The widespread adoption of cloud computing helps companies scale their businesses. However, utilizing new platforms also brings about new threats. Supporting an internal team responsible for monitoring the security of cloud services is no simple task. Existing monitoring tools are expensive and slow. In some respects, they are difficult to manage when ensuring the security of large-scale cloud infrastructure. To maintain high levels of cloud security, companies need powerful, flexible, and user-friendly tools that exceed what was previously available. This is where open-source technologies come in handy, helping to save security budgets and developed by experts who truly understand their field.
In the article we are publishing today, we provide an overview of 7 open-source tools for monitoring cloud security. These tools are designed to protect against hackers and cybercriminals by detecting anomalies and unsafe actions.
1. Osquery
is a system for low-level monitoring and analysis of operating systems that allows security professionals to conduct complex data investigations using SQL. The Osquery framework can run on Linux, macOS, Windows, and FreeBSD. It represents the operating system (OS) as a high-performance relational database. This enables security experts to examine the OS by executing SQL queries. For instance, queries can provide insights into running processes, loaded kernel modules, open network connections, installed browser extensions, hardware events, and file hash sums.
The Osquery framework was created by Facebook. Its code was opened in 2014, after the company realized that the tools for observing low-level mechanisms of operating systems were needed not just by themselves but also by others. Since then, Osquery has been utilized by specialists from companies like Dactiv, Google, Kolide, Trail of Bits, Uptycs, and many more. Recently, it was that the Linux Foundation and Facebook are planning to form a fund to support Osquery.
The Osquery host monitoring daemon, called osqueryd, allows for scheduling query executions aimed at gathering data across the organization’s entire infrastructure. The daemon collects the results of the queries and creates logs that reflect changes in the infrastructure state. This can help security professionals stay informed about the system's condition and is particularly useful for identifying anomalies. Osquery’s log aggregation capabilities can be used to facilitate the detection of both known and unknown malware, as well as to identify entry points used by attackers and find any software they have installed. material that provides details on anomaly detection using Osquery.
2. GoAudit
System consists of two main components. The first is some kernel-level code designed to intercept and monitor system calls. The second component is a daemon that runs in user space, called . It is responsible for writing audit results to disk. , a system developed by and released in 2016, is designed to replace auditd. It offers enhanced logging capabilities by converting multi-line event messages generated by the Linux audit system into unified JSON BLOB objects, which simplifies analysis. With GoAudit, you can directly access kernel-level mechanisms over the network. Additionally, minimal event filtering can be enabled on the host itself (or filtering can be completely disabled). Notably, GoAudit is a project intended not just for security. This tool is designed as a multifunctional resource for system support or development professionals. It aids in addressing issues in large-scale infrastructures.
The GoAudit system is written in Golang. It is a type-safe and high-performance language. Before installing GoAudit, ensure that the version of Golang you have is greater than 1.7.
3. Grapl
Project (Graph Analytics Platform) was transitioned to open-source in March of last year. It is a relatively new platform for detecting security issues, conducting computer forensic analysis, and generating incident reports. Attackers often operate using something like a graph model, gaining control over a specific system and exploring other network systems starting from that system. Therefore, it is quite natural that system defenders will also utilize a mechanism based on a graph model of interconnections between network systems, taking into account the characteristics of relationships between systems. Grapl demonstrates an attempt to implement incident detection and response measures based on a graph model rather than a log model.
The Grapl tool takes security-related logs (Sysmon logs or logs in standard JSON format) and converts them into subgraphs (defining 'identifying information' for each node). It then merges the subgraphs into a master graph, which represents the actions taken in the analyzed environments. Subsequently, Grapl runs analyzers on the resulting graph using 'attacker signatures' to identify anomalies and suspicious patterns. When an analyzer detects a suspicious subgraph, Grapl generates an Engagement construct designed for investigations. Engagement is a Python class that can be loaded, for example, in a Jupyter Notebook deployed in an AWS environment. Additionally, Grapl is capable of scaling information gathering for incident investigation through graph expansion.
If you want to learn more about Grapl, you can watch an interesting video — a recording of the talk from BSides Las Vegas 2019.
4. OSSEC
is a project founded in 2004. This project can generally be described as an open-source security monitoring platform designed for host analysis and intrusion detection. OSSEC is downloaded over 500,000 times a year. This platform is primarily used as an intrusion detection tool for servers. It applies to both local and cloud systems. Additionally, OSSEC is often used as a tool for log analysis and research on firewalls, intrusion detection systems, web servers, and authentication logs.
OSSEC combines host-based intrusion detection system (HIDS) capabilities with security incident management (SIM) and security information and event management (SIEM) systems. OSSEC can also perform real-time file integrity monitoring, such as monitoring the Windows registry and detecting rootkits. OSSEC is capable of notifying relevant parties about detected issues in real-time and helps respond promptly to identified threats. This platform supports Microsoft Windows and most modern Unix-like systems, including Linux, FreeBSD, OpenBSD, and Solaris.
The OSSEC platform consists of a central manager entity, which is used to receive and monitor information from agents (small programs installed on the systems that need to be monitored). The manager is installed on a Linux system, which stores a database used for file integrity checks. It also stores logs and records of events and audit results.
The OSSEC project is currently supported by Atomicorp. The company manages the free open-source version and also offers commercial version of the product. a podcast in which the OSSEC project manager discusses the latest version of the system — OSSEC 3.0. It also covers the history of the project and how it differs from modern commercial systems used in the field of cybersecurity.
5. Suricata
— is an open-source project focused on addressing key tasks in computer security. In particular, it includes an intrusion detection system, an intrusion prevention system, and a tool for monitoring network security.
This product was launched in 2009. Its operation is based on rules. This means that users have the ability to describe certain characteristics of network traffic. When a rule is triggered, Suricata generates a notification, blocking or terminating suspicious connections, which again depends on the defined rules. Additionally, the project supports multi-threaded operation. This allows for fast processing of a large number of rules in networks with high traffic volumes. With multi-threading support, a standard server can effectively analyze traffic at speeds of 10 Gbit/s. This means the administrator doesn’t have to restrict the set of rules used for traffic analysis. Suricata also supports file hashing and extraction.
Suricata can be configured to run on standard servers or virtual machines, for example, in AWS, using a newly introduced feature in the product. .
The project supports Lua scripts, which allow for the creation of complex and detailed threat signature analysis logic.
The Suricata project is managed by the Open Information Security Foundation (OISF).
6. Zeek (Bro)
Like Suricata, (this project was previously called Bro and was renamed to Zeek at the BroCon 2018 event) — is also an intrusion detection system and a tool for monitoring network security, which can identify anomalies such as suspicious or dangerous activities. Zeek differs from traditional IDS in that, unlike rule-based systems that detect exceptions, Zeek also captures metadata related to network activities. This is done to better understand the context of unusual network behavior. For instance, by analyzing an HTTP call or a secure certificate exchange procedure, one can look into the protocol, the packet headers, and the domain names.
When considering Zeek as a network security tool, it can be said that it provides specialists the ability to investigate incidents by understanding what occurred before or during the incident. In addition, Zeek converts network traffic data into high-level events and allows interaction with a script interpreter. This interpreter supports the programming language used to manage event interactions and to clarify what those events mean in terms of network security. The Zeek programming language can be used to customize the interpretation of metadata as required by a specific organization. It allows for the construction of complex logical conditions using AND, OR, and NOT operators. This provides users the chance to customize the analysis procedures of their environments. However, it should be noted that compared to Suricata, Zeek may appear to be a rather complex tool for conducting security threat reconnaissance.
If you are interested in details about Zeek, please refer to the video.
7. Panther
is a powerful, originally cloud-focused platform for continuous security monitoring. It was recently made open source. The project was founded by the lead architect — a solution for automated log analysis, the code for which was opened by Airbnb. Panther provides the user with a unified system for centralized threat detection across all environments and for orchestrating responses. This system is capable of scaling with the size of the infrastructure it serves. Threat detection is organized using transparent deterministic rules, designed to reduce the rate of false positives and lessen the unnecessary burden on security specialists.
Among the key features of Panther are the following:
- Detection of unauthorized access to resources through log analysis.
- Threat hunting implemented through searching log metrics that indicate security issues. The search is conducted using standardized data fields from Panther.
- Compliance system check for SOC/PCI/HIPAA standards using Panther mechanisms.
- Protecting cloud resources through automatic error correction in configurations that, if exploited by attackers, can lead to serious issues.
Panther is deployed in the organization's AWS cloud using AWS CloudFormation. This allows users to maintain control over their data.
Summary
Security monitoring of systems is a crucial task today. Open source tools that provide numerous capabilities and are either low-cost or free can assist companies of any size in addressing this challenge.
Dear readers! What security monitoring tools do you use?
Source: habr.com
