Mastodawn

WowSuchCyber May 27, 2024

@adamshostack @xgranade we had good recovery so not too bad but then I met all the vendors I could find and asked them: this is a very specific behavior, one laptop opening thousands of file per seconds over the network on the file server, you should be able to detect and block that, what do you have?

None had a solution. Even Cisco despite them having acquired Snort.

afx May 27, 2024

@WowSuchCyber @adamshostack @xgranade Shouldn't that be a trivial rule in Splunk or any other decent log analysis tool? Either by monitoring the file server or the client.

@afx @WowSuchCyber @xgranade What’s “trivial”? (1/3)

@afx @WowSuchCyber @xgranade If it’s so obvious why does every Splunk user need to reinvent it? (2/3)

[edit I should have said snort not splunk]

@afx @WowSuchCyber @xgranade Lastly, can you give me your GitHub of trivial rules that everyone should be using? 😀 More seriously it’s easy to declare things obvious in hindsight (3/3)

@afx @WowSuchCyber @xgranade Lastly Splunk is a network IDS not a log analysis tool. I don’t think it does volume very well. If it did, a Cisco sales Eng should have whipped it up on the spot. (4/3, doubling down on “what’s trivial 😀🤷)

[edit: I meant to say snort]

afx May 27, 2024

@adamshostack @WowSuchCyber @xgranade Are mixing up Splunk with Snort?

@afx @WowSuchCyber @xgranade I totally am. I blame a lack of coffee and Covid. Probably in that order

@afx @WowSuchCyber @xgranade I think it should be an easy rule in the Splunk log analysis tool, which is not the snort ids that Cisco owns. But also I don’t know Splunk rules and so have no idea how to express “lots” in them.

afx May 27, 2024

@adamshostack @WowSuchCyber @xgranade Can't whip it up right now, I am on vacation, no Splunk to play with. But in general it is not hard to set up a rule that says if event X occurs more than Y times in a given time window on host Z, raise an alert. Of course, that requires to get the right events into it first.

@afx @WowSuchCyber @xgranade yes, just to play devils advocate "you want to log every file open and pay us for it? ok!"

Tindra May 27, 2024

@adamshostack @afx @WowSuchCyber @xgranade ding!

In order to make such a rule cost effective, you need correlation to happen on the endpoint. Which requires a specialized endpoint security solution.

You take the idea of I forget the name of the security product, and drop some honey files and only take action when those are touched. Much lower volume to ship up to your centralized logging solution but also means actually understanding logging well enough to know how to set up and send up those logs.