├── saynomore.png ├── Suricata ├── selks │ ├── hunt-pcap-read.png │ └── README.md ├── docker │ ├── dalton │ │ ├── stop.sh │ │ └── build.sh │ └── redisLogging │ │ ├── logstash-redis-ela.conf │ │ └── docker-compose.yml ├── lua │ ├── stats2influxdb.md │ └── provision.sh ├── vagrant │ ├── day2 │ │ └── Vagrantfile │ ├── README.md │ ├── day1 │ │ ├── Vagrantfile │ │ └── provision.sh │ └── day3 │ │ └── Vagrantfile ├── ips │ ├── exercises.md │ └── README.md ├── data-exploration │ └── 999-tasks.ipynb ├── build │ ├── intro.md │ └── hyperscan.md ├── live │ └── README.md ├── unix-socket │ └── README.md ├── README.md ├── rulesets │ └── README.md ├── ebpf │ └── README.md ├── frontend │ └── README.md ├── elastic-log-shipping │ ├── 000-bulk-intro.ipynb │ ├── syslog.md │ └── README.md ├── suricata-update │ └── README.md ├── elastic-cluster │ └── README.md ├── eve │ └── README.md └── datasets │ └── README.md ├── data ├── README.md ├── download-public-sources.sh └── source-mta-pcap.txt ├── common ├── Closing.md ├── elastic │ ├── elastic.api.md │ ├── logstash-redis-ela.conf │ ├── elastic.config.example.md │ ├── kibana.install.md │ ├── elastic.ingest.md │ ├── docker-compose.yml │ ├── README.md │ ├── elastic.install.md │ ├── elastic.config.basic.md │ ├── kibana.queries.md │ └── elastic.mappings.md ├── GoHello.md ├── vagrant │ ├── Vagrantfile │ ├── scripts │ │ ├── install-telegraf.sh │ │ └── install-salt-minion.sh │ └── README.md ├── day_intro.md ├── SetUpGoLang.md ├── certstream-mining.md └── docker │ └── README.md ├── singlehost ├── intro.md ├── Vagrantfile └── README.md ├── Arkime ├── misp_wise │ ├── README.md │ ├── 001-MISP-Samples.ipynb │ └── 002-MISP-Populate.ipynb ├── pikksilm │ └── README.md ├── package_setup │ └── Vagrantfile ├── setup │ ├── Vagrantfile │ └── build-freebsd.md ├── tuning │ └── Vagrantfile ├── wise │ └── Vagrantfile ├── queries │ ├── Vagrantfile │ ├── 003-export-pcap.ipynb │ └── 004-tagging.ipynb ├── README.md ├── polarproxy │ └── README.md ├── suricata │ └── README.md ├── prepare-laptop.md └── clustering │ ├── Vagrantfile │ └── 000-parliament.ipynb ├── LICENSE ├── .gitignore ├── README.md └── prerequisites └── README.md /saynomore.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ccdcoe/CDMCS/HEAD/saynomore.png -------------------------------------------------------------------------------- /Suricata/selks/hunt-pcap-read.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ccdcoe/CDMCS/HEAD/Suricata/selks/hunt-pcap-read.png -------------------------------------------------------------------------------- /data/README.md: -------------------------------------------------------------------------------- 1 | # Data folder 2 | 3 | This folder is meant for storing any data files downloaded on host. Per-topic vagrant environments that require user-downloaded data mount this folder under `/data`. 4 | -------------------------------------------------------------------------------- /common/Closing.md: -------------------------------------------------------------------------------- 1 | # feedback, contact exchange, thanks, etc 2 | 3 | * Please fill in the course feedback (link provided in class) 4 | * Course certificates 5 | * Remember to backup all the relevant materials from the classroom hosts 6 | * FIN 7 | -------------------------------------------------------------------------------- /Suricata/docker/dalton/stop.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | echo "stopping dalton" 4 | [[ -d dalton ]] || exit 1 5 | cd dalton 6 | 7 | if [ -f "/etc/arch-release" ]; then 8 | sudo bash -c "docker-compose stop && docker-compose rm -f" 9 | else 10 | time docker-compose stop && docker-compose rm -f 11 | fi 12 | 13 | -------------------------------------------------------------------------------- /common/elastic/elastic.api.md: -------------------------------------------------------------------------------- 1 | # Elasticsearch API 2 | 3 | * https://www.elastic.co/guide/en/elasticsearch/reference/current/docs.html 4 | * https://elasticsearch-py.readthedocs.io/en/master/ 5 | * https://www.elastic.co/guide/en/elasticsearch/client/javascript-api/current/api-reference.html 6 | * https://github.com/olivere/elastic 7 | * https://gist.github.com/markuskont/1cfffc8c813806364200ecf2fa7eaaad 8 | * https://gist.github.com/markuskont/499ee5113ecaf63e7f98c8a4b2343f1f 9 | -------------------------------------------------------------------------------- /data/download-public-sources.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | exit_with_message() { 4 | printf "%s\n" "$1" 5 | exit 1 6 | } 7 | 8 | which unzip || exit_with_message "please install unzip" 9 | 10 | WGET_PARAMS="-4 -q" 11 | ROOT=$(dirname "$0") 12 | 13 | for pcap in $(cat ${ROOT}/source-mta-pcap.txt) ; do 14 | echo pulling $pcap 15 | file=$(printf $pcap | cut -d "/" -f7) 16 | [[ -f $ROOT/${file} ]] || wget -O $ROOT/${file} $WGET_PARAMS ${pcap} 17 | unzip -n -P infected -d ${ROOT} ${ROOT}/${file} 18 | done 19 | -------------------------------------------------------------------------------- /common/elastic/logstash-redis-ela.conf: -------------------------------------------------------------------------------- 1 | input { 2 | redis { 3 | data_type => "list" 4 | host => "redis" 5 | port => 6379 6 | key => "suricata" 7 | tags => ["suricata", "CDMCS", "fromredis"] 8 | } 9 | } 10 | filter { 11 | json { 12 | source => "message" 13 | } 14 | if 'syslog' not in [tags] { 15 | mutate { remove_field => [ "message", "Hostname" ] } 16 | } 17 | } 18 | output { 19 | elasticsearch { 20 | hosts => ["elasticsearch"] 21 | index => "logstash-bigindex" 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /singlehost/intro.md: -------------------------------------------------------------------------------- 1 | # Singlehost 2 | 3 | ## What 4 | 5 | * Entire monitoring stack built on single VM 6 | * Latest Ubuntu LTS 7 | * IDS + PFC + SIEM + *cool stuff* 8 | 9 | ## Why 10 | 11 | * Not for classwork (though you could use it) 12 | * As demo of final monitoring stack 13 | * For taking home 14 | * For reference configs (we kinda also set it up for ourselves) 15 | 16 | ## How 17 | 18 | * 1k+ lines of bash, curl, wget, docker run... 19 | * Vagrant to spin it all up 20 | 21 | ## Demo 22 | 23 | * ... -------------------------------------------------------------------------------- /Suricata/docker/dalton/build.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | export debian_frontend=noninteractive 4 | export port=8089 5 | 6 | bash stop.sh 7 | 8 | echo "provisioning dalton" 9 | [[ -d dalton ]] || git clone https://github.com/secureworks/dalton.git 10 | cd dalton && grep $port .env || sed -i "s/DALTON_EXTERNAL_PORT=80/DALTON_EXTERNAL_PORT=$port/g" .env 11 | 12 | if [ -f "/etc/arch-release" ]; then 13 | sudo bash -c "time docker-compose build && docker-compose up -d" 14 | else 15 | time docker-compose build && docker-compose up -d 16 | fi 17 | -------------------------------------------------------------------------------- /Suricata/docker/redisLogging/logstash-redis-ela.conf: -------------------------------------------------------------------------------- 1 | input { 2 | redis { 3 | data_type => "list" 4 | host => "redis" 5 | port => 6379 6 | key => "suricata" 7 | tags => ["suricata", "CDMCS", "fromredis"] 8 | } 9 | } 10 | filter { 11 | json { 12 | source => "message" 13 | } 14 | if 'syslog' not in [tags] { 15 | mutate { remove_field => [ "message", "Hostname" ] } 16 | } 17 | } 18 | output { 19 | elasticsearch { 20 | hosts => ["elasticsearch"] 21 | index => "suricata-%{+YYYY.MM.dd}" 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /Arkime/misp_wise/README.md: -------------------------------------------------------------------------------- 1 | # MISP to WISE integration 2 | 3 | ## MISP setup 4 | 5 | * https://github.com/MISP/misp-docker 6 | 7 | # Set up jupyter notebook 8 | 9 | Jupyter notebook is a useful tool for interactive scripting, especially around anything involving interaction with data. 10 | 11 | ``` 12 | apt install python3-pip python3-venv 13 | python3 -m venv /jupyter 14 | source /jupyter/bin/activate 15 | pip install jupyter jupyterlab pandas numpy pymisp 16 | ``` 17 | 18 | ``` 19 | jupyter lab --no-browser --allow-root --ip 192.168.56.12 20 | ``` 21 | -------------------------------------------------------------------------------- /common/GoHello.md: -------------------------------------------------------------------------------- 1 | # Hello, World! 2 | 3 | See if go environment is configured and create the directory for your program 4 | ``` 5 | go env 6 | mkdir -p $GOPATH/src/github.com/username/helloworld 7 | cd $GOPATH/src/github.com/username/helloworld 8 | touch helloworld.go 9 | ``` 10 | 11 | Add the following content to helloworld.go 12 | 13 | ``` 14 | package main 15 | 16 | import "fmt" 17 | 18 | func main() { 19 | fmt.Printf("Hello, world!\n") 20 | } 21 | ``` 22 | 23 | And then build the binary 24 | ``` 25 | go build 26 | ls 27 | ./helloworld 28 | ``` 29 | -------------------------------------------------------------------------------- /common/elastic/elastic.config.example.md: -------------------------------------------------------------------------------- 1 | # Elasticsearch config 2 | 3 | ``` 4 | cluster: 5 | name: josephine 6 | discovery: 7 | zen: 8 | ping: 9 | unicast: 10 | hosts: 11 | - 192.168.10.120 12 | - 192.168.10.82 13 | - 192.168.10.122 14 | http: 15 | enabled: true 16 | host: 0.0.0.0 17 | network: 18 | host: 192.168.10.140 19 | node: 20 | data: false 21 | ingest: false 22 | master: false 23 | name: es-proxy-0.labor.sise 24 | path: 25 | data: 26 | - /srv/elasticsearch/0 27 | - /srv/elasticsearch/1 28 | logs: /var/log/elasticsearch 29 | ``` 30 | -------------------------------------------------------------------------------- /common/vagrant/Vagrantfile: -------------------------------------------------------------------------------- 1 | # -*- mode: ruby -*- 2 | # vi: set ft=ruby : 3 | 4 | $provision_script = <