WEBVTT 00:19.670 --> 00:21.990 Okay, good morning everybody. 00:21.990 --> 00:24.950 Welcome to DEF CON 28, Blue Team Village. 00:25.070 --> 00:30.590 We are going to start this morning's workshop off with Lennart Koopman from Greylog. 00:30.590 --> 00:33.790 He's going to be doing an introduction to the OpenStock CTF tools. 00:33.850 --> 00:35.450 Definitely worthwhile listening to. 00:35.450 --> 00:36.650 Hope everybody enjoys. 00:36.650 --> 00:40.710 I'm going to turn it over to Lennart now to get to the meat and potatoes of it. 00:40.710 --> 00:41.590 Thank you. 00:42.130 --> 00:43.410 That sounds great. 00:43.410 --> 00:44.710 Thank you so much. 00:44.930 --> 00:49.190 First time I'm doing a talk at a remote conference. 00:49.190 --> 00:52.210 I think we're all learning new things in this year. 00:52.550 --> 01:06.710 I wanted to, before I start with anything else, I just wanted to say thank you to the organizers not only of DEF CON, but also the organizers of Blue Team Village, because I think that's just an amazing job they're all doing. 01:06.710 --> 01:09.990 They're doing that every year, but now this year I think it's even harder. 01:10.210 --> 01:15.750 And I as a speaker, and I think I was the first in the lineup here, so some things were new to them too. 01:15.970 --> 01:18.590 I feel like they did an absolutely fantastic job. 01:18.590 --> 01:26.690 So thanks everyone, and I hope everyone has an absolutely fantastic time at at DEF CON and at Blue Team Village specifically. 01:26.970 --> 01:35.650 So what I'm going to do today is I'm going to walk you through a very, very high-level overview of what Greylog is. 01:37.230 --> 01:41.570 And we're doing that because Greylog is also part of OpenSOC. 01:41.570 --> 01:49.090 And OpenSOC, the CTF of the Blue Team Village, if you're competing in it, you're going to be using Greylog a lot. 01:49.090 --> 01:57.930 So I was asked if I could give an introduction to it, especially I think for everyone, but even a little focused on the people that will be using it during OpenSOC. 01:57.930 --> 02:09.930 So I think it's going to be a fantastic overview if you're new to Greylog, or if you haven't looked at Greylog in a while, or if you're generally interested in open source software, DFIR, block management, whatever. 02:09.930 --> 02:12.730 I'm going to walk you through it, like I said, very high level. 02:13.130 --> 02:18.970 And very important, we're going to have a bunch of time for Q&A and questions at the end. 02:19.370 --> 02:27.390 That means that if you have any questions, we're going to go through them then, and I'm going to make sure that we leave enough time there. 02:27.630 --> 02:39.910 We will also be, when I say we, we Greylog people are going to be around in the Blue Team Village Discord, and there is a Greylog channel there under the Sponsors tab. 02:40.670 --> 02:42.590 And we'll be around there. 02:42.590 --> 02:43.810 We're in multiple time zones. 02:43.810 --> 02:47.430 There's a good chance you're going to meet someone from us over there. 02:47.430 --> 03:03.390 I believe we have a little flag at our username or something that shows that we're part of Greylog, and we'll be happy to also answer any kind of questions that you might have, maybe during the CTF or OpenSoc itself, or maybe in general about Greylog. 03:03.390 --> 03:04.530 So we'll be around. 03:04.530 --> 03:08.610 We'll be happy to answer any questions you have. 03:09.390 --> 03:12.230 Next slide is the agenda. 03:12.230 --> 03:19.590 I'm going to be very careful with not moving around too much and not skipping through slides too fast. 03:19.590 --> 03:24.130 I hope there's not too large of a delay between what I'm saying and what you're seeing. 03:25.290 --> 03:29.130 So that that is all in sync, but I'm going to be careful that that works. 03:29.130 --> 03:33.390 If there are any issues, you can always post in the Discord channel. 03:33.390 --> 03:38.590 There are moderators there, and they can make me aware if there's something going massively wrong in any way. 03:38.730 --> 03:43.190 The agenda for today, you'll see this here on the left, I think. 03:43.190 --> 03:49.670 I only have like three real slides, because I want to really show you Greylog as a product. 03:49.750 --> 03:51.190 I want to show you what it does. 03:51.190 --> 03:53.390 So it's going to be a big focus on a live demo. 03:53.910 --> 03:57.150 But I'm going to go over one slide, just real quick, about me. 03:57.150 --> 03:59.330 Then one about Greylog, give you a little bit of background. 03:59.970 --> 04:03.050 Then we can take a quick look at the Greylog architecture. 04:04.230 --> 04:19.350 Not kind of in the level of detail for when you would get ready to deploy this yourself, but just to give you an idea of how the parts of Greylog are kind of coupled together, so that you can, when you use it later, maybe a few things might make a little more sense. 04:19.350 --> 04:25.130 I just feel we should take a quick, just a minute, at the components of Greylog itself. 04:25.330 --> 04:26.830 Then, like I said, live demo. 04:26.830 --> 04:37.850 We're going to focus on analysis, because I think that's, as a user and as an analyst, that's probably the most important part for you, especially if you're part of OpenSoc this year. 04:39.090 --> 04:44.730 But we're also going to look at some differences if you're used to other tools. 04:44.730 --> 04:49.250 I think that could also be a really important kind of question that you might want to ask. 04:49.250 --> 05:04.230 If you are used to another log management tool out there, maybe if you have questions about how Greylog compares to that, from kind of how you use this, does Greylog do that, is there another way of doing that, so you can apply the knowledge that you have already, 05:04.230 --> 05:10.770 so that you can really apply this in a good way with a new product like Greylog. 05:11.550 --> 05:14.330 And then, like I said, we're going to have a lot of time for Q&A. 05:14.750 --> 05:20.110 For the questions that you have, please use the channel in the Blue Team Village Discord. 05:20.110 --> 05:24.130 If you're not in that yet, it's a good moment to just quickly sign up for that. 05:24.230 --> 05:30.050 Go to the Blue Team Village Discord, and in Discord you see these categories on the left in your sidebar. 05:30.170 --> 05:32.970 There's one that's called the Flamingo Hotel category. 05:32.970 --> 05:35.970 Made me miss Las Vegas very much when I saw that this morning. 05:36.270 --> 05:42.630 But there's the Flamingo Hotel category, and there's a channel in there that's called Text Workshop Track One. 05:42.630 --> 05:46.130 We are here right now, we're Workshop Track One, and that's a text channel. 05:46.170 --> 05:48.110 So that's where you can post your questions. 05:48.110 --> 05:55.590 The moment we're going into the Q&A phase, at the end of this, I'm going to go to that channel, and we can start to look at your questions and start answering them. 05:55.590 --> 05:56.170 All right? 05:56.570 --> 05:59.750 So, like I said, Text Workshop Track One. 05:59.750 --> 06:07.990 If you get lost somewhere in there after you join, like I said, there are moderators swarming that place, and they'll be happy to help you and guide you to the right channel. 06:07.990 --> 06:11.150 So just ask anywhere, and you should find it. 06:11.750 --> 06:13.710 About me, it's real quick. 06:14.050 --> 06:15.450 Lennart Koopman. 06:15.790 --> 06:20.690 My Twitter handle is at underscore Lennart, L-E-N-N-A-R-T. 06:20.690 --> 06:25.270 If you want to follow me on your own risk, you should definitely do that. 06:25.570 --> 06:29.510 My background is actually software development and architecture. 06:29.510 --> 06:36.490 So I've started my career as a software developer, and also started the Greylock project in 2009 already. 06:36.490 --> 06:40.010 I realized with horror that it's been 11 years already. 06:40.010 --> 06:46.910 It's been 11 great years, but 11 years is a pretty long time, and I felt like it was more like three years. 06:47.350 --> 06:59.170 But Greylock as an open source log management product started in 2009, I believe, actually pretty much on the day in 2009, like in early August. 06:59.270 --> 07:09.230 We had a nice little celebration at our last party over in Vegas. 07:09.810 --> 07:10.250 That was fun. 07:10.250 --> 07:11.150 I think there are pictures. 07:11.490 --> 07:16.990 I then started a company behind Greylock in 2013. 07:17.790 --> 07:22.710 That was after the open source project was showing some commercial interest from people out there. 07:22.710 --> 07:25.270 So they asked me, hey, can you give me support? 07:25.270 --> 07:27.070 And I said, hey, I don't know how to write an invoice. 07:27.310 --> 07:29.450 So that was a good moment to start a company behind it. 07:29.450 --> 07:30.790 That was 2013. 07:31.130 --> 07:34.290 I'm currently the CTO over here at Greylock. 07:34.350 --> 07:36.190 That's really what I started as, too. 07:37.170 --> 07:39.390 And I was born and raised in Germany. 07:39.390 --> 07:42.370 That's where my accent is coming from, if you can make it up. 07:42.390 --> 07:49.130 But I am living in beautiful Houston, Texas now, which is also where one of our offices is. 07:49.130 --> 07:55.010 The other offices are in Germany and then also straight out across the United States. 07:55.070 --> 07:57.250 I guess I have to say, we are hiring. 07:57.470 --> 08:05.090 If you want to go to greylock.org careers, there might be something that you could be interested in that's remote in Germany or the United States. 08:05.090 --> 08:06.510 But enough about me. 08:06.850 --> 08:08.370 Real quick about Greylock. 08:08.730 --> 08:16.810 This would be the moment at a conference or at a physical talk where I would ask who knows about Greylock, and then I would see hands go up or not go up. 08:17.010 --> 08:19.570 And then I could adapt this a little to the audience. 08:19.570 --> 08:22.610 So I'm just gonna tell you the whole story real quick. 08:23.390 --> 08:24.970 Open source log management. 08:24.970 --> 08:29.730 So you send Greylock or instruct Greylock to pull logs from somewhere. 08:29.930 --> 08:46.530 It will ingest these logs, it will parse them, and it will make them available for you for searching, analysis, threat hunting, for alerting, and also maybe to filter some out and say I'm actually not interested in these. 08:46.530 --> 08:48.470 Throw them away, route them somewhere else. 08:48.470 --> 08:53.810 Really a way to handle logs that are being generated in your environment. 08:54.050 --> 09:00.870 The three main use cases for that are dev or ops or DevOps, depending on what you're doing. 09:01.290 --> 09:07.390 Definitely very interesting for developers to do root cause analysis, to do monitoring, to do performance monitoring. 09:07.430 --> 09:27.210 Maybe when they know that there's an issue on the platform that they need to research or that they need to investigate, they use Greylock to go into the logs to figure out what exactly happened and to make sure that either it doesn't happen again or to put an alert on it or simply to resolve the issue that's causing it. 09:27.210 --> 09:28.130 Same for ops. 09:28.130 --> 09:32.690 For ops that could be just classic IT system ops. 09:32.690 --> 09:34.450 This could be network operations. 09:34.630 --> 09:36.890 I see a lot of people using it for that. 09:37.010 --> 09:53.110 The fastest growing use case has been for a while now security use cases, which I guess you as the audience here is probably very aware of, which basically means you're using it to keep a track record and a history of everything that's going on in the environment. 09:53.230 --> 10:04.670 That means you need to have a system that is able to really ingest all of your logs and to make sense of them and keep them for long enough so you can run your analysis against it. 10:05.950 --> 10:14.690 And it will then allow you to set up pretty complex alerting, like you would know it from some sim systems out there, for example. 10:14.790 --> 10:19.350 That's a feature that came out, I think, about a year or a year and a half ago. 10:19.350 --> 10:25.690 A new alerting engine that lets you help be a little more proactive about what's going on in your environment. 10:25.690 --> 10:29.630 But one of the other really classic use cases is you need to investigate an IP address. 10:29.630 --> 10:32.990 You need to investigate some kind of indicator of compromise. 10:33.070 --> 10:35.650 Something new came out and there's a new patch. 10:35.710 --> 10:41.270 You want to make sure that that specific file has not been anywhere in your environment in the last six months. 10:41.430 --> 10:44.970 Let's go in and let's see if that happened or not. 10:45.290 --> 10:54.850 And then, of course, classic DFIR incident response, figuring out if there was an attacker, what that attacker did, all of that fun stuff. 10:54.910 --> 10:57.890 And, of course, compliance, just having the logs somewhere. 10:57.890 --> 10:59.710 I think that is a valid use case. 10:59.930 --> 11:01.810 And for that, you need to centralize them. 11:02.150 --> 11:05.070 And I think Greylock is a really good choice for that, too. 11:05.810 --> 11:10.210 Like I said, started in 2009, really constantly grown since then. 11:10.430 --> 11:14.830 Very, very happy to have been a Blue Team Village sponsor really from the beginning. 11:14.830 --> 11:16.950 Like I said, absolutely fantastic people. 11:17.370 --> 11:20.790 Make sure to watch as much of their content as you can. 11:20.790 --> 11:23.930 And next year when we're hopefully all back in Vegas, make sure to stop by in person. 11:23.930 --> 11:25.230 It's always a lot of fun. 11:26.230 --> 11:37.550 And Greylock is also part of OpenSOC, the CTF that runs during Blue Team Village that has got so much positive feedback over the last years. 11:37.550 --> 11:39.950 Also, of course, extremely happy about that. 11:39.950 --> 11:46.510 And like I said, we'll be around to help you with any questions that comes up during your OpenSOC participation. 11:47.930 --> 11:53.450 Now, during OpenSOC or during the Blue Team Village, no booth this year. 11:53.450 --> 11:57.230 I was always happy to spend a day over there and just chat with people. 11:57.230 --> 12:00.050 Maybe give out some shirts and some Greylock swag. 12:00.110 --> 12:02.290 Because that is not happening this year. 12:02.290 --> 12:10.230 Make sure to stop by the Greylock channel in the Blue Team Village Discord, because I hear that we will be sending out swag from there. 12:11.070 --> 12:15.010 And then we'll be there to answer any of your questions. 12:15.630 --> 12:21.890 Very important is that OpenSOC is not running the latest version of Greylock yet. 12:21.890 --> 12:24.810 They're slightly behind it for some very good reasons. 12:25.530 --> 12:28.710 So the demo that I'm going to show you is the latest version. 12:28.710 --> 12:40.930 If you see something that's slightly different, definitely reach out to us in the Discord channel and we'll be happy to give you a maybe a workaround or tell you where that is. 12:40.930 --> 12:44.230 Or if it's simply not there and what else you could do about that. 12:44.230 --> 12:45.490 So just keep that in mind. 12:45.490 --> 12:49.930 But there's some structural differences about where some elements are. 12:49.930 --> 12:52.250 But overall, it's pretty much the same. 12:52.250 --> 13:00.230 And especially the core ideas and the core principles are of course the same, because they simply haven't changed in the last months. 13:00.830 --> 13:02.970 And then most importantly, have fun. 13:02.970 --> 13:03.950 Stay in touch. 13:03.950 --> 13:04.970 It's open source. 13:04.970 --> 13:07.490 So if you get interested in this, just start using it. 13:07.490 --> 13:08.770 Start running it yourself. 13:08.770 --> 13:10.330 It's designed for that. 13:10.770 --> 13:17.910 And there are many ways to install and run Greylock, especially if you maybe just want to try it out really quick. 13:17.910 --> 13:21.050 There's some ways to get something up and running really fast. 13:21.050 --> 13:23.690 There's a big community around this that can always help you out. 13:24.030 --> 13:26.330 So I want to say have fun and open SOG. 13:26.330 --> 13:28.550 I've only heard fantastic things about how much fun it is. 13:28.550 --> 13:30.470 So I'm sure you will have fun. 13:30.470 --> 13:33.690 And even if you're not participating in it, just download it. 13:33.690 --> 13:34.130 Give it a try. 13:34.130 --> 13:34.990 It's open source. 13:35.290 --> 13:36.650 That's what it's all about. 13:37.590 --> 13:42.450 So the next slide here promises a live demo. 13:42.510 --> 13:46.650 Before we do that I want to send you straight to the docs real quick. 13:46.970 --> 13:48.790 So we can look at the... 13:50.650 --> 13:52.070 I have to find where they are. 13:52.070 --> 13:53.510 First link here. 13:53.690 --> 13:55.130 Architectural considerations. 13:55.130 --> 13:57.510 And we will not be detailed. 13:57.650 --> 13:58.930 No worries. 13:58.930 --> 14:05.550 But I want to show you just really quick the parts that Greylock consists of. 14:05.830 --> 14:14.770 If you ever get stuck somewhere with Greylock, always go to docs.greylock.org if you feel like just looking it up yourself. 14:15.450 --> 14:16.610 That is up here. 14:16.610 --> 14:17.970 Docs.greylock.org. 14:18.010 --> 14:20.250 That's where all of our documentation lives. 14:21.130 --> 14:28.690 And if you can't figure it out there because your use case might not be described in there, then, like I said, reach out to us. 14:28.690 --> 14:32.030 But that's always a good place to get started. 14:32.690 --> 14:38.570 And I'm just using... you won't have to deal with the architecture because the open SOG folks are already setting that up for you. 14:38.570 --> 14:43.290 But just so you understand it, Greylock really consists of three big parts. 14:43.290 --> 14:45.210 Or three and a half big parts, I would say. 14:45.270 --> 14:50.110 There's Greylock itself, which consists of Greylock server and Greylock web interface. 14:50.110 --> 14:55.230 But it's really one system that you're running or one executable that you're running. 14:55.590 --> 14:57.330 And it has two dependencies. 14:57.530 --> 14:59.090 It connects to MongoDB. 14:59.090 --> 15:06.530 It does that to store some state, to store some cluster communication, to store some configuration that lives in MongoDB. 15:06.530 --> 15:10.690 And because there's really not much data, that MongoDB is really, really small in the end. 15:10.690 --> 15:15.390 Actually, most people will just run it on the same node as the Greylock server. 15:16.090 --> 15:24.670 And that way, you can almost forget that it's there and set it up in a replica set to make it highly available. 15:24.990 --> 15:29.550 The Elasticsearch part, though, that's what we're using to store the messages. 15:30.270 --> 15:35.730 And so that will, of course, you have to scale that properly because that gets all the load from searches. 15:35.730 --> 15:39.910 And it gets, of course, all the load from actually writing the messages to disk. 15:40.710 --> 15:50.310 And what happens is, if you connect to the Greylock web interface, it will basically execute API calls against the Greylock server. 15:50.310 --> 15:54.790 And it will say, hey, my user of the web interface is trying to search for these messages. 15:54.790 --> 16:05.230 And then the server says, yep, I'm going to search for them, queries Elasticsearch, gets the data back, does all its funky Greylock stuff with it, sends it back to the web interface, and the web interface displays it. 16:05.770 --> 16:15.910 I'm mentioning that because all the communication between the web interface and the Greylock server is really API calls, nothing else happening. 16:15.910 --> 16:21.290 All it is, it's just authenticated HTTP REST API calls. 16:21.310 --> 16:23.610 That means that you can also automate everything. 16:23.810 --> 16:31.690 So if you are getting at a point where you want to write a script to look at data, for example, you can always use the Greylock API. 16:31.690 --> 16:38.570 There's an API browser in Greylock, and you can start to write your Python scripts and start to pull that data out of Greylock and do something with it. 16:38.610 --> 16:44.010 That's kind of my secret sauce tip for if you're working in OpenSoC for sure. 16:44.010 --> 16:48.830 If you're good at Python or another language, then definitely keep that in mind that you can do that. 16:49.210 --> 17:00.030 But overall, Greylock server accepts the messages, you send the messages to the Greylock server, use the web interface to analyze, display, configure, set up alerts, all of that fun stuff. 17:00.030 --> 17:04.350 And then Greylock behind the scenes will do all the management of Elastic Search. 17:04.510 --> 17:07.270 You can define your retention times, all of that. 17:07.270 --> 17:21.170 So if you're maybe used to the Elastic Stack where you have to do a lot of stuff in Elastic Search itself, for Greylock you really just have to tell Greylock where the Elastic Search is and then Greylock takes care of the rest for you so you don't have to become an Elastic Search expert. 17:21.170 --> 17:23.930 I think that's a very important part. 17:24.790 --> 17:32.690 If you want to, you can scroll down here and look at what complex looks like with multiple nodes, clustering, load balancer in front. 17:32.710 --> 17:40.970 I think that is definitely out of scope right now for what you are about to do here or if you just want to give it a try. 17:40.970 --> 17:47.130 But be aware that this is all documented here and then there's also another setup guide that talks you through that. 17:47.130 --> 17:50.050 So it should be a good place to get started. 17:50.630 --> 17:53.770 All right, so now we're going to the real life demo part. 17:54.530 --> 18:02.010 And what I'm going to do is I'm going to walk you through... I made some notes here. 18:02.010 --> 18:05.550 I'm going to work with one, two, three, four areas really. 18:06.230 --> 18:09.130 And I want to spend the most time in the search and analysis. 18:09.130 --> 18:12.930 Like I said, I think that's where most of your time will be spent. 18:12.930 --> 18:20.390 But I just want to show you a few other parts of the system, at least real quick, so you are aware that they are there. 18:21.590 --> 18:24.650 So I always like to start in the system area. 18:24.650 --> 18:30.490 And that is simply because I think that gives you an idea of kind of the philosophy behind Greylock itself. 18:31.010 --> 18:38.470 Our idea is that you should have to set up a Greylock in a config file only initially and only once. 18:39.050 --> 18:42.550 Basically tell Greylock, where's my MongoDB search? 18:42.830 --> 18:49.610 Give it some data it needs to encrypt passwords, to set up TLS on the web interface, kind of this basic setup. 18:49.810 --> 18:54.570 And then from there on, we believe that you should be able to do everything from within the web interface. 18:55.170 --> 18:59.590 Like I said, those web interface calls are really just API calls. 18:59.590 --> 19:04.190 So if you want to use automation, you can just use curl to set up stuff automatically. 19:05.230 --> 19:10.810 But during, I would say, after a base setup, everything is configured in Greylock itself. 19:10.810 --> 19:14.790 And then Greylock keeps the configuration basically in MongoDB for you. 19:15.050 --> 19:17.790 What that means is, I just want to give you a real quick overview. 19:17.790 --> 19:20.130 We're going to go into that very deeply. 19:20.130 --> 19:27.710 But if we look at our pipelines, for example, that is where all of the message processing of Greylock is happening. 19:27.710 --> 19:33.550 This is not some API call where you have to post some cryptic language to. 19:33.550 --> 19:38.870 This is not a huge YAML file or JSON configuration of that. 19:38.870 --> 19:41.030 This is all, no, here we go. 19:41.030 --> 19:42.370 Here comes my Linux syslog. 19:42.370 --> 19:45.390 And I'm going to say, I want to parse some stuff out of it. 19:45.390 --> 19:53.250 And you just basically configure Greylock here with a very efficient and small rule language that then says, OK, everything has Linux syslog. 19:53.250 --> 19:55.010 Apply this regular expression on it. 19:55.010 --> 19:56.430 Extract some fields. 19:56.650 --> 20:00.490 You'll see here on the right, this is all the functions you can execute on it. 20:00.530 --> 20:02.310 You can drop a message. 20:02.470 --> 20:06.290 You can check what a message looks like and then define other actions on it. 20:06.290 --> 20:08.190 You can thread Intel lookups on it. 20:08.190 --> 20:10.350 You can run a Whois lookup on it. 20:10.350 --> 20:12.290 DNS reverse lookup on it. 20:12.290 --> 20:14.570 Run it against your own lookup tables. 20:14.970 --> 20:17.730 You can check if something is in a certain subnet. 20:17.950 --> 20:19.670 All of this processing happens. 20:19.670 --> 20:20.650 And this is very important. 20:20.650 --> 20:24.770 This is a very important thing that you need to understand, especially if you come from other systems. 20:25.550 --> 20:37.250 All the processing happens when the message arrives in Greylock, OK? 20:37.450 --> 20:45.430 That means that once a message has been written, that means that that message basically becomes immutable. 20:45.430 --> 20:47.890 That means that you cannot change it afterwards. 20:47.890 --> 20:52.990 That has some positive side effects and some side effects that you might have to work around. 20:52.990 --> 21:03.010 What that means, most importantly, for you, if you're coming from a system that allows you to transform data while you search, Greylock simply won't do that for you. 21:03.750 --> 21:07.150 Especially not in a way that you can then further search on. 21:07.150 --> 21:10.610 Everything that's in Elasticsearch is in Elasticsearch as it is. 21:10.610 --> 21:13.630 You can't transform the messages during search time. 21:13.710 --> 21:15.210 Very important to keep in mind. 21:15.210 --> 21:22.630 Of course, we've built our whole web interface and the processing in a way that you can still do all the good stuff with it. 21:23.170 --> 21:31.510 And it also means that we're getting a huge usability and performance hit from that in a good way, as in it's much easier to use. 21:31.510 --> 21:37.570 We hear a lot of people who come from these schema-on-read systems who say that is useful for a bunch of queries. 21:37.570 --> 21:50.790 But overall, just being sure what data you're already looking at and not having to mess with super complex queries all the time is actually something that in the long term people really, really start to like. 21:51.190 --> 21:52.630 So just be aware of that. 21:53.810 --> 21:58.530 You'll see in the inputs area, you'll see where all your messages are coming in. 21:58.530 --> 22:03.590 We've got a whole section here for authentication, if you want to connect that to LDAP or an AD. 22:03.910 --> 22:05.890 We have API tokens. 22:07.070 --> 22:10.710 There's all kinds of authentication mechanisms happening here. 22:11.710 --> 22:15.390 And also, that's the last thing I really want to touch on real quick, we have content packs. 22:15.390 --> 22:29.850 So if you want to export any kind of configuration, dashboards, reports, alerts, anything like that, and insert it into a different setup, you can export and import these things here using a feature called content packs. 22:29.850 --> 22:30.970 We've got outputs. 22:30.970 --> 22:35.350 There's a whole index management here, how long you want to keep data. 22:35.350 --> 22:40.930 Then after that data has been deleted, you want to archive, you want to close it, you want to delete it. 22:41.050 --> 22:42.750 All of that happens here. 22:42.750 --> 22:47.790 It's, I think, for you for now, and especially if you're just getting started, not super relevant yet. 22:47.790 --> 22:50.970 Just be aware that Greylock has that, Greylock does that for you. 22:50.970 --> 22:55.310 So always a good idea to maybe just click around in the system area a little. 22:55.530 --> 23:00.050 The other thing I just also really want to tell you, so you know that it's there. 23:00.050 --> 23:09.470 I am honestly not sure how much of that can be used during a CTF, but know that there is an alerting engine. 23:09.990 --> 23:12.470 I have here, this is kind of my small demo setup. 23:12.850 --> 23:21.990 I have an alert setup here that alerts me every time there's a high priority IDS alert, Greylock, and I have another one, and we can actually look at those. 23:22.390 --> 23:30.310 I live in southeast Texas, so we're pretty good at storms, and I live in the United States, so we're pretty good at not burying our power lines. 23:30.310 --> 23:37.110 So that combination will definitely require for you to have some kind of an uninterrupted power supply. 23:37.110 --> 23:54.130 So I'm reading the logs from one of my UPSs, sending those into Greylock, and I'm triggering alerts to my iPhone when the power goes out, because I really want to know about that, because maybe if it doesn't come back up within five minutes, I'm just going to start to shut down some servers remotely real quick, 23:54.130 --> 23:55.890 or do something else. 23:56.290 --> 23:59.290 So I have an alert setup here, let me look at this first. 23:59.710 --> 24:07.170 Under event definitions, I have a condition set up here called UPS without external power. 24:07.170 --> 24:08.370 Click on that. 24:08.370 --> 24:27.490 Really what it does is, it says when you find a message that has its status field set to OB discharge, which is the UPS reporting that it is now discharging, which means it has no power, I say when that happens, I don't need aggregations, I don't need groupings, 24:27.490 --> 24:30.570 I don't need any other further rules and statistics. 24:30.590 --> 24:33.930 Just the moment that happens, I want to be sent a message. 24:34.150 --> 24:44.070 Set this up here on notifications, I'm using Ops Genie, which is the system that Greylock can post these alerts to, and it will then send an alert on my phone. 24:44.590 --> 25:00.410 I say when that happens, send me a notification, and you can actually see here, if I go to my alerts and events, and I filter my events by UPS, you will see, because I'm looking here at the last 360 days right now, usually you would probably look at the last day or so, 25:00.410 --> 25:05.590 you'll see now a history of all the days when my UPS was out of power. 25:05.590 --> 25:16.450 So you see here, for example, just about almost exactly a month ago, my UPS was without external power and it did trigger a notification to my phone. 25:16.630 --> 25:27.130 So you can set up these things, you can set up all kinds of conditions, I can say only send me this if certain events happen in a certain order, all of that is there. 25:27.130 --> 25:37.330 Also, I don't think anything from this demo today, but just something to be aware of and know that it's there if you want to use it. 25:38.170 --> 25:43.230 Then we have the streams, and after that I'm going to go into search and analysis and give you a quick overview of that. 25:43.230 --> 25:45.390 But we have the streams here. 25:45.450 --> 25:51.070 Streams are basically, think of categorization of messages when they're going into Greylock. 25:51.190 --> 25:57.350 They are an important concept for Greylock because, for example, our retention settings are sitting on top of that. 25:57.350 --> 26:08.170 So if I say I want to keep my NetFlow logs for two days and my domain controller logs for two months, I would route them into two different streams with a very simple rule. 26:08.170 --> 26:19.870 This one here, for example, if the field Greylock type matches exactly the value NetFlow, then route this into the stream NetFlow. 26:19.870 --> 26:22.530 Another one here would be this one. 26:22.530 --> 26:30.170 Yeah, if the message matches the regular expression filter log at the beginning of the string, then route it into my firewall logs. 26:30.170 --> 26:36.490 I think here's one for, yeah, this is anything that has a snort process ID in it. 26:36.490 --> 26:38.490 Route that into my IDS alerts. 26:38.490 --> 26:43.790 So you're basically pre-configuring or pre-configuring messages and you put all kinds of stuff on top of that. 26:44.470 --> 27:00.590 Like further processing, extractions, enrichments, you can put access rights on top of that and say only team A is allowed to see my AD controller logs, but my support team is allowed to see, for example, my database debug logs or something like that. 27:00.710 --> 27:02.130 Same for retention times. 27:02.130 --> 27:04.810 A bunch of concepts in Greylock streams. 27:05.350 --> 27:14.450 I think for you, if you're getting started with this or using it during OpenSoC, I think it's just a great way to make certain types of messages available with one click. 27:14.450 --> 27:17.770 Okay, so we're now going into search and analysis. 27:17.950 --> 27:31.170 If I wanted to see all my firewall logs, I just click on the firewall stream and it opens a search page that has the stream selector here on top already pre-configured to only look at my firewall logs. 27:31.170 --> 27:32.450 I can select multiple here. 27:32.450 --> 27:37.310 So if I wanted to see all my firewall and all logs, you just do that. 27:37.550 --> 27:39.310 This thing's going to update. 27:39.610 --> 27:40.370 Here we go. 27:40.370 --> 27:42.430 And now we also got my NetFlow logs in it. 27:42.430 --> 27:45.510 For this example, though, I'm only going to look at my firewall logs. 27:45.510 --> 27:46.730 I'm going to take this out again. 27:46.730 --> 27:55.970 Every time I make a change to a query, you will see that this is... you get this little yellow icon here, which means, hey, you haven't executed your new search yet. 27:55.970 --> 27:59.910 I don't believe this is the case in the version you're going to be playing with. 28:00.030 --> 28:02.750 But if you download it fresh, that's definitely going to be the case. 28:02.830 --> 28:05.010 So I have to manually execute that one more time. 28:05.470 --> 28:07.630 What we're looking at here is our search page. 28:08.290 --> 28:10.810 So I think this is what you're going to spend the most time. 28:11.130 --> 28:14.890 So let me walk through the main areas, and then we can run more. 28:16.130 --> 28:20.890 Maybe execute a search query or two, and then I would say we go into Q&A. 28:20.890 --> 28:26.550 And I will ask a moderator to let me know when we run out of time during the Q&A. 28:26.550 --> 28:28.090 I think we started a little late . 28:28.090 --> 28:32.750 So just let me know what the best time for you as the organizers is. 28:32.750 --> 28:35.930 But you have three main areas here. 28:35.930 --> 28:39.170 You've got the search query bar here on top. 28:39.170 --> 28:48.810 This is basically where you are selecting what exactly you want to be searching for, in which stream, what query, and also in which time range. 28:48.810 --> 28:52.070 That's always the first thing you've got to think about. 28:52.130 --> 28:53.990 Then you've got a site bar here on the left. 28:53.990 --> 28:59.970 I think the important part of this is the fields area that shows you all the fields that are in these messages. 29:00.050 --> 29:04.170 So pre-parsed fields in the message. 29:04.650 --> 29:07.590 And then, of course, you've got the actual result set. 29:07.590 --> 29:12.450 So everything you're seeing here, everything under the... is your result set. 29:12.450 --> 29:17.770 So that is actually everything that Draylog returns for your search query. 29:17.770 --> 29:20.350 So let's say I don't want to search in the last five minutes. 29:20.350 --> 29:22.130 I want to search in the last hour. 29:22.790 --> 29:24.210 Change that. 29:24.230 --> 29:25.310 Execute it. 29:26.350 --> 29:27.190 Here we go. 29:27.190 --> 29:32.190 So now we're looking... you saw that this message count chart here changed. 29:32.190 --> 29:33.990 We're now looking at the whole hour. 29:34.610 --> 29:36.750 And I think that we can also... 29:36.750 --> 29:39.950 I don't think that's this one yet. 29:40.570 --> 29:45.470 But you can also definitely generate a widget that shows you how many messages were found in total. 29:45.470 --> 29:47.390 We can do that in just a second, actually. 29:48.890 --> 29:53.670 So let's say we're looking at all my firewall logs here in an hour. 29:53.670 --> 29:55.430 You see that we have a little bit of a spike here. 29:56.090 --> 30:00.950 And this is... firewall logs are always great because they have a lot of data in it, how much value you actually get out of them. 30:00.950 --> 30:02.210 So I think it's up to you. 30:02.210 --> 30:03.510 But it's a great example. 30:03.730 --> 30:14.070 And overall, the searches work the same for everything, no matter if it's a firewall log, a Windows log, a Linux log, a Amazon API log, anything like that. 30:14.070 --> 30:17.770 So if I click on it, you see here this is the original message that came into Greylock. 30:17.770 --> 30:19.290 Very hard to read. 30:19.530 --> 30:24.390 If I click on it, you get the details and you get what Greylock has actually returned. 30:24.390 --> 30:28.450 So you see that Greylock here has parsed this out into some fields. 30:28.450 --> 30:44.270 Like, for example, the destination address and destination port, header length, which interface it came in, which IP version it was, the length of the whole of the whole packet that was let through, which protocol it was. 30:44.270 --> 30:47.510 And you'll also see here that in this case, the action was block. 30:47.510 --> 30:53.030 Everything that I'm looking at here on these logs, I'm only sending me the block logs. 30:53.030 --> 30:54.970 So I'm not interested in what the firewall let through. 30:54.970 --> 30:59.270 I'm only interested in what the firewall actually blocked. 30:59.550 --> 31:03.090 So with all of this, you also see source address and source port. 31:03.530 --> 31:11.470 Let's say we only want to see the messages from a certain source, where the source address is set to this value. 31:11.570 --> 31:22.950 What I could do is I could go into the search query bar on top here and say source underscore address equals, and then 1356, whatever I want to look for. 31:23.790 --> 31:28.630 Much faster is to just simply click on the value. 31:29.070 --> 31:31.870 This context menu opens, and you say add to query. 31:33.090 --> 31:36.150 And it will just build that for you and immediately execute. 31:36.270 --> 31:44.690 So what we're now looking at is we're looking at all blocked packets from the last hour where this was the source address. 31:44.690 --> 31:48.710 So basically all the packets this source address sent us locked. 31:48.710 --> 31:56.070 Okay, so let's try to get a little bit of a better overview here of what that looked like. 31:56.070 --> 32:00.910 So I want to find out what's this all TCP or both. 32:01.090 --> 32:03.210 Do you see we have a field here called protocol. 32:03.730 --> 32:05.350 Try to get the top values. 32:05.350 --> 32:07.030 I want to see they're all set. 32:08.390 --> 32:11.170 I see something that's a protocol. 32:11.250 --> 32:13.110 Show top values. 32:14.170 --> 32:22.230 This opens, and you see that no, actually this source only sent UDP messages. 32:22.230 --> 32:27.930 Okay, let's go a little deeper and say is this always the same kind of package? 32:27.930 --> 32:30.210 Do they all have the same length? 32:30.210 --> 32:31.910 Like very, very uniform? 32:31.950 --> 32:32.750 Same thing. 32:32.750 --> 32:33.890 Data length. 32:33.910 --> 32:35.410 Show top values. 32:35.470 --> 32:35.850 Here we go. 32:35.850 --> 32:40.410 We see that actually all these packages are UDP and exactly 278 bytes long. 32:40.410 --> 32:45.170 That looks like we're just blocking the same package over and over and over again. 32:45.190 --> 32:50.630 Now what would be interesting, this setup isn't doing it, but if we were to run a lookup . 32:50.630 --> 32:56.110 That's a built-in lookup table onto the source address or our GeoIP to see where this is coming from. 32:56.110 --> 32:57.670 Who owns this IP address? 32:57.830 --> 32:59.490 Look up the underlying ASN. 32:59.490 --> 33:00.510 Do all of that stuff. 33:00.510 --> 33:04.990 I'm simply not doing that here in this setup, but that's all stuff that you could do. 33:05.730 --> 33:13.630 And now let's maybe say I want to see... now let's actually go back. 33:13.630 --> 33:15.510 I'm going to execute this query again. 33:15.510 --> 33:21.610 And what you're going to see is all the data in the result set, because the result set change, has now updated. 33:21.610 --> 33:27.530 Now we see for the last one hour, for everything that was blocked, UDP, TCP, and ICMP. 33:27.530 --> 33:30.510 Okay, I'm going to delete this widget here. 33:31.030 --> 33:33.210 I want to show you the aggregation builder. 33:33.210 --> 33:35.210 That's really the last part I want to show you here. 33:35.210 --> 33:38.930 For the search query language, go to docs.greylock.org. 33:38.930 --> 33:42.330 There's a whole page that explains the search query language for you. 33:42.470 --> 33:46.190 I don't want to go into too much detail here, because you can simply read it up there. 33:46.190 --> 33:47.110 It's pretty simple. 33:47.110 --> 33:50.230 It's in the end, if you've been using the Elastic Stack, it's the same language. 33:50.230 --> 33:51.650 We're just passing it through Elastic. 33:51.910 --> 33:54.270 So if you're used to that, same thing. 33:55.410 --> 34:00.410 So whenever Greylock creates a widget, that is under the hood. 34:00.410 --> 34:03.410 In fact, an aggregation and an aggregation builder. 34:03.410 --> 34:09.810 So you will always see this little icon, top right of the widget, that you can click on and say edit. 34:10.150 --> 34:13.810 And now edit is going to show you the aggregation builder. 34:14.650 --> 34:19.490 And it has one very important drop down box, which is the visualization type. 34:19.690 --> 34:27.530 Let's say you want to visualize this not as a data table, but as a bar chart. 34:27.530 --> 34:34.890 And say, I really want to see three bars here, with UDP the largest, TCP on second, and then a tiny one for ICMP based on the count. 34:35.230 --> 34:36.450 You switch it up. 34:36.450 --> 34:37.250 Art chart. 34:37.350 --> 34:38.290 Here we go. 34:38.930 --> 34:39.870 Save it. 34:39.870 --> 34:42.230 I could now make a dashboard out of this. 34:42.230 --> 34:46.510 Here we see for the last hour, we mostly brought UDP stuff. 34:46.510 --> 34:47.730 Okay, interesting. 34:48.290 --> 34:54.430 You could, of course, if you really wanted to, make it... I think they're much harder to read, but sure, could do that. 34:54.450 --> 34:57.670 Greylock is not going to keep you from building weird charts either. 34:57.670 --> 34:59.810 So you want to make this a long chart? 35:00.690 --> 35:02.290 Sure, not a problem. 35:02.290 --> 35:03.270 Can do that. 35:03.790 --> 35:05.630 So this is our aggregation builder. 35:05.630 --> 35:06.810 You can do sorting. 35:06.810 --> 35:08.390 You can add multiple rows. 35:08.390 --> 35:09.770 We're going to do that in just one second. 35:09.770 --> 35:11.890 And you can also add metrics. 35:12.090 --> 35:21.170 So let's say I want to get the total bytes that were blocked over the last one hour. 35:21.170 --> 35:24.550 Okay, so you know we got the data length field here. 35:24.810 --> 35:26.490 Click on that, press chart. 35:26.490 --> 35:35.310 That is going to create a new widget, and that widget is basically just the same aggregation builder, but with other predefined values. 35:35.310 --> 35:36.830 Okay, you're going to see that in one second. 35:36.850 --> 35:39.970 Here we go. 35:39.970 --> 35:43.490 So now we got the average data length by timestamp. 35:43.490 --> 35:44.650 Click on edit. 35:45.530 --> 35:47.010 See, okay, that's our line chart. 35:47.010 --> 35:52.470 That's how much data was transferred per minute, in this case, on average. 35:52.870 --> 35:54.250 But you know what? 35:54.250 --> 35:57.590 Let's make this a data table, so you see what this looks like under the hood. 35:57.690 --> 36:01.150 It's like for each minute, it calculates the average data length. 36:01.150 --> 36:07.230 And with this kind of column row structure, you can put that into a bar chart. 36:07.230 --> 36:08.930 You can put this into a line chart. 36:08.930 --> 36:14.370 But I think what we're really interested in here, we don't want to look at the average data length. 36:14.610 --> 36:19.230 We want to look at the sum of the data length. 36:19.230 --> 36:22.090 Here we go. 36:22.450 --> 36:23.590 Data line chart. 36:24.310 --> 36:27.950 And now we see how many bytes are blocked in total. 36:28.370 --> 36:30.690 I just had to know that this was called sum. 36:32.630 --> 36:40.090 You can do standard deviation, max, min, count, cardinality, average, variance, percentile. 36:40.090 --> 36:42.750 You can do all of that stuff with it if you wanted to. 36:42.750 --> 36:43.170 Okay. 36:43.790 --> 36:46.710 One more thing I want to show you, and then we're going to go into Q&A. 36:47.330 --> 36:53.350 I really want to make sure that you start playing around with aggregation because that one is extremely powerful. 36:53.350 --> 36:57.530 It will really help you solve these challenges that OpenSock is going to give you. 36:57.990 --> 37:01.650 One more thing I want to show you is, let's say we want to build an aggregate. 37:01.650 --> 37:11.710 We say grouped by source address which protocol was used. 37:11.710 --> 37:12.190 Okay. 37:12.310 --> 37:14.870 So let's go into the source address. 37:14.970 --> 37:18.450 Get the top values of that as kind of a start. 37:18.730 --> 37:19.990 Add it. 37:20.030 --> 37:21.870 And we can add multiple rows here. 37:21.870 --> 37:25.130 So let's set this to protocol. 37:25.130 --> 37:28.150 I want to add a second type of row which is protocol. 37:29.070 --> 37:30.690 It's going to update. 37:30.690 --> 37:36.590 And you actually see here that these have all only communicated with UDP or TCP. 37:36.590 --> 37:38.730 They're not really doing multiple things. 37:38.730 --> 37:43.090 So to explain this a little better, let's build pairs of source address to destination. 37:43.510 --> 37:45.130 Take the protocol out. 37:45.210 --> 37:47.570 Add a new field, destination address. 37:48.770 --> 37:49.430 Here we go. 37:49.430 --> 37:53.970 So now you see this is not really what I wanted to show. 37:53.970 --> 37:55.210 It should be the other way around. 37:55.850 --> 37:58.410 Maybe destination address to source address. 37:58.530 --> 37:59.070 Here we go. 37:59.070 --> 37:59.890 That's what I wanted. 37:59.890 --> 38:05.910 So you get this grouping where you say this destination address was reached by these source addresses. 38:05.910 --> 38:09.890 And you can go lower and lower and lower as you wish and add more and more stuff. 38:09.890 --> 38:14.010 So let's say as the metric, here's the third column, I actually don't want the count. 38:14.010 --> 38:20.090 I do actually want the total bytes that were transferred. 38:20.090 --> 38:21.790 So the sum of the data length. 38:22.590 --> 38:35.630 So without any kind of complex queries, you establish that this destination address was hit by this source address with this many bytes over the last hour. 38:36.310 --> 38:39.050 And I can make this a little larger, put this wherever I want. 38:39.050 --> 38:42.410 I could now save this as a dashboard, share it with colleagues. 38:42.490 --> 38:44.650 There's a whole concept of parameters in there. 38:44.650 --> 38:47.110 It's all stuff I don't want to go into today. 38:47.530 --> 38:50.450 But that's all stuff that you can do. 38:50.470 --> 38:54.250 And you can also really start to combine this in very many different ways. 38:54.250 --> 39:03.030 What I can tell you is this might be, this might look like it's a pretty good learning curve associated with all these fields in the data table and the visualizations. 39:04.090 --> 39:06.170 I would encourage you just to play around with it. 39:06.170 --> 39:14.670 The worst thing that can happen is that it shows you either a chart that doesn't make sense or that it shows you an error when something really doesn't compute. 39:14.670 --> 39:16.370 Okay, you can't break anything. 39:16.710 --> 39:19.310 Just really start to play around with this stuff. 39:19.310 --> 39:23.150 Maybe think about something you want to visualize and see how you would approach that. 39:23.390 --> 39:29.870 If you get stuck, go into Discord and there might be someone who can help you from our team. 39:30.050 --> 39:38.550 And also, whenever you feel like, okay, this stops making sense, go back to the data table and look at what underlying data we're really looking at. 39:38.750 --> 39:43.990 Once you have multiple dimensions, you can do stack, bar charts, you can do all kinds of stuff. 39:43.990 --> 39:46.170 So, I would encourage you to play around with that. 39:46.330 --> 39:52.790 This is really an absolute core idea of what CorelDoc does and what you can do with it. 39:52.810 --> 39:56.630 So, with that, I would say that's my demo. 39:57.230 --> 40:02.410 And as many minutes as we have left, I would use for Q&A. 40:02.650 --> 40:11.250 And like I said, if a moderator could let me know if we're kind of starting to run short on time or when it's time for me to stop. 40:11.390 --> 40:13.510 I would say we're going to do five minutes. 40:13.510 --> 40:15.930 I really, I honestly hope we have a little more time. 40:16.770 --> 40:18.590 I'm going to do five minutes of Q&A. 40:18.590 --> 40:27.010 I'm breaking my promise here a little of having time, but I'm going to promise I'm personally going to be around in that Discord channel for the next days. 40:27.010 --> 40:32.610 So, everything that's left after these five minutes, I'm just going to answer there. 40:32.610 --> 40:36.210 And like I said, there are a bunch of other people too, and I hear that it's whack. 40:37.630 --> 40:41.750 So, Linux on the desktop, I do not know how to hide it when you can't see it. 40:41.750 --> 40:43.430 So, I'm going to go straight into that. 40:44.670 --> 40:49.610 I'm going to go straight onto this one here, and I'm going to try to find some questions, okay? 40:50.550 --> 40:53.030 We have about two minutes, if you don't mind. 40:53.170 --> 40:54.390 Okay, understood. 40:54.390 --> 40:55.550 Thank you very much. 40:55.550 --> 41:01.430 We'd just like to move the questions over to the text window, or the chat, I'm sorry, if we run out of time. 41:01.430 --> 41:02.190 Thank you. 41:02.250 --> 41:03.010 Understood. 41:04.350 --> 41:06.490 So, I see a few questions here. 41:06.490 --> 41:12.570 I'm going to skim through a lot of them, but I see a question about if there is an OVA. 41:12.830 --> 41:22.250 There is, if you go to Greylock.org, and you go to Get Greylock, big button here, these are all the ways that you can install it. 41:22.250 --> 41:25.110 There's Docker images, OVA, virtual appliances. 41:25.270 --> 41:36.490 We're integrating with Chef, Puppet, Ansible, and there are Debian and RPM packages to get started really quick, and the documentation is going to guide you through doing that. 41:36.850 --> 41:39.490 Okay, let me scroll down a little more here. 41:40.550 --> 41:46.970 This is available on Linux, and the best way to set up the environment is described in the documentation. 41:46.970 --> 41:48.650 In fact, it only runs on Linux. 41:48.850 --> 41:50.550 It does not run on Windows. 41:51.490 --> 41:55.590 So, I would definitely recommend to run this on Linux. 41:55.590 --> 42:02.050 All of the official installation methods are going to be based on Linux, for sure. 42:03.270 --> 42:08.810 I'm going to pick one more, and then I'm going to stick around in the channel, and also in the Greylock channel, please. 42:11.250 --> 42:13.610 Let's see if I find one more. 42:14.830 --> 42:15.550 There we go. 42:15.550 --> 42:16.150 That's a good one. 42:16.150 --> 42:21.590 Is there some kind of how-to for reading in a log file written by another application? 42:21.590 --> 42:25.770 So, you have another server, and there's something running on it that writes a local log file, right? 42:25.770 --> 42:28.850 How do I add these into my Greylock now? 42:29.990 --> 42:32.210 There are several ways of doing that. 42:32.210 --> 42:37.730 Greylock has a concept called sidecar to even remotely manage of collectors. 42:38.110 --> 42:39.650 That is, however, not required. 42:39.650 --> 42:45.010 You can also just use any kind of open source collector that's out there. 42:45.030 --> 42:48.390 I personally recommend FileBeats or NXLog. 42:48.610 --> 42:50.410 FileBeats is coming from Elastic. 42:50.530 --> 43:01.030 They can send straight to our inputs, and you really just tell it, hey, here's a log file, and please send me everything that goes into this Greylock system with a buffer locally. 43:01.110 --> 43:04.450 So, look at FileBeat or NXLog. 43:04.710 --> 43:09.450 There's also WinLogBeat and a PacketBeat, and NXLog is also great for reading properly. 43:10.510 --> 43:17.310 And so, with that, I will keep my promise and stick around for more questions that are coming in. 43:17.810 --> 43:21.010 Follow me on Twitter if you have questions in the long term. 43:21.010 --> 43:32.330 That's at underscore Leonard, L-E-N-N-A-R-T, and I hope you enjoyed that, and I really, really hope that you had a fantastic time playing OpenSoC or trying out Greylock. 43:32.330 --> 43:40.470 We're building this for you, for the community in the end, and so let us know if anything doesn't work, if anything doesn't make sense, if you want to prove anything, it's open source. 43:40.530 --> 43:41.950 Use it, play it, improve it. 43:42.350 --> 43:43.230 That's it. 43:43.550 --> 43:45.070 Thank you very much. 43:46.790 --> 43:47.790 Thanks a lot, Leonard. 43:47.790 --> 43:48.770 I appreciate your time. 43:48.770 --> 43:49.910 A great presentation. 43:49.910 --> 43:51.470 We look forward to hearing more from you guys.