Cloud Native Threat Intelligence for...
summary
An open source framework called Kubernetes Storm Centre runs diverse honey‑clusters, ingests ebpf logs via eBPF/Tetragon, maps observables to STIX, and links them to modeled attack trees; calibration reproduces chains so indicators (SQL/regex) can catch future attacks. A demo shows a stolen cloud metadata token theft used with cloudsql‑proxy and psql to read databases, while an exposed RunSE honeypot only attracted crude C2, not the RCE exploit. AI assists log classification and indicator generation; those 2,219 vulnerability counts are noise without measurement.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:49Threat intelligence in Kubernetes
- 6:40Threat measurement framework
- 11:39Token theft detection
- 16:27Token exposure demo
- 24:01Calibration and testing
- 29:16AI-assisted detection
- 31:43Open source next steps
- 32:30Q&A
related talks
38mCruising Ocean Threat With TheHive, Cortex & MISP Without Sinking
37mKeynote: Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supp...
25mORKL: Building an Archive for Threat Intelligence History
08mCloud Native Networks - The Open Way
31mReverse Engineering Cloud Native: Interoperability and Community
01h 27mOpen-source Tools and CSIRT Success Stories
04mKeynote: Finding Clarity in a Cloudy Landscape
28mOpen Source for Better Observability