Building Your Own DFIR Sidekick: S4Con Edition

My lightening talk on using Hubot & ChatOps concepts for DFIR. Given at OpenDNS excellent S4 conference.

Transcript

1. Building Your Own DFIR Sidekick ChatOps for Incident Response
2. I do incident response @ GitHub Hi, I’m Scott
3. He does basically Everything @ GitHub This Is Hubot
4. “making it easier to work together than to work alone….”
5. “making it easier to Respond to Incidents together than to Respond alone….”
6. ChatOps & Incident Response
7. What is ChatOps?! DevOps + Chat = Chatops Collaborative Terminal Experience
8. Why ChatOps?! ๏ asynchronous ๏ geographically distributed ๏ multidevice ๏ hides the “Ugly”
10. “This was always my main motivation with Hubot - teaching by doing by making things visible.” - @Tomayko
11. How GitHub uses Chatops?
12. deploy & monitor servers via Puppet
13. deploy & monitor Code via Capistrano & Jenkins CI
14. Monitor Systems via Nagios
15. update status.github.com
16. look up funny pictures And Gifs too!
17. what about DFIR? Hint: We already were Doing It
18. Manage pager alerts via PagerDuty
19. show process lists on hosts
20. manipulate firewall rules
21. get whois information
22. get application logs and statistics via Splunk & Graphite
23. Swinging the Ban Hammer
24. other secret stuff
25. Hubot VTR
26. Hubot ๏ node.js based Chat bot ๏ coffeeScript based actions ๏ deployable anywhere you can run node.js (Unix, Windows, Heroku, etc)
27. 3 Major Components brain + Connector + Scripts
28. ChatOps for IR ๏ Disk Forensics ๏ Network Forensics ๏ OSINT ๏ Malware Analysis
29. Hubot VTR ! Modules for DFIR
30. Codename Generator Because you can’t call it
 “That thing from January Where…” Forever
31. GeoLocating IPs
32. Reverse DNS
33. Reputation: MyWOT
34. Reputation: Google Safe Browsing
35. Reputation: Entity Lookup Generator Robtext, CentralOps, Hurricane Electric…
36. Shodan
37. Virus Total Hashes, URLs, & IP Addresses
38. Yara Rule Generator
39. Deployment & Development
40. Deployment Local Or Heroku
41. Development CoffeeScript On NodeJs
42. Development CoffeeScript
49. Speaking of Development: ! A NEW MODULE!!!
50. OpenDNS Umbrella ’ RR, Security Info, and “Whats UP?”
52. And In Conclusion…
53. ChatOps makes incident response collaborative & Hubot VTR puts DFIR tools & tasks in chat
54. Find Out More Hubot.GitHub.com & GitHub.com/sroberts/hubot-vtr-scripts
55. Contact Me email: sroberts@github.com github & twitter: @sroberts sroberts.github.io
56. Thanks!!!