Osquery vs sysdig software#
Osquery vs sysdig free#

The overall process of threat hunting is to make attackers stand out from the noise.

Osquery vs sysdig software#

Threat hunters should also make sure existing security software works and sensors and systems should be routinely tested, using different breach and attack simulation tools such as the Infection Monkey to verify systems. However, many of these sensors go untested outside the occasional pentest. Over time, organizations build up a large set of sensors and alerts. The concept of File Integrity Monitoring (FIM) enables threat hunters to define baselines and recognize deviations. These files are classic locations to monitor for attacker activity, whether by locking down access to the files or monitoring for changes. In addition, these files are rarely changed. Networks frequently rely on a handful of configuration files that control DNS resolving, database access, user management and other key systems. Monitoring artifacts that rarely change is an additional method for hunting threats. Examples of deviations could be a binary executing from a temporary folder (potential attacker), a server communicating with a cloud service it typically doesnвЂ™t (possible data exfiltration) or traffic to an IP address that isnвЂ™t matched with a DNS query. Threat hunters define the current state of affairs as valid and look for deviations. Threat hunters recognize that applications arenвЂ™t replaced on a daily basis, new servers donвЂ™t just appear, and organizations donвЂ™t suddenly start communicating with new third-party services. Instead of trying to find a trace in a firehose of data, threat hunters must use their collective years of security and IT experience. Handling the deluge of data that comes through the feed is more challenging than collecting it. However, once this feed is set up, a new problem emerges. This feed is frequently built using the same tools mentioned before, such as sysmon, capable of efficiently logging events to centralized servers. The laundry list of running images, their hashes, domain lookups and so forth is a crucial component for building up sensors. An accurate map is just part of that visibility puzzle.

To be effective, threat hunters need an accurate feed for what happens inside machines and across the network. Over time, threat hunters working in a specific network build up a collection of alerts that rarely trigger and indicate truly suspicious activity. These are worthy of investigation, fixing dormant issues that attackers frequently abuse to hide within the network. These alerts are not necessarily indicators of attackers! In fact, many will be undocumented behavior or IT misconfigurations. A web server behind a load balancer starts communicating directly with Internet users? Alert.

Communication from a standalone Linux server to the local AD server? Alert. Using maps, defenders can start analyzing what typical network traffic looks like and set up alerts with different tools to detect abnormal traffic. The goal is to construct an accurate map of the network.

Osquery vs sysdig free#

Free tools such as ss, sysmonand sysdig, combined with graphviz can help defenders build maps that track network activity. But threat hunters should build simple tools to give them partial answers. Analyzing what assets exist and who communicates with whom is an open challenge. ItвЂ™s hard to tell whatвЂ™s really going on in any large network. By starting from a baseline, we detect deviations that might be indicators of attacker activity, while at the same time, we harden existing systems and turn the baseline into a trusted base. This process allows defenders to get work done. We start from a baseline, a вЂњknown good state,вЂќ then detect anomalies and classify them as either part of the environment or security incidents.