WEBVTT 00:00:00.520 --> 00:00:01.330 Hello there. 00:00:01.420 --> 00:00:03.010 I'm your instructor, Owen Dubiel, 00:00:03.010 --> 00:00:06.880 and today we'll be covering everything you need to know around OS 00:00:06.880 --> 00:00:09.610 analysis with Nagios in a live environment. 00:00:10.100 --> 00:00:11.980 Let's dig right in. 00:00:11.980 --> 00:00:16.420 Nagios is a tool that professionals use to centrally manage and monitor 00:00:16.420 --> 00:00:19.610 assets that they are responsible for in their environment. 00:00:19.710 --> 00:00:20.740 In this course, 00:00:20.760 --> 00:00:24.470 we'll be focusing solely on its ability to monitor and provide 00:00:24.470 --> 00:00:27.390 analysis into operating‑system‑level activities. 00:00:27.390 --> 00:00:31.330 To better teach this concept of OS analysis with Nagios, 00:00:31.330 --> 00:00:35.740 I plan to walk you through how to enable monitoring based specifically 00:00:35.740 --> 00:00:40.760 around NIST and MITRE frameworks to provide you with a solid key takeaway 00:00:40.980 --> 00:00:43.260 that can be applied in a real‑world scenario. 00:00:43.810 --> 00:00:44.510 Lastly, 00:00:44.570 --> 00:00:47.890 I plan to also review at a high level some of the additional features that 00:00:47.890 --> 00:00:52.320 can be enabled in order to enhance your Nagios experience when performing 00:00:52.320 --> 00:00:55.280 security investigations. But first some history. 00:00:55.700 --> 00:01:01.610 Nagios was first created in 1996 by Ethan Galstad as an MS‑DOS application 00:01:01.720 --> 00:01:05.190 designed to perform simple ping operations and server checks. 00:01:05.190 --> 00:01:09.010 Throughout the years, Ethan continued to add on to his creation, 00:01:09.230 --> 00:01:13.940 forming it towards more of a hosted monitoring and managed service approach. 00:01:14.090 --> 00:01:15.030 Eventually, 00:01:15.040 --> 00:01:20.030 Ethan revamped the tool to run his solution as a Linux‑based application design. 00:01:20.530 --> 00:01:21.940 In 1999, 00:01:21.950 --> 00:01:26.460 Ethan released the project as an open source development and named it NetSaint, 00:01:26.720 --> 00:01:31.060 which was later changed to Nagios due to trademark concerns with the name Saint. 00:01:32.050 --> 00:01:32.990 Throughout the years, 00:01:33.000 --> 00:01:37.700 Ethan continued to build out Nagios with features like SNMP traps, 00:01:37.820 --> 00:01:41.960 Windows support, Incident Manager, Network Analyzer, 00:01:42.100 --> 00:01:43.530 and even a log server. 00:01:43.530 --> 00:01:45.180 Fast forward to today, 00:01:45.180 --> 00:01:49.840 where Nagios has over 7.5 million user downloads on SourceForge alone. 00:01:51.690 --> 00:01:53.610 All right, let's get into the nitty gritty. 00:01:53.680 --> 00:01:56.390 What is Nagios, anyway? 00:01:56.390 --> 00:02:01.230 Nagios is a monitoring tool used for mission‑critical infrastructure assets. 00:02:01.380 --> 00:02:04.150 I'm talking about applications, services, 00:02:04.160 --> 00:02:06.750 operating systems, and even network appliances. 00:02:06.750 --> 00:02:07.780 With Nagios, 00:02:07.780 --> 00:02:11.330 you can walk away with the ability to implement performance monitoring, 00:02:11.570 --> 00:02:16.170 incident management, network mapping, and even event alerting. 00:02:16.750 --> 00:02:19.910 Okay, so where do I get Nagios? 00:02:19.910 --> 00:02:22.210 In order to gain access to Nagios, 00:02:22.210 --> 00:02:25.680 you simply have to visit their site at nagios.com to start a 00:02:25.680 --> 00:02:28.010 download of the product that you're interested in. 00:02:28.020 --> 00:02:31.660 Alternatively, if you head over to SourceForge.com as well, 00:02:31.670 --> 00:02:33.460 you can get a community download. 00:02:34.570 --> 00:02:36.770 All right, but what makes it special? 00:02:36.770 --> 00:02:38.230 Why would I use it? 00:02:38.240 --> 00:02:40.070 I'm a member of a security blue team. 00:02:40.080 --> 00:02:42.000 What makes it special for me? 00:02:42.560 --> 00:02:46.870 So Nagios comes with tons of built‑in add‑on configuration wizards to help 00:02:46.870 --> 00:02:49.790 assist you with any type of integration you may be interested in. 00:02:50.150 --> 00:02:54.240 These services include Microsoft, AWS, Digital Ocean, 00:02:54.290 --> 00:02:57.640 Docker, Google, Oracle, VMware, and more. 00:02:57.640 --> 00:02:59.070 At the end of the day, 00:02:59.080 --> 00:03:02.020 Nagios helps to streamline operating system 00:03:02.020 --> 00:03:04.730 monitoring in a centralized location. 00:03:04.730 --> 00:03:07.450 From the blue team perspective, 00:03:07.460 --> 00:03:11.780 Nagios makes centralized log management and asset tracking a breeze 00:03:11.810 --> 00:03:14.610 with its two options of deployment that are offered, 00:03:14.730 --> 00:03:18.600 either an auto‑discovery scan or remote agent deployment. 00:03:18.700 --> 00:03:23.210 Both options allow for mass deployment, no matter your network configuration. 00:03:23.210 --> 00:03:26.070 And then for blue teams specifically, 00:03:26.070 --> 00:03:30.000 Nagios is straight to the point and allows easy mapping into major 00:03:30.000 --> 00:03:34.100 security frameworks like NIST or even MITRE TTPs, 00:03:34.150 --> 00:03:36.150 which we're going to dig into next. 00:03:37.990 --> 00:03:41.480 Taking a quick look at the compliance security side of the house, NIST 00:03:41.480 --> 00:03:44.520 provides guidelines to help companies better align their efforts and 00:03:44.520 --> 00:03:47.690 resources to achieve a greater security posture. 00:03:48.220 --> 00:03:53.060 NIST now organizes its coverage into five topics: Identify, 00:03:53.500 --> 00:03:55.500 Protect, Detect, 00:03:55.660 --> 00:03:59.960 Respond, and Recover. Today, we'll be focusing solely on the 00:03:59.960 --> 00:04:02.290 Detect realm within the NIST framework. 00:04:04.640 --> 00:04:07.880 Breaking out that Detect realm a little further, you can see that the 00:04:07.880 --> 00:04:11.210 categories are further broken down into subcategories. 00:04:11.770 --> 00:04:16.230 This includes examples like anomalies and events, detection processes, 00:04:16.240 --> 00:04:19.470 and then the one we'll be focusing on in this course is security 00:04:19.470 --> 00:04:23.860 continuous monitoring, or the ability to ensure continuous log monitoring 00:04:24.050 --> 00:04:28.370 is ongoing and reputable to provide blue teams with a constant feedback 00:04:28.380 --> 00:04:30.100 of security‑related activity. 00:04:32.960 --> 00:04:36.210 Now, as we continue to break down the NIST framework here, 00:04:36.220 --> 00:04:41.620 we can easily determine that by implementing Nagios for OS‑level analysis, 00:04:41.750 --> 00:04:47.770 you are able to check the box for DE.CM‑1, which is The network is 00:04:47.770 --> 00:04:52.410 monitored to detect potential cyber security events. If implemented 00:04:52.410 --> 00:04:56.030 correctly, Nagios can be configured to provide monitoring and detection 00:04:56.030 --> 00:05:00.870 capabilities for specific network‑related events, like if a firewall is 00:05:00.870 --> 00:05:04.920 modified or even disabled, which could be a precursor to an attack. 00:05:05.710 --> 00:05:09.970 Another NIST box that can be checked with this implementation of Nagios is 00:05:09.970 --> 00:05:16.170 DE.CM‑7, or Monitoring for unauthorized personnel, connections, 00:05:16.180 --> 00:05:22.800 devices, and software is performed. Over time, as you get used to using Nagios, 00:05:22.810 --> 00:05:26.430 you will get a better feel for what is normal activity in your environment. 00:05:26.440 --> 00:05:31.180 By using Nagios, you can have instant visibility into unauthorized 00:05:31.180 --> 00:05:35.500 activity like the launching of PowerShell or even a specific 00:05:35.500 --> 00:05:38.070 file‑related activity that may be occurring. 00:05:40.820 --> 00:05:46.030 All right, next we have MITRE, the MITRE ATT@CK framework. Now that we've 00:05:46.030 --> 00:05:49.290 really identified what those NIST categories are going to be doing for 00:05:49.290 --> 00:05:54.660 us, let's take a deeper and more narrow look at MITRE ATT@CK TTPs, or 00:05:54.660 --> 00:05:59.570 Tactics, Techniques, and Procedures that we can effectively detect with 00:05:59.580 --> 00:06:07.410 our implementation of Nagios, the first one being T11058.001, or Command 00:06:07.420 --> 00:06:12.630 and Scripting Interpreter, more specifically, PowerShell. This TTP is 00:06:12.630 --> 00:06:17.360 located under the Execution tactic. It is simply means of being able to 00:06:17.360 --> 00:06:20.640 detect the use of PowerShell within a corporate environment. 00:06:21.590 --> 00:06:25.430 This is important to alert or monitor on, as PowerShell can be easily 00:06:25.430 --> 00:06:29.330 used to carry out additional admin actions and exploits throughout a 00:06:29.330 --> 00:06:33.820 network. Ideally, each detection should have a solid use case and 00:06:33.820 --> 00:06:38.130 explanation as to why it is triggered, and then whitelist it to prevent 00:06:38.130 --> 00:06:39.890 further alerting. This way, 00:06:39.890 --> 00:06:42.320 you should only be alerted on PowerShell events that are 00:06:42.330 --> 00:06:45.390 unauthorized to you or ones that you are unaware of. 00:06:46.560 --> 00:06:54.660 Next we have T1562.007: Impair Defenses: Disable or Modify the Firewall. 00:06:55.380 --> 00:06:58.970 This is nested under the Defense Evasion tactic, and has the 00:06:58.970 --> 00:07:03.140 ability to detect when firewall‑level changes are made and/or 00:07:03.140 --> 00:07:04.980 the firewall could be disabled. 00:07:05.340 --> 00:07:09.210 This is a very important alert to have in place to ensure that all firewall 00:07:09.210 --> 00:07:12.270 changes are tracked through your change management system, 00:07:12.610 --> 00:07:17.430 thus helping you identify if there are any unwarranted changes that 00:07:17.430 --> 00:07:20.340 could lead to an attack that may be underway. 00:07:20.410 --> 00:07:21.380 Most times, 00:07:21.520 --> 00:07:24.960 attackers that have a compromised admin account will have the ability 00:07:24.960 --> 00:07:28.060 to open up ports on a firewall to create a command and control 00:07:28.060 --> 00:07:32.660 channel, or a C2, over an obfuscated port to carry out remote 00:07:32.660 --> 00:07:34.860 activities from afar without your knowledge. 00:07:35.840 --> 00:07:42.850 And then lastly, we have T1083: File and Directory Discovery, which is 00:07:42.850 --> 00:07:46.750 located under the Discovery tactic and can help security personnel quickly 00:07:46.750 --> 00:07:51.710 identify anyone that may be performing recon or lateral movement activities 00:07:51.720 --> 00:07:53.660 within the early stages of an attack. 00:07:54.630 --> 00:07:57.150 Having the ability to see when someone is performing 00:07:57.150 --> 00:08:01.170 directory scans enumerating your network is essential in 00:08:01.170 --> 00:08:03.260 stopping an attack before it happens. 00:08:03.270 --> 00:08:04.150 Also, 00:08:04.150 --> 00:08:09.150 attackers may be able to also traverse files or directories in search of 00:08:09.150 --> 00:08:13.950 sensitive data or even additional credentials that allow them access to 00:08:13.950 --> 00:08:18.640 other accounts that may contain other sensitive data. In the next video, 00:08:18.640 --> 00:08:23.280 we will dive into a demo of how to utilize Nagios in a real‑world 00:08:23.280 --> 00:08:25.310 environment for security monitoring. 00:08:25.320 --> 00:08:26.790 I'll see you in the next video.