My latest (and final) Hubot for IR talk, given at the excellent NYUPoly CSAW THREADS 2014.
Building Your OwnDFIR SidekickChatOps for Incident Response
View Slide
I do incident response @ GitHubHi, I’m Scott
He Does Basically Everything@GitHubThis is Hubot
“making it easier to work together thanto work alone….”
๏ CHatops & Incident Response๏ Hubot Variable Threat Response๏ Deploying & Developing Hubot
A BriefIntroduction toChatOps
What is ChatOps?!DevOps + Chat = ChatopsCollaborative Terminal Experience
So What Really isChatOps?!
Chat
Why Chatopsanyway?
Geographicallydistributed
asynchronous
multi device
hides the “ugly”Or at least makes interfacesconsistent
“This was always my main motivationwith Hubot - teaching by doing bymaking things visible.”-@Tomayko
How GitHub UsesChatops
deploy&monitor serversvia Puppet
deploy&monitor Codevia Capistrano & Jenkins CI
Monitor Systemsvia Nagios
Update ourStatus Site(Hopefully rarely)
Lookup FunnypicturesAnd Gifs Too!
Shoutout to MattJay
So what aboutDFIR?!Hint: We were already Doing It
Managing ourpager alertsvia pagerduty
Showing ProcessLists on Hosts
Changingfirewall rules
getting whoisinformation
getting applogs & statsvia Splunk & Graphite
“Swinging theBanHammer”
Other “secret”stuffjust come ask me if you’re curious
“making it easier to Respond to Incidentstogether than to Respond alone….”
Hubot VTR
Hubot๏ node.js based Chat bot๏ coffeeScript based actions๏ deployable anywhere you can runnode.js (Unix, Windows, Heroku, etc)
๏Disk Forensics๏Network Forensics๏Open Source Intelligence๏Malware Analysis
hubot-vtrmodules for dfir
Code namegeneratorBecause you can’t call it “That thing from January” forever
Geolocating IPsBut not for attribution...
reverse dnslookups
checkingresourcereputationsmywot, Google, virustotal, & Opendns
research linksgeneratorRobtext, CentralOps, HurricaneElectric…
server profilingvia shodan
malwareresearchvia virustotal
passive dnsvia virustotal
detectiongenerationvia yara & Snort
force multipler
Deployment&Development
DeploymentLocalOrHeroku
3 Componentsbrain+Connector+Scripts
DevelopmentCoffeeScriptOnNodeJs
Docs Matter
Hubot’s “Voice”
InConclusion…
ChatOps can make incidentresponse collaborative&Hubot VTR puts DFIR tools& tasks in chat
Find Out MoreHubot.GitHub.com&GitHub.com/sroberts/hubot-vtr-scripts
Contact Megithub & twitter: @srobertssroberts.github.io
Thanks!!!