2014.10.29 - Security@Scale - Michael McGrew, Facebook
summary
Facebook describes an incident response stack that actually runs: cerakota + bro + ntop for corporate NSM, pf_ring dna to push 10 Gbps without packet loss, and a Python XML-RPC service that pulls indexed pcaps from a disk store. They report 200k bad IPs loaded, 21k signatures, 5 Gbps per Cerakota box, and zero drops on Bro at 2.5 Gbps. Remote forensics finishes a 1 TB root image in ~2.6 hours with SSH compression and a 30-minute rolling pcap window for quick retrieval.
AI-written summary · about
chapters (35)
- 0:00Intro
- 0:23Homebrew Incident Response
- 1:03Goals of this talk
- 3:03Quick notes
- 3:46State of affairs (the bad)
- 7:06Exercise #1
- 7:58DNS logs from a BlueCat DNS Server
- 8:13Firewall egress logs
- 8:52Exercise #2
- 9:08DHCP logs from a Microsoft DHCP Server
- 9:37Exercise #3
- 9:54Audit process feature
- 11:55Commercial vs. Sysmon
- 12:29Exercise #4
- 13:56Datasources
- 14:31Resulting Capabilities
- 15:55Suricata is detection-driven
- 16:17Ex: Detecting a Cnc beacon
- 16:34Ex: Detecting exfiltration
- 16:44Ex: Thinking outside of the box
- 17:26Scaling your intelligence
- 18:01Bro informs response
- 18:40Bro informs detection
- 19:08Example intel config
- 20:04Note on ntop & bro
- 23:24IR Lifecycle
- 23:52Communications
- 24:56PROD Forensics Infrastructure
- 27:43CORP Forensics Infrastructure
- 29:37active exfiltration
- 31:26Don't forget to triage alerts during an incident
- 32:15Containment
- 33:29WiFi Network ACLS
- 34:41Sinkhole via DNS Zones
- 35:11Sinkhole Logging
related talks
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
38mThe Black Hat Europe Network Operations Center (NOC) Report
39mBarbarians at the Gate(way)
40mThe NOC Report
43mSocial Forensication: A Multidisciplinary Approach to Successful Social Engineering
44mNetsec is Dead(?): Modern Network Fingerprinting for...
52mInvestigating DDOS - Architecture Actors and Attribution
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report