{"id":71862,"date":"2020-02-28T21:00:12","date_gmt":"2020-02-28T18:00:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/7-opensorsnyh-instrumentov-dlya-monitoringa-bezopasnosti-oblachnyh-sistem-o-kotoryh-stoit-znat"},"modified":"2020-03-03T16:14:10","modified_gmt":"2020-03-03T13:14:10","slug":"7-opensorsnyh-instrumentov-dlya-monitoringa-bezopasnosti-oblachnyh-sistem-o-kotoryh-stoit-znat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/7-opensorsnyh-instrumentov-dlya-monitoringa-bezopasnosti-oblachnyh-sistem-o-kotoryh-stoit-znat","title":{"rendered":"7 mjeteve t\u00eb hapura p\u00ebr monitorimin e siguris\u00eb s\u00eb sistemeve t\u00eb cloud-it, p\u00ebr t\u00eb cilat duhen ditur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebrhapja e gjer\u00eb e llogaritjes n\u00eb re ndihmon kompanit\u00eb n\u00eb zgjerimin e biznesit. Por p\u00ebrdorimi i platformave t\u00eb reja do t\u00eb thot\u00eb edhe shfaqjen e k\u00ebrc\u00ebnimeve t\u00eb reja. Mb\u00ebshtetja brenda organizat\u00ebs nga nj\u00eb ekip i vet\u00ebkuptuesh\u00ebm p\u00ebr monitorimin e siguris\u00eb s\u00eb sh\u00ebrbimeve t\u00eb reja \u00ebsht\u00eb nj\u00eb detyr\u00eb e v\u00ebshtir\u00eb. Mjetet ekzistuese t\u00eb monitorimit jan\u00eb t\u00eb shtrenjta dhe t\u00eb ngadalta. Ato, n\u00eb nj\u00eb far\u00eb mase, jan\u00eb t\u00eb v\u00ebshtira p\u00ebr t'u menaxhuar kur nevojitet sigurimi i siguris\u00eb s\u00eb nj\u00eb infrastrukture t\u00eb madhe n\u00eb re. Kompanit\u00eb, p\u00ebr ta mbajtur sigurin\u00eb e tyre n\u00eb re n\u00eb nj\u00eb nivel t\u00eb lart\u00eb, kan\u00eb nevoj\u00eb p\u00ebr mjete t\u00eb fuqishme, fleksib\u00ebl dhe t\u00eb qarta, mund\u00ebsit\u00eb e t\u00eb cilave e tejkalojn\u00eb at\u00eb q\u00eb ka qen\u00eb e disponueshme m\u00eb par\u00eb. Pik\u00ebrisht k\u00ebtu ndihmojn\u00eb teknologjit\u00eb open-source, t\u00eb cilat ndihmojn\u00eb n\u00eb kursimin e buxhetit p\u00ebr sigurin\u00eb dhe krijohen nga specialist\u00eb q\u00eb din\u00eb pun\u00ebn e tyre.<\/p>\n

\"7<\/a><\/noindex><\/p>\n

N\u00eb artikullin, p\u00ebrkthimi i t\u00eb cilit po e publikojm\u00eb sot, paraqitet nj\u00eb p\u00ebrmbledhje e 7 mjeteve open-source p\u00ebr monitorimin e siguris\u00eb s\u00eb sistemeve n\u00eb re. K\u00ebto mjete jan\u00eb projektuar p\u00ebr t\u00eb mbrojtur nga haker\u00ebt dhe kriminel\u00ebt kibernetik\u00eb p\u00ebrmes zbulimit t\u00eb anomali dhe veprimeve t\u00eb pasigurt.
\n<\/a><\/noindex><\/p>\n

1. Osquery<\/h2>\n

\nOsquery<\/a><\/noindex> \u00ebsht\u00eb nj\u00eb sistem p\u00ebr monitorimin dhe analizimin n\u00eb nivel t\u00eb ul\u00ebt t\u00eb sistemeve operative, i cili i lejon profesionist\u00ebt e siguris\u00eb t\u00eb kryejn\u00eb hetime t\u00eb komplikuara t\u00eb t\u00eb dh\u00ebnave duke p\u00ebrdorur SQL. Framework-u Osquery mund t\u00eb funksionoj\u00eb n\u00eb Linux, macOS, Windows dhe FreeBSD. Ai paraqet sistemin operativ (OS) si nj\u00eb baz\u00eb t\u00eb dh\u00ebnash relacional t\u00eb lart\u00eb. Kjo i lejon profesionist\u00ebt e siguris\u00eb t\u00eb eksplorojn\u00eb OS duke ekzekutuar pyetje SQL. P\u00ebr shembull, p\u00ebrmes nj\u00eb pyetjeje mund t\u00eb m\u00ebsohet p\u00ebr proceset q\u00eb jan\u00eb n\u00eb ekzekutim, p\u00ebr modul\u00ebt q\u00eb jan\u00eb ngarkuar n\u00eb kernel, p\u00ebr lidhjet rrjet, p\u00ebr zgjerimet e instaluara t\u00eb shfletuesit, p\u00ebr ngjarjet harduerike, p\u00ebr hash-t\u00eb e skedar\u00ebve.<\/p>\n

Frameworku Osquery \u00ebsht\u00eb krijuar nga Facebook. Kodi i tij u hap n\u00eb vitin 2014, pasi kompania e kuptoi se mjeteve p\u00ebr monitorimin e mekanizmave t\u00eb operacioneve t\u00eb ul\u00ebta nuk u nevojitej vet\u00ebm asaj. Q\u00eb nga at\u00ebher\u00eb, Osquery p\u00ebrdoret nga specialist\u00eb nga kompani si Dactiv, Google, Kolide, Trail of Bits, Uptycs dhe shum\u00eb t\u00eb tjera. S\u00eb fundmi, ka pasur u shpall<\/a><\/noindex> informacione se The Linux Foundation dhe Facebook po planifikojn\u00eb t\u00eb formojn\u00eb nj\u00eb fond p\u00ebr mb\u00ebshtetje t\u00eb Osquery.<\/p>\n

Demonu i monitorimit t\u00eb hosteve Osquery, i quajtur osqueryd, lejon planifikimin e ekzekutimit t\u00eb pyetjeve t\u00eb drejtuara p\u00ebr t\u00eb mbledhur t\u00eb dh\u00ebna nga e gjith\u00eb infrastruktura e organizat\u00ebs. Demoni mbledh rezultatet e pyetjeve dhe krijon logje q\u00eb reflektojn\u00eb ndryshimin e gjendjes s\u00eb infrastruktur\u00ebs. Kjo mund t\u00eb ndihmoj\u00eb specialist\u00ebt e siguris\u00eb t\u00eb jen\u00eb n\u00eb dijeni t\u00eb situat\u00ebs n\u00eb sistem dhe \u00ebsht\u00eb ve\u00e7an\u00ebrisht e dobishme p\u00ebr identifikimin e anomali. Mund\u00ebsit\u00eb e Osquery p\u00ebr agregimin e logjeve mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb leht\u00ebsuar k\u00ebrkimin e programeve t\u00eb njohura dhe t\u00eb panjohura keqdash\u00ebse, si dhe p\u00ebr t\u00eb identifikuar vendet e dep\u00ebrtimit t\u00eb sulmuesve n\u00eb sistem dhe p\u00ebr t\u00eb gjetur programet q\u00eb ata kan\u00eb vendosur. Ja<\/a><\/noindex> materiali n\u00eb t\u00eb cilin mund t\u00eb gjeni detaje mbi zbardhjen e anomalis\u00eb me ndihm\u00ebn e Osquery.<\/p>\n

2. GoAudit<\/h2>\n

\nSistemi auditimi i Linuxit<\/a><\/noindex> consiston n\u00eb dy komponent\u00eb kryesor\u00eb. E para \u00ebsht\u00eb nj\u00eb kod i nivelit t\u00eb b\u00ebrtham\u00ebs, i destinuar p\u00ebr t\u00eb kapur dhe monitoruar thirrjet n\u00eb sistem. Komponenti i dyt\u00eb \u00ebsht\u00eb nj\u00eb demon q\u00eb punon n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit, i quajtur auditd<\/a><\/noindex>. Ai \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr regjistrimin n\u00eb disk t\u00eb rezultateve t\u00eb auditimit. GoAudit<\/a><\/noindex>, nj\u00eb sistem i krijuar nga Slack<\/a><\/noindex> dhe l\u00ebshuar n\u00eb vitin 2016, \u00ebsht\u00eb krijuar p\u00ebr t\u00eb z\u00ebvend\u00ebsuar auditd. Ai ka mund\u00ebsi t\u00eb p\u00ebrmir\u00ebsuara logimi fale faktit se konverton mesazhet shum\u00eb rreshtore t\u00eb ngjarjeve t\u00eb gjeneruara nga sistemi i auditimit t\u00eb Linuxit n\u00eb objekte JSON t\u00eb vetme BLOB, duke e b\u00ebr\u00eb analiz\u00ebn m\u00eb t\u00eb leht\u00eb. N\u00ebp\u00ebrmjet GoAudit \u00ebsht\u00eb e mundur t\u00eb aksesoni drejtp\u00ebrdrejt mekanizmat e nivelit t\u00eb b\u00ebrtham\u00ebs p\u00ebrmes rrjetit. P\u00ebr m\u00eb tep\u00ebr, \u00ebsht\u00eb e mundur t\u00eb aktivizoni filtrimin minimal t\u00eb ngjarjeve n\u00eb vet\u00eb hostin (ose ta \u00e7aktivizoni plot\u00ebsisht filtrimin). N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, GoAudit \u00ebsht\u00eb nj\u00eb projekt i konceptuar jo vet\u00ebm p\u00ebr t\u00eb siguruar sigurin\u00eb. Ky instrument \u00ebsht\u00eb menduar si nj\u00eb mjet shum\u00ebfunksional p\u00ebr specialist\u00ebt q\u00eb merren me mir\u00ebmbajtjen e sistemeve ose zhvillimin. Ai ndihmon n\u00eb luftimin e problemeve n\u00eb infrastrukturat me shkall\u00eb t\u00eb gjer\u00eb.<\/p>\n

Sistemi GoAudit \u00ebsht\u00eb shkruar n\u00eb Golang. Ky \u00ebsht\u00eb nj\u00eb gjuh\u00eb e tipit t\u00eb sigurt dhe me performanc\u00eb t\u00eb lart\u00eb. Para se t\u00eb instaloni GoAudit, kontrolloni q\u00eb versioni juaj ekzistues i Golang t\u00eb jet\u00eb m\u00eb i lart\u00eb se 1.7.<\/p>\n

3. Grapl<\/h2>\n

\nProjekti Grapl<\/a><\/noindex> (Graph Analytics Platform) u shpall me burim t\u00eb hapur n\u00eb mars t\u00eb vitit t\u00eb kaluar. Kjo \u00ebsht\u00eb nj\u00eb platform\u00eb e re p\u00ebr zbules\u00ebn e problemeve me sigurin\u00eb, p\u00ebr kryerjen e ekspertizave kriminalistike dhe p\u00ebr formimin e raporteve mbi incidentet. Sulmuesit shpesh punojn\u00eb duke p\u00ebrdorur di\u00e7ka si nj\u00eb model grafi, duke fituar kontroll mbi nj\u00eb sistem t\u00eb ve\u00e7ant\u00eb dhe duke eksploruar sisteme t\u00eb tjera rrjetesh duke filluar nga ky sistem. Prandaj, \u00ebsht\u00eb krejt\u00ebsisht e natyrshme q\u00eb mbrojt\u00ebsit e sistemeve gjithashtu do t\u00eb p\u00ebrdorin nj\u00eb mekaniz\u00ebm t\u00eb bazuar n\u00eb nj\u00eb model grafi t\u00eb lidhjeve t\u00eb sistemeve rrjetore, duke marr\u00eb parasysh ve\u00e7orit\u00eb e marr\u00ebdh\u00ebnieve midis sistemeve. Grapl tregon p\u00ebrpjekjen p\u00ebr t\u00eb aplikuar masa p\u00ebr zbules\u00ebn e incidenteve dhe p\u00ebr reagimin ndaj tyre, duke u bazuar n\u00eb modelin graf, e jo n\u00eb modelin e log-ut.<\/p>\n

K\u00ebi\u0308 instrument Grapl merr log-e q\u00eb kan\u00eb t\u00eb b\u00ebjn\u00eb me sigurin\u00eb (log-e Sysmon ose log-e n\u00eb formatin standard JSON) dhe i kthen ato n\u00eb n\u00ebngraf\u00eb (duke identifikuar \"informacionin identifikues\" p\u00ebr \u00e7do nyje). Pas k\u00ebsaj, ai e bashkon n\u00ebngraf\u00ebt n\u00eb nj\u00eb graf t\u00eb p\u00ebrgjithsh\u00ebm (Master Graph), i cili p\u00ebrfaq\u00ebson veprimet e kryera n\u00eb mjediset e analizuar. Pastaj Grapl aktivizon analizator\u00ebt (Analyzers) n\u00eb grafin e marr\u00eb duke p\u00ebrdorur \"shkall\u00ebt e sulmuesit\" p\u00ebr t\u00eb zbuluar anomalit\u00eb dhe modelet e dyshimta. Kur analizatori zbulon nj\u00eb n\u00ebngraf t\u00eb dyshimt\u00eb, Grapl gjeneron konstruktin Engagement, i cili \u00ebsht\u00eb i destinuar p\u00ebr kryerjen e hetimeve. Engagement \u00ebsht\u00eb nj\u00eb klas\u00eb Python q\u00eb mund t\u00eb ngarkohet, p\u00ebr shembull, n\u00eb Jupyter Notebook, t\u00eb vendosur n\u00eb mjedisin AWS. P\u00ebr m\u00eb tep\u00ebr, Grapl \u00ebsht\u00eb n\u00eb gjendje t\u00eb rris\u00eb mas\u00ebn e informacionit p\u00ebr hetimin e incidentit p\u00ebrmes zgjerimit t\u00eb grafit.<\/p>\n

N\u00ebse d\u00ebshironi t\u00eb kuptoni m\u00eb mir\u00eb Grapl \u2014 mund t\u00eb shikoni kjo<\/a><\/noindex> nj\u00eb video interesante \u2014 nj\u00eb regjistrim i prezantimit n\u00eb BSides Las Vegas 2019.<\/p>\n

4. OSSEC<\/h2>\n

\nOSSEC<\/a><\/noindex> \u2014 \u00ebsht\u00eb nj\u00eb projekt i themeluar n\u00eb vitin 2004. Ky projekt, n\u00eb p\u00ebrgjith\u00ebsi, mund t\u00eb p\u00ebrshkruhet si nj\u00eb platform\u00eb e hapur p\u00ebr monitorimin e siguris\u00eb, e cila synon analizimin e hosteve dhe zbulimin e sulmeve. N\u00eb vit, OSSEC shkarkohet m\u00eb shum\u00eb se 500,000 her\u00eb. Kjo platform\u00eb p\u00ebrdoret kryesisht si nj\u00eb mjet p\u00ebr zbulimin e sulmeve n\u00eb server\u00eb. Po ashtu, p\u00ebrfshin edhe sisteme lokale e t\u00eb bazuara n\u00eb re. OSSEC, p\u00ebrve\u00e7 k\u00ebsaj, shpesh p\u00ebrdoret si nj\u00eb mjet p\u00ebr hulumtimin e regjistrave t\u00eb monitorimit dhe analizimin e firewall-eve, sistemeve t\u00eb zbulimit t\u00eb sulmeve, server\u00ebve t\u00eb internetit, si dhe p\u00ebr t\u00eb studiuar regjistrat e autentifikimit.<\/p>\n

OSSEC kombinon mund\u00ebsit\u00eb e sistemit t\u00eb zbulimit t\u00eb sulmeve n\u00eb host (HIDS, Host-Based Intrusion Detection System) me sistemin e menaxhimit t\u00eb incidenteve n\u00eb fush\u00ebn e siguris\u00eb (SIM, Security Incident Management) dhe me sistemin e menaxhimit t\u00eb informacionit n\u00eb lidhje me sigurin\u00eb dhe ngjarjet e siguris\u00eb (SIEM, Security Information and Event Management). OSSEC, p\u00ebr m\u00eb tep\u00ebr, mund t\u00eb kryej\u00eb monitorimin e integritetit t\u00eb skedar\u00ebve n\u00eb koh\u00eb reale. Kjo p\u00ebrfshin, p\u00ebr shembull, monitorimin e regjistrit Windows, zbulimin e rootkit-eve. OSSEC mund t\u00eb informoj\u00eb pal\u00ebt e interesuara p\u00ebr problemet e zbuluara n\u00eb koh\u00eb reale dhe ndihmon n\u00eb reagimin e menj\u00ebhersh\u00ebm ndaj k\u00ebrc\u00ebnimeve t\u00eb gjetura. Kjo platform\u00eb mb\u00ebshtet Microsoft Windows dhe shumic\u00ebn e sistemeve Unix-like moderne, duke p\u00ebrfshir\u00eb Linux, FreeBSD, OpenBSD dhe Solaris.<\/p>\n

Platforma OSSEC p\u00ebrb\u00ebhet nga nj\u00eb entitet qendror administrativ, menaxheri, i p\u00ebrdorur p\u00ebr marrjen dhe monitorimin e informacionit nga agjent\u00ebt (programet e vogla t\u00eb instaluara n\u00eb sistemet q\u00eb duhet t\u00eb monitorohen). Menaxheri instalohet n\u00eb nj\u00eb sistem Linux, i cili ruan nj\u00eb baz\u00eb t\u00eb dh\u00ebnash, e cila p\u00ebrdoret p\u00ebr verifikimin e integritetit t\u00eb skedar\u00ebve. Ai, p\u00ebrve\u00e7 k\u00ebsaj, ruan regjistrat dhe sh\u00ebnimet p\u00ebr ngjarjet dhe rezultatet e auditimit t\u00eb sistemeve.<\/p>\n

Mb\u00ebshtetje p\u00ebr projektin OSSEC aktualisht ofrohet nga kompania Atomicorp. Kompania mbik\u00ebqyr versionin e saj falas dhe t\u00eb hapur, dhe gjithashtu ofron versionin e zgjeruar<\/a><\/noindex> tregtar t\u00eb produktit. Ja<\/a><\/noindex> podcast, n\u00eb t\u00eb cilin menaxheri i projektit OSSEC flet p\u00ebr versionin e ri t\u00eb sistemit \u2014 OSSEC 3.0. Aty p\u00ebrmendet historia e projektit dhe se si ndryshon nga sistemet tregtare moderne q\u00eb p\u00ebrdoren n\u00eb fush\u00ebn e siguris\u00eb kompjuterike.<\/p>\n

5. Suricata<\/h2>\n

\nSuricata<\/a><\/noindex> \u2014 \u00ebsht\u00eb nj\u00eb projekt me burim t\u00eb hapur, i orientuar p\u00ebr zgjidhjen e problemeve kryesore t\u00eb siguris\u00eb kompjuterike. N\u00eb ve\u00e7anti, ai p\u00ebrfshin nj\u00eb sistem p\u00ebr zbulimin e nd\u00ebrhyrjeve, nj\u00eb sistem p\u00ebr parandalimin e nd\u00ebrhyrjeve dhe nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb rrjetore.<\/p>\n

Ky produkt u shfaq n\u00eb vitin 2009. Funksionimi i tij bazohet n\u00eb rregulla. Kjo do t\u00eb thot\u00eb \u2013 ai q\u00eb e p\u00ebrdor ka mund\u00ebsin\u00eb t\u00eb p\u00ebrshkruaj\u00eb disa ve\u00e7ori t\u00eb trafikut rrjetor. N\u00ebse nj\u00eb rregull aktivizohet, at\u00ebher\u00eb Suricata gjeneron nj\u00eb njoftim, duke bllokuar ose nd\u00ebrprer\u00eb lidhjen e dyshimt\u00eb, q\u00eb, p\u00ebrs\u00ebri, varet nga rregullat e caktuara. Projekti gjithashtu mb\u00ebshtet funksionimin n\u00eb m\u00ebnyr\u00eb shum\u00ebfishe. Kjo i jep mund\u00ebsin\u00eb p\u00ebr p\u00ebrpunimin e shpejt\u00eb t\u00eb nj\u00eb numri t\u00eb madh rregullash n\u00eb rrjetet, p\u00ebr t\u00eb cilat kalon nj\u00eb sasi t\u00eb madhe trafiku. Fal\u00eb mb\u00ebshtetjes p\u00ebr shum\u00ebfishe, nj\u00eb server i zakonsh\u00ebm \u00ebsht\u00eb n\u00eb gjendje t\u00eb analizoj\u00eb me sukses trafikun q\u00eb kalon me shpejt\u00ebsi 10 Gbit\/s. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, administratorit nuk i duhet t\u00eb kufizoj\u00eb p\u00ebrzgjedhjen e rregullave t\u00eb p\u00ebrdorura p\u00ebr analizimin e trafikut. Suricata gjithashtu mb\u00ebshtet hashing dhe nxjerrjen e skedar\u00ebve.<\/p>\n

Suricata mund t\u00eb konfigurohet p\u00ebr t\u00eb punuar n\u00eb server\u00eb t\u00eb zakonsh\u00ebm ose n\u00eb makina virtuale, p\u00ebr shembull, n\u00eb AWS, duke p\u00ebrdorur mund\u00ebsin\u00eb e fundit t\u00eb paraqitur n\u00eb produkt. monitorimi-i-trafikut<\/a><\/noindex>.<\/p>\n

Projekti mb\u00ebshtet skriptet Lua, me an\u00eb t\u00eb cilave mund t\u00eb krijoni logjik\u00eb t\u00eb komplikuar dhe t\u00eb detajuar p\u00ebr analizimin e n\u00ebnshkrimeve t\u00eb k\u00ebrc\u00ebnimeve.<\/p>\n

Projekti Suricata merret me Open Information Security Foundation (OISF).<\/p>\n

6. Zeek (Bro)<\/h2>\n

\nSi Suricata, Zeek<\/a><\/noindex> (ky projekt m\u00eb par\u00eb quhej Bro dhe u riem\u00ebrua n\u00eb Zeek n\u00eb ngjarjen BroCon 2018) \u2014 \u00ebsht\u00eb gjithashtu nj\u00eb sistem p\u00ebr zbulimin e nd\u00ebrhyrjeve dhe nj\u00eb mjet p\u00ebr monitorimin e siguris\u00eb rrjetore, i cili mund t\u00eb identifikoj\u00eb anomalit\u00eb, t\u00eb tilla si aktivitete t\u00eb dyshimta ose t\u00eb rrezikshme. Zeek ndryshon nga IDS tradicionale n\u00eb at\u00eb q\u00eb, ndryshe nga sistemet e bazuara n\u00eb rregulla q\u00eb identifikojn\u00eb p\u00ebrjashtime, Zeek gjithashtu kap metadatat e lidhura me ngjarjet q\u00eb ndodhin n\u00eb rrjet. Kjo b\u00ebhet p\u00ebr t\u00eb kuptuar m\u00eb mir\u00eb kontekstin e sjelljes rrjetore t\u00eb pazakont\u00eb. Kjo lejon, p\u00ebr shembull, duke analizuar nj\u00eb thirrje HTTP ose nj\u00eb procedur\u00eb shk\u00ebmbimi t\u00eb certifikatave t\u00eb siguris\u00eb, t\u00eb shikoni protokollin, titujt e paketeve, emrat e domain-it.<\/p>\n

N\u00ebse e shqyrtojm\u00eb Zeek si nj\u00eb mjet t\u00eb siguris\u00eb n\u00eb rrjet, mund t\u00eb themi se ai i jep specialistit mund\u00ebsin\u00eb p\u00ebr t\u00eb kryer nj\u00eb hetim mbi incidentin, duke m\u00ebsuar se \u00e7far\u00eb ndodhi para ose gjat\u00eb incidentit. Zeek, p\u00ebrve\u00e7 k\u00ebsaj, konverton t\u00eb dh\u00ebnat mbi trafikun e rrjetit n\u00eb ngjarje t\u00eb nivelit t\u00eb lart\u00eb dhe ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb punuar me interpretuesin e skriptave. Interpretuesi mb\u00ebshtet gjuh\u00ebn e programimit q\u00eb p\u00ebrdoret p\u00ebr t\u00eb organizuar nd\u00ebrveprimin me ngjarjet dhe p\u00ebr t\u00eb zbuluar se \u00e7far\u00eb do t\u00eb thot\u00eb sakt\u00ebsisht k\u00ebto ngjarje n\u00eb planin e siguris\u00eb n\u00eb rrjet. Gjuha e programimit Zeek mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb konfiguruar interpretimin e metadata-ve sipas nevojave t\u00eb ve\u00e7anta t\u00eb organizat\u00ebs. Ajo lejon nd\u00ebrtimin e kushteve logjike komplekse, duke p\u00ebrdorur operator\u00ebt AND, OR dhe NOT. Kjo i jep p\u00ebrdoruesve mund\u00ebsin\u00eb p\u00ebr t\u00eb konfiguruar procedur\u00ebn e analiz\u00ebs s\u00eb mjedisit t\u00eb tyre. Megjithat\u00eb, duhet t\u00eb theksohet se, n\u00eb krahasim me Suricata, Zeek mund t\u00eb duket si nj\u00eb mjet mjaft i komplikuar p\u00ebr kryerjen e hetimeve mbi k\u00ebrc\u00ebnimet p\u00ebr sigurin\u00eb.<\/p>\n

N\u00ebse jeni t\u00eb interesuar p\u00ebr detaje mbi Zeek \u2014 kontaktoni k\u00ebt\u00eb<\/a><\/noindex> video.<\/p>\n

7. Panther<\/h2>\n

\nPanther<\/a><\/noindex> \u2014 \u00ebsht\u00eb nj\u00eb platform\u00eb e fuqishme, e orientuar fillimisht p\u00ebr pun\u00eb n\u00eb Cloud, p\u00ebr organizimin e monitorimit t\u00eb vazhduesh\u00ebm t\u00eb siguris\u00eb. Ajo u b\u00eb e hapur p\u00ebr burime s\u00eb fundmi. N\u00eb themel t\u00eb projektit q\u00ebndron arkitekti kryesor StreamAlert<\/a><\/noindex> \u2014 nj\u00eb zgjidhje p\u00ebr analiz\u00ebn automatizuar t\u00eb regjistrave, kodi i s\u00eb cil\u00ebs u hap nga kompania Airbnb. Panther i ofron p\u00ebrdoruesit nj\u00eb sistem t\u00eb vet\u00ebm p\u00ebr zbulimin e centralizuar t\u00eb k\u00ebrc\u00ebnimeve n\u00eb t\u00eb gjitha mjediset dhe p\u00ebr organizimin e reagimeve ndaj tyre. Ky sistem \u00ebsht\u00eb n\u00eb gjendje t\u00eb rritet paralelisht me madh\u00ebsin\u00eb e infrastruktur\u00ebs s\u00eb sh\u00ebrbyer. Zbulimi i k\u00ebrc\u00ebnimeve \u00ebsht\u00eb organizuar p\u00ebrmes rregullave transparente dhe deterministe, q\u00eb \u00ebsht\u00eb b\u00ebr\u00eb p\u00ebr t\u00eb ulur p\u00ebrqindjen e alarmave t\u00eb rreme dhe p\u00ebr t\u00eb zvog\u00ebluar nivelin e ngarkes\u00ebs s\u00eb panevojshme p\u00ebr specialist\u00ebt e siguris\u00eb.<\/p>\n

Disa nga funksionalitetet kryesore t\u00eb Panther duhet t\u00eb p\u00ebrmenden si m\u00eb posht\u00eb:<\/p>\n