×
Copy
Open
Link
Embed
Share
Beginning
This slide
Copy link URL
Copy link URL
Copy iframe embed code
Copy iframe embed code
Copy javascript embed code
Copy javascript embed code
Share
Tweet
Share
Tweet
Slide 1
Slide 1 text
Building Your Own DFIR Sidekick ChatOps for Incident Response
Slide 2
Slide 2 text
I do incident response @ GitHub Hi, I’m Scott
Slide 3
Slide 3 text
He Does Basically Everything @ GitHub This is Hubot
Slide 4
Slide 4 text
“making it easier to work together than to work alone….”
Slide 5
Slide 5 text
๏ CHatops & Incident Response ๏ Hubot Variable Threat Response ๏ Deploying & Developing Hubot
Slide 6
Slide 6 text
A Brief Introduction to ChatOps
Slide 7
Slide 7 text
What is ChatOps?! DevOps + Chat = Chatops Collaborative Terminal Experience
Slide 8
Slide 8 text
So What Really is ChatOps?!
Slide 9
Slide 9 text
No content
Slide 10
Slide 10 text
No content
Slide 11
Slide 11 text
Chat
Slide 12
Slide 12 text
Chat
Slide 13
Slide 13 text
No content
Slide 14
Slide 14 text
Why Chatops anyway?
Slide 15
Slide 15 text
Geographically distributed
Slide 16
Slide 16 text
No content
Slide 17
Slide 17 text
No content
Slide 18
Slide 18 text
asynchronous
Slide 19
Slide 19 text
multi device
Slide 20
Slide 20 text
No content
Slide 21
Slide 21 text
No content
Slide 22
Slide 22 text
No content
Slide 23
Slide 23 text
hides the “ugly” Or at least makes interfaces consistent
Slide 24
Slide 24 text
“This was always my main motivation with Hubot - teaching by doing by making things visible.” - @Tomayko
Slide 25
Slide 25 text
How GitHub Uses Chatops
Slide 26
Slide 26 text
deploy & monitor servers via Puppet
Slide 27
Slide 27 text
deploy & monitor Code via Capistrano & Jenkins CI
Slide 28
Slide 28 text
Monitor Systems via Nagios
Slide 29
Slide 29 text
No content
Slide 30
Slide 30 text
No content
Slide 31
Slide 31 text
Update our Status Site (Hopefully rarely)
Slide 32
Slide 32 text
Lookup Funny pictures And Gifs Too!
Slide 33
Slide 33 text
No content
Slide 34
Slide 34 text
Shoutout to MattJay
Slide 35
Slide 35 text
So what about DFIR?! Hint: We were already Doing It
Slide 36
Slide 36 text
Managing our pager alerts via pagerduty
Slide 37
Slide 37 text
Showing Process Lists on Hosts
Slide 38
Slide 38 text
Changing firewall rules
Slide 39
Slide 39 text
getting whois information
Slide 40
Slide 40 text
getting app logs & stats via Splunk & Graphite
Slide 41
Slide 41 text
No content
Slide 42
Slide 42 text
“Swinging the BanHammer”
Slide 43
Slide 43 text
Other “secret” stuff just come ask me if you’re curious
Slide 44
Slide 44 text
“making it easier to work together than to work alone….”
Slide 45
Slide 45 text
“making it easier to Respond to Incidents together than to Respond alone….”
Slide 46
Slide 46 text
Hubot VTR
Slide 47
Slide 47 text
Hubot ๏ node.js based Chat bot ๏ coffeeScript based actions ๏ deployable anywhere you can run node.js (Unix, Windows, Heroku, etc)
Slide 48
Slide 48 text
๏Disk Forensics ๏Network Forensics ๏Open Source Intelligence ๏Malware Analysis
Slide 49
Slide 49 text
hubot-vtr modules for dfir
Slide 50
Slide 50 text
Code name generator Because you can’t call it “That thing from January” forever
Slide 51
Slide 51 text
Geolocating IPs But not for attribution...
Slide 52
Slide 52 text
reverse dns lookups
Slide 53
Slide 53 text
checking resource reputations mywot, Google, virustotal, & Opendns
Slide 54
Slide 54 text
No content
Slide 55
Slide 55 text
research links generator Robtext, CentralOps, Hurricane Electric…
Slide 56
Slide 56 text
server profiling via shodan
Slide 57
Slide 57 text
No content
Slide 58
Slide 58 text
malware research via virustotal
Slide 59
Slide 59 text
passive dns via virustotal
Slide 60
Slide 60 text
detection generation via yara & Snort
Slide 61
Slide 61 text
force multipler
Slide 62
Slide 62 text
Deployment & Development
Slide 63
Slide 63 text
Deployment Local Or Heroku
Slide 64
Slide 64 text
3 Components brain + Connector + Scripts
Slide 65
Slide 65 text
Development CoffeeScript On NodeJs
Slide 66
Slide 66 text
No content
Slide 67
Slide 67 text
Docs Matter
Slide 68
Slide 68 text
No content
Slide 69
Slide 69 text
No content
Slide 70
Slide 70 text
No content
Slide 71
Slide 71 text
No content
Slide 72
Slide 72 text
No content
Slide 73
Slide 73 text
No content
Slide 74
Slide 74 text
No content
Slide 75
Slide 75 text
No content
Slide 76
Slide 76 text
No content
Slide 77
Slide 77 text
No content
Slide 78
Slide 78 text
Hubot’s “Voice”
Slide 79
Slide 79 text
In Conclusion…
Slide 80
Slide 80 text
ChatOps can make incident response collaborative & Hubot VTR puts DFIR tools & tasks in chat
Slide 81
Slide 81 text
Find Out More Hubot.GitHub.com & GitHub.com/sroberts/hubot-vtr-scripts
Slide 82
Slide 82 text
Contact Me github & twitter: @sroberts sroberts.github.io
Slide 83
Slide 83 text
Thanks!!!
Slide 84
Slide 84 text
No content