Our great sponsors
-
jupyter2kibana
A Workflow for Data Scientists to bring Jupyter Notebook Visualizations to Kibana Dashboards
-
ansible-pentest-deploy
Using Ansible as an orchestrator, this project is another solution for testers looking to configure and deploy a new VM or VPS box with the tools that they need for penetration testing.
-
WorkOS
The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
-
-
invoke-atomicredteam
Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
Big picture: We want to work out an in-depth ELK workflow and develop some threat hunting automation. I found that a small ELK stack is hosted for a very reasonable price ($0.0263/hr for a small stack w/ 45GB storage as of today). And a CoCalc instance (collaborative cloud-hosted JupyterLab) costs another $6 per month. So between those two low-cost resources we've figured out a pretty neat Python -> Vega -> Kibana workflow to apply some data science and visualization to our threat-hunting workflow (after some trouble).
We looked into pre-configured, plug-and-play options. One project (leveraging Ansible) is called PurpleCloud. Probably because running even a handful of Windows VMs on a PC can get pretty slow, pretty fast, their project spins this network up on Azure. However, the estimated monthly cost of the cloud resources is not attractive; over $300 per month. While it's true that we would not need to run the lab every day resulting in lower cost, I think we would want to run new tests fairly often, especially if multiple analysts are using it (and I already know the burn of forgetting an EC2 instance on for a week or two).
We looked into pre-configured, plug-and-play options. One project (leveraging Ansible) is called PurpleCloud. Probably because running even a handful of Windows VMs on a PC can get pretty slow, pretty fast, their project spins this network up on Azure. However, the estimated monthly cost of the cloud resources is not attractive; over $300 per month. While it's true that we would not need to run the lab every day resulting in lower cost, I think we would want to run new tests fairly often, especially if multiple analysts are using it (and I already know the burn of forgetting an EC2 instance on for a week or two).
However, I've been tinkering with this for a few days now without success so far. I'm running into bugs and also am simply uncertain whether this is even viable. For example, I don't know if the Windows images offered for Docker will support the commands run by the PowerShell testing suite we have in mind for simulating threats, Invoke-AtomicRedTeam. Theoretically, everything should work fine. I'm also curious if someone else has already done this and published setup scripts or anything to help.
However, I've been tinkering with this for a few days now without success so far. I'm running into bugs and also am simply uncertain whether this is even viable. For example, I don't know if the Windows images offered for Docker will support the commands run by the PowerShell testing suite we have in mind for simulating threats, Invoke-AtomicRedTeam. Theoretically, everything should work fine. I'm also curious if someone else has already done this and published setup scripts or anything to help.