start	end	text
580	8840	So today, I really wanted to focus on kind of an introductory level explanation of, you know,
8840	13700	some of the stuff that we see in the cloud and, you know, of course, how a lot of things are moving
13700	19180	to the cloud these days, just security onion in general, and how we might be able to leverage
19180	25260	security in the cloud to monitor our cloud infrastructure. And then also, maybe a couple
25260	34420	ways that, you know, through a stance of academia or standing up a POC proof of concept or whatnot,
34420	39740	how we can automate that and automate our testing and maybe automate the deployment
39740	46380	of security in the cloud. So most of this will be focused on AWS, since it is one of the largest
46380	51340	cloud providers. Although we will have some resources to share for other cloud providers,
51340	56840	and we'll be going through some of that stuff there. So without further ado, I will go ahead
56840	64880	and get started. A little bit about me. I have four kids, married, of course, and definitely love
65500	71360	every minute of it. I, as I mentioned, work for Security Onion Solutions, where we develop and
71360	76580	maintain Security Onion. And we also provide professional services and training for Security
76580	83620	Onion. And it's really all about that open source platform and getting folks better visibility into
83620	90180	their network. So let me go ahead and get started. Talking about the agenda today, we're going to go
90180	95700	through the cloud in general, some of the stuff that we find all over the place in different
95700	104980	clouds, whether it be AWS, Azure, GCP, Google Cloud Platform. And then also, again, introducing
104980	111740	Security Onion, what it is, how it can help us, and then introducing, again, Security Onion in the cloud,
111740	120190	and then automating that deployment. So when we talk about the cloud, and we talk about all the
120190	127670	assets and all the data that we really house there, and that potentials or other folks could
127670	134450	potentially access, some of those are as follows. For AWS, it's going to be things like S3 buckets,
134450	140710	which we might have seen in the news recently. A lot of leaky buckets, a lot of unsecured S3
140710	147050	buckets having public read or maybe even write access to them. So there's definitely some
147050	153010	attack surface there with that kind of stuff, as well as DynamoDB and some other production data
153010	161210	storage in AWS. Again, with Azure, it's blob storage, or maybe even event hubs, where our data might be
161210	168470	stored, or logs, or whatnot. So that's another thing to keep a look for in Azure. And then in Google
168470	174490	Cloud Platform, obviously, like S3, we have storage buckets, cloud data stores and file stores that we
174490	180450	want to keep an eye on, and lots of juicy stuff for attackers that they may be trying to find this
180450	188690	stuff, publicly accessible from the internet, or they're able to get past, slip past our initial
188690	193770	defenses and easily get to the stuff, or maybe even not easily get this stuff, we definitely want to
193770	200550	know. And then of course, we have the application or the network traffic itself, right? So we have
200550	205010	all this this traffic and this data flowing across from these different instances, from these
205010	210310	different segments in the cloud. And we definitely would love to know what's going on. And it
210310	214990	definitely can help others to know what's going on, such as an attacker. So we just want to be mindful
214990	219950	of these things whenever we're doing business in the cloud, running all these critical operations
219950	228650	and whatnot, just being aware of that. Now, an example of that stuff being abused in the case of
228650	235270	AWS, there are various tools that, you know, attackers or just security researchers use in
235270	242050	general to try to find these items. It might be S3 scanner to scan for open S3 buckets, or maybe AWS
242050	247010	bucket dump to try to get the stuff where we could enumerate buckets, look for interesting, juicy
247010	253330	tidbits of data. So there are lots, there are no shortage. And, you know, every day, again, there
253330	259410	are more leaks and more tools being released to try to find this type of stuff. So it's becoming
259410	264950	easier and easier for the attacker to get in and get this data if we're not careful about our
264950	274880	environments. Similarly with Azure, there's microburst, right? So we could look for different
274880	281160	services in Azure that might be enabled, weak configuration, or maybe even try to identify
281160	287380	post-exploitation actions, right? So, again, these tools, there's no shortage. Definitely have to
287380	296400	keep an eye on this stuff. And then, again, with GCP. So GCP, there's a mechanism, GCP bucket
296400	301120	brute, similar to the others, where we can enumerate Google Cloud storage buckets. We can
301120	307000	determine access levels, privileges, see if we can get privask, privilege escalation there.
307120	315720	Lots of ways that we can do that there. And then also the cloud credentials. It's really
315720	321180	going to be another thing where it's not even the data itself, but something that brokers access to
321180	326320	the data, right? If account passwords, IM, or root account credentials are able to be phished
326320	331620	from people, of course, that's no good. And, again, it's the weakest link, which is,
331620	337400	you know, very commonly the human in this case. And, you know, with these access keys or these
337400	342520	credentials, that means that attackers could control access to AWS servers without a username
342520	347760	and password, right? So access keys, if they have those, they can just go straight in.
348020	352760	And then, again, those are obtained usually by a phish or some similar method, right?
356070	361250	And then, again, with the privilege escalation with regard to cloud credentials,
361250	367710	folks can create new policy versions, right? They can create new keys off of those keys. So even if
367710	371490	you delete the old keys that were compromised, if you're not deleting new keys that were created by
371490	377390	them, or you're not monitoring that, it's very difficult to get, you know, those attackers out
377390	383190	of your network, or it just poses yet another concern and another question, right? Even adding
383190	389230	malicious Lambda layers to existing Lambda functions, it's one thing that attackers can do,
389630	395050	and Rhino Security Labs actually demonstrated it's pretty cool, actually, basically modifying
395050	401150	existing Lambda functions to act as you would not expect, and it's a great way to hide stuff like
401150	409260	that without being super obvious. So we've talked about that stuff, and I've gone through that
409260	414620	rather quickly, but I think as far as a cloud village, I think some of us are aware of these
414620	422020	threats, of course. So now I want to talk a little bit about monitoring challenges, right? So monitoring
422020	428560	in the cloud. Now with NSM, or network security monitoring, which is really a core component of
428560	433580	security engine, where we're monitoring that network data, we're monitoring that traffic that goes from
433580	438400	endpoint to endpoint, there can be some challenges in the cloud, and there are ways to get around
438400	445440	them, but to talk about a couple, VXLAN encapsulation. So even if we are able to capture the traffic
445440	452160	in the cloud, typically if we don't have the right applications, if we can't decapsulate that,
452160	458180	or understand what it means, or alert on it, then it's not as much value to us. So it makes it more
458180	464680	difficult, you know, to interpret that data, or to use that data in analytics, or reporting,
464680	470920	or alerting, and that can be difficult. That can be a challenge. Another one would be segmentation.
471160	478400	Maybe you have certain segmentation in your clouds where you're not able to easily tie together a
478400	484280	monitoring solution. I'm not saying security engine is it, and they'll be all for that, or
484280	489560	anything else, but that's just a general challenge overall that sometimes it's just difficult to
489560	498320	overcome. Then again, ephemerality. So we talk about instances spinning up and down a lot of times in
498320	503780	cloud environments. You may have a variable number of instances. They may be there one minute, they
503780	509060	may be gone another minute, and one of the challenges with monitoring that is how do you
509060	516160	tell something, right, to monitor this host, or to monitor the activity of this host when it spins up,
516160	520300	and then it just goes away? How do we tell, you know, to monitor the next host and the next host?
520540	527240	How can we group these together and create an effective solution? And in some cases, there really
527240	533000	is no native or no great mechanism for monitoring in the cloud, and it just, again, makes it even
533000	539920	more difficult. But there are ways around it. Sometimes they don't scale that well. Well, a lot
539920	544700	of times they don't scale that well. So it's always best if there is a native solution. And again,
544700	549200	there are commercial solutions available for monitoring. A lot of times these are highly
549200	556400	specialized, highly integrated with specific feature sets and specific products, so they can
556400	562720	be very expensive. And a lot of folks may not be able to afford something like that, especially
562720	571050	small to medium-sized businesses that are trying to run their workloads in the cloud. So
572770	578010	enter the onion. Just making sure that wasn't from you guys. Enter the onion, right? Security
578010	584170	onion. We're going to talk a little bit about here. So what is security in general? A little
584170	591050	introduction. It was created by Doug Burks in 2008. Doug was really scratching the need or the
591050	600450	itch to create an all-in-one solution, a click, click, or a click, click, finish solution as far
600450	608690	as rolling your own IDS and doing all this alerting and this analyst activity. Back during
609470	615250	2007, 2008, there really weren't a lot of great solutions tied together to enable somebody to
615250	621230	have this effective monitoring platform and not have to know all these ins and outs, not having
621230	629310	to compile ZEKE, not having to compile Cercata, PFRing, NetSniffNG and all this stuff. You had to
629310	636190	know a lot of stuff, a lot of that core technology to be able to even get in the game. And it takes
636290	641610	a lot of time to spin up. So a lot of the reasoning behind this is that we want this platform that's
641610	649250	easy to install, easy to set up, and we're getting folks monitoring in minutes. And it's free. It's
649250	655330	open source. Again, those small businesses, those medium-sized businesses can easily adopt this and
655330	660950	be able to tip the scale in favor of the blue team maybe, just a little bit more to that side
660950	667770	and be able to identify what's going on in the network. So security in itself can be installed
667770	673630	from an ISO image. We provide one on our site. And then also it can be installed from packages
673630	680410	on top of Ubuntu 16.04. And again, all this takes a very little amount of time. Obviously,
680410	686670	the ISO image is going to be faster, but you can install it on your Ubuntu flavor of choice.
687790	693110	So like many IDSs and network security monitoring platforms, Security Engine is traditionally fed
693110	701530	data from a TAP or a SPAN port. We have had folks use ERSPAN, GRE tunnels, that sort of thing.
701530	705350	It's not recommended, and it's not really supported, but there are other methods of
705350	711210	getting that traffic to it. And now we do integrate with the Elastic Stack for the
711210	716930	data enrichment, indexing, and visualization components. So it gives you all that rich,
716930	721370	being able to create data tables and be able to create visualizations and really get an
721370	724670	idea of what's going on in your network. It makes it really, really easy.
727600	732540	And here's just a quick screenshot. It's not the most exciting screenshot, but it does give you an
732540	738520	overview into the overview dashboard itself in Security Engine. And this is inside of Kibana.
738520	744020	So we can see the overall number of logs here and some different log types that we've recorded.
744100	748980	Some sensors that we've got connected right now, in this case just one. And then the number of
748980	758780	devices connected, which would be the management node and the sensor itself. Let me just click here.
760900	765660	And again, just some more, you know, just kind of scrolling down that overview dashboard. And
765660	769420	I'm going to go through this more in just a little bit, but we can see some other data types.
769420	774820	And again, just grouping on those sensors and those protocols. And then you also see some NIDS
774820	784330	alerts down here. So talking about some of that data that we get, a lot of folks traditionally,
784330	788810	when they've been exposed to an IDS or a network-based intrusion detection system,
788810	792070	they're going to be aware of this type of alert data that we see here on the screen.
792630	796110	So this right here is an alert, right?
796910	801590	Let me see if I can do it without clicking. Oh, let me go back. Sorry about that. So the
801590	806930	panmunix right here, this is just a Wazoo alert for the user W. Lambert that occurred locally
806930	812990	on a system. So Wazoo is a host-based intrusion detection system that we include in Security
812990	817870	Engine that can generate that alert data. And not even just alerts, but other types of activity
817870	825530	generated on the host itself. And then we have down below alert data, similar to what you would
825530	832350	find from Suricata, going to be generated down here. So we've got both of those types of alert
832350	836810	data there, the host and the network-based intrusion detection system alerts. And it gives
836810	843570	us the ability to kind of correlate back and forth and tie things together better, right?
845960	851780	The other types of data that Security Engine provides is going to be that of network metadata.
851780	857160	And this data is going to be recorded by Zeek, formerly known as Bro. You might have some Bro
857160	865100	fans in here. And this metadata is going to give us a lot of detail around specific protocols and
865100	872500	transport mechanisms that we see in our environment. For example, DNS, HTTP, SSL,
872500	877860	there's tons of different protocol parsers for Zeek. And it gives us just a lot of great detail
877860	887440	about those, right? Like URIs, user agents, queries, the query codes, whatnot. Just tons and
887440	891840	tons of different stuff that you might have associated with each different type of transaction.
893740	899080	And then the full content data is another thing that Security Engine provides. And this is going
899080	905860	to be commonly known as PCAP. So we can render an ASCII transcript of that PCAP based on whatever
906440	913080	items that you're looking at in Security Engine. So if you want to go from an event in Kibana to
913080	919100	the PCAP and see the actual raw communication, typically if it's not encrypted or whatnot,
919100	923980	or if it's not some unsupported protocol, then you should be able to see that activity.
923980	930400	And it helps to really verify what you think is going on and the other things that you're
930400	937700	seeing in the environment. So again, it offers that complete picture or that complete transcript
937700	949640	of what is going on. Now, you can feed supplementary data to Security Engine. So we have
950380	955780	the HIDS data, the NIDS data, we have all of this network metadata and stuff generated by Zeek,
955780	962680	we have PCAP, and then we have other stuff like Beats, right? So using FileBeat, we could pick up
963220	967720	DNS debug logs, we could pick up specific application logs and send those off to
967720	972760	Security Engine. We could pick up Windows event logs and send those off with Sysmon and whatnot.
972860	977560	We could even use PacketBeat and send that stuff. So if we have a segment where we're monitoring
977560	983840	hosts, and some people do this in the cloud, but whenever you can avoid it, I would probably
983840	990700	recommend it, you can use PacketBeat to have it on those isolated hosts. If you have a host that's
990700	994920	on its own dedicated network and you're not allowed to monitor that segment traditionally,
995380	1001640	maybe if you have that pinhole in the firewall or whatnot, to install PacketBeat and send that
1001640	1006660	data back, you at least have some better visibility into what's going on in the box,
1006660	1014780	as well as a host-based agent and whatnot. And then there's stuff like S3 and Azure event hubs
1014780	1020200	that Logstash affords us, and even FileBeat these days, that we can send data from those
1021060	1029880	storage facilities and even Syslog. And that's great and all, right? It's great that Security
1029880	1033520	Engine offers that stuff, and I haven't really gone into a lot of detail so far,
1033520	1038220	but how can it help us when we're in a cloud environment, and how might we set that up?
1038220	1042260	Or what might that look like? What does the infrastructure look like?
1042660	1051560	You know, maybe with AWS or something similar. So that brings me to traffic mirroring. When we
1051560	1058800	talk about traffic mirroring, I'm talking mainly here with regard to AWS, because that is the
1058800	1066660	actual naming of their mirroring facility in AWS. And we can take advantage of that with Security
1066660	1075240	Engine. We can basically use this architecture to collect this traffic from these hosts and then
1075240	1082540	forward it off to our Security Engine instance. So we can set up a mirror target, which is going
1082540	1087920	to be our Security Engine instance or a sniffing interface, and we can set up our mirror filter,
1087920	1093000	which is going to filter any traffic that we want to go to that target. For example,
1093000	1099720	if we don't want certain traffic, if we don't want DHCP or some other type of traffic to be sent
1099720	1106900	to our Security Engine instance, we can filter that out with our mirror filter. And then we'll
1106900	1111640	set up our sources, which will feed through that mirror filter into that mirror target.
1112020	1118140	And all of this encompasses a mirror session, really. So that's what a mirror session is
1118140	1125760	comprised of. And that is really the pretty basic concepts of the AWS Traffic Mirroring.
1129290	1134430	Again, that traffic mirror target is going to be where we define the target interface,
1134430	1138630	our Security Engine instance in this case, where we want to send our mirrored traffic
1138630	1144710	that we're collecting from our hosts. And then we have that filter, which is going to filter out
1144710	1149750	any unwanted stuff that we don't want or allow us just to specify what we do want.
1152030	1155670	And then we have that overarching mirror session comprised of each of those.
1157110	1166350	Let's check this real quick. Okay, no questions. All right. So let me get back to this. All right.
1166350	1170730	So the mirror session, then. You can see here we've got a screenshot right here. The name is
1170730	1176550	just Security Engine demo session. And then, again, the source and the target, which is our
1176550	1184610	Security Engine instance. And there's another way we could approach this. So maybe instead of
1184610	1189830	just setting up a standalone instance of Security Engine, if we just want to have our Security
1189830	1195890	Engine forward node, which is going to be our sensor only and our distributed deployment,
1195890	1200930	we can have just that in AWS. So typically, I don't think I went through this, but our
1200930	1205990	architecture would suggest in a distributed fashion that you have a master or manager node,
1205990	1211770	and then you have this forward node. And then you have a storage node, which is going to store most
1211770	1217290	of your elastic data. So what's going to happen in this case is you're going to send your forward
1217290	1220910	node, or you're going to have it in AWS. It's going to be collecting that traffic from the
1220910	1224990	mirror session. And then your master server is going to be connected up to that. So you could
1224990	1229650	have an on-premise master server. You don't necessarily have to deploy all of Security
1229650	1235450	Engine in the cloud. You could have another on-premises forward node, right? You can have
1235450	1240650	all of these different types of devices on your local network and have maybe open VPN or direct
1240650	1245630	VPN access to the cloud and having that one security in an instance if you need it.
1245730	1250410	So it's very flexible how we can architect these deployments. And I think it makes it
1250410	1256450	very powerful overall for us to be able to have that comprehensive view for both our local and
1256450	1267540	our cloud networks. And this right here is just an example of some of the VXLAN traffic that would
1267540	1273740	come across during a typical mirror session. So all of this mirror traffic is going to be
1273740	1280700	encapsulated, as I mentioned, in that VXLAN tunnel. So this basically, for applications
1280700	1285420	that can't read it, of course, as I mentioned, creates a little bit of a challenge. But in our
1285420	1291240	case, Zeek and Suricata can both decapsulate this data. So this is what this looks like
1291240	1296180	just coming across the wire on a box right here in AWS.
1299990	1305910	Again, just a shot of some cloud node stuff. If we were going to set up security as a cloud node
1305910	1317600	and have the rest of it on premise. And as I mentioned before, Suricata 4.1.5 and up, which
1317600	1322100	of course now we distribute a version higher. I can't remember the exact version off the top of my
1322100	1330880	head, but we can decapsulate VXLAN now. And VPC mirroring is capable with only these Nitro-based
1330880	1337360	instances. And I've got some documentation down there at the bottom with regard to those EC2
1337360	1343440	Nitro instances. So you'll want to make sure if you're monitoring stuff or if you've not even
1343440	1347600	deployed yet, and if it's feasible cost-wise, that you're deploying on these supported instances so
1347600	1357860	that we can take advantage of that. And then again, there are other considerations as far as
1357860	1363120	mirror sources and destinations. There are overall limits to the number of sources, so
1363120	1367860	please do check out that link down there if you do plan on standing this up in production.
1368380	1373400	Just testing in a lab environment, you're never going to really exceed the limits here. But
1373960	1380280	architecturally, there are some considerations that you'll want to have, maybe using a
1380280	1386380	NLB or a network load balancer versus individual hosts and whatnot. So that's just something to
1386380	1394940	think about there when you're going through and planning your deployment.
1394940	1401020	All right, and before we get started here, I also want to talk about TMNIDS real quick. So
1401020	1409020	TMNIDS is an open source project written by Tiago Faria and ThreeCorsec. So they've been
1409020	1415620	doing a bunch of great work with NSM lately, specifically NSM in the cloud.
1416940	1425220	And what this is, TMNIDS is an open source script that will allow you to, if you're familiar with
1425220	1434600	NIDS, testing your IDS using TestMyIDS. So it's a very... folks like me that have been doing it
1434600	1439380	for a little while, there's a site called TestMyIDS, and you would curl that and you would
1439380	1446080	get the UID root, and that would send you a little IDS alert as long as that rule was enabled and
1446080	1451340	make sure that your IDS is A-OK and that it's working as intended. And this serves a similar
1451340	1457700	purpose. This is a little bit more modern day, I think, and of course you could extend it if you
1457700	1463020	wanted to, but you can see here the different choices of alerts that you would like to trigger.
1463020	1468600	So you have a few different options here to try and see, generate some data, generate some alerts,
1468600	1475120	to see if that IDS is working, and to really just generate some interesting lab data. Now,
1475120	1482120	all of this traffic right here is not actually malicious, just simulating the maliciousness,
1482120	1490540	so please don't be afraid to run it. I know Tiago very well, and he would not... I don't think he
1490540	1500300	would do anything like that, so... All right. So now, I know we've been talking a lot. I've been
1500300	1507900	speaking to the joy of security and how it might help us. And now, I want to go through just
1507900	1513340	setting it up from scratch in AWS, and hopefully you guys can follow along if you have an AWS
1513340	1519380	account and you've seen the resources that we have here. Let me just get out of here,
1519380	1532440	out of presentation mode. So we do have these resources here that should have been in the talk
1532440	1539320	description or the workshop description. And if you scroll down here to follow along, I not long
1539320	1545700	ago posted a document. And this will really be just a text-based version of the instruction here.
1545700	1552940	And if you can, if you would like to, please do follow along. It is not the most verbose,
1552940	1558820	but hopefully it captures everything that we need to do here, and I myself will likely be referring
1558820	1563800	to it as we go through, just to make sure I don't miss anything. So please do let me know if you
1563800	1570060	have any questions or something seems amiss, and we can definitely get that taken care of.
1570960	1578980	So without further ado, I will begin to go into AWS here. Let me just go ahead and refresh.
1579640	1585580	And what we're going to do here is we're going to stand up a security and an instance from our
1585580	1592060	community AMI here. And we're also going to stand up another instance that we're going to be
1592060	1598040	monitoring with the VPC, sorry, or the traffic mirroring. So we're going to get through from
1598040	1602080	scratch, set this all up, and then I'm going to show you a way to make this a little bit easier.
1602160	1607400	But I do want to get started from scratch, just getting you guys used to all of these mechanisms,
1607400	1612680	all these different concepts, and maybe nailing them down a little bit more easily.
1613760	1619740	Okay, so I'm in AWS here. I want to launch the security and an instance from the AMI.
1620200	1626700	So a quick note, real quick too, if you guys do have trouble, I know this might be a deal
1626700	1633020	breaker for some of you guys, there are images. So if you're looking and you don't see the image,
1633020	1643020	there are images in EU Central 1, EU West 2, US East 2, and US West 1. I won't be able to
1643020	1647260	update that on the fly right now, but if you do still want to try it and you're in another region,
1647260	1651780	please feel free to reach out after the workshop and I can definitely help you out there.
1652340	1658400	So we've got these four in these four regions. Right now I'm going to be using US East 2.
1659240	1663340	So if I go, obviously you can see I have zero running instances right now.
1663340	1665340	I'm going to launch an instance here.
1666540	1672200	And come on, click launch instance. And I'm going to search for security onion.
1675180	1679660	Right now, don't be fooled, you may see one in the marketplace here. We don't actually charge
1679660	1686040	for our image here, and I don't believe we plan on doing that in the future. You'll see one here,
1686040	1693740	it's by BL King Consulting. Do not use this one. Do not. This one, first of all, is based on 1404,
1694580	1702120	which is several iterations behind what we're on now, and it is not supported nor endorsed by us,
1702120	1708800	so please do not use that one. The one we will be using is this security onion 1604 right here.
1708800	1713640	The official AMI provided by Security Onion Solutions. So we're going to select this,
1714160	1720040	and the smallest you probably want to go on this is going to be a T3 medium.
1720040	1724400	Now, this is going to be a little bit of a charge. I mentioned this in the documentation.
1724660	1731000	It's not really much at all. It's a few cents an hour to run this box itself, so it's not much,
1731000	1736240	but just a heads up there that it's not completely free.
1737600	1741860	And again, this is not really for Security Onion itself. This is just really the infrastructure
1741860	1747520	that's running Security Onion. So we're going to choose T3 medium for Security Onion,
1747960	1752960	and we're going to configure instance details. Oh, you know what? I skipped a step.
1753340	1759940	All right, so let's go back. See, I should have been reading my own documentation. All right,
1759940	1766500	we'll get a VPC because first of all, we need a VPC to put all this together, right? So we're
1766500	1772760	going to launch the VPC wizard, and for the sake of ease for this workshop, we're going to choose
1773080	1777840	a VPC with a single public subnet. Now, if you're doing this in production, you probably don't want
1777840	1784300	to do this. You'll probably want something behind a VPN using OpenVPN or Direct Connect or something
1784300	1789580	like that. But for purposes of our testing and whatnot, and because we're whitelisting by IP,
1790240	1795860	it'll be just fine using this. So what we're going to do here, we're going to specify the
1795860	1804860	CIDR block for the VPC and then for the public subnet. Now, if we go to the docs here,
1804860	1812200	we're going to choose the default 10 WACC for the entire VPC. But in case you wanted to add
1812200	1819880	something later, we're just going to specify the 10 110 for the public subnet. So that's what I'm
1819880	1828180	going to do here. 10 110. So if you want to go play with it, you could add other subnets later.
1828180	1832000	We just want to narrow the scope on this one a bit. All right, so we're just keeping the name
1832000	1846570	public subnet. Sorry. There we go. So we'll keep it like this. And then we'll go with the default
1846570	1858330	public subnet name right here. And then we'll click create VPC. And I forget to name it.
1858330	1863630	Okay. So let's go to my VPCs. And I'm just going to give it a name here because I failed
1863630	1871950	to do that. Because once again, not following my own directions. So I'm going to call this VPC
1871950	1881430	security onion demo. And right here we can see that one VPC is available. Now if we go into EC2,
1881430	1885610	we can go to running instances. We'll go back and we'll launch an instance.
1885610	1891330	We'll launch that security onion instance I mentioned before. That AMI.
1892530	1901800	Like that. And we'll grab the T3 medium here and we'll go to configure instance details.
1902360	1906380	And we'll make sure it's in our VPC that we defined and of course in our public subnet,
1906380	1909460	which it should be since those are the only ones that we have available right now.
1910520	1914600	Now what we're going to do here is we're going to go ahead and add the secondary device
1914600	1919400	for the sniffing interface by clicking add device right here. And what this is going to do,
1919400	1926340	it's going to make it so that AWS will not be able to publicly assign an IP address if you have,
1926900	1931580	you can see it here, if you have more than one interface. So we're going to go back and
1931580	1936380	fix that in just a minute. But we're going to go ahead and click next, add storage here.
1937420	1940720	And everything looks good here. We don't need to modify anything here.
1941280	1945420	Let's click next, add tags. And unless you really wanted to, we don't necessarily need
1945420	1950500	to add any tags here. I just really want to get to this configure security group right here.
1951780	1958500	And so what this one is called, it's called right now launch wizard one. We just want to call this
1958500	1966760	maybe, actually we'll select a default security group here. All right. And we'll click review
1966760	1971480	and launch. So this will have our default security group attached to it once we launch it.
1974060	1980200	All right. Now, what we can do here is it's going to ask you for a key pair to authenticate to your
1980200	1985920	host. Now, if you don't already have a key pair uploaded to AWS, you can create a new one and
1985920	1991040	then use that key pair to connect with this instance. You could proceed without a key pair,
1991040	1996060	which I don't recommend because you won't be able to get into it. So we're going to do
1997480	2006040	create a new key pair. And go to onion demo. All right.
2008460	2014800	And download this key pair. Okay. So I've got it saved locally now. And if I want to launch it
2014800	2018860	from my terminal, I can do that. I'm going to go ahead and launch this instance now that I've got
2018860	2024020	the key pair downloaded. And we get this nice little screen and we can go view our instances
2024020	2031380	here. And we can see that it's starting up here. All right. So it's going to flip back over here.
2031420	2038360	So once we launch that instance, what we're going to want to do is we're going to want to go to that
2038360	2044060	network interface and we're going to want to allocate an Elastic IP. So this makes it available
2044060	2050300	publicly so that we can access it from our box across the internet. All right. So let me go
2050300	2057600	ahead. Go to actions. Well, I'm sorry. Go to the network interface, eth0, which is the one we want
2057600	2061900	to connect to. It's going to bring up this hyperlinked interface ID. I'm going to click on that.
2062540	2067240	All right. So we brought up the interface and it's selected. And then we want to manage the
2067240	2073620	IP addresses for this interface. Once we get there, we can allocate an Elastic IP for it,
2073620	2078860	the one I mentioned previously. It's going to give us a new tab here. And it's going to ask if we want
2078860	2083720	to, you know, how we want to allocate it, what kind of settings. Just leave the defaults here and
2083720	2088980	click allocate. And then you can actually see that I've got some various ones that I didn't clean up
2088980	2094940	before allocated. But here you would have one here. So let me just go ahead and delete these
2094940	2103680	just so I'm not confusing you guys. Okay. I'm just going to release those real quick
2103680	2109120	so I'm not confusing anybody. All right. So we've got our Elastic interface. And now that
2109120	2116880	that's allocated, we can go back. Go ahead and hit cancel. Go back to actions and go to associate
2116880	2123620	address, which will allow us to associate that IP address. And we want to click allow reassociation
2124060	2128280	just in case that we want to change it later. We probably won't be doing that here, but
2128280	2131760	might be a good habit to get into if you want to be able to reassign them.
2131760	2134400	And then we're going to click associate address.
2136000	2143000	Okay. So now that we see that the... if we go back to the instances, see the instances running,
2143000	2150820	then we see our public IP right here. So if we want to go ahead and verify that that is up,
2150820	2157700	we can do that from here. So I downloaded that PIM file right there. You see right here,
2157700	2164540	securityunion1.pim. And you can do this with sudo or you can change the permissions on the file.
2164540	2169060	I'll just use sudo in this case to elevate my privileges to be able to execute this.
2169340	2174040	But I'll just do... I'm not in the downloads. Let me change to that.
2175580	2185180	And real quick before I continue. So when you're SSHing here, if you're on Mac or you're on Linux
2185180	2189860	and you already have a native SSH client, you should be able to do this natively. But if you're
2189860	2195880	using PuTTY, you will need to do something like the following in this link to convert the PIM file
2195880	2200720	for use with PuTTY. And it's going to be using PuTTYgen so that you can basically have PuTTY
2200720	2207000	source that that's a public key and then be able to go off and authenticate to that host.
2207660	2211000	So do look at those links there if you need to do that.
2211000	2215780	But then down here, we also have the command that you'll run. And then again,
2215780	2220320	if you don't change the permissions on the file, you will probably have to add sudo to that
2220320	2225260	to execute it with higher or elevated privileges.
2227720	2236720	So I'm going to do an SSHI PIM and then the default user for the security in an image
2236720	2246100	that's going to be onion. So we'll use onion at and then the public IP right here of the host.
2246500	2255680	Okay, so we'll paste that in here. And we'll just hit enter. And this is my local password
2256320	2274190	so that I can sudo. Remember it. Let's see if I fat fingered it again.
2276420	2282600	Oh, you know what? Okay, so what we're going to do here. One more thing. I'm sorry.
2283180	2287520	We'll need to change the security groups assigned for this interface.
2287580	2293900	Okay, so we'll go into security groups, go back to our default security group.
2294600	2300780	Okay, and we'll edit the inbound rules because we really only want to allow SSH
2302100	2308640	for our IP. And so I'm just going to allow it for my external IP here.
2309460	2318380	And then also for HTTPS when we want to access the web interface of a security ending. So
2320220	2326820	just modify the inbound rules here for the default security group. And we'll just save that.
2327640	2333140	Okay, so now anything that's part of that default security group will respect those
2333140	2338380	firewall rules. So now we only have SSH and HTTPS from that external IP.
2339260	2343520	And you'll want to do the same when you're standing ears up. So we'll do that real quick.
2345220	2347960	And let me just do this real quick.
2350040	2358440	And right now that we've modified that, we can just hit yes to accept here. And now we are into
2358440	2364360	our security box. Now we we do have the security in an image and most of the stuff is installed
2364360	2370760	already, but we still have to run setup on here. So what that means is the actual process of
2370760	2376660	configuring all the stuff and you know, and all the packages installed on the OS. So what we'll
2376660	2382820	do here, just some kind of administration stuff. We'll just change the host name real quick to
2382820	2393050	something like security and in demo. And I'm just going to reflect that in Etsy host real quick.
2395830	2407060	So we'll change Etsy host name and Etsy host. I'm going to just give the box a quick reboot.
2414070	2425280	Let's check for any questions or anything. Okay. All right, so it's probably rebooted by now.
2425860	2434900	Because these AWS instances are pretty fast. So SSH back in to security and in demo.
2435240	2442700	And now what we'll do is we'll run the first phase of setup for security. And what I'm doing here
2442700	2449400	is I'm running SS setup minimal. Now, because we're running on a box with four gigs of RAM,
2449880	2455440	yeah, four gigs of RAM and two cores, we run the minimal setup of security in it so that we can
2455440	2461900	still operate efficiently. You could run the full fledged version, you would have to size up probably
2461900	2469980	to a T3 large, or maybe even a little more comfortably a T3 extra large. But SS setup
2469980	2475560	minimal will be more than enough for our lab. And usually is more than enough for many folks as well.
2475560	2481740	So we'll run that. It's going to ask us if we would like to proceed. We'll hit yes.
2483020	2489300	Yes. And we're going to configure the network interfaces. And we'll just select ENS5 for our
2489300	2496260	management interface. And we'll hit okay. And we'll want to make sure to select DHCP and let AWS
2496260	2502480	handle all of the IP addressing and that sort of stuff. And then we'll like to configure our
2502480	2508740	sniffing interfaces. So we'll just hit yes whenever it asks us to do so. And then we'll
2508740	2513180	select ENS6, which is really the only other interface available at this moment. So we'll hit
2513180	2520360	okay. And so it's just going to ask us if we're really ready. And yes, we're ready. So we'll click
2520360	2525760	yes. But we are not ready to reboot. So hopefully you haven't gone through and hit reboot just yet.
2525760	2531880	But if you did, then it shouldn't be too far until you're rebooted. So we'll go and edit.
2531880	2535820	Since the network interfaces have been configured for the most part,
2536420	2543600	an important distinction for cloud monitoring and monitoring in AWS is going to be the VXLAN
2544400	2550940	encapsulation. And what that does is going to add 54 bytes to the MTU or to the size of the packet
2550940	2557060	in general. So we want to accommodate for that. We want to plan for that. So we'll want to manually
2557060	2564080	adjust our MTU of our sniffing interface. And we can do that simply by adding this MTU 1575 line
2564080	2571100	right here. And then we'll just hit control Z to save. And then so now that we've got our MTU set
2571100	2579640	right there, I'm just going to reboot real quick. It's on. And then once it comes back up, we should
2579640	2585220	be able to configure our run through the next phase of setup. And I'm just going to refer to
2585220	2593080	these instructions here to make sure that I didn't miss anything. Okay. All right. So we've SSH'd
2593080	2599300	back into the security in an instance. And now we're ready to run the next phase of setup.
2599420	2607280	And we'll run ss setup minimal again. And just hit yes. And yes. And it's going to ask if we
2607280	2611500	would like to skip the network configuration. And we're going to click yes because we've already
2611500	2616540	configured it as we want to. And we're going to go through the main configuration, selecting the
2616540	2622340	production mode option. And then we're going to click the option for a new deployment. And hit
2622340	2629820	okay. I'm just going to specify a username here. And what this will be is my application level user
2629820	2638320	account for logging into things like Squirt or Kibana. And basically it's not going to be the
2638320	2642180	same as the OS level account but a separate account that you would use for those purposes.
2648100	2653100	Now we're going to roll with best practices here because they are the best practices. So we use
2653100	2660520	them. I'm going to hit okay. And we're going to use the default ET open rule set here. We're going to
2660520	2668000	click okay. And because Suricata does offer that VXLAN DCAP, we're going to select Suricata
2668000	2674760	versus Snort right now. And we're going to hit okay. And we're going to enable the network
2674760	2680240	sensor services because that's what we're looking for. And we're just going to go with the defaults
2680240	2688660	here from there. Logs. Okay. And continue. And so what's going to happen, that's going to roll
2688660	2694380	through setup. And while that's rolling through setup, we can go ahead and start prepping our
2694380	2704080	other node that we want to monitor. So I'm just going to minimize that. And go to instances. And
2704080	2709940	let me flip back real quick. All right. So we're going to create an instance, a Linux 2 AMI
2709940	2716020	instance. We're going to launch right here. And another thing to remember, and what I mentioned
2716020	2722520	earlier, is you'll want to make sure that for the traffic mirroring that you're using supported
2722520	2729300	instances for those Nitro instances. I'm sorry, Nitro-based instances. And the T3 line of images
2729300	2735040	is one of those, as well as I believe the T3A. So what we're going to do here, we don't have to
2735040	2742860	select a giant image. We can still use a very, very small image. So I'm going to use a T3 micro
2743400	2750860	right here. And then I'm going to select configure instance details. And sure, all of this good
2750860	2756700	stuff, the network and the subnet looks okay. Everything else looks okay. And what we can do
2756700	2764000	is we can actually just auto-assign a public IP. So if we select that, then it'll automatically
2764000	2769420	assign an IP, since we only have a single interface. And then we'll click next add storage.
2769420	2774760	Don't need anything else here. Add tags. And then we'll make sure that we're using the security
2774760	2781560	group that we want to use. In this case, we can again use that default security group because
2781560	2788720	we'll want that SSH access. While we really don't need HTTP access, in this case,
2788720	2793300	as far as a demo, there's really no need to create another security group because there's
2793300	2798800	not really anything running on this host as far as HTTPS. So we're just going to click review and launch.
2800920	2810000	Okay, all right, and launch. And it's going to give us the same question about the key pair.
2810360	2816280	So what I'm going to do here and what we can do is select the the key pair that we created
2816280	2822300	previously. So the one that we just created was security in demo one. We're going to select that
2822300	2829200	and click I acknowledge. And then we're going to launch instances here and go to view instances.
2830200	2833800	Okay, so now we see it's creating it automatically assigned that public IP
2834400	2839120	that we can then access here in just a minute. So we'll flip back over here.
2839120	2842880	Security is still downloading a few things, still configuring a few things.
2844840	2848360	And then you go ahead and double check here.
2849140	2855540	Yep, okay. So while that's still going, what we can do is create our security group that's going
2855540	2864100	to be used for the sniffing interface of security. So what we want to do is be able to allow access
2864100	2869440	or allow traffic to be forwarded to that interface, but we don't want that interface to be able really
2869440	2877400	to or anybody else to that interface. So we'll create a security group right here.
2877400	2886600	Just click create security group and we'll call it security and sniffing group.
2887220	2896900	And this is the group that dictates who can talk to security and sniffing interface.
2899060	2905320	All right, and what we're going to do here, instead of all traffic, well I guess we can do all traffic, but
2906760	2915440	in fact you'll want to. So you'll want to limit it to the subnet that we defined earlier, right?
2915640	2919600	So we will only really want to accept traffic from those hosts that are forwarding that traffic.
2921260	2930780	Only accept from internal, so that's outbound. I'm sorry, I'm not... well that'll be the same case.
2930780	2941890	So we really only want outbound connectivity to those as well, if there's any at all. So we'll do that.
2951020	2958020	All right, so we've created that group now and what we can do is we can associate that
2958020	2965880	with that sniffing interface. So if we go over here to our instances again, we will... let me go ahead
2965880	2975640	and label these so they're a little bit easier to see. Okay, all right, so this one's the security anyone?
2975760	2986460	All right, so we'll go to eth1 and we'll go to interface id and we'll go ahead and we'll change the security groups.
2988020	2994960	I'm going to change it to this security and sniffing security group. All right, so it no longer has
2994960	3000940	anything that can access it from external. It needs to. It's only doing its deed as a sniffing interface.
3003080	3011340	All right, so what we do next... let's go ahead and check. Okay, so run through the first set
3011340	3015440	and there's just a little bit of post-configuration that it automatically runs through here for the
3015440	3029900	security inbox. All right, so we'll let that go and then what we'll do here is open up a new terminal
3029900	3041520	and we're going to go ahead and ssh to our Amazon Linux host while the security inbox is finishing up.
3041520	3047400	Okay, I'm going to do the sudo ssh i
3049480	3057660	1 and the default user for the AZ Linux box or the Amazon Linux box is going to be ec2-user
3058580	3065450	and we'll just paste this in here and again
3067010	3085160	prompt it locally because my sudo and if i could type oh my goodness okay all right there we go
3085160	3089000	all right so we're in the Amazon Linux node right now over here on this screen
3090060	3092700	okay so we got that ssh session going there
3094380	3096620	all right so it's not quite finished here
3099220	3106280	Okay, so we've got those two SSH connections up now. Now what we'll do is really, I guess
3106280	3112060	what you guys have been waiting for, not the boring AWS setup, but the actual mirror traffic
3112060	3118980	configuration. Okay, so what we'll do now is go ahead and create our mirror filter,
3118980	3129380	our mirror target, and our mirror session. So, go over here to VPC, and traffic mirror
3129380	3133640	filters. We'll just go ahead and create the filter first, and we're just going to name
3133640	3146420	it security.demo, and let's call it security.demo. Alright, now we want everything in this filter,
3146420	3156720	we want all the traffic, all the things. So we'll do a quad zero here, here, the inbound
3156720	3162260	and the outbound, we'll do a quad zero for the source and destination, because it will
3162260	3167520	actually filter out the inbound and outbound from the traffic it's mirroring if you're
3167520	3174620	not careful, so that's why we're doing that here. Okay, and we'll hit close. So we've
3174620	3179340	created our traffic mirror filter, what defines what will be forwarded to the mirror target.
3179420	3186120	Now we'll go ahead and create that mirror target. Alright, and this is going to be the
3186120	3199540	security.onion.sniffing demo. And what we'll do here is we'll choose the target ENI, or
3199540	3203600	network interface. And right here, as you can see, these primary network interfaces
3203600	3207520	aren't going to be it, those are going to be management interfaces. So we know that
3207520	3216040	it's this one right here, otherwise we might have to go check. Alright, so we'll hit create.
3217340	3223320	So we've created our traffic mirror filter and our traffic mirror target, so now we just
3223320	3229880	need to associate all this with a source inside of a mirror session. And that's what we'll
3229880	3244400	do here is our security.onion.demo.mirror.session. And our mirror source, again, is going to
3244400	3249580	be one of these primary network interfaces. However, we don't know just yet, so we'll
3249580	3254780	need to go over here to instances, and we'll need to go to the instance where we want to
3254780	3260540	mirror and find that source network interface. And here it is, eth0. So we're going to click
3260540	3265920	that, we're going to grab this interface ID and copy it so that we know for certain which
3265920	3272280	one we want to monitor. And it's this primary network interface. And we know here our target,
3272280	3277780	so we'll select that. And one thing that always gets me is that you'll have to enter in here,
3277780	3281860	even though it's prepended, or pre-populated with a 1, it's not really filled out, you
3281860	3288800	have to enter a 1 there for the session number. And then we'll hit create... I didn't add
3288800	3294120	my filter. So we'll need to add filter here, and that's going to apply that filter, right?
3294120	3301440	So let's create that. So we've now got our security.onion.demo.mirror.session, our traffic
3301440	3307420	mirror session, created. So from a networking standpoint, security.onion, or at least the
3307420	3314320	box, should be able to see all this traffic on the network interface. So let's go back
3314320	3320580	to our SSH session. Okay. So setup is now complete. I'm just going to check the status
3320580	3328740	and make sure everything looks good. Okay. And real quick, before we dive into any of
3328740	3333220	the other stuff, I'm just going to check real quick with the tcpdump command to check and
3333220	3339940	see if that traffic is coming by. I don't see anything just yet. But if we type here...
3341140	3348480	and let's see if I can break this out into a different one. We can see now that our traffic
3348480	3354280	is being mirrored. Right? So that's it. It's that simple to create the mirror sessions,
3354280	3363160	right? It's a little bit of work to get the infrastructure set up. And to... I guess
3363160	3366100	once you go through it a couple of times, it's a little bit easier to grasp, I guess.
3366640	3371780	But it's fairly straightforward to get that set up. And now once we have that, since we're
3371780	3376980	using security engine, and we want to see that traffic, we can actually use something
3377980	3384680	like... where is it? Test my nids, which I was referring to earlier. And so what this
3384680	3392340	does is it's going to execute a series of tests, callouts to this actual website, testmynids.org.
3392340	3400120	It's going to simulate that bad activity. So if we just do this here, and there's several
3400120	3406680	options right here, we're going to enable pure chaos and run them all, as always. And
3406680	3412500	it looks like maybe on Amazon Linux, Netcat is not installed by default, which is fine.
3413560	3419600	So maybe that one didn't go through, but that's fine. We can just do yum.install.netcat if
3419600	3438610	we want. Install-y netcat. I'll just run it one more time. And just let it run through
3438610	3442430	there. So it's just going to simulate some nice traffic for us to be able to see in security
3442430	3458050	engine. All right, still going there. All right, I think that's probably more than enough
3458050	3463990	for us to take a look at. So I'm going to get off of this TCB dump here, and I'm going
3463990	3470670	to allow access locally, because even though we've run or allowed the port in the firewall
3470670	3475830	for AWS, we have not allowed it for the local firewall. So we'll want to allow that for
3475830	3484290	the analyst, the port 443. It's going to give us 22443 and 7734 in case you wanted to run
3484290	3489090	the SQL client, which is... I honestly didn't mention it previously. I didn't mention all
3489090	3494610	of the tools in security engine. But if some of you have used SQL before, you can use that
3494610	3503210	SQL client to connect up there and view that alert data. So I'm just going to do... before
3503210	3510550	I do this, I'm going to do who real quick. Grab this business. Okay. And you can do the
3510550	3518510	same thing. Run who to get that IP. Just paste that in there. All right. And we'll just hit
3518510	3523230	enter, and it's going to refresh and throw that rule in there. And then we're going to
3523230	3530710	access the web interface of that external IP. So let's go back and get our... where
3531250	3540480	am I going? Okay. EC2 instances. And we're going to grab the public IP of the security
3540480	3553060	in an instance. And we're going to go over here. That's not it. If I can copy... copy
3553060	3565710	pasta. Come on, people. All right. Copy and paste is not being happy with me today. I'll
3565710	3576990	just copy it from over here. Copy. There we go. Okay. Okay.
3577610	3581550	So we get here, of course, it's a self-signed certificate. Obviously, you would want to
3581550	3586350	change this if you deploy it in your environment. But for us, it's just fine. For Catalina,
3586350	3595450	it's annoying. So we type this is unsafe. And then here we are on the just kind of splash
3595450	3600190	page for security. And there's some links here for Cyber Chef, which we include for
3600190	3606230	data transformation. And, you know, if you've got things like encoded bits of text, compressed
3606230	3612050	stuff, performing other types of data analysis and whatnot, it's really good for that. And
3612050	3615950	then also Squirt, which is going to be the web equivalent of Squeal, where you view that
3615950	3621970	IDS alert data. So I can pop in there real quick if I want to. And I'll specify that
3621970	3632200	username and password that I created earlier. And let's see. So okay. So we don't get much
3632200	3649690	here. But let me pivot back over to Kibana. Okay. And let's see what kind of NIDS alerts
3649690	3657150	we got here. Hmm. Okay. So we got the return to root one. But we didn't get many others.
3657870	3665030	I think I know why. I think it's because we didn't enable EVX and decapsulation for Cercata.
3665030	3670590	So this is something important to note, that we do not enable this by default, just because of the
3670590	3675830	potential overhead of having to run it and not the percentage of folks who actually don't run
3675830	3682610	VXLAN traffic compared to on prem. So we'll want to enable that real quick in Cercata.yaml. And I
3682610	3688830	feel like it's good for folks to be comfortable with that and know where that exists. So right
3688830	3694410	here we see VXLAN. I'm just searching for it in here. And then we see a VXLAN enabled.
3694910	3698350	Stanza right here. I'm just going to change this to true.
3700960	3705560	And yes, I really want to edit it. And just to make sure that it's still there.
3706760	3711000	Okay. So we've got VXLAN decap enabled for Cercata.
3713280	3719960	Let's do an asonids restart, which will restart Cercata and pull in that change.
3720160	3723580	And we're going to replay that traffic one more time and then see what we get.
3724160	3729620	And this is kind of what I alluded to previously, is no matter if you're watching the traffic or
3729620	3734920	recording the traffic with seeing that VXLAN traffic, it's very important to be able to have
3734920	3740520	an IDS or a mechanism to be able to decapsulate that or unwrap that so you can actually see and
3740520	3748020	alert on what's going on underneath. So if we run this command again,
3748020	3751240	let it run through. And I'm going to give it a minute before we refresh.
3751240	3758160	But we should see some more data in there. Hopefully, you know, several more NIDS alerts
3758760	3762880	and then, you know, something that we can have a little meat towards.
3767230	3771070	All right. So I'll give that a minute there. Okay. So it looks like it's done.
3772110	3777170	And if we go back, it will take... it does take about 30 seconds for Elasticsearch to
3777610	3784830	refresh its indexes. So we'll just do this. And by refresh, I mean basically making it
3784830	3791790	available for search, even though the data is in there. And so now that we've enabled that
3791790	3796890	VXLAN decapsulation, we're seeing a lot more. As I mentioned, it's very important that that's
3796890	3802290	enabled when you're doing this in the cloud. So we can see all sorts of types of alerts here.
3802290	3808810	And then if we go down here, we can see that stuff here as well. Let me see if I can put
3808810	3814490	it down just a little bit. Right. We get an ET policy PDF with an embedded file. That's
3814490	3820470	interesting, right? We could go investigate that. We could see what other activity was
3820470	3826650	associated with this. So if I wanted to search for this particular IP, this destination IP,
3826650	3831250	or how about the source IP here? This is strange, right? So maybe where it came from.
3836190	3841250	I can click that, and what it's going to do is take me to an indicator dashboard.
3841430	3847610	And this indicator dashboard is basically doing a search for any time this IP address was seen.
3847610	3853790	So it's going to give me other snort alerts. So these are the Suricata alerts. To clarify,
3853790	3859530	we just called the data type snort, just for our parsing purposes. It's just what we've done so far
3860070	3865050	that will change in the future. And then we can see the Ebro connection records,
3865050	3870630	or ZEKE connection records, and then the ZEKE files records. Again, we've kept the
3870630	3876590	older naming convention for now. And then the HTTP records, right? So we also see different
3876590	3884920	stuff that this destination IP address was associated with. And then we can see some
3884920	3892640	other, if there were any other source destination IPs that communicated, right? And then, let's see,
3892640	3897780	get some different MIME types here. And you can really, at least from here,
3897780	3904300	go off in each type of these, right? If you want to filter down for, say, HTTP,
3904300	3909680	you can scroll down here, look at these HTTP logs that we've indicated via the indicator dashboard,
3909680	3916690	drill into those. And then, now this is important as well. In fact, I don't know many,
3916690	3924230	even commercial solutions that can do this off the shelf is VXLAN decapsulated PCAP.
3924970	3931790	So I will say that typically in the on-premise version, you can pivot to PCAP from here and
3931790	3937050	see the full conversation, as I mentioned. One limitation currently with the current platform
3937050	3943390	is that you can't necessarily pivot to PCAP, but you can enable stuff like Suricata,
3943390	3949450	EJSON logging, and still log that packet. Or you can do other stuff with that PCAP,
3949450	3954690	which I'll talk about in just a little bit. But again, you can see the breadth of data
3954690	3961010	that we have here. As far as HTTP, we have MIME types, the file IDs that were basically
3961010	3967170	Zykl pull-out identifiers for the files that it rips out of the network stream. So we can
3967170	3972070	pivot based off of those into different types of data, and it can be very powerful.
3972890	3978790	All right, so if we go back here again, if we just want to even get a summary of the
3978790	3985070	connection data, so we can see all of the stuff that was even VXLAN. So if you want
3985070	3991230	to separate out nodes that are maybe cloud nodes and maybe on-prem nodes, then you can
3991230	3999250	kind of filter out maybe based on the VXLAN, because all of these are VXLAN encapsulated.
3999250	4003230	So if I filter on those, well, let me actually do this.
4005870	4013250	Let's take those out then. It's really going to be the categorized con logs and whatnot.
4013390	4018570	So again, I mean, you can group by service. You can then, if you want to drill into,
4018570	4022550	maybe you've got some weird SSL stuff, you know, you've got a high count here,
4022550	4025790	then you can drill into the SSL data over here.
4025790	4032070	All right, and then we can see the different server names that we have here, common names
4032070	4037470	associated with the SSL, the validation status, if you want to track validation of certs,
4037470	4043770	and maybe, you know, you see some certs that aren't valid or track expiration, stuff like that.
4043770	4048590	There's a lot more here than, you know, just detection-oriented stuff. And, you know,
4048690	4052290	a lot of that, even that stuff can lend its way to being detection-oriented.
4054110	4058710	So, as you can see here on this Zeek hunting panel, there's tons and tons of data that we
4058710	4065010	could pore over if we wanted to. We could see these query types and these response codes for DNS,
4065970	4071330	obviously what server we reached out to, the actual queries, right? So, you know,
4071330	4077510	hey, that's a weird query, right? So, it's pretty easy to stack this data and to see
4077510	4086440	it and represent it in an easy-to-digest fashion. And then, again, with the HIDS alerts,
4086440	4092040	if we had any host-based agents deployed, we would see those logs here, and we could,
4092980	4098100	you know, drill into different details there. You can see the TCP dump that we ran locally
4098100	4103180	earlier, and you can also see where we modified suricata.yaml. So, Suricata, I'm sorry,
4103180	4110920	security in itself will run a local Wazoo or OSEC agent here on the box and watch everything
4110920	4117940	that's going on its own box as well as any other agents or any other endpoints to which we deploy
4117940	4126180	it. So, again, you know, being able to tie in, and we don't have any just at the moment,
4126180	4132560	you can tie in autoruns data, beats data, and all that other good stuff to help augment this data.
4132560	4137300	And, again, you know, there are things like CloudWatch, and there are these host-based
4137300	4142340	events, but being able to have the network security monitoring component and being able
4142340	4147460	to bridge the gap from the host to host and being able to see what's going on is super powerful,
4147460	4154400	and in many cases can be very cost-effective compared to other solutions. So, let me just
4154400	4162900	go back here to... let me make sure, see if I missed anything here. Okay. All right. So,
4162900	4171720	we walked through that. Let me see. So, again, that's how you, you know, from scratch go and set
4171720	4180980	up security in that environment in AWS, promote that traffic mirroring and whatnot. And I know
4180980	4185320	I didn't go into a whole lot of the investigation, but I really just want to try to leave you guys
4185320	4191080	wanting for more and exploratory there and being able to delve into a lot of that on your own
4191080	4198100	and in your testing. But I will continue here, and what we're going to do is I'm just going to
4198100	4206340	go ahead and terminate these real quick. Yes, terminate. I'm going to clean up the VPC here
4206340	4211700	and then show you guys something else, which if you do have that Ubuntu host and you're able to
4211700	4218380	have internet access, you should be able to follow along with. Let's see. Okay. So, it's
4218380	4225700	going to take a second for those to get the story there. So, I'll go back here with the PowerPoint
4226460	4234250	and I'll follow up on some more stuff while that's happening. So, we'll move on. I mentioned
4234250	4240510	that supplementary data. So, if we want to bring in Azure logs, stuff from Azure Event Hubs,
4240870	4247790	we can absolutely do that. Logstash has an Event Hubs plugin that we can use. So, we can pull all
4247790	4252370	that telemetry, all of that data into Security Engine. If you've got multiple clouds, that can
4252370	4259170	be a very effective solution. And what that looks like in summary is, you know, the instructions
4259170	4266250	are here. I'm not going to go over these too much right now. I'll leave this as an exercise
4266250	4272650	to the reader if they want to go and do that. But there is plenty of guidance on being able to do
4272650	4279250	that and just ingest that data into Security Engine. This is kind of what it looks like,
4279250	4288790	the configuration there. Again, once you configure that, you can pull those logs from
4288790	4293470	Azure Event Hubs into Security Engine and then correlate that data across all of your other data
4294010	4298770	and have, again, your cloud data and your on-prem data and whatnot all in one place
4298770	4307300	through that single pane of glass. And this is kind of what it might look like here. So,
4307300	4312380	we've got some stuff from Event Hub. We're just tracking administrative actions here.
4314740	4320160	Different... looks like somebody listed some keys here in Azure. So, that might be an interesting
4320160	4323680	event to go after. And there's tons and tons of stuff that you can glean there
4324440	4332920	and throw in there to make that context even greater. And the same case with Google Cloud,
4332920	4337900	which I'm not going to go over with too much right here. But you could also have things like
4337900	4344240	VPC flow logs or audit logs sent to the cloud logging functionality, the export sync in Google
4344240	4349760	Cloud. You could pick that up with something like PubSubBeat and have that transmitted to
4349760	4357050	Logstash if you like. That is one option. And, again, I'm not going to go through that too much
4357050	4361210	just right this second. It's kind of what the configuration looks like there. Fairly
4361210	4367430	straightforward as far as PubSubBeat itself. And then once that data is in there, again,
4367430	4372550	if you've got VPC flow logs from Google Cloud and you're not performing any other type of monitoring,
4372550	4380610	then we can pull that stuff in. And the same thing with AWS, right? So,
4380610	4385610	aside from traffic mirroring, we can still pull in CloudTrail, we can still pull in CloudWatch
4386090	4391170	and throw them into S3 and have Logstash read from S3 and have those in security
4391170	4397330	and in for that greater context. And I'm just going to skip through this.
4398410	4404630	And so, before continuing any further, again, just again kind of harping on the idea that
4405130	4410190	you can pretty much take any of this cloud data that you want to augment your current
4410190	4414890	monitoring strategy with and send it to security, whether it be in the cloud or on-prem,
4414890	4421930	and really have a powerful solution without having to buy into a bunch of commercial stuff,
4421930	4428350	basically. So, to move along from that, I want to talk about 3CoreSec AutoMirror real quick.
4428350	4436250	And what it is, is it's another open source tool by 3CoreSec, Tiago Faria and his folks,
4436250	4442170	and it really allows for that quick and easy facilitation of NSM. Now, we talked about the
4442170	4449830	mirror config, and obviously going and adding stuff to a mirror session can, if you have a ton
4449830	4455270	of hosts and they spin up and spin down, it can be a chore and it can be difficult to manage.
4455610	4463450	So, one of the solutions here is to use 3CoreSec AutoMirror in AWS. And what this means is that
4463450	4470850	if we have instances tagged with mirror equals true, a mirror tag that equals true, then we can
4470850	4475970	do that upon creation. That can be a default and a template, and then these will be added to a VPC
4475970	4480210	mirror session for a mirror target. And what that means is that we can spin up one host, we can
4480210	4484210	spin up another host, we can spin up another host, and these will all be added to the mirror session,
4484210	4489030	and security on end can be watching these without having to do any additional configuration.
4489130	4492430	It's pretty powerful and pretty awesome to be able to do something like this.
4492710	4498530	Now, it sits as a Lambda function. Tiago has released a serverless app. The way I use it,
4498530	4504390	I upload a Lambda function with everything required, which is the way that he used to do it.
4504390	4510130	If you're not using security on end, you can still use that, obviously, to facilitate that.
4515810	4520150	Another thing I want to talk about, automating the deployment is one of the things that I
4520150	4523610	mentioned at the beginning, and something that really doesn't take too much time.
4523810	4529170	This is where we can automate the deployment of security on end and 3CS AutoMirror so that
4529170	4533990	we're deploying a security on end node, we're deploying maybe a Ubuntu instance
4534710	4542470	for a lab environment or for POC. Ultimately, you could do this with a production environment.
4542470	4547430	Although the templates here aren't necessarily suited for a production environment, you could
4547430	4555890	tweak them to do so. Again, that's kind of what I want to walk through here and get into the
4555890	4563670	next demo here. I will hop out of this and check on our instances. Let's go ahead and do this.
4563990	4572190	Ta-da! Refresh. Okay, so those are gone. Now I'm just going to clean up this VPC. I really don't
4572190	4578270	want this thing anymore. You know, it's just we want to try to automate this thing, so let's just
4578270	4584870	delete this whole VPC. I don't need this stinking thing. All right. All right, we blew it with
4584870	4593590	smithereens. Okay, so now we've got a fresh account, right? No VPC, nothing. Now we want
4593590	4600210	to automate this. How do we do that? So we're going to pop over. I've got any Ubuntu 18.04
4600210	4609690	box right here. Let me get out of this. This thing is in my way. Sorry, let me
4611330	4617470	clear that up. Okay, so now what we're going to be utilizing here is going to be, let me go back
4617470	4626090	real quick, this security onion cloud right here. So this page, it's in the link here in the
4626090	4631990	document for this automated deployment. Let me go ahead and paste that in there just in case.
4634330	4636790	And we're going to be doing it for AWS.
4638490	4645650	So I didn't put it in there. All right, so you can go there to take a look at that,
4645650	4650430	and you can follow along. The steps I use are going to be a little bit different. It's not
4650430	4657310	going to be as manual. So I'll just go from there. But let me go back to my host here,
4657310	4661760	and what I've done is I've already get cloned security onion cloud. So I would just do...
4665070	4668470	probably should have done this from fresh. All right, so we're going to do a get clone
4668970	4675470	security and solutions security onion cloud right here. And then once that's cloned,
4675470	4679890	we're going to cd into it. I'm going to cd into the Terraform AWS directory.
4680250	4687210	So we can see all this good stuff in here. And what we're going to want to do is there are a few
4687210	4693210	variables that we need to populate. First of all, when you're first installing it, you need to run
4694230	4699390	obviously the prep. It's going to be the prep so script. So if you just clone that,
4699390	4710970	it's going to be prep so right here. Just do a sudo prep so and super secret password. All right,
4710970	4715350	it's going to run through. It's going to install Terraform. It's going to install AWS CLI. It's
4715350	4722910	going to install jq. Just because we like things pretty. It's going to install...
4725530	4732310	know what? What else is it going to install? It's going to basically get everything prepped for the
4734290	4738970	Terraform thing that we're going to do here. And then it's going to prompt you to configure AWS CLI.
4739130	4743830	Now, when you configure it for the first time, you're going to get this. It's configuring AWS CLI
4743830	4749010	and then the access key ID right here. So it's not going to show secret right here. It's going to
4749010	4752890	just be blank and you're going to have to enter in. Let me see if I can get it right here real
4752890	4761710	quick. You're going to have to go here to my security credentials and access keys. Expand
4761710	4765910	that and if you don't already have an access key, you're going to create one. And there's going to
4765910	4772730	be an access key ID, right? So once you have that access key ID, you'll paste that into the first
4772730	4777550	prompt. Then there'll be a secret key that's included with that. You'll paste that into the
4777550	4789450	second prompt. So this access key ID isn't necessarily like your secret key. You may still
4789450	4794870	want to protect it, but obviously you're not going to be able to do anything without the secret key
4794870	4801410	as well. So we'll just press enter here to keep the secret access key. And then in the region,
4801410	4805770	you're going to want to specify one of those regions that has access to that AMI. So in our
4805770	4812290	case, that's going to be that US-East-2. It's going to be the US-West-2, the EU-Central-1,
4812290	4823430	and EU-West-2, I think. Sorry, I've got terrible memory. EU-West-2, yep. Let me go back. Alright,
4823430	4827730	so I've already got this configured, so it's just going to keep the defaults. And default output
4827730	4833490	format is none, that's fine. Okay, and I've already... it's already generated a public-private
4833490	4838610	key pair. It's going to prompt you on your first install, and you can just hit enter for the time
4838610	4843030	being unless you want to protect it with a password, which obviously in a production case,
4843030	4848050	you would want to take more secure measures, but for the purposes of testing, you should be fine.
4849250	4858310	So we're not going to overwrite this. Alright, we're just going to... it's going to prompt us
4858310	4864070	from this stance if we would like to have any Ubuntu host also stood up that we want to monitor.
4864190	4871270	Now, there's an option in the actual terraform.tfvars file that you can modify if you want
4871270	4876050	this enabled or not, but this just helps you do it. So this is just less manual going in and doing
4876050	4882310	stuff. So I'm just going to select yes, and then what it's going to do is it's going to populate
4882310	4893590	this... terraform.tfvars. It's going to populate it with the path of the credential files, which
4893590	4898950	should be the default that you're going to be using. It's going to already have the default
4898950	4906070	path of the security and then key pair, and then it's going to have... where is it? The Ubuntu
4906070	4911230	host right here. Now, this instance type and... I'm sorry, the AMI will get configured here in
4911310	4917230	a minute. Don't worry about that just yet because that may be an old AMI that you're looking at.
4918810	4924690	But thankfully, what we have here is a launch SO script, and what this is going to do,
4924690	4930290	this is actually going to grab the latest AMI. It's going to substitute that in for that AMI
4930290	4937010	in that file, and then it's also going to try to determine your public IP address,
4937010	4940870	and if it can determine your public IP address, it's going to populate that in there as well.
4940870	4946010	So you don't really have to touch it a whole lot. Otherwise, you can go inside of that file,
4946010	4952470	that TFR's file, and modify it yourself. So we're going to go ahead and click sudo launch so,
4953670	4957730	and what it's going to do, it's going to run behind the scenes a Terraform init
4957730	4964530	to initialize Terraform in this directory. It's going to also do the things I mentioned a second
4964530	4970850	ago, and then also a Terraform apply auto approve so that it goes ahead and runs that action.
4970870	4978290	And now what it's doing is creating that entire VPC, it's creating the subnets, it's creating the
4978290	4983870	security groups, it's creating the instances, the mirror config, and auto mirror lambda function,
4983870	4989430	and it's doing all of that behind the scenes. It may take a few minutes, so you know, if you
4989430	4996750	see it sit there for just a couple minutes, that's normal. Wes, we do have a question that came up.
5000030	5006010	It's one dumb question. Is it possible to make it work like a host intrusion prevention system?
5006010	5013530	If not, are there any open source projects that can do that? Yeah, yeah, so I mean you can also
5013530	5020710	not use the nids, the sensor components at all, right? You can send up security engine and only
5020710	5027370	enable Wazoo, or you know, if you want to point just stuff to Elastic Stack, you can do that.
5028690	5034510	Yeah, I mean, you can absolutely do that and only use the host-based monitoring components.
5035030	5048090	Absolutely. Okay, so let me go ahead and copy that. So now you see that we now already,
5048090	5053830	instead of spending the time, you know, going and configuring this manually, we now already have
5053830	5078430	these ready to go, right? And what did I do? Exit it? Hmm, what did I... I did something wrong. Let's see.
5080540	5081460	Hmm.
5083740	5086700	Dee dee dee dee. What am I doing?
5087440	5099810	Let's just get that out of there. Typos. Typos galore.
5100970	5110650	WLAM root. Hmm, okay, well that's strange. I tested this. No, all right, so let me go back here.
5110650	5112330	Just do a...
5122740	5125180	SSHI security. Do I have a typo?
5133050	5135950	Okay, that's why. Okay.
5138550	5145350	Okay, so I've actually... I must have the same public IP in here and then host. Let's see.
5147350	5152350	Listen and host. Okay, let me take a step back real quick.
5154590	5166970	And do a SSHI.
5171850	5175090	Okay, so let's try this one. See if this one works.
5188630	5191750	Okay, so something with the permission of the key. Let me...
5192550	5204210	All right, so I think what might have happened is the script modified the permissions on the key.
5204210	5205310	Let me see.
5215070	5216120	Members.
5234230	5236370	Apologies for that.
5237850	5247550	There we go. All right, so basically, that's how it works there. And let me go ahead and get back into that Onion instance.
5251430	5257050	Okay, so you want to make sure, apparently, that's something that wasn't as well tested with that script.
5257050	5263070	But just ensure the permissions are correct on that key and you should be able to SSH accordingly.
5263070	5265070	That is my bad.
5266310	5270950	Yeah, I was trying to help folks and automate it just a little bit, but apparently it bit me just a little bit.
5272070	5278470	All right, so onion at security, onion zero. That's going to be the security and then host, right?
5278470	5284510	So we could go ahead, if we wanted to, just get the interface up. We really don't have to do anything else here.
5285890	5288190	Let's do an ifconfig.
5288970	5291950	See, all right, so ens6 is not up yet.
5291950	5298990	So what we can do, if we just want to run setup minimal real quick, or if we just want to do, really, an ifup ens6.
5302350	5302730	ifconfig
5307510	5315790	validate. Okay, all right, so we'll just run through the setup minimal real quick, if I can type.
5317270	5321590	And what we're going to do here is we're not going to go all the way through the configuration.
5321590	5329390	We're just going to, really, just illustrating you how the auto mirror and everything else works, since we've already gone through the actual security and install.
5329830	5331230	So I'm just going to do that here.
5332090	5334410	Yep, we're just going to reboot real quick.
5335870	5341290	And again, this is really just about illustrating how quickly and easily that you can stand this stuff up, right?
5341290	5344650	So it's much quicker than the prior route that we took.
5344950	5348850	Again, I wanted you to get the feel and get the understanding of how to build that manually,
5348850	5352630	but it's definitely easier when we're using something like this.
5353630	5358170	And we can see that security and zero and that Ubuntu zero instance are running.
5358290	5362150	And then if we want to go over real quick, just to view it while we wait for the reboot,
5363970	5369530	we can go and see that mirror session that's already created right here.
5369570	5372810	So it's pretty neat to be able to have that kind of stuff automated.
5372810	5377570	And you can, again, add another host and it would pop back onto that.
5377570	5379730	It would also be mirrored as well.
5380290	5383410	So let's modify that real quick.
5383630	5385010	And wrong one.
5385810	5388270	We'll SSH back in.
5389790	5391350	And it's fine.
5394430	5400890	Okay, so now if we do a ccpdump, you know, six.
5401550	5402970	That will also do...
5403490	5405250	Oops, new terminal here.
5408890	5409990	Let's see.
5411130	5417910	Let's do a history grep ssh.org.
5417910	5421370	Nope, it's not the right one.
5421590	5431130	All right, let me go back and grab that IP of the Ubuntu instance.
5431990	5433810	All right, got that right here.
5433810	5434830	It's this one.
5436070	5439950	Pop back over here and do an ssh i.
5445850	5448790	And Ubuntu is the default user for Ubuntu.
5452590	5454670	All right, and we see that traffic's...
5455910	5461650	And once again, you know, obviously, if we run something like testmyniz and generate a bunch of
5461650	5469700	traffic, then we can see all that flowing as well.
5469700	5477660	So again, I'm not going to go through really the whole investigationary component or illustration.
5477660	5483100	But again, you can kind of see how easy it is to sand this stuff up and have it automatically
5483100	5483640	mirrored.
5483640	5491700	So I would definitely recommend that you check out the Terraform stuff and AutoMirror in general,
5491700	5494620	you know, aside from even if you're not using the security engine.
5495700	5498500	So let me go back here.
5499820	5504320	All right, and so we're not going to do it right this second.
5504320	5509760	But feel free, if you have some time and you want to experiment, and please do offer any
5509760	5511940	feedback if you do try it.
5511940	5515180	But we can also do this with Google Cloud.
5515300	5522840	So we have on the GitHub as well, we have some usage information for Google GCP over here.
5522840	5525380	So you can do pretty much the same thing.
5525380	5530740	And because they use mirroring groups, you can just add a host to the group to be mirrored.
5530740	5533320	And it's very much so like AutoMirror.
5533320	5536400	Very nice being able to do something like that.
5537300	5542860	So it's yet another way to quickly and easily spin up security in Google Cloud and do a very
5542860	5544200	similar thing.
5547410	5551530	And then last but not least, there is a tool that we have.
5551550	5556010	I mentioned that the PCAP is not, you know, we're not able to...
5556010	5561810	we write the PCAPs to disk, they are VXLAN encapsulated, but we just don't have the
5561810	5566450	technology in the current platform to actually render that ASCII transcript.
5566710	5571510	But if you would like to take the PCAP and be able to import it into other tools that
5571510	5576430	also don't understand VXLAN encapsulation, you can use VXLAN to PCAP.
5576890	5579970	And I'm sorry, I should play from the current slide and make that a little bit bigger for
5579970	5580670	you guys.
5581130	5585050	And what you can do is just run the PCAP through there and it will decapsulate it.
5585050	5589510	It will take off that VXLAN wrapper, and then you're left with the PCAP that you would
5589510	5592970	normally see on the wire if it was not transported by VXLAN.
5593550	5599210	So that's another pretty cool tool to be able to use if you've got VXLAN encapsulated PCAP
5599210	5602570	and you have tools that need to be able to parse that and pull that in.
5606260	5612260	And then, of course, all of this stuff you can miter, miter, miter, right?
5612400	5617320	You can absolutely use a miter attack cloud matrix with some of this stuff when you're
5617320	5619000	pulling this stuff in, right?
5619000	5626680	And when you're pulling in cloud trail data, when you're pulling in NSM data, you can create
5626680	5629020	detections with Elastic Alert rules.
5629020	5635320	You can use Sigmac from the Sigma authors to convert this to Elastic Alert rules and
5635320	5639340	base those on those techniques and tactics, right?
5639600	5643700	And then you can test those detections using something like Atomic Red Team, right, if
5643700	5644840	you want to do that.
5644840	5650000	And we've got some really exciting stuff coming up in the next release of Security
5650000	5656520	Onion 2.0, which is in plans to be released hopefully soon.
5656640	5662840	Right now we have an RC1 release, Candidate 1 release, of Security Onion 2.0 that you
5662840	5666500	can go check out by following that link at the bottom.
5666580	5670300	And it does include that Sigma stuff and Playbook.
5670860	5677220	Playbook is going to be basically taking the Sigma rules and converting them to Elastic
5677220	5678200	Alert rules.
5678200	5679740	It includes OS Query.
5679740	5681690	I know you mentioned host-based monitoring.
5682040	5685840	That's going to be another addition to the host-based monitoring that we have.
5685840	5688760	And also the Hive and Cortex, right?
5688820	5696880	Being able to go in there and have those events fire from the Sigma rules and then have them
5696880	5699000	in an investigationary stance.
5699000	5704980	Have them ready to go in the Hive and creating cases and working those observables and whatnot.
5704980	5707060	It's just going to be really good stuff.
5707060	5709120	So please do check that out.
5709120	5712540	I would have loved to have demoed that for you today.
5712660	5718100	Unfortunately, we don't have a public 2.0 AMI out just yet.
5718440	5726240	But definitely do keep in touch and keep looking and we will have something ready for you soon.
5726240	5729800	And then if you want to download, obviously, the current platform on Security On-End,
5730600	5733420	you can download it from securityonend.net.
5733720	5736520	And, you know, absolutely free, open source.
5736640	5739920	We have a great community, great mailing list on there.
5740800	5744200	And, you know, hopefully some decent documentation.
5744480	5750260	And then if you're already using Security On-End or you really want more help figuring out how
5750260	5755440	to set it up in the cloud or you want training or support, then we have professional services
5755440	5757460	available for that as well if you need that.
5757460	5764320	But anything else, if you have any other questions or feedback, anything else,
5764320	5771200	just feel free to reach out to me at the real W. Lambert on Twitter.
5771220	5775460	Or feel free to hit securityonend on there and just let us know what you're thinking.
5775720	5777300	And we'd be glad to help out.
5777300	5779980	And hopefully you got something useful today.