Nope. Okay, I see there is a lot of misunderstanding. I changed my post (: ... View more

it will work if I have the same (duplicates) values, no? For example, I have 5 values that have similar context and I want them united as one: signature Jonh is eating Sara is eating Josh is eating Dog Cat  Should be like this: signature Human Animals  ... View more

Hi rich! It's different values, but they  have one common keyword. Also, there will be cases in future when I need to united different values without common keyword as one.   ... View more

Thanks for your Splunk search, I used it in my research! ... View more

Yes, I have noticed that I have a lot of events, and it forced me to ask a question on the forum 😄 No, we don't have such regulations. It's allowed in my country and in the company (in case, if there's a suspicion that a person is causing damage to the company, an evil insider). But, I'm talk about his activity on the corporate resources, not his privacy life. If a person starts to break a policy, we need to do an investigation and collect statistic data (his activity). It's the same if you use your RFID-card to open the doors and your data: when you opened door, when you came to the work - all of this is stored in DB. And in the event of an incident where you were involved, this database is being reviewed (your activity being reviewed). Or I'm talking about different cases and that's not what you meant by that? ... View more

Up! Bump! 🙂 ... View more

@doksu, yeap, I already saw your presentation and it was very useful for me, although I still can't make puzzle in my head about monitoring by Auditd. Logging all commands. I still don't understand even with your guide-video on youtube how to logging TTY. Your guides not working on my machine or I don't know what I'm doing wrong. For example, to have at least something logging from TTY l I need to run one more command: echo "session required pam_tty_audit.so enable=*" >> /etc/pam.d/system And after it i can logging all commands, but only by user root. Commands by another users I still can't logging. Watch a context of file. It's possible by auditd to parse context of file? I think it's important. For example, I made rules for changing such files as: /etc/passwd , /etc/shadow , /etc/crontab and auditd only can said me that something happen, but I can't see context of file to appreciate the whole picture. I can not assess the risks. Of course I can write scripts that will cover it ... View more

Later I did it, but it's not helped me. But, on onother machine with Ubuntu 16.04 it's works good. ... View more

@AndySplunks, thanks! :3 I will reviewed some of my old use cases. The main problem that I don't have any colleagues that are pro in Linux or had any CEH/OSCP cert. And it's hard for me to handle so much information in a solo. Ideally, I would have to study one thing to the ideal level, rather than focusing my attention on everything. Any security chats/forums it's only where I can get any people who works in InfoSec and can give me advice (what I am actively using) Also, it's my own list of some use cases: List of all log in attempts (either successful or not) Alert after X failed log in attempts List of all sudo commands executed, and the user who ran them Addition/removal of users to the system Activation/de-activation of services (e.g. A/V, IDS, firewall) Unauthorized access attempts to deactivated accounts/files/services Binaries with curvature rights to rais If running any NMAP on machine SSH, VPN on machines where it can't be installed Detecting short-lived files in /temp (noise/false-positive) Installing malware or non-upgraded software Recording yourself to any startup Change the settings of /etc/shadow, /etc/passwd, /etc/sudoers, including changing privileges for certain users Detect what drives, flash drives are connected to the host system (including rubber ducky) Monitoring browser extension ... View more

@doksu Great, thank you for answer! 🙂 @AndySplunks provided some use cases. What can you add to his list? About Mitre, when I having a free time I'm trying to do some cases from that list (while only offense part): https://attack.mitre.org/wiki/Linux_Technique_Matrix The first question, can auditd cover these use cases? And the second, how to monitor commands? Sudo commands - easy, but what about other? (many of there use cases seems that can be success monitoring if you can logging commands) Enable TTY logging by echo "session required pam_tty_audit.so enable=*" >> /etc/pam.d/password-auth-ac I used it only 4 times and only one time it was worked. And I really don't understand why I can't logging any key-strokes by it (was tested on CentOS7) ... View more

Alert Manager 2.2.2 Splunk 7.0.3 ... View more

It works! Thank you! Will be nice if you will explain a bit why it works, cause i have some triggers in my head. ... View more

It works, too! Explain me what you did. I mean: lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match ... View more