Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Red Team's SIEM

github.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Red Team's SIEM

#21

Post by oblio »

Kiro wrote: post #20
oblio wrote: post #6

Earlier quoted context omitted.

I did the searching you mention, and I found the info you mention. But the link sucks on its own, for it to the #1 on HN, in my opinion. The page is written with the philosophy: if you don't know what all these terms are, you don't belong here. Which is fine for a random Github repo. I'd be curious to know about HN's sorting algorithms, this topic seems such a niche thing that I'm amazed this page reached #1...

I personally believe it's natural to know what these things are when you're browsing a site called "Hacker News".

Yes, of course, because our brain capacities are infinite, as is our time :)

On top of that "hacker" doesn't come from the popular term, it comes from: http://catb.org/jargon/html/introduction.html

Re: Red Team's SIEM

#22

Post by neatcoder »

rsanheim wrote: post #11
coldtea wrote: post #8

Earlier quoted context omitted.

> The page is written with the philosophy: if you don't know what all these terms are, you don't belong here. Which is fine for a random Github repo. It's also fine for a page meant for a specific audience. It's not like they want to attract random developers working outside security. Whenever someone says something akin to "Hey that project's page didn't explain/market their offering well enough for me!", an obvious…

I actually assumed it was from the GitHub blog from the front page link, so assumed it was from former colleagues / friends (I worked at GH, and know many of the fine people there). Then I realized it was just a random GH repo and some sort of security tools software. And even then, was full of its own jargon -- blue team / red team / white team. So I could only ask wtf is this even doing here. Like how does this par…

HN often contains very specialized articles that would not make much sense to people not involved in the technology. That doesn't prevent such articles from being upvoted. There are enough specialists within various domains in HN to be interested in such articles. This is not a typical generalist-software-developer-only forum.

Re: Red Team's SIEM

#23

Post by twunde »

swalsh wrote: post #18

Am I alone in seeing a trend of Corporations really tooling up their security? I realize that in the age of digital transformation, securing your digital infrastructure is critical. And you have to do it, or your business is at a serious risk... but it keeps getting bigger, additionally so much of security is also physical. I guess my concern is if you combine this with the longer term trend of the dominance of corpo…

Companies are absolutely increasing their investment in security. You're seeing a response to the number of large security breaches over the last few years, and the increase in compliance requirements such as GDPR. More companies have adopted compliance programs, which means that their vendors need a compliance program. If you talk to anyone in enterprise sales, you'll hear that more people ask for their SOC2 and other compliance docs.

Re: Red Team's SIEM

#24

Post by freehunter »

rsanheim wrote: post #11
coldtea wrote: post #8

Earlier quoted context omitted.

> The page is written with the philosophy: if you don't know what all these terms are, you don't belong here. Which is fine for a random Github repo. It's also fine for a page meant for a specific audience. It's not like they want to attract random developers working outside security. Whenever someone says something akin to "Hey that project's page didn't explain/market their offering well enough for me!", an obvious…

I actually assumed it was from the GitHub blog from the front page link, so assumed it was from former colleagues / friends (I worked at GH, and know many of the fine people there). Then I realized it was just a random GH repo and some sort of security tools software. And even then, was full of its own jargon -- blue team / red team / white team. So I could only ask wtf is this even doing here. Like how does this par…

I work in information security and do you know the number of articles I see here on a daily basis that have their own jargon and doesn't help my life I wonder WTF is this doing here? This is a big forum with lots of people who do lots of things. This isn't "Rsanheim News", not everything needs to be custom tailored to your desires.

Since you work in the tech industry, you should be aware that Google exists and you can very quickly find out what a SIEM is (if you don't do log management you should look into it) and what a red team is (if you don't do security audits you should look into it) and hey, now you know what the subject is.

Re: Red Team's SIEM

#25

Post by freehunter »

raesene9 wrote: post #9

It's interesting to see the development of Red team tooling over the last couple of years. It's obviously necessary for red teamers to continue to advance to be able to cope with improving Blue team technology. However Red Team tech. is, by it's nature, dual-use. It's equally useful for "real" attackers to have these capabilities as it is for people emulating real attackers. The nature of open source makes these capa…

As someone who has spent their entire life on the blue team, I've used some of these red team tools to assess my effectiveness. I can remember using Metasploit to make as much noise as possible to test my team's responsiveness to our SIEM going crazy with alerts. We've used Burp and similar tools to perform security audits of the company's custom code, and audits of software we're doing a PoC with to ensure quality.

I've never once worried that the tools I'm using would end up in the hands of more sophisticated hackers. If anything, I'm glad for the basic red team tools because it makes script kiddies easier to find. They're not going to do custom exploits anymore when Metasploit exists. On the other side, it's almost always a safe bet that the actual bad guys are going to skip the off-the-shelf tools...

... assuming, of course, you have a decent enough security posture as-is. If script kiddies and ransomware and Zeus can get into your network unnoticed, you've got a much larger problem on your hands. Unfortunately, most companies still fall into this category because even companies that spend tens of millions of dollars on security don't take basic security seriously.

Re: Red Team's SIEM

#26

Post by freehunter »

swalsh wrote: post #18

Am I alone in seeing a trend of Corporations really tooling up their security? I realize that in the age of digital transformation, securing your digital infrastructure is critical. And you have to do it, or your business is at a serious risk... but it keeps getting bigger, additionally so much of security is also physical. I guess my concern is if you combine this with the longer term trend of the dominance of corpo…

I've spent a decade in information security and I've been working as a consultant from a security vendor for the past few years, and yeah there's been a big outpouring of cash for security. Unfortunately it's almost never spent right and most of it goes to waste. So you don't need to worry about a corporation having a standing army when it comes to information security, because that army doesn't have guns and isn't allowed to engage the enemy. An army, yes, but they're defending the Maginot Line [1]

I have a customer whose SIEM generates several hundred high severity alerts every month, and they've told me that those alerts are 90% accurate and it's a real actual high severity security incident on every true positive. We've tried to get them to put controls in place to prevent the activity rather than merely responding to the incident after it was detected, but doing so would cause a workflow change for some business units, and they can't do that. All they can do is detect and respond, not prevent. To compensate, they hired more security analysts to respond faster, and bought more tools to detect quicker... but they're still just responding after the fact. The security incident already happened. Millions of dollars per year wasted. And this isn't uncommon.

[1] https://en.wikipedia.org/wiki/Maginot_Line

Re: Red Team's SIEM

#27

Post by [deleted] »

raesene9 wrote: post #9

It's interesting to see the development of Red team tooling over the last couple of years. It's obviously necessary for red teamers to continue to advance to be able to cope with improving Blue team technology. However Red Team tech. is, by it's nature, dual-use. It's equally useful for "real" attackers to have these capabilities as it is for people emulating real attackers. The nature of open source makes these capa…

[deleted]

Re: Red Team's SIEM

#28

Post by raesene9 »

freehunter wrote: post #25
raesene9 wrote: post #9

It's interesting to see the development of Red team tooling over the last couple of years. It's obviously necessary for red teamers to continue to advance to be able to cope with improving Blue team technology. However Red Team tech. is, by it's nature, dual-use. It's equally useful for "real" attackers to have these capabilities as it is for people emulating real attackers. The nature of open source makes these capa…

As someone who has spent their entire life on the blue team, I've used some of these red team tools to assess my effectiveness. I can remember using Metasploit to make as much noise as possible to test my team's responsiveness to our SIEM going crazy with alerts. We've used Burp and similar tools to perform security audits of the company's custom code, and audits of software we're doing a PoC with to ensure quality.…

So as a Blue teamer your perspective makes sense, as presumably you only work in organizations who can afford dedicated blue teams :)

Where I think most of the re/mis-use of red team tools would be effective is in the many organizations who are not yet mature enough to staff a dedicated blue team capability...

Re: Red Team's SIEM

#29

Post by rsanheim »

freehunter wrote: post #24
rsanheim wrote: post #11

Earlier quoted context omitted.

I actually assumed it was from the GitHub blog from the front page link, so assumed it was from former colleagues / friends (I worked at GH, and know many of the fine people there). Then I realized it was just a random GH repo and some sort of security tools software. And even then, was full of its own jargon -- blue team / red team / white team. So I could only ask wtf is this even doing here. Like how does this par…

I work in information security and do you know the number of articles I see here on a daily basis that have their own jargon and doesn't help my life I wonder WTF is this doing here? This is a big forum with lots of people who do lots of things. This isn't "Rsanheim News", not everything needs to be custom tailored to your desires. Since you work in the tech industry, you should be aware that Google exists and you ca…

"rsanheim news" is all lowercase, btw
Post reply on HN