650 --> 00:29:07,590
And then, of course, you've got the actual result set.

342
00:29:07,590 --> 00:29:12,450
So everything you're seeing here, everything under the... is your result set.

343
00:29:12,450 --> 00:29:17,770
So that is actually everything that Draylog returns for your search query.

344
00:29:17,770 --> 00:29:20,350
So let's say I don't want to search in the last five minutes.

345
00:29:20,350 --> 00:29:22,130
I want to search in the last hour.

346
00:29:22,790 --> 00:29:24,210
Change that.

347
00:29:24,230 --> 00:29:25,310
Execute it.

348
00:29:26,350 --> 00:29:27,190
Here we go.

349
00:29:27,190 --> 00:29:32,190
So now we're looking... you saw that this message count chart here changed.

350
00:29:32,190 --> 00:29:33,990
We're now looking at the whole hour.

351
00:29:34,610 --> 00:29:36,750
And I think that we can also...

352
00:29:36,750 --> 00:29:39,950
I don't think that's this one yet.

353
00:29:40,570 --> 00:29:45,470
But you can also definitely generate a widget that shows you how many messages were found in total.

354
00:29:45,470 --> 00:29:47,390
We can do that in just a second, actually.

355
00:29:48,890 --> 00:29:53,670
So let's say we're looking at all my firewall logs here in an hour.

356
00:29:53,670 --> 00:29:55,430
You see that we have a little bit of a spike here.

357
00:29:56,090 --> 00:30:00,950
And this is... firewall logs are always great because they have a lot of data in it, how much value you actually get out of them.

358
00:30:00,950 --> 00:30:02,210
So I think it's up to you.

359
00:30:02,210 --> 00:30:03,510
But it's a great example.

360
00:30:03,730 --> 00:30:14,070
And overall, the searches work the same for everything, no matter if it's a firewall log, a Windows log, a Linux log, a Amazon API log, anything like that.

361
00:30:14,070 --> 00:30:17,770
So if I click on it, you see here this is the original message that came into Greylock.

362
00:30:17,770 --> 00:30:19,290
Very hard to read.

363
00:30:19,530 --> 00:30:24,390
If I click on it, you get the details and you get what Greylock has actually returned.

364
00:30:24,390 --> 00:30:28,450
So you see that Greylock here has parsed this out into some fields.

365
00:30:28,450 --> 00:30:44,270
Like, for example, the destination address and destination port, header length, which interface it came in, which IP version it was, the length of the whole of the whole packet that was let through, which protocol it was.

366
00:30:44,270 --> 00:30:47,510
And you'll also see here that in this case, the action was block.

367
00:30:47,510 --> 00:30:53,030
Everything that I'm looking at here on these logs, I'm only sending me the block logs.

368
00:30:53,030 --> 00:30:54,970
So I'm not interested in what the firewall let through.

369
00:30:54,970 --> 00:30:59,270
I'm only interested in what the firewall actually blocked.

370
00:30:59,550 --> 00:31:03,090
So with all of this, you also see source address and source port.

371
00:31:03,530 --> 00:31:11,470
Let's say we only want to see the messages from a certain source, where the source address is set to this value.

372
00:31:11,570 --> 00:31:22,950
What I could do is I could go into the search query bar on top here and say source underscore address equals, and then 1356, whatever I want to look for.

373
00:31:23,790 --> 00:31:28,630
Much faster is to just simply click on the value.

374
00:31:29,070 --> 00:31:31,870
This context menu opens, and you say add to query.

375
00:31:33,090 --> 00:31:36,150
And it will just build that for you and immediately execute.

376
00:31:36,270 --> 00:31:44,690
So what we're now looking at is we're looking at all blocked packets from the last hour where this was the source address.

377
00:31:44,690 --> 00:31:48,710
So basically all the packets this source address sent us locked.

378
00:31:48,710 --> 00:31:56,070
Okay, so let's try to get a little bit of a better overview here of what that looked like.

379
00:31:56,070 --> 00:32:00,910
So I want to find out what's this all TCP or both.

380
00:32:01,090 --> 00:32:03,210
Do you see we have a field here called protocol.

381
00:32:03,730 --> 00:32:05,350
Try to get the top values.

382
00:32:05,350 --> 00:32:07,030
I want to see they're all set.

383
00:32:08,390 --> 00:32:11,170
I see something that's a protocol.

384
00:32:11,250 --> 00:32:13,110
Show top values.

385
00:32:14,170 --> 00:32:22,230
This opens, and you see that no, actually this source only sent UDP messages.

386
00:32:22,230 --> 00:32:27,930
Okay, let's go a little deeper and say is this always the same kind of package?

387
00:32:27,930 --> 00:32:30,210
Do they all have the same length?

388
00:32:30,210 --> 00:32:31,910
Like very, very uniform?

389
00:32:31,950 --> 00:32:32,750
Same thing.

390
00:32:32,750 --> 00:32:33,890
Data length.

391
00:32:33,910 --> 00:32:35,410
Show top values.

392
00:32:35,470 --> 00:32:35,850
Here we go.

393
00:32:35,850 --> 00:32:40,410
We see that actually all these packages are UDP and exactly 278 bytes long.

394
00:32:40,410 --> 00:32:45,170
That looks like we're just blocking the same package over and over and over again.

395
00:32:45,190 --> 00:32:50,630
Now what would be interesting, this setup isn't doing it, but if we were to run a lookup .

396
00:32:50,630 --> 00:32:56,110
That's a built-in lookup table onto the source address or our GeoIP to see where this is coming from.

397
00:32:56,110 --> 00:32:57,670
Who owns this IP address?

398
00:32:57,830 --> 00:32:59,490
Look up the underlying ASN.

399
00:32:59,490 --> 00:33:00,510
Do all of that stuff.

400
00:33:00,510 --> 00:33:04,990
I'm simply not doing that here in this setup, but that's all stuff that you could do.

401
00:33:05,730 --> 00:33:13,630
And now let's maybe say I want to see... now let's actually go back.

402
00:33:13,630 --> 00:33:15,510
I'm going to execute this query again.

403
00:33:15,510 --> 00:33:21,610
And what you're going to see is all the data in the result set, because the result set change, has now updated.

404
00:33:21,610 --> 00:33:27,530
Now we see for the last one hour, for everything that was blocked, UDP, TCP, and ICMP.

405
00:33:27,530 --> 00:33:30,510
Okay, I'm going to delete this widget here.

406
00:33:31,030 --> 00:33:33,210
I want to show you the aggregation builder.

407
00:33:33,210 --> 00:33:35,210
That's really the last part I want to show you here.

408
00:33:35,210 --> 00:33:38,930
For the search query language, go to docs.greylock.org.

409
00:33:38,930 --> 00:33:42,330
There's a whole page that explains the search query language for you.

410
00:33:42,470 --> 00:33:46,190
I don't want to go into too much detail here, because you can simply read it up there.

411
00:33:46,190 --> 00:33:47,110
It's pretty simple.

412
00:33:47,110 --> 00:33:50,230
It's in the end, if you've been using the Elastic Stack, it's the same language.

413
00:33:50,230 --> 00:33:51,650
We're just passing it through Elastic.

414
00:33:51,910 --> 00:33:54,270
So if you're used to that, same thing.

415
00:33:55,410 --> 00:34:00,410
So whenever Greylock creates a widget, that is under the hood.

416
00:34:00,410 --> 00:34:03,410
In fact, an aggregation and an aggregation builder.

417
00:34:03,410 --> 00:34:09,810
So you will always see this little icon, top right of the widget, that you can click on and say edit.

418
00:34:10,150 --> 00:34:13,810
And now edit is going to show you the aggregation builder.

419
00:34:14,650 --> 00:34:19,490
And it has one very important drop down box, which is the visualization type.

420
00:34:19,690 --> 00:34:27,530
Let's say you want to visualize this not as a data table, but as a bar chart.

421
00:34:27,530 --> 00:34:34,890
And say, I really want to see three bars here, with UDP the largest, TCP on second, and then a tiny one for ICMP based on the count.

422
00:34:35,230 --> 00:34:36,450
You switch it up.

423
00:34:36,450 --> 00:34:37,250
Art chart.

424
00:34:37,350 --> 00:34:38,290
Here we go.

425
00:34:38,930 --> 00:34:39,870
Save it.

426
00:34:39,870 --> 00:34:42,230
I could now make a dashboard out of this.

427
00:34:42,230 --> 00:34:46,510
Here we see for the last hour, we mostly brought UDP stuff.

428
00:34:46,510 --> 00:34:47,730
Okay, interesting.

429
00:34:48,290 --> 00:34:54,430
You could, of course, if you really wanted to, make it... I think they're much harder to read, but sure, could do that.

430
00:34:54,450 --> 00:34:57,670
Greylock is not going to keep you from building weird charts either.

431
00:34:57,670 --> 00:34:59,810
So you want to make this a long chart?

432
00:35:00,690 --> 00:35:02,290
Sure, not a problem.

433
00:35:02,290 --> 00:35:03,270
Can do that.

434
00:35:03,790 --> 00:35:05,630
So this is our aggregation builder.

435
00:35:05,630 --> 00:35:06,810
You can do sorting.

436
00:35:06,810 --> 00:35:08,390
You can add multiple rows.

437
00:35:08,390 --> 00:35:09,770
We're going to do that in just one second.

438
00:35:09,770 --> 00:35:11,890
And you can also add metrics.

439
00:35:12,090 --> 00:35:21,170
So let's say I want to get the total bytes that were blocked over the last one hour.

440
00:35:21,170 --> 00:35:24,550
Okay, so you know we got the data length field here.

441
00:35:24,810 --> 00:35:26,490
Click on that, press chart.

442
00:35:26,490 --> 00:35:35,310
That is going to create a new widget, and that widget is basically just the same aggregation builder, but with other predefined values.

443
00:35:35,310 --> 00:35:36,830
Okay, you're going to see that in one second.

444
00:35:36,850 --> 00:35:39,970
Here we go.

445
00:35:39,970 --> 00:35:43,490
So now we got the average data length by timestamp.

446
00:35:43,490 --> 00:35:44,650
Click on edit.

447
00:35:45,530 --> 00:35:47,010
See, okay, that's our line chart.

448
00:35:47,010 --> 00:35:52,470
That's how much data was transferred per minute, in this case, on average.

449
00:35:52,870 --> 00:35:54,250
But you know what?

450
00:35:54,250 --> 00:35:57,590
Let's make this a data table, so you see what this looks like under the hood.

451
00:35:57,690 --> 00:36:01,150
It's like for each minute, it calculates the average data length.

452
00:36:01,150 --> 00:36:07,230
And with this kind of column row structure, you can put that into a bar chart.

453
00:36:07,230 --> 00:36:08,930
You can put this into a line chart.

454
00:36:08,930 --> 00:36:14,370
But I think what we're really interested in here, we don't want to look at the average data length.

455
00:36:14,610 --> 00:36:19,230
We want to look at the sum of the data length.

456
00:36:19,230 --> 00:36:22,090
Here we go.

457
00:36:22,450 --> 00:36:23,590
Data line chart.

458
00:36:24,310 --> 00:36:27,950
And now we see how many bytes are blocked in total.

459
00:36:28,370 --> 00:36:30,690
I just had to know that this was called sum.

460
00:36:32,630 --> 00:36:40,090
You can do standard deviation, max, min, count, cardinality, average, variance, percentile.

461
00:36:40,090 --> 00:36:42,750
You can do all of that stuff with it if you wanted to.

462
00:36:42,750 --> 00:36:43,170
Okay.

463
00:36:43,790 --> 00:36:46,710
One more thing I want to show you, and then we're going to go into Q&A.

464
00:36:47,330 --> 00:36:53,350
I really want to make sure that you start playing around with aggregation because that one is extremely powerful.

465
00:36:53,350 --> 00:36:57,530
It will really help you solve these challenges that OpenSock is going to give you.

466
00:36:57,990 --> 00:37:01,650
One more thing I want to show you is, let's say we want to build an aggregate.

467
00:37:01,650 --> 00:37:11,710
We say grouped by source address which protocol was used.

468
00:37:11,710 --> 00:37:12,190
Okay.

469
00:37:12,310 --> 00:37:14,870
So let's go into the source address.

470
00:37:14,970 --> 00:37:18,450
Get the top values of that as kind of a start.

471
00:37:18,730 --> 00:37:19,990
Add it.

472
00:37:20,030 --> 00:37:21,870
And we can add multiple rows here.

473
00:37:21,870 --> 00:37:25,130
So let's set this to protocol.

474
00:37:25,130 --> 00:37:28,150
I want to add a second type of row which is protocol.

475
00:37:29,070 --> 00:37:30,690
It's going to update.

476
00:37:30,690 --> 00:37:36,590
And you actually see here that these have all only communicated with UDP or TCP.

477
00:37:36,590 --> 00:37:38,730
They're not really doing multiple things.

478
00:37:38,730 --> 00:37:43,090
So to explain this a little better, let's build pairs of source address to destination.

479
00:37:43,510 --> 00:37:45,130
Take the protocol out.

480
00:37:45,210 --> 00:37:47,570
Add a new field, destination address.

481
00:37:48,770 --> 00:37:49,430
Here we go.

482
00:37:49,430 --> 00:37:53,970
So now you see this is not really what I wanted to show.

483
00:37:53,970 --> 00:37:55,210
It should be the other way around.

484
00:37:55,850 --> 00:37:58,410
Maybe destination address to source address.

485
00:37:58,530 --> 00:37:59,070
Here we go.

486
00:37:59,070 --> 00:37:59,890
That's what I wanted.

487
00:37:59,890 --> 00:38:05,910
So you get this grouping where you say this destination address was reached by these source addresses.

488
00:38:05,910 --> 00:38:09,890
And you can go lower and lower and lower as you wish and add more and more stuff.

489
00:38:09,890 --> 00:38:14,010
So let's say as the metric, here's the third column, I actually don't want the count.

490
00:38:14,010 --> 00:38:20,090
I do actually want the total bytes that were transferred.

491
00:38:20,090 --> 00:38:21,790
So the sum of the data length.

492
00:38:22,590 --> 00:38:35,630
So without any kind of complex queries, you establish that this destination address was hit by this source address with this many bytes over the last hour.

493
00:38:36,310 --> 00:38:39,050
And I can make this a little larger, put this wherever I want.

494
00:38:39,050 --> 00:38:42,410
I could now save this as a dashboard, share it with colleagues.

495
00:38:42,490 --> 00:38:44,650
There's a whole concept of parameters in there.

496
00:38:44,650 --> 00:38:47,110
It's all stuff I don't want to go into today.

497
00:38:47,530 --> 00:38:50,450
But that's all stuff that you can do.

498
00:38:50,470 --> 00:38:54,250
And you can also really start to combine this in very many different ways.

499
00:38:54,250 --> 00:39:03,030
What I can tell you is this might be, this might look like it's a pretty good learning curve associated with all these fields in the data table and the visualizations.

500
00:39:04,090 --> 00:39:06,170
I would encourage you just to play around with it.

501
00:39:06,170 --> 00:39:14,670
The worst thing that can happen is that it shows you either a chart that doesn't make sense or that it shows you an error when something really doesn't compute.

502
00:39:14,670 --> 00:39:16,370
Okay, you can't break anything.

503
00:39:16,710 --> 00:39:19,310
Just really start to play around with this stuff.

504
00:39:19,310 --> 00:39:23,150
Maybe think about something you want to visualize and see how you would approach that.

505
00:39:23,390 --> 00:39:29,870
If you get stuck, go into Discord and there might be someone who can help you from our team.

506
00:39:30,050 --> 00:39:38,550
And also, whenever you feel like, okay, this stops making sense, go back to the data table and look at what underlying data we're really looking at.

507
00:39:38,750 --> 00:39:43,990
Once you have multiple dimensions, you can do stack, bar charts, you can do all kinds of stuff.

508
00:39:43,990 --> 00:39:46,170
So, I would encourage you to play around with that.

509
00:39:46,330 --> 00:39:52,790
This is really an absolute core idea of what CorelDoc does and what you can do with it.

510
00:39:52,810 --> 00:39:56,630
So, with that, I would say that's my demo.

511
00:39:57,230 --> 00:40:02,410
And as many minutes as we have left, I would use for Q&A.

512
00:40:02,650 --> 00:40:11,250
And like I said, if a moderator could let me know if we're kind of starting to run short on time or when it's time for me to stop.

513
00:40:11,390 --> 00:40:13,510
I would say we're going to do five minutes.

514
00:40:13,510 --> 00:40:15,930
I really, I honestly hope we have a little more time.

515
00:40:16,770 --> 00:40:18,590
I'm going to do five minutes of Q&A.

516
00:40:18,590 --> 00:40:27,010
I'm breaking my promise here a little of having time, but I'm going to promise I'm personally going to be around in that Discord channel for the next days.

517
00:40:27,010 --> 00:40:32,610
So, everything that's left after these five minutes, I'm just going to answer there.

518
00:40:32,610 --> 00:40:36,210
And like I said, there are a bunch of other people too, and I hear that it's whack.

519
00:40:37,630 --> 00:40:41,750
So, Linux on the desktop, I do not know how to hide it when you can't see it.

520
00:40:41,750 --> 00:40:43,430
So, I'm going to go straight into that.

521
00:40:44,670 --> 00:40:49,610
I'm going to go straight onto this one here, and I'm going to try to find some questions, okay?

522
00:40:50,550 --> 00:40:53,030
We have about two minutes, if you don't mind.

523
00:40:53,170 --> 00:40:54,390
Okay, understood.

524
00:40:54,390 --> 00:40:55,550
Thank you very much.

525
00:40:55,550 --> 00:41:01,430
We'd just like to move the questions over to the text window, or the chat, I'm sorry, if we run out of time.

526
00:41:01,430 --> 00:41:02,190
Thank you.

527
00:41:02,250 --> 00:41:03,010
Understood.

528
00:41:04,350 --> 00:41:06,490
So, I see a few questions here.

529
00:41:06,490 --> 00:41:12,570
I'm going to skim through a lot of them, but I see a question about if there is an OVA.

530
00:41:12,830 --> 00:41:22,250
There is, if you go to Greylock.org, and you go to Get Greylock, big button here, these are all the ways that you can install it.

531
00:41:22,250 --> 00:41:25,110
There's Docker images, OVA, virtual appliances.

532
00:41:25,270 --> 00:41:36,490
We're integrating with Chef, Puppet, Ansible, and there are Debian and RPM packages to get started really quick, and the documentation is going to guide you through doing that.

533
00:41:36,850 --> 00:41:39,490
Okay, let me scroll down a little more here.

534
00:41:40,550 --> 00:41:46,970
This is available on Linux, and the best way to set up the environment is described in the documentation.

535
00:41:46,970 --> 00:41:48,650
In fact, it only runs on Linux.

536
00:41:48,850 --> 00:41:50,550
It does not run on Windows.

537
00:41:51,490 --> 00:41:55,590
So, I would definitely recommend to run this on Linux.

538
00:41:55,590 --> 00:42:02,050
All of the official installation methods are going to be based on Linux, for sure.

539
00:42:03,270 --> 00:42:08,810
I'm going to pick one more, and then I'm going to stick around in the channel, and also in the Greylock channel, please.

540
00:42:11,250 --> 00:42:13,610
Let's see if I find one more.

541
00:42:14,830 --> 00:42:15,550
There we go.

542
00:42:15,550 --> 00:42:16,150
That's a good one.

543
00:42:16,150 --> 00:42:21,590
Is there some kind of how-to for reading in a log file written by another application?

544
00:42:21,590 --> 00:42:25,770
So, you have another server, and there's something running on it that writes a local log file, right?

545
00:42:25,770 --> 00:42:28,850
How do I add these into my Greylock now?

546
00:42:29,990 --> 00:42:32,210
There are several ways of doing that.

547
00:42:32,210 --> 00:42:37,730
Greylock has a concept called sidecar to even remotely manage of collectors.

548
00:42:38,110 --> 00:42:39,650
That is, however, not required.

549
00:42:39,650 --> 00:42:45,010
You can also just use any kind of open source collector that's out there.

550
00:42:45,030 --> 00:42:48,390
I personally recommend FileBeats or NXLog.

551
00:42:48,610 --> 00:42:50,410
FileBeats is coming from Elastic.

552
00:42:50,530 --> 00:43:01,030
They can send straight to our inputs, and you really just tell it, hey, here's a log file, and please send me everything that goes into this Greylock system with a buffer locally.

553
00:43:01,110 --> 00:43:04,450
So, look at FileBeat or NXLog.

554
00:43:04,710 --> 00:43:09,450
There's also WinLogBeat and a PacketBeat, and NXLog is also great for reading properly.

555
00:43:10,510 --> 00:43:17,310
And so, with that, I will keep my promise and stick around for more questions that are coming in.

556
00:43:17,810 --> 00:43:21,010
Follow me on Twitter if you have questions in the long term.

557
00:43:21,010 --> 00:43:32,330
That's at underscore Leonard, L-E-N-N-A-R-T, and I hope you enjoyed that, and I really, really hope that you had a fantastic time playing OpenSoC or trying out Greylock.

558
00:43:32,330 --> 00:43:40,470
We're building this for you, for the community in the end, and so let us know if anything doesn't work, if anything doesn't make sense, if you want to prove anything, it's open source.

559
00:43:40,530 --> 00:43:41,950
Use it, play it, improve it.

560
00:43:42,350 --> 00:43:43,230
That's it.

561
00:43:43,550 --> 00:43:45,070
Thank you very much.

562
00:43:46,790 --> 00:43:47,790
Thanks a lot, Leonard.

563
00:43:47,790 --> 00:43:48,770
I appreciate your time.

564
00:43:48,770 --> 00:43:49,910
A great presentation.

565
00:43:49,910 --> 00:43:51,470
We look forward to hearing more from you guys.