Madhu Akula, Automation Ninja We can see attacks happening in real time using a dashboard. By collecting logs from various sources we will monitor & analyse. Using data gleaned from the logs, we can apply defensive rules against the attackers. We will use AWS for managing and securing the infrastructure discussed in our talk. For most network engineers who monitor the perimeter for malicious content, it is very important to respond to an imminent threat originating from outside the boundaries of their network. Having to crunch through all the logs that the various devices (firewalls, routers, security appliances etc.) spit out, correlating that data and in real time making the right choices can prove to be a nightmare. Even with the solutions already available in the market. As I have experienced this myself, as part of the Internal DevOps and Incident Response Teams, in several cases, I would want to create a space for interested folks to design, build, customise and deploy their very own FOSS based centralised visual attack monitoring dashboard. This setup would be able to perform real time analysis using the trusted ELK stack and visually denote what popular attack hotspots exist on a network.

1. Automated Infrastructure Security
Monitoring using FOSS
#AllDayDevOps
@madhuakula, Automation Ninja
Appsecco

2. About Me !
Automation Ninja at Appsecco
Appsecco is a specialist application security company
Interested in Security, DevOps & Cloud
Found bugs in Google, Microsoft, Yahoo, etc
Never ending learner!
Follow (or) Tweet to me @madhuakula
2

3. What we are covering today?
ELK stack to analyse and visualise logs in near real­time
ElastAlert to create rules to automatically defend against SSH
bruteforce attacks
AWS Lambda to do this, since our infra is hosted on AWS
Python based Chalice framework for using AWS Lambda
3

4. Architecture
4

5. Automated Defence Demo
Appsecco Automated Infrastructure Security Monitoring Demo (ELK + AWS Lambda)
http://bit.ly/addo­aism
5

6. AWS Lambda ­ Chalice Code
https://github.com/appsecco/alldaydevops­aism
6

7. Security for our AWS Lambda
We are primarily doing the following two things
1. A sufficiently random token to protect the request when we
post the IP address from ElastAlert
2. Whitelist the IP address of the host where the HTTP POST
request originates from
7

8. Use Cases for Automated Defence
1. Automated Defender (Attack Alerts + Automated Firewall)
2. Security Analytics + Reports
3. Near real­time Centralised Log Monitoring
8

9. Attack Scenario : Wordpress XML­RPC
https://blog.appsecco.com/analysing­attacks­on­a­wordpress­xml­rpc­using­an­
elk­stack­3bf25a7e36cc
9

10. Needs Improvement
More attack signatures required
For example OSSEC Wazuh Ruleset
Improve the ElastAlert Alerter custom code
Any suggestions from your side
10

11. Alternatives to our stack
Stack
Elastic
Graylog
TICK Stack
Prometheus + Grafana
Serverless
AWS Lambda
Azure Functions
Cloud Functions
11

12. Our assumptions
You are already monitoring in near real­time using the ELK
stack
You are under attack for a specific service
You have configured ElastAlert for your alerting
12

13. In Summary
We created attack threshold rules in ElastAlert
We created an AWS Lambda endpoint to be able to modify
AWS VPC Network ACLs
We have a real­time blocking system infinitely scalable
13

14. References
Blog Post
Elastic
Elast Alert
AWS Lambda
Chalice
14

17. Thanks
@madhuakula | @appseccouk | http://appsecco.com