9_siem.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Security information and event management (SIEM) and Elastic (ELK) Stack lab</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
    # Introduction
    This lab provides a comprehensive overview of logging and security information and event management (SIEM) concepts, with an emphasis on the context of Linux systems. Logging is a critical aspect of system administration and security, enabling the monitoring of system events and providing valuable insights into system activities. The lab covers the fundamentals of logging, including the systemd journal and traditional syslog, and introduces the Elastic (ELK) Stack as a powerful SIEM solution. It also explores the usage of Auditbeat to monitor system audit information and highlights the role of a Security Operations Centre (SOC) in managing and responding to security incidents.

    In this lab, you will learn how to use various logging tools and commands, such as journalctl and syslog, to access and analyze system logs. You will gain practical experience in configuring logging rules, utilizing regular expressions to filter log data, and exploring log rotation for efficient log management. Additionally, you will set up Auditbeat to monitor system activities and visualize the collected data using Elastic Stack. By the end of the lab, you will have a strong foundation in log management, SIEM, and be well-equipped to enhance the security and monitoring capabilities of Linux systems.

    This is a Hackerbot lab. The labsheet is available once you claim a set of VMs. Work through the labsheet, then when prompted interact with Hackerbot.
  </description>
  <lab_sheet_url>https://docs.google.com/document/d/13fzmV01ju4sTFc9R-Fzr6Ti2zQ5UYSx3ClGrycs9XVA/edit?usp=sharing</lab_sheet_url>

  <type>ctf-lab</type>
  <type>hackerbot-lab</type>
  <type>lab-sheet</type>
  <difficulty>intermediate</difficulty>

  <CyBOK KA="SOIM" topic="Fundamental Concepts">
    <keyword>workflows and vocabulary</keyword>
    <keyword>PURPOSE OF LOGGING AND AUDITING</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="Monitor: Data Sources">
    <keyword>system and kernel logs</keyword>
    <keyword>Syslog</keyword>
    <keyword>Linux Journal and SystemD</keyword>
    <keyword>EVENTS - LOGGING</keyword>
    <keyword>LOG FILES - CENTRALIZED LOGGING</keyword>
    <keyword>LOG FILES - EVENT SOURCE CONFIGURATION</keyword>
    <keyword>LOGGING AND AUDITING OF CHANGES</keyword>
    <keyword>MONITORING - INTEGRITY</keyword>
    <keyword>AuditBeat</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="Analyse: Analysis Methods">
    <keyword>contribution of SIEM to analysis and detection</keyword>
    <keyword>EVENTS - ANALYSIS</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="Plan: Security Information and Event Management">
    <keyword>data collection</keyword>
    <keyword>alert correlation</keyword>
    <keyword>LOG FILES - INCIDENT RESPONSE</keyword>
    <keyword>MONITORING - INCIDENT RESPONSE</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="Execute: Mitigation and Countermeasures">
    <keyword>SIEM platforms and countermeasures</keyword>
    <keyword>SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM)</keyword>
    <keyword>Configuring Elastic Stack for centralised logging and SIEM</keyword>
  </CyBOK>

  <video>
    <title>Log Management</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/0EafG4CLwA4</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SOIM" topic="Fundamental Concepts">
      <keyword>workflows and vocabulary</keyword>
      <keyword>PURPOSE OF LOGGING AND AUDITING</keyword>
    </CyBOK>
    <CyBOK KA="SOIM" topic="Monitor: Data Sources">
      <keyword>system and kernel logs</keyword>
      <keyword>Syslog</keyword>
      <keyword>Linux Journal and SystemD</keyword>
      <keyword>EVENTS - LOGGING</keyword>
      <keyword>LOG FILES - CENTRALIZED LOGGING</keyword>
      <keyword>LOG FILES - EVENT SOURCE CONFIGURATION</keyword>
      <keyword>Log format: Common Log Format (CLF)</keyword>
    </CyBOK>
    <CyBOK KA="SOIM" topic="Analyse: Analysis Methods">
      <keyword>contribution of SIEM to analysis and detection</keyword>
    </CyBOK>
  </video>

  <system>
    <system_name>siem_management</system_name>
    <base platform="linux" distro="Buster"/>

    <input into_datastore="IP_addresses">
      <!-- 0 siem_management -->
      <value>172.16.0.2</value>
      <!-- 1 desktop -->
      <value>172.16.0.3</value>
      <!-- 2 hackerbot -->
      <value>172.16.0.4</value>
    </input>

    <!--generate two accounts, YOU and someone else-->
    <input into_datastore="accounts">
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>tiaspbiqe2r</value>
        </input>
        <input into="super_user">
          <value>true</value>
        </input>
        <input into="leaked_filenames">
          <value></value>
        </input>
        <input into="strings_to_leak">
          <value></value>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>test</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
        <input into="leaked_filenames">
          <value></value>
        </input>
        <input into="strings_to_leak">
          <value></value>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>test</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
        <input into="leaked_filenames">
          <value></value>
        </input>
        <input into="strings_to_leak">
          <value></value>
        </input>
      </generator>
    </input>

    <!-- an admin account used for hackerbot access to the desktop and also spoilers/administration of the challenge -->
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>

    <input into_datastore="elasticsearch_port">
      <value>9200</value>
    </input>

    <input into_datastore="logstash_port">
      <value>5044</value>
    </input>

    <input into_datastore="kibana_port">
      <value>5601</value>
    </input>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="strings_to_leak">
        <value></value>
      </input>
    </utility>

    <utility module_path=".*/kde_minimal">
      <input into="autologin_user">
        <datastore access="0" access_json="['username']">accounts</datastore>
      </input>
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart_konsole">
        <value>true</value>
      </input>
    </utility>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart">
        <value>true</value>
      </input>
      <input into="start_page">
        <encoder module_path=".*/concatenate">
          <input into="strings_to_encode">
            <datastore access="0">IP_addresses</datastore>
            <datastore>kibana_port</datastore>
          </input>
          <input into="delim">
            <value>:</value>
          </input>
        </encoder>
      </input>
    </utility>

    <service module_path=".*/elasticsearch">
      <input into="elasticsearch_ip">
        <datastore access="0">IP_addresses</datastore>
      </input>
      <input into="elasticsearch_port">
        <datastore access="0">elasticsearch_port</datastore>
      </input>
    </service>

    <service module_path=".*/logstash">
      <input into="logstash_port">
        <datastore access="0">logstash_port</datastore>
      </input>
      <input into="elasticsearch_ip">
        <datastore access="0">IP_addresses</datastore>
      </input>
      <input into="elasticsearch_port">
        <datastore access="0">elasticsearch_port</datastore>
      </input>
    </service>

    <service module_path=".*/kibana">
      <input into="kibana_ip">
        <datastore access="0">IP_addresses</datastore>
      </input>
      <input into="kibana_port">
        <datastore access="0">kibana_port</datastore>
      </input>
      <input into="elasticsearch_ip">
        <datastore access="0">IP_addresses</datastore>
      </input>
      <input into="elasticsearch_port">
        <datastore access="0">elasticsearch_port</datastore>
      </input>
    </service>

    <utility module_path=".*/filebeat.*">
      <input into="logstash_ip">
        <datastore access="0">IP_addresses</datastore>
      </input>
      <input into="logstash_port">
        <datastore access="0">logstash_port</datastore>
      </input>
    </utility>

    <utility module_path=".*/auditbeat.*">
      <input into="logstash_ip">
        <datastore access="0">IP_addresses</datastore>
      </input>
      <input into="logstash_port">
        <datastore access="0">logstash_port</datastore>
      </input>
    </utility>

    <utility module_path=".*/elastalert.*"/>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>desktop</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <utility module_path=".*/auditbeat.*">
      <input into="logstash_ip">
        <datastore access="0">IP_addresses</datastore>
      </input>
      <input into="logstash_port">
        <datastore access="0">logstash_port</datastore>
      </input>
    </utility>
    <utility module_path=".*/filebeat.*">
      <input into="logstash_ip">
        <datastore access="0">IP_addresses</datastore>
      </input>
      <input into="logstash_port">
        <datastore access="0">logstash_port</datastore>
      </input>
    </utility>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="strings_to_leak">
        <value></value>
      </input>
    </utility>

    <utility module_path=".*/kde_minimal">
      <input into="autologin_user">
        <datastore access="0" access_json="['username']">accounts</datastore>
      </input>
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart_konsole">
        <value>true</value>
      </input>
    </utility>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart">
        <value>true</value>
      </input>
      <input into="start_page">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </utility>

    <utility module_path=".*/pidgin">
      <input into="server_ip">
        <datastore access="2">IP_addresses</datastore>
      </input>
      <input into="accounts">
        <datastore access="0">accounts</datastore>
      </input>
    </utility>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>


  <system>
    <system_name>hackerbot_server</system_name>
    <base distro="Kali" name="MSF"/>

    <service type="ircd"/>

    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>

    <service type="httpd"/>

    <utility module_path=".*/hackerbot">
      <input into="hackerbot_configs" into_datastore="hackerbot_instructions">
        <generator module_path=".*/hb_siem">
          <input into="accounts">
            <datastore>accounts</datastore>
          </input>
          <input into="root_password">
            <datastore>spoiler_admin_pass</datastore>
          </input>
        </generator>
      </input>
    </utility>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <generator type="strong_password_generator"/>
      </input>
    </build>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

</scenario>