Building Your Own DFIR Sidekick: THREADS Edition

Ded29c7918dce50c65131df03c769004?s=47 Scott J. Roberts
November 14, 2014
Technology
2
590

Building Your Own DFIR Sidekick: THREADS Edition

My latest (and final) Hubot for IR talk, given at the excellent NYUPoly CSAW THREADS 2014.

Ded29c7918dce50c65131df03c769004?s=128

Scott J. Roberts

November 14, 2014
Tweet

More Decks by Scott J. Roberts

See All by Scott J. Roberts
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
160
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
3.9k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
61
Ded29c7918dce50c65131df03c769004?s=48 sroberts
0
55
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
150
Ded29c7918dce50c65131df03c769004?s=48 sroberts
3
2.6k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
5
810
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
11k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
750

Other Decks in Technology

See All in Technology
53850955f15249a1a9dc49df6113e400?s=48 line_developers
1
420
Add4ea030be9e6aa7a319fc8c1b587c6?s=48 hashhub
2
2.2k
D5a8875907107294786ee8cba72c7f4c?s=48 torufuru
1
280
8a84268593355816432ceaf78777d585?s=48 dena_tech
0
510
2102a6b8760bd6f57f672805723dd83a?s=48 line_developers_tw
0
510
97d180294474e9df01503148f3b11f39?s=48 lambda
0
130
21a4b941766d805333e11c5766be43b4?s=48 takahashim
12
910
2011382f0f10050fbb5f08e80e2bd125?s=48 akuwano
0
120
961126d9892ae4df45249529a0721571?s=48 sugamasao
2
470
96f06c7c9af1405aa0f0e4102b2812be?s=48 iwashi86
9
2.8k
098ad475722e3697ec2fba28c8654f9f?s=48 yuhta28
0
370
928b1395afedebb5ee48d44ab917c5f1?s=48 ryusa
1
310

Featured

See All Featured
C35e01544a0dd94a2cf1619ee8a42ebb?s=48 clairelew
12
1.3k
25c7c18223fb42a4c6ae1c8db6f50f9b?s=48 mojombo
356
62k
245cee81a9c424266e5e401d844ea881?s=48 lara
169
9.3k
0bce06bd06ee7a2c4f5500f25dcf7f18?s=48 paulrobertlloyd
69
1.3k
6804f1775cb4babfcc3851298566fbce?s=48 tanoku
257
24k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
775
240k
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
492
110k
79acae287842acf29084005533a7fb3b?s=48 hursman
104
9.1k
7edec06b5435e0dac07a353b2cc26253?s=48 geeforr
331
29k
Ecdea9b9714877b86cee08458f085481?s=48 trallard
10
440
C157b16234f1e75e8eac3698c1d4414a?s=48 ddemaree
273
31k
B47b288784fda77a94aeb234ca743c24?s=48 keavy
105
14k

Transcript

  1. Building Your Own DFIR Sidekick ChatOps for Incident Response

  2. I do incident response @ GitHub Hi, I’m Scott

  3. He Does Basically Everything @ GitHub This is Hubot

  4. “making it easier to work together than to work alone….”

  5. ๏ CHatops & Incident Response ๏ Hubot Variable Threat Response

    ๏ Deploying & Developing Hubot

  6. A Brief Introduction to ChatOps

  7. What is ChatOps?! DevOps + Chat = Chatops Collaborative Terminal

    Experience

  8. So What Really is ChatOps?!

  9. None
  10. None

  11. Chat

  12. Chat

  13. None

  14. Why Chatops anyway?

  15. Geographically distributed

  16. None
  17. None

  18. asynchronous

  19. multi device

  20. None
  21. None
  22. None

  23. hides the “ugly” Or at least makes interfaces consistent

  24. “This was always my main motivation with Hubot - teaching

    by doing by making things visible.” - @Tomayko

  25. How GitHub Uses Chatops

  26. deploy & monitor servers via Puppet

  27. deploy & monitor Code via Capistrano & Jenkins CI

  28. Monitor Systems via Nagios

  29. None
  30. None

  31. Update our Status Site (Hopefully rarely)

  32. Lookup Funny pictures And Gifs Too!

  33. None

  34. Shoutout to MattJay

  35. So what about DFIR?! Hint: We were already Doing It

  36. Managing our pager alerts via pagerduty

  37. Showing Process Lists on Hosts

  38. Changing firewall rules

  39. getting whois information

  40. getting app logs & stats via Splunk & Graphite

  41. None

  42. “Swinging the BanHammer”

  43. Other “secret” stuff just come ask me if you’re curious

  44. “making it easier to work together than to work alone….”

  45. “making it easier to Respond to Incidents together than to

    Respond alone….”

  46. Hubot VTR

  47. Hubot ๏ node.js based Chat bot ๏ coffeeScript based actions

    ๏ deployable anywhere you can run node.js (Unix, Windows, Heroku, etc)

  48. ๏Disk Forensics ๏Network Forensics ๏Open Source Intelligence ๏Malware Analysis

  49. hubot-vtr modules for dfir

  50. Code name generator Because you can’t call it
 “That thing

    from January” forever

  51. Geolocating IPs But not for attribution...

  52. reverse dns lookups

  53. checking resource reputations mywot, Google, virustotal, & Opendns

  54. None

  55. research links generator Robtext, CentralOps, Hurricane Electric…

  56. server profiling via shodan

  57. None

  58. malware research via virustotal

  59. passive dns via virustotal

  60. detection generation via yara & Snort

  61. force multipler

  62. Deployment & Development

  63. Deployment Local Or Heroku

  64. 3 Components brain + Connector + Scripts

  65. Development CoffeeScript On NodeJs

  66. None

  67. Docs Matter

  68. None
  69. None
  70. None
  71. None
  72. None
  73. None
  74. None
  75. None
  76. None
  77. None

  78. Hubot’s “Voice”

  79. In Conclusion…

  80. ChatOps can make incident response collaborative & Hubot VTR puts

    DFIR tools & tasks in chat

  81. Find Out More Hubot.GitHub.com & GitHub.com/sroberts/hubot-vtr-scripts

  82. Contact Me github & twitter: @sroberts sroberts.github.io

  83. Thanks!!!

  84. None