2014.10.29 - Security@Scale - Scott Roberts, GitHub
summary
Built a shared chatbot called Hubot VTR that runs on Node/CoffeeScript and performs incident tasks from chat: Splunk queries, VirusTotal and PassiveTotal integration, reverse DNS, yara/snort signature generation, banning users, changing firewall rules and even full deploys triggered from specific rooms. Scripts parse JSON APIs, tighten decision logic (example: VirusTotal threshold), and log everything to Elasticsearch for audit. Role- and room-restricted commands and simple two-factor-like checks limit risk; modules are small, reusable and actually used daily.
AI-written summary · about
chapters (25)
- 0:00Start
- 0:35BUILDING YOUR OWN DFIR SIDEKICK CHATOPS FOR INCIDENT RESPONSE
- 1:08CHATOPS AND INCIDENT RESPONSE: HUBOT, VARIABLE THREAT RESPONSE, DEPLOYING AND DEVELOPING HUBOT
- 2:43WHY CHATOPS ANYWAY?
- 2:59GEOGRAPHICALLY DISTRIBUTED
- 3:35ASYNCHRONOUS
- 4:05MULTI DEVICE
- 5:33HIDES THE "UGLY"
- 6:29HOW GITHUB USES CHATOPS
- 6:58MONITOR SYSTEMS
- 7:21UPDATE OUR STATUS SITE
- 7:50SO WHAT ABOUT DFIR?!
- 8:11SHOWING PROCESS LISTS ON HOSTS
- 8:26GETTING WHOIS INFORMATION
- 9:11SWINGING THE BANHAMMER
- 9:28OTHER "SECRET" STUFF
- 9:44HUBOT VTR
- 10:27CODE NAME GENERATOR
- 11:15GEOLOCATING IPS
- 11:45RESEARCH LINKS GENERATOR
- 11:59SERVER PROFILING
- 12:16DETECTION GENERATION
- 17:23SPEAKING OF DEVELOPMENT... A NEW MODULE!
- 17:39LASTLINE URL ANALYSIS
- 17:51HUBOT'S "VOICE"
related talks
42mPentesting ChatOps
49mKeynote: Pentesting ChatOps
42mPentesting ChatOps
52mPentesting ChatOps
38mOpening Plenaries: Security in Automation
22mEmpowering the Employee: Incident Response with a Security Bot
40mDetecting and responding to threats in generative AI workloads
48mHow to Thwart Malicious Automation and Kick Bot Butt for $0