WEBVTT 00:00:01.450 --> 00:00:03.290 Welcome to the Nagios demo. 00:00:03.290 --> 00:00:04.330 At a high level, 00:00:04.330 --> 00:00:08.540 we are going to review how to set up and enable the free version of Nagios. 00:00:08.540 --> 00:00:12.600 Then we will demonstrate how to deploy agents or discovery scans. 00:00:12.810 --> 00:00:16.290 We will also deep dive into implementing visibility into 00:00:16.290 --> 00:00:18.850 the main MITRE TTPs for this course, 00:00:18.980 --> 00:00:22.450 which are command and scripting interpreter with PowerShell, 00:00:22.520 --> 00:00:26.780 disable or modify the firewall, or file and directory traversal. 00:00:27.000 --> 00:00:27.560 Lastly, 00:00:27.560 --> 00:00:31.520 I will review a few additional features that I believe to be very 00:00:31.520 --> 00:00:34.410 useful in security triage and investigation. 00:00:34.670 --> 00:00:35.680 Let's dig right in. 00:00:38.010 --> 00:00:41.530 All right, let's go ahead and enable the free version of Nagios. 00:00:41.530 --> 00:00:44.040 You're going to want to head on over to the Admin tab, 00:00:44.050 --> 00:00:47.180 and then also the License Information. 00:00:47.190 --> 00:00:51.290 Now as you can see under License Type, I have Free already selected. 00:00:51.290 --> 00:00:55.200 To select it, you just go up and click the little toggle icon next to Free. 00:00:55.200 --> 00:01:00.510 This gives you 7 nodes free to try out within this Nagios XI interface. 00:01:02.200 --> 00:01:04.720 The paid version gives you more control from a server 00:01:04.720 --> 00:01:07.020 perspective for things like patch management, 00:01:07.030 --> 00:01:08.960 deployments, and network visibility, 00:01:08.960 --> 00:01:13.090 but the free version in my opinion gives enough general visibility to 00:01:13.090 --> 00:01:15.360 get the context needed for further investigation. 00:01:15.360 --> 00:01:16.620 All right, 00:01:16.950 --> 00:01:19.980 let's go ahead and head to the Configure tab to set up some 00:01:19.980 --> 00:01:23.000 of these scans and deploy some agents. 00:01:23.080 --> 00:01:23.740 So first, 00:01:23.740 --> 00:01:28.570 we're going to head on over to the Auto‑Discovery option on the left‑hand side, 00:01:28.570 --> 00:01:32.640 and go ahead and click that to set up an auto‑discovery scan. 00:01:32.640 --> 00:01:37.030 Click the bright blue button for a new scan job, 00:01:37.030 --> 00:01:41.160 and this is where we'll go ahead and enter the scan target information. 00:01:41.160 --> 00:01:44.180 Either a subnet or a singular IP will work, 00:01:44.190 --> 00:01:47.620 and any IPs you want to exclude, and then click Submit. 00:01:47.620 --> 00:01:49.830 And it's as simple as that. 00:01:50.710 --> 00:01:53.540 Next, let's click on Deploy Agent. 00:01:53.550 --> 00:01:55.690 Now this is the same general concept. 00:01:55.690 --> 00:01:58.550 We're going to go ahead and type in our IP address for a 00:01:58.550 --> 00:02:02.650 singular agent that we want to deploy a host on. 00:02:02.650 --> 00:02:06.810 Select the operating system from the list that is provided, 00:02:06.820 --> 00:02:10.630 the authentication type, enter in the credentials needed, 00:02:11.920 --> 00:02:15.640 and then that is the Nagios software, and click Deploy. 00:02:15.640 --> 00:02:16.560 And that's it. 00:02:17.290 --> 00:02:20.260 If you head on over to the Manage Deployment tab, 00:02:20.270 --> 00:02:23.590 you can actually manage and see all the different agents 00:02:23.590 --> 00:02:25.300 that you may have deployed out there. 00:02:26.630 --> 00:02:28.890 All right, now that we have some hosts added, 00:02:28.900 --> 00:02:33.070 let's go ahead and head on over to Configuration Wizards to add in some 00:02:33.070 --> 00:02:37.030 logging and context to our host to really give that juiciness. 00:02:37.040 --> 00:02:40.400 Right, so we're going to go ahead and type in Windows in the search bar. 00:02:41.170 --> 00:02:44.850 And since we have a Windows host, which is a Windows 10 Workstation, 00:02:44.850 --> 00:02:48.780 we're going to go ahead and click on the Windows Desktop add‑on wizard. 00:02:48.790 --> 00:02:50.920 That's the one right in the middle there. 00:02:50.920 --> 00:02:52.440 If you go ahead and click on that, 00:02:55.000 --> 00:02:59.890 here you're going to enter your IP of the VM or 00:02:59.890 --> 00:03:02.170 Workstation that you're working with, 00:03:02.180 --> 00:03:06.210 and I'm going to go ahead and type that in here. 00:03:06.210 --> 00:03:09.700 And you can add in your token, which, 00:03:09.710 --> 00:03:12.700 in order for within the Nagios instance here, 00:03:12.700 --> 00:03:16.300 you just head on over to your admin account and grab the API 00:03:16.300 --> 00:03:18.760 key is what it's referring to for token. 00:03:18.760 --> 00:03:24.300 So, just copy that, come on back, do the Configuration Wizard again, 00:03:28.230 --> 00:03:32.570 Windows Desktop, pop in your token there. 00:03:32.570 --> 00:03:35.630 And then just to verify we have the right host, 00:03:35.630 --> 00:03:39.570 let's head on over to our Windows VM Workstation anyway and just 00:03:39.570 --> 00:03:44.860 double‑check the IP to ensure we have the right one. 00:03:47.820 --> 00:03:51.850 Do a little quick ipconfig, if I can type it right. 00:03:51.850 --> 00:03:55.260 There we go. 00:03:55.260 --> 00:03:58.420 And there is our IP. 00:03:58.420 --> 00:04:02.110 We're going to go back on over and plug that in. 00:04:07.560 --> 00:04:11.270 As you can see, it's over that unique port 5693. 00:04:12.290 --> 00:04:16.040 Now, once you're at this screen here, this is where all the fun happens. 00:04:16.040 --> 00:04:19.310 Everything with a blue checkmark is enabled by default, 00:04:19.320 --> 00:04:23.470 and you can customize some of those CPU usages or memory usages. 00:04:23.470 --> 00:04:25.820 We're going to scroll on down to the fun stuff. 00:04:25.820 --> 00:04:31.230 We're going to enable certain services that we want monitored or alerted on. 00:04:31.230 --> 00:04:36.820 So, we're going to head on over here to our Windows Workstation again, 00:04:36.830 --> 00:04:41.520 and we're just going to verify, for the sake of this demo, what the 00:04:41.520 --> 00:04:46.140 service name is for the firewall running on a Windows host. 00:04:46.150 --> 00:04:48.480 So I'm going to go over to my Task Manager, 00:04:49.780 --> 00:04:54.650 and I'm going to go to the Services tab and search 00:04:54.660 --> 00:04:59.690 for that Windows Defender Firewall, which is right here. 00:05:00.350 --> 00:05:02.270 Service name mpssvc. 00:05:02.270 --> 00:05:04.570 So all we're going to do here, 00:05:04.570 --> 00:05:06.940 and this is for any service that you want monitored, 00:05:06.940 --> 00:05:11.710 we're just going to go under the Processes and/or Services tab, 00:05:11.710 --> 00:05:14.260 depending on what it is, type in that service name, 00:05:14.260 --> 00:05:18.290 mpssvc, just a quick description of what it is, 00:05:19.630 --> 00:05:23.100 and then make sure you check the box next to it to 00:05:23.100 --> 00:05:24.830 have it enabled and monitored. 00:05:24.840 --> 00:05:28.740 So as you can see, we're also looking at Windows Defender service as well, 00:05:28.740 --> 00:05:30.910 and ensuring that it's running. 00:05:30.910 --> 00:05:33.030 Now, just for fun, in the Processes, 00:05:33.030 --> 00:05:36.680 we're going to go ahead and select different processes that we 00:05:36.680 --> 00:05:39.220 want to be alerted on whenever they are executed, 00:05:39.230 --> 00:05:44.010 explore.exe, cmd, right, the command‑line interface, 00:05:44.020 --> 00:05:45.510 or even PowerShell. 00:05:45.510 --> 00:05:50.970 Now we're just putting one time as an alert instance just for the demo, 00:05:50.970 --> 00:05:53.870 but you can customize that to however many you would like. 00:05:54.730 --> 00:05:55.240 Also, 00:05:55.240 --> 00:05:59.320 I'm going down and enabling the event logs events to pull 00:05:59.320 --> 00:06:01.910 those in to provide additional context. 00:06:01.920 --> 00:06:04.430 Okay, once that's finished, 00:06:04.800 --> 00:06:08.020 this is where you would set your time threshold for this job to run, 00:06:08.020 --> 00:06:09.980 and you click Finish, and that's it. 00:06:10.560 --> 00:06:12.720 The configuration changes have been made. 00:06:13.600 --> 00:06:17.390 So now what you're going to do is go into the Core Configuration Manager, 00:06:17.390 --> 00:06:21.040 and this is where you can see all the different configuration changes that 00:06:21.040 --> 00:06:26.410 you just enabled in a quick dashboard view and get a bird's eye sense of 00:06:26.410 --> 00:06:28.450 what's going on in this host. As you can see, 00:06:28.460 --> 00:06:34.030 here's our PowerShell alert, here's our CPU usage, everything that we selected 00:06:34.040 --> 00:06:39.490 is ready to roll. All right, now it's time for the fun stuff. 00:06:39.500 --> 00:06:43.380 Let's dig into these MITRE TTP s and see how we can use Nagios to 00:06:43.380 --> 00:06:46.040 quickly alert on what's happening on a host. 00:06:46.070 --> 00:06:48.040 Let's look into PowerShell first. 00:06:48.130 --> 00:06:51.700 This is primarily going to be viewed from the Host Status page, but 00:06:51.700 --> 00:06:54.400 first we're going to head on over to our VM, and we're going to 00:06:54.400 --> 00:06:57.160 actually generate PowerShell alerts. We're just going to open up a 00:06:57.160 --> 00:07:01.960 couple instances of PowerShell to give Nagio something to alert on and 00:07:01.960 --> 00:07:03.310 something for us to look at. 00:07:03.320 --> 00:07:08.590 So you can see I opened up two instances. Head on over to the Host Status page, 00:07:09.910 --> 00:07:13.680 and then we're going to go ahead and click on that IP that we enabled the 00:07:13.680 --> 00:07:19.020 Windows add‑on for. Next, we're going to head up to the Services tab. Click 00:07:19.020 --> 00:07:23.990 that, and it'll give us a breakdown of all the services that are included in 00:07:23.990 --> 00:07:26.150 that specific add‑on that we enabled. 00:07:26.290 --> 00:07:29.840 Now, as you can see, there's a PowerShell line item, 00:07:29.950 --> 00:07:33.980 it's listed as critical, and it's the exact alert that we created. For 00:07:33.980 --> 00:07:38.320 every one instance of PowerShell, trigger an alert. And you'll see actually 00:07:38.320 --> 00:07:42.140 if you scroll down a couple more line items, there's another line item for 00:07:42.140 --> 00:07:46.540 PowerShell. So this is going to trigger every single time PowerShell was 00:07:46.540 --> 00:07:48.490 opened. We opened it twice. 00:07:48.500 --> 00:07:52.370 This is obviously a very simplistic example of how to detect 00:07:52.370 --> 00:07:55.760 PowerShell. You can get much more in‑depth with these, 00:07:55.770 --> 00:07:59.010 but you can also do the same thing for that Firewall 00:07:59.020 --> 00:08:02.650 mpssvc service that we entered as well. 00:08:02.660 --> 00:08:06.170 So if you were to go into that VM, stop the Firewall 00:08:06.170 --> 00:08:10.110 service, start it back up. You should get the same exact 00:08:10.640 --> 00:08:14.080 alert details within this services page. 00:08:14.090 --> 00:08:18.990 This is a great way to get quick visibility into if Windows Defender 00:08:18.990 --> 00:08:26.550 is running, if command‑line is running, etc. Also, 00:08:26.550 --> 00:08:28.700 if you go ahead and click on Event Log, 00:08:28.710 --> 00:08:32.940 this is another way to verify individual events that are occurring 00:08:32.950 --> 00:08:35.830 outside of the realm of the ones that you selected as well. 00:08:35.830 --> 00:08:40.470 These will give you the individual events as they occur per click, 00:08:40.470 --> 00:08:45.795 that is that bullet point that I selected for Event Logs or event 00:08:45.795 --> 00:08:50.885 alerts. This will give you all that context needed that's happening 00:08:50.885 --> 00:08:53.855 on a host that you actually may not even be aware of, and it'll help 00:08:53.855 --> 00:08:58.765 you actually generate better alerting that is fit for whatever use 00:08:58.765 --> 00:08:59.735 cases you need. 00:09:01.480 --> 00:09:04.130 Lastly, if you go ahead and click on Network Status Map, 00:09:04.140 --> 00:09:06.360 I want to review a couple of the cool features that I 00:09:06.360 --> 00:09:08.540 found in Nagios while investigating. 00:09:08.550 --> 00:09:10.110 Now, as you can see, 00:09:10.120 --> 00:09:14.360 it gives you a network topology map of all your assets that 00:09:14.360 --> 00:09:16.780 are deployed or discovered through scanning. 00:09:16.790 --> 00:09:22.080 Now, if you want a more in‑depth look into your network or your host operations, 00:09:22.090 --> 00:09:26.880 go ahead and click on the Graph Explorer under the graphs on the left side, and 00:09:26.880 --> 00:09:32.880 that will give you a very high‑level overview of all the different hosts that 00:09:32.880 --> 00:09:35.860 you have monitored and the top alerts produced. 00:09:35.860 --> 00:09:37.840 You can see our PowerShell ones, 00:09:37.850 --> 00:09:41.750 some of the event logs, user counts that are logged in, 00:09:41.760 --> 00:09:45.560 different command lines, or even CPU usages, right. 00:09:45.570 --> 00:09:48.310 There's other tabs as well, around heartbeats, 00:09:48.320 --> 00:09:50.540 host health check, service health. 00:09:50.550 --> 00:09:54.630 This gives you quick visibility into maybe some different unusual 00:09:54.630 --> 00:09:57.750 activity or spikes i performance within your network. 00:09:58.570 --> 00:10:00.850 Now, that's all we have for today. 00:10:00.860 --> 00:10:04.990 I hope you enjoyed this class, and I look forward to seeing you in the next one. 00:10:05.050 --> 00:10:06.670 Until then, have a good one!