start	end	text
19670	25930	Okay, good morning everybody. Welcome to DEF CON 28, Blue Team Village. We are going to start this
25930	31670	morning's workshop off with Lennart Koopman from Greylog. He's going to be doing an introduction
31670	36930	to the OpenStock CTF tools. Definitely worthwhile listening to. Hope everybody enjoys. I'm going to
36930	43410	turn it over to Lennart now to get to the meat and potatoes of it. Thank you. That sounds great.
43410	49970	Thank you so much. First time I'm doing a talk at a remote conference. I think we're all learning
49970	55490	new things in this year. I wanted to, before I start with anything else, I just wanted to say
55490	63410	thank you to the organizers not only of DEF CON, but also the organizers of Blue Team Village,
64130	67810	because I think that's just an amazing job they're all doing. They're doing that every year,
67810	72750	but now this year I think it's even harder. And I as a speaker, and I think I was the first in
72750	77710	the lineup here, so some things were new to them too. I feel like they did an absolutely
77710	82330	fantastic job. So thanks everyone, and I hope everyone has an absolutely fantastic time at
83770	90570	at DEF CON and at Blue Team Village specifically. So what I'm going to do today is I'm going to
90570	99410	walk you through a very, very high-level overview of what Greylog is. And we're doing that because
99410	105890	Greylog is also part of OpenSOC. And OpenSOC, the CTF of the Blue Team Village, if you're
105890	111670	competing in it, you're going to be using Greylog a lot. So I was asked if I could give an introduction
111670	116950	to it, especially I think for everyone, but even a little focused on the people that will be using
116950	121390	it during OpenSOC. So I think it's going to be a fantastic overview if you're new to Greylog,
121390	125670	or if you haven't looked at Greylog in a while, or if you're generally interested in open source
125670	131590	software, DFIR, block management, whatever. I'm going to walk you through it, like I said,
131590	137990	very high level. And very important, we're going to have a bunch of time for Q&A and questions at
137990	144330	the end. That means that if you have any questions, we're going to go through them
144330	150170	then, and I'm going to make sure that we leave enough time there. We will also be, when I say we,
150170	153970	we Greylog people are going to be around in the Blue Team Village
155210	162230	Discord, and there is a Greylog channel there under the Sponsors tab. And we'll be around
162230	165970	there. We're in multiple time zones. There's a good chance you're going to meet
165970	170010	someone from us over there. I believe we have a little flag at our username or something that
170010	174150	shows that we're part of Greylog, and we'll be happy to also answer any kind of questions that
174150	183510	you might have, maybe during the CTF or OpenSoc itself, or maybe in general about Greylog. So
183510	192230	we'll be around. We'll be happy to answer any questions you have. Next slide is the agenda.
192230	199130	I'm going to be very careful with not moving around too much and not skipping through slides
199130	204130	too fast. I hope there's not too large of a delay between what I'm saying and what you're seeing.
205290	210510	So that that is all in sync, but I'm going to be careful that that works. If there are any issues,
210510	215010	you can always post in the Discord channel. There are moderators there, and they can make me aware
215430	221690	if there's something going massively wrong in any way. The agenda for today, you'll see
221690	227890	this here on the left, I think. I only have like three real slides, because I want to really
227890	232730	show you Greylog as a product. I want to show you what it does. So it's going to be a big focus on a live
232730	238010	demo. But I'm going to go over one slide, just real quick, about me. Then one about Greylog,
238010	243050	give you a little bit of background. Then we can take a quick look at the Greylog architecture.
244230	248590	Not kind of in the level of detail for when you would get ready to deploy this yourself, but
249130	254870	just to give you an idea of how the parts of Greylog are kind of coupled together,
254870	259650	so that you can, when you use it later, maybe a few things might make a little more sense. I just
259650	265930	feel we should take a quick, just a minute, at the components of Greylog itself. Then, like I said,
265930	272450	live demo. We're going to focus on analysis, because I think that's, as a user and as
272450	276970	an analyst, that's probably the most important part for you, especially if you're part of OpenSoc
276970	284730	this year. But we're also going to look at some differences if you're used to other tools.
284730	289250	I think that could also be a really important kind of question that you might want to ask.
289250	296290	If you are used to another log management tool out there, maybe if you have questions about how
296290	300550	Greylog compares to that, from kind of how you use this, does Greylog do that, is there another way
300550	305090	of doing that, so you can apply the knowledge that you have already, so that you can
307430	312610	really apply this in a good way with a new product like Greylog. And then, like I said,
312610	318330	we're going to have a lot of time for Q&A. For the questions that you have, please use the channel
318330	322790	in the Blue Team Village Discord. If you're not in that yet, it's a good moment to just quickly
322790	328170	sign up for that. Go to the Blue Team Village Discord, and in Discord you see these categories
328170	333490	on the left in your sidebar. There's one that's called the Flamingo Hotel category. Made me miss
333490	338690	Las Vegas very much when I saw that this morning. But there's the Flamingo Hotel category, and
338690	343650	there's a channel in there that's called Text Workshop Track One. We are here right now,
343650	347430	we're Workshop Track One, and that's a text channel. So that's where you can post your
347430	352290	questions. The moment we're going into the Q&A phase, at the end of this, I'm going to go to
352290	356170	that channel, and we can start to look at your questions and start answering them. All right?
356570	362010	So, like I said, Text Workshop Track One. If you get lost somewhere in there after you join,
362010	366630	like I said, there are moderators swarming that place, and they'll be happy to help you
366630	371150	and guide you to the right channel. So just ask anywhere, and you should find it.
371750	378770	About me, it's real quick. Lennart Koopman. My Twitter handle is at underscore Lennart,
378770	385270	L-E-N-N-A-R-T. If you want to follow me on your own risk, you should definitely do that.
385570	390710	My background is actually software development and architecture. So I've started my career as
390810	397390	a software developer, and also started the Greylock project in 2009 already. I realized
397390	402410	with horror that it's been 11 years already. It's been 11 great years, but 11 years is a pretty
402410	408750	long time, and I felt like it was more like three years. But Greylock as an open source
408750	417030	log management product started in 2009, I believe, actually pretty much on the day in 2009,
417030	426910	like in early August. We had a nice little celebration at our last party
426910	434370	over in Vegas. That was fun. I think there are pictures. I then started a company behind Greylock
434370	441110	in 2013. That was after the open source project was showing some commercial interest
441630	446170	from people out there. So they asked me, hey, can you give me support? And I said, hey, I don't know
446170	450790	how to write an invoice. So that was a good moment to start a company behind it. That was 2013.
451130	456190	I'm currently the CTO over here at Greylock. That's really what I started as, too.
457170	462370	And I was born and raised in Germany. That's where my accent is coming from, if you can make it up.
462390	469130	But I am living in beautiful Houston, Texas now, which is also where one of our offices is.
469130	475010	The other offices are in Germany and then also straight out across the United States.
475070	479810	I guess I have to say, we are hiring. If you want to go to greylock.org careers,
479810	484250	there might be something that you could be interested in that's remote in Germany or the
484250	490450	United States. But enough about me. Real quick about Greylock. This would be the moment at a
490450	494410	conference or at a physical talk where I would ask who knows about Greylock, and then I would
494410	500270	see hands go up or not go up. And then I could adapt this a little to the audience. So I'm just
500270	506630	gonna tell you the whole story real quick. Open source log management. So you send Greylock or
506630	513530	instruct Greylock to pull logs from somewhere. It will ingest these logs, it will parse them,
514070	520610	and it will make them available for you for searching, analysis, threat hunting, for
521510	526530	alerting, and also maybe to filter some out and say I'm actually not interested in these.
526530	532730	Throw them away, route them somewhere else. Really a way to handle logs that are being generated in
532730	539930	your environment. The three main use cases for that are dev or ops or DevOps, depending on what
539930	545130	you're doing. Definitely very interesting for developers to do root cause analysis, to do
545130	549830	monitoring, to do performance monitoring. Maybe when they know that there's an issue on the platform
549830	556250	that they need to research or that they need to investigate, they use Greylock to go into
556250	562050	the logs to figure out what exactly happened and to make sure that either it doesn't happen again
562050	567570	or to put an alert on it or simply to resolve the issue that's causing it. Same for
567570	575210	ops. For ops that could be just classic IT system ops. This could be network operations. I see a lot
575210	580270	of people using it for that. The fastest growing use case has been for a while now security use
580270	587290	cases, which I guess you as the audience here is probably very aware of, which basically means
587290	592250	you're using it to keep a track record and a history of everything that's going on in the
592250	597470	environment. That means you need to have a system that is able to really ingest all of your logs
597470	604670	and to make sense of them and keep them for long enough so you can run your analysis against it.
605950	611950	And it will then allow you to set up pretty complex alerting, like you would know it from
611950	617950	some sim systems out there, for example. That's a feature that came out, I think, about a year
617950	624010	or a year and a half ago. A new alerting engine that lets you help be a little more proactive
624010	628430	about what's going on in your environment. But one of the other really classic use cases is you need
628430	633350	to investigate an IP address. You need to investigate some kind of indicator of compromise. Something
633350	638270	new came out and there's a new patch. You want to make sure that that specific file has not been
638270	644230	anywhere in your environment in the last six months. Let's go in and let's see if that happened
644230	652030	or not. And then, of course, classic DFIR incident response, figuring out if there was an attacker,
652030	656910	what that attacker did, all of that fun stuff. And, of course, compliance, just having the
656910	661810	logs somewhere. I think that is a valid use case. And for that, you need to centralize them.
662150	667770	And I think Greylock is a really good choice for that, too. Like I said, started in 2009,
667770	673530	really constantly grown since then. Very, very happy to have been a Blue Team Village sponsor
673530	679390	really from the beginning. Like I said, absolutely fantastic people. Make sure to watch as much of
679390	683470	their content as you can. And next year when we're hopefully all back in Vegas, make sure to stop by
683470	692190	in person. It's always a lot of fun. And Greylock is also part of OpenSOC, the CTF that runs during
692190	698810	Blue Team Village that has got so much positive feedback over the last years. Also, of course,
698810	702770	extremely happy about that. And like I said, we'll be around to help you with any questions
702770	710150	that comes up during your OpenSOC participation. Now, during OpenSOC or during the Blue Team
711090	715750	Village, no booth this year. I was always happy to spend a day over there and just
715750	721130	chat with people. Maybe give out some shirts and some Greylock swag. Because that is not
721130	726250	happening this year. Make sure to stop by the Greylock channel in the Blue Team Village Discord,
726250	733230	because I hear that we will be sending out swag from there. And then we'll be there to answer
733230	741450	any of your questions. Very important is that OpenSOC is not running the latest version of
741450	747050	Greylock yet. They're slightly behind it for some very good reasons. So the demo that I'm going to
747050	751690	show you is the latest version. If you see something that's slightly different, definitely
751690	758030	reach out to us in the Discord channel and we'll be happy to give you a maybe a workaround or
758030	764330	tell you where that is. Or if it's simply not there and what else you could do about that. So
764330	768750	just keep that in mind. But there's some structural differences about where
768750	774630	some elements are. But overall, it's pretty much the same. And especially the core
774630	778870	ideas and the core principles are of course the same, because they simply haven't changed in the
778870	785510	last months. And then most importantly, have fun. Stay in touch. It's open source. So if you
785510	790330	get interested in this, just start using it. Start running it yourself. It's designed for that.
790770	796330	And there are many ways to install and run Greylock, especially if you maybe just want to
796330	801190	try it out really quick. There's some ways to get something up and running really fast. There's
801250	806050	a big community around this that can always help you out. So I want to say have fun and open
806050	810470	SOG. I've only heard fantastic things about how much fun it is. So I'm sure you will have fun.
810470	814990	And even if you're not participating in it, just download it. Give it a try. It's open source.
815290	823430	That's what it's all about. So the next slide here promises a live demo. Before we do that
823430	828790	I want to send you straight to the docs real quick. So we can look at the...
830650	836010	I have to find where they are. First link here. Architectural considerations. And we will not be
836670	844190	detailed. No worries. But I want to show you just really quick the parts that Greylock
844190	852310	consists of. If you ever get stuck somewhere with Greylock, always go to docs.greylock.org
852310	858510	if you feel like just looking it up yourself. That is up here. Docs.greylock.org. That's where
858510	865870	all of our documentation lives. And if you can't figure it out there because your use case might
865870	870990	not be described in there, then, like I said, reach out to us. But that's always a good place
870990	876390	to get started. And I'm just using... you won't have to deal with the architecture because the
876390	881570	open SOG folks are already setting that up for you. But just so you understand it, Greylock
881570	886110	really consists of three big parts. Or three and a half big parts, I would say. There's Greylock
886110	891210	itself, which consists of Greylock server and Greylock web interface. But it's really one
891990	897330	system that you're running or one executable that you're running. And it has two dependencies.
897530	903190	It connects to MongoDB. It does that to store some state, to store some cluster communication,
903190	908550	to store some configuration that lives in MongoDB. And because there's really not much data, that
908550	912570	MongoDB is really, really small in the end. Actually, most people will just run it on the
912570	921790	same node as the Greylock server. And that way, you can almost forget that it's there and set it
921790	927870	up in a replica set to make it highly available. The Elasticsearch part, though, that's what we're
927870	934030	using to store the messages. And so that will, of course, you have to scale that properly because
934030	938530	that gets all the load from searches. And it gets, of course, all the load from actually writing the
938530	945090	messages to disk. And what happens is, if you connect to the Greylock web interface, it will
945090	952250	basically execute API calls against the Greylock server. And it will say, hey, my user of the web
952250	956430	interface is trying to search for these messages. And then the server says, yep, I'm going to search
956430	962110	for them, queries Elasticsearch, gets the data back, does all its funky Greylock stuff with it,
962110	967210	sends it back to the web interface, and the web interface displays it. I'm mentioning that because
967210	974670	all the communication between the web interface and the Greylock server is really API calls,
974670	981790	nothing else happening. All it is, it's just authenticated HTTP REST API calls. That means
981790	986290	that you can also automate everything. So if you are getting at a point where you want to
986290	992250	write a script to look at data, for example, you can always use the Greylock API. There's an API
992250	996930	browser in Greylock, and you can start to write your Python scripts and start to pull that data
996930	1001490	out of Greylock and do something with it. That's kind of my secret sauce tip for if you're working
1001490	1007470	in OpenSoC for sure. If you're good at Python or another language, then definitely keep that in
1007470	1012550	mind that you can do that. But overall, Greylock server accepts the messages, you send the messages
1012550	1018730	to the Greylock server, use the web interface to analyze, display, configure, set up alerts,
1018730	1023610	all of that fun stuff. And then Greylock behind the scenes will do all the management of Elastic
1023610	1028590	Search. You can define your retention times, all of that. So if you're maybe used to the Elastic
1028590	1033670	Stack where you have to do a lot of stuff in Elastic Search itself, for Greylock you really
1033670	1037850	just have to tell Greylock where the Elastic Search is and then Greylock takes care of the
1037850	1042850	rest for you so you don't have to become an Elastic Search expert. I think that's a very
1042850	1049710	important part. If you want to, you can scroll down here and look at what complex looks like
1049710	1054610	with multiple nodes, clustering, load balancer in front. I think that is definitely out of scope
1054610	1061550	right now for what you are about to do here or if you just want to give it a try. But be aware
1061550	1066630	that this is all documented here and then there's also another setup guide that talks you through
1066630	1073010	that. So it should be a good place to get started. All right, so now we're going to the real life demo
1073010	1081650	part. And what I'm going to do is I'm going to walk you through... I made some
1081650	1087870	notes here. I'm going to work with one, two, three, four areas really. And I want to spend the most time
1087870	1092930	in the search and analysis. Like I said, I think that's where most of your time will be spent.
1092930	1098910	But I just want to show you a few other parts of the system, at least real quick, so you are aware
1098910	1105270	that they are there. So I always like to start in the system area. And that is simply
1106330	1110490	because I think that gives you an idea of kind of the philosophy behind Greylock itself.
1111010	1117130	Our idea is that you should have to set up a Greylock in a config file only initially
1117130	1124010	and only once. Basically tell Greylock, where's my MongoDB search? Give it some data it needs
1124970	1129610	to encrypt passwords, to set up TLS on the web interface, kind of this basic setup.
1129810	1133930	And then from there on, we believe that you should be able to do everything from within the web
1133930	1140290	interface. Like I said, those web interface calls are really just API calls. So if you want to use
1140290	1146470	automation, you can just use curl to set up stuff automatically. But during, I would say,
1146470	1152090	after a base setup, everything is configured in Greylock itself. And then Greylock keeps
1152090	1157070	the configuration basically in MongoDB for you. What that means is, I just want to give you a real
1157070	1162370	quick overview. We're going to go into that very deeply. But if we look at our pipelines, for
1162370	1170350	example, that is where all of the message processing of Greylock is happening. This is not some API
1170350	1177970	call where you have to post some cryptic language to. This is not a huge YAML file or JSON configuration
1177970	1183590	of that. This is all, no, here we go. Here comes my Linux syslog. And I'm going to say,
1183590	1188410	I want to parse some stuff out of it. And you just basically configure Greylock here with a
1188410	1194130	very efficient and small rule language that then says, OK, everything has Linux syslog. Apply this
1194130	1198470	regular expression on it. Extract some fields. You'll see here on the right, this is all the
1198470	1204230	functions you can execute on it. You can drop a message. You can check what a message looks
1204230	1209650	like and then define other actions on it. You can thread Intel lookups on it. You can run a
1209650	1215910	Whois lookup on it. DNS reverse lookup on it. Run it against your own lookup tables. You can
1215910	1220790	check if something is in a certain subnet. All of this processing happens. And this is very important.
1220890	1223770	This is a very important thing that you need to understand, especially if you come from other
1223770	1237250	systems. All the processing happens when the message arrives in Greylock, OK?
1237450	1241890	That means that once a message has been written,
1242530	1246950	that means that that message basically becomes immutable. That means that you cannot change it
1246950	1252030	afterwards. That has some positive side effects and some side effects that you might have to
1252030	1257190	work around. What that means, most importantly, for you, if you're coming from a system that
1257190	1264270	allows you to transform data while you search, Greylock simply won't do that for you. Especially
1264270	1268950	not in a way that you can then further search on. Everything that's in Elasticsearch is in
1268950	1274570	Elasticsearch as it is. You can't transform the messages during search time. Very important to
1274570	1279770	keep in mind. Of course, we've built our whole web interface and the processing in a way that
1279770	1285730	you can still do all the good stuff with it. And it also means that we're getting a huge
1286850	1291930	usability and performance hit from that in a good way, as in it's much easier to use. We hear a lot
1291930	1296970	of people who come from these schema-on-read systems who say that is useful for a bunch of
1296970	1303790	queries. But overall, just being sure what data you're already looking at and not having to mess
1303790	1309190	with super complex queries all the time is actually something that in the long term people
1309190	1316230	really, really start to like. So just be aware of that. You'll see in the inputs area, you'll see
1316230	1320930	where all your messages are coming in. We've got a whole section here for authentication, if you
1320930	1328870	want to connect that to LDAP or an AD. We have API tokens. There's all kinds of authentication
1328870	1334310	mechanisms happening here. And also, that's the last thing I really want to touch on real quick,
1334310	1340130	we have content packs. So if you want to export any kind of configuration, dashboards, reports,
1340130	1346890	alerts, anything like that, and insert it into a different setup, you can export and import
1346890	1351750	these things here using a feature called content packs. We've got outputs. There's a whole index
1351750	1357570	management here, how long you want to keep data. Then after that data has been deleted, you want
1357570	1363810	to archive, you want to close it, you want to delete it. All of that happens here. It's, I think, for you
1363810	1368870	for now, and especially if you're just getting started, not super relevant yet. Just be aware that
1368870	1373950	Greylock has that, Greylock does that for you. So always a good idea to maybe just click around in
1373950	1379570	the system area a little. The other thing I just also really want to tell you, so you know that it's
1379570	1388070	there. I am honestly not sure how much of that can be used during a CTF, but know that there
1388070	1394210	is an alerting engine. I have here, this is kind of my small demo setup. I have an alert setup
1394210	1400150	here that alerts me every time there's a high priority IDS alert, Greylock, and I have another
1400150	1405930	one, and we can actually look at those. I live in southeast Texas, so we're pretty good at storms,
1405930	1410310	and I live in the United States, so we're pretty good at not burying our power lines.
1410310	1416330	So that combination will definitely require for you to have some kind of an uninterrupted
1416330	1423210	power supply. So I'm reading the logs from one of my UPSs, sending those into Greylock, and I'm
1423210	1428930	triggering alerts to my iPhone when the power goes out, because I really want to know about that,
1428930	1432570	because maybe if it doesn't come back up within five minutes, I'm just going to start to shut
1432570	1437890	down some servers remotely real quick, or do something else. So I have an alert setup here,
1437890	1444490	let me look at this first. Under event definitions, I have a condition set up here called
1444490	1452090	UPS without external power. Click on that. Really what it does is, it says when you find a message
1452650	1459330	that has its status field set to OB discharge, which is the UPS reporting that it is now
1459330	1466170	discharging, which means it has no power, I say when that happens, I don't need aggregations,
1466170	1471390	I don't need groupings, I don't need any other further rules and statistics. Just the moment
1471390	1477210	that happens, I want to be sent a message. Set this up here on notifications, I'm using Ops Genie,
1477210	1483310	which is the system that Greylock can post these alerts to, and it will then send an alert on my
1483310	1488610	phone. I say when that happens, send me a notification, and you can actually see here,
1488610	1495590	if I go to my alerts and events, and I filter my events by UPS, you will see, because I'm looking
1495590	1500410	here at the last 360 days right now, usually you would probably look at the last day or so,
1500410	1506290	you'll see now a history of all the days when my UPS was out of power. So you see here, for
1506290	1513470	example, just about almost exactly a month ago, my UPS was without external power and it did
1513470	1519230	trigger a notification to my phone. So you can set up these things, you can set up
1519230	1525090	all kinds of conditions, I can say only send me this if certain events happen in a
1525090	1529370	certain order, all of that is there. Also, I don't think anything from this demo today, but
1530010	1537330	just something to be aware of and know that it's there if you want to use it.
1538170	1541930	Then we have the streams, and after that I'm going to go into search and analysis and give
1541930	1547130	you a quick overview of that. But we have the streams here. Streams are basically, think of
1548150	1552690	categorization of messages when they're going into Greylock. They are an important concept
1552690	1557970	for Greylock because, for example, our retention settings are sitting on top of that. So if I say
1557970	1564790	I want to keep my NetFlow logs for two days and my domain controller logs for two months,
1564790	1569770	I would route them into two different streams with a very simple rule. This one here, for example,
1569770	1578790	if the field Greylock type matches exactly the value NetFlow, then route this into the
1578790	1584530	stream NetFlow. Another one here would be this one. Yeah, if the message matches the regular
1584530	1590170	expression filter log at the beginning of the string, then route it into my firewall logs.
1590170	1597370	I think here's one for, yeah, this is anything that has a snort process ID in it. Route that into my
1597370	1602070	IDS alerts. So you're basically pre-configuring or pre-configuring messages and you put all kinds
1602070	1608910	of stuff on top of that. Like further processing, extractions, enrichments, you can put access
1608910	1613810	rights on top of that and say only team A is allowed to see my AD controller logs, but my
1614670	1620590	support team is allowed to see, for example, my database debug logs or something like that.
1620710	1627090	Same for retention times. A bunch of concepts in Greylock streams. I think for you, if you're
1627090	1631650	getting started with this or using it during OpenSoC, I think it's just a great way to make
1631650	1637170	certain types of messages available with one click. Okay, so we're now going into search and
1637170	1641970	analysis. If I wanted to see all my firewall logs, I just click on the firewall stream
1642530	1649450	and it opens a search page that has the stream selector here on top already pre-configured to
1649450	1653510	only look at my firewall logs. I can select multiple here. So if I wanted to see all my
1653510	1660630	firewall and all logs, you just do that. This thing's going to update. Here we go. And now
1660630	1664710	we also got my NetFlow logs in it. For this example, though, I'm only going to look at my
1664710	1669930	firewall logs. I'm going to take this out again. Every time I make a change to a query, you will
1669930	1674790	see that this is... you get this little yellow icon here, which means, hey, you haven't executed
1674790	1679210	your new search yet. I don't believe this is the case in the version you're going to be playing
1679210	1683810	with. But if you download it fresh, that's definitely going to be the case. So I have to manually execute
1683810	1689510	that one more time. What we're looking at here is our search page. So I think this is what you're
1689510	1694890	going to spend the most time. So let me walk through the main areas, and then we can run more.
1696130	1703010	Maybe execute a search query or two, and then I would say we go into Q&A. And I will ask a
1703010	1707890	moderator to let me know when we run out of time during the Q&A. I think we started a little
1707890	1715090	late. So just let me know what the best time for you as the organizers is. But you have three
1715090	1720930	main areas here. You've got the search query bar here on top. This is basically where you are
1720930	1727810	selecting what exactly you want to be searching for, in which stream, what query, and also in
1727810	1733010	which time range. That's always the first thing you've got to think about. Then you've got a site
1733010	1738050	bar here on the left. I think the important part of this is the fields area that shows you all the
1738050	1744170	fields that are in these messages. So pre-parsed fields in the message.
1744650	1749410	And then, of course, you've got the actual result set. So everything you're seeing here, everything
1749410	1757250	under the... is your result set. So that is actually everything that Draylog returns for your search
1757250	1761450	query. So let's say I don't want to search in the last five minutes. I want to search in the last
1761450	1770710	hour. Change that. Execute it. Here we go. So now we're looking... you saw that this message
1770710	1776750	count chart here changed. We're now looking at the whole hour. And I think that we can also...
1776750	1783730	I don't think that's this one yet. But you can also definitely generate a widget that shows
1783730	1787390	you how many messages were found in total. We can do that in just a second, actually.
1788890	1794390	So let's say we're looking at all my firewall logs here in an hour. You see that we have a little
1794390	1798650	bit of a spike here. And this is... firewall logs are always great because they have a lot of data
1798650	1803510	in it, how much value you actually get out of them. So I think it's up to you. But it's a great example.
1803730	1809890	And overall, the searches work the same for everything, no matter if it's a firewall log, a
1809890	1816050	Windows log, a Linux log, a Amazon API log, anything like that. So if I click on it, you see here this
1816050	1821650	is the original message that came into Greylock. Very hard to read. If I click on it, you get the details
1821650	1827070	and you get what Greylock has actually returned. So you see that Greylock here has parsed this out
1827070	1832190	into some fields. Like, for example, the destination address and destination port,
1832190	1838170	header length, which interface it came in, which IP version it was, the length of the whole
1838670	1845370	of the whole packet that was let through, which protocol it was. And you'll also see here that
1845370	1849830	in this case, the action was block. Everything that I'm looking at here on these logs,
1850550	1855110	I'm only sending me the block logs. So I'm not interested in what the firewall let through. I'm
1855110	1861510	only interested in what the firewall actually blocked. So with all of this, you also see source
1861510	1868170	address and source port. Let's say we only want to see the messages from a certain source,
1868170	1874110	where the source address is set to this value. What I could do is I could go into the search
1874110	1882370	query bar on top here and say source underscore address equals, and then 1356, whatever I want
1882370	1890430	to look for. Much faster is to just simply click on the value. This context menu opens,
1890430	1896150	and you say add to query. And it will just build that for you and immediately execute.
1896270	1903470	So what we're now looking at is we're looking at all blocked packets from the last hour where
1903470	1907070	this was the source address. So basically all the packets this source address sent us
1907830	1916070	locked. Okay, so let's try to get a little bit of a better overview here of what that looked like.
1916070	1922370	So I want to find out what's this all TCP or both. Do you see we have a field here called
1922370	1930430	protocol. Try to get the top values. I want to see they're all set. I see something that's a
1930430	1939610	protocol. Show top values. This opens, and you see that no, actually this source only sent
1940730	1947930	UDP messages. Okay, let's go a little deeper and say is this always the same kind of package?
1947930	1955410	Do they all have the same length? Like very, very uniform? Same thing. Data length. Show top values.
1955470	1960410	Here we go. We see that actually all these packages are UDP and exactly 278 bytes long.
1960410	1965170	That looks like we're just blocking the same package over and over and over again.
1965190	1970550	Now what would be interesting, this setup isn't doing it, but if we were to run a
1970550	1975510	lookup. That's a built-in lookup table onto the source address or our GeoIP to see where
1975510	1980890	this is coming from. Who owns this IP address? Look up the underlying ASN. Do all of that stuff.
1980890	1984990	I'm simply not doing that here in this setup, but that's all stuff that you could do.
1985730	1994370	And now let's maybe say I want to see... now let's actually go back. I'm going to execute
1994370	1999310	this query again. And what you're going to see is all the data in the result set, because the
1999310	2005490	result set change, has now updated. Now we see for the last one hour, for everything that was blocked,
2005490	2012730	UDP, TCP, and ICMP. Okay, I'm going to delete this widget here. I want to show you the aggregation
2012730	2017370	builder. That's really the last part I want to show you here. For the search query language,
2017370	2022330	go to docs.greylock.org. There's a whole page that explains the search query language for you.
2022470	2026190	I don't want to go into too much detail here, because you can simply read it up there.
2026190	2029330	It's pretty simple. It's in the end, if you've been using the Elastic Stack,
2029330	2033430	it's the same language. We're just passing it through Elastic. So if you're used to that,
2033430	2041370	same thing. So whenever Greylock creates a widget, that is under the hood. In fact,
2041370	2045610	an aggregation and an aggregation builder. So you will always see this little icon,
2045610	2052310	top right of the widget, that you can click on and say edit. And now edit is going to show you
2052310	2058410	the aggregation builder. And it has one very important drop down box, which is the visualization
2058410	2068050	type. Let's say you want to visualize this not as a data table, but as a bar chart. And say,
2068050	2072970	I really want to see three bars here, with UDP the largest, TCP on second, and then a tiny one
2072970	2080710	for ICMP based on the count. You switch it up. Art chart. Here we go. Save it. I could now make
2080930	2086910	a dashboard out of this. Here we see for the last hour, we mostly brought UDP stuff. Okay,
2086910	2091790	interesting. You could, of course, if you really wanted to, make it... I think they're much harder
2091790	2097150	to read, but sure, could do that. Greylock is not going to keep you from building weird charts
2097150	2104790	either. So you want to make this a long chart? Sure, not a problem. Can do that. So this is our
2104790	2109290	aggregation builder. You can do sorting. You can add multiple rows. We're going to do that in just
2109290	2119130	one second. And you can also add metrics. So let's say I want to get the total bytes that were blocked
2119130	2125510	over the last one hour. Okay, so you know we got the data length field here. Click on that,
2125510	2132210	press chart. That is going to create a new widget, and that widget is basically just the same
2132210	2136830	aggregation builder, but with other predefined values. Okay, you're going to see that in one second.
2136850	2146450	Here we go. So now we got the average data length by timestamp. Click on edit. See, okay, that's our
2146450	2153730	line chart. That's how much data was transferred per minute, in this case, on average. But you
2153730	2157590	know what? Let's make this a data table, so you see what this looks like under the hood.
2157690	2162410	It's like for each minute, it calculates the average data length. And with this kind of column
2162930	2168930	row structure, you can put that into a bar chart. You can put this into a line chart.
2168930	2174370	But I think what we're really interested in here, we don't want to look at the average data length.
2174610	2179230	We want to look at the sum of the data length.
2179230	2189170	Here we go. Data line chart. And now we see how many bytes are blocked in total. I just
2189170	2196970	had to know that this was called sum. You can do standard deviation, max, min, count, cardinality,
2196970	2203170	average, variance, percentile. You can do all of that stuff with it if you wanted to. Okay.
2203790	2206710	One more thing I want to show you, and then we're going to go into Q&A.
2207330	2211270	I really want to make sure that you start playing around with aggregation because that one
2211270	2216650	is extremely powerful. It will really help you solve these challenges that OpenSock is going
2216650	2221650	to give you. One more thing I want to show you is, let's say we want to build an aggregate.
2221650	2234130	We say grouped by source address which protocol was used. Okay. So let's go into the source
2234130	2241870	address. Get the top values of that as kind of a start. Add it. And we can add multiple rows here.
2241870	2248150	So let's set this to protocol. I want to add a second type of row which is protocol.
2249070	2253970	It's going to update. And you actually see here that these have all only communicated
2254830	2260250	with UDP or TCP. They're not really doing multiple things. So to explain this a little
2260250	2266390	better, let's build pairs of source address to destination. Take the protocol out. Add a new field,
2266390	2273970	destination address. Here we go. So now you see this is not really what I wanted to show.
2273970	2279390	It should be the other way around. Maybe destination address to source address. Here we go. That's what
2279390	2284910	I wanted. So you get this grouping where you say this destination address was reached by these
2284910	2289890	source addresses. And you can go lower and lower and lower as you wish and add more and more stuff.
2289890	2294010	So let's say as the metric, here's the third column, I actually don't want the count.
2294010	2301790	I do actually want the total bytes that were transferred. So the sum of the data length.
2302590	2310690	So without any kind of complex queries, you establish that this destination address
2310690	2317250	was hit by this source address with this many bytes over the last hour. And I can make
2317250	2321090	this a little larger, put this wherever I want. I could now save this as a dashboard,
2321090	2325230	share it with colleagues. There's a whole concept of parameters in there. It's all stuff
2325230	2331710	I don't want to go into today. But that's all stuff that you can do. And you can also really
2331710	2336630	start to combine this in very many different ways. What I can tell you is this might be,
2336630	2341590	this might look like it's a pretty good learning curve associated with all these fields in the data
2341590	2346650	table and the visualizations. I would encourage you just to play around with it. The worst thing
2346650	2351390	that can happen is that it shows you either a chart that doesn't make sense or that it shows
2351390	2358070	you an error when something really doesn't compute. Okay, you can't break anything. Just really start
2358070	2361850	to play around with this stuff. Maybe think about something you want to visualize and see how you
2361850	2367830	would approach that. If you get stuck, go into Discord and there might be someone who can help
2367830	2373950	you from our team. And also, whenever you feel like, okay, this stops making sense,
2373950	2379190	go back to the data table and look at what underlying data we're really looking at. Once
2379190	2384430	you have multiple dimensions, you can do stack, bar charts, you can do all kinds of stuff. So,
2384430	2388850	I would encourage you to play around with that. This is really an absolute core idea of
2389630	2396630	what CorelDoc does and what you can do with it. So, with that, I would say that's my demo.
2397230	2404910	And as many minutes as we have left, I would use for Q&A. And like I said, if a moderator could
2404910	2411250	let me know if we're kind of starting to run short on time or when it's time for me to stop.
2411390	2415130	I would say we're going to do five minutes. I really, I honestly hope we have a little more
2415130	2420150	time. I'm going to do five minutes of Q&A. I'm breaking my promise here a little of having
2420710	2425790	time, but I'm going to promise I'm personally going to be around in that Discord channel
2425790	2431290	for the next days. So, everything that's left after these five minutes, I'm just going to
2431930	2436210	answer there. And like I said, there are a bunch of other people too, and I hear that it's whack.
2437630	2441870	So, Linux on the desktop, I do not know how to hide it when you can't see it. So,
2441870	2447150	I'm going to go straight into that. I'm going to go straight onto this one here,
2447150	2449610	and I'm going to try to find some questions, okay?
2450550	2453030	We have about two minutes, if you don't mind.
2453170	2455550	Okay, understood. Thank you very much.
2455550	2459930	We'd just like to move the questions over to the text window, or the chat, I'm sorry,
2459930	2462190	if we run out of time. Thank you.
2462250	2468910	Understood. So, I see a few questions here. I'm going to skim through a lot of them,
2468910	2477190	but I see a question about if there is an OVA. There is, if you go to Greylock.org,
2477190	2482250	and you go to Get Greylock, big button here, these are all the ways that you can install it.
2482250	2488450	There's Docker images, OVA, virtual appliances. We're integrating with Chef, Puppet, Ansible,
2489050	2493790	and there are Debian and RPM packages to get started really quick, and the documentation
2493790	2499490	is going to guide you through doing that. Okay, let me scroll down a little more here.
2500550	2506310	This is available on Linux, and the best way to set up the environment is described in the
2506310	2510550	documentation. In fact, it only runs on Linux. It does not run on Windows.
2511490	2517790	So, I would definitely recommend to run this on Linux. All of the official
2518590	2522050	installation methods are going to be based on Linux, for sure.
2523270	2527210	I'm going to pick one more, and then I'm going to stick around in the channel, and also in the
2527210	2536350	Greylock channel, please. Let's see if I find one more. There we go. That's a good one. Is there
2536350	2541930	some kind of how-to for reading in a log file written by another application? So, you have
2541930	2546190	another server, and there's something running on it that writes a local log file, right? How do I
2546190	2553950	add these into my Greylock now? There are several ways of doing that. Greylock has a concept called
2553950	2560430	sidecar to even remotely manage of collectors. That is, however, not required. You can also
2560430	2567550	just use any kind of open source collector that's out there. I personally recommend FileBeats or
2567550	2573550	NXLog. FileBeats is coming from Elastic. They can send straight to our inputs, and you really just
2573550	2579630	tell it, hey, here's a log file, and please send me everything that goes into this Greylock system
2579630	2586870	with a buffer locally. So, look at FileBeat or NXLog. There's also WinLogBeat and a PacketBeat,
2586870	2594950	and NXLog is also great for reading properly. And so, with that, I will keep my promise and stick
2594950	2600190	around for more questions that are coming in. Follow me on Twitter if you have questions in
2600190	2606470	the long term. That's at underscore Leonard, L-E-N-N-A-R-T, and I hope you enjoyed that,
2606470	2612330	and I really, really hope that you had a fantastic time playing OpenSoC or trying out Greylock.
2612330	2615810	We're building this for you, for the community in the end, and so let us know
2615810	2619470	if anything doesn't work, if anything doesn't make sense, if you want to prove anything,
2619470	2625070	it's open source. Use it, play it, improve it. That's it. Thank you very much.
2626790	2630330	Thanks a lot, Leonard. I appreciate your time. A great presentation. We look forward
2630330	2631470	to hearing more from you guys.