Long time since last post.
I was very busy organizing the second edition of RomHack, the free cyber security conference made with ❤ by Cyber Saiyan – the non-profit organization I founded 2 years ago – that took place in Rome past 28th of September.
We had an incredible lineup with italian and international speakers coming from around the world and 400 attendees. Not just the conference; at the end of the conf 16 team played the on site Capture The Flag.
Continue reading “#RomHack2019”
I use twitter to follow a lot of good feeds but often I need to follow twitter threads for new replies to have a fast and complete view of complex threads even if I’m not cited or the tweet owner.
I did some search and found a python script from @edu on github that was a good starting point. I learned that twitter API doesn’t allow to get all the replies to a tweet but can be used to search for replies to a given tweet and replies to any reply as well. Good.
So starting from @edu code I wrote Twitter Scraper, a project – made of 2 scripts
The project page details the usage and configuration of both scripts with examples (command line and video), so jump and test 🙂
Enjoy!
This post is the fifth of a series on Threat Intelligence Automation topic.
Post 1: Architecture and Hardening of MineMeld
Post 2: Foundation: write a custom prototype and SOC integration
Post 3: Export internal IoC to the community
Post 4: Search IoC events with SPLUNK
Long time since my last post. I was very busy creating Cyber Saiyan – a non-profit organization – and organizing RomHack 2018, a free cyber security event that will take place in Rome next September 22th.
On the field of threat intelligence automation and info sharing community building, the work continued too.
I’m working hard with italian community and we setup a STIX/TAXII network using a combination of open source sofware: MISP, OpenTAXII and MineMeld. We are now testing a complex consumer/producer network where companies (producers) can push IoC that, after validation, are injected into the consumer network, a TAXII service built on top of MineMeld.
Continue reading “MineMeld: threat intelligence automation – connect to STIX/TAXII service [5]”
Sabato 13 Gennaio 2018 sono stato relatore, insieme ad amici e colleghi bravissimi, della prima edizione del BSides Roma con un talk dal titolo “Building an Effective Info Sharing Community“.
L’evento è stato un successo: sala piena e livello dei talk notevole – a parte il mio ovviamente 🙂
Il mese scorso ho costituito, insieme ad altri tre amici, l’associazione di promozione sociale Cyber Saiyan, con l’obiettivo di organizzare un evento di sicurezza a Roma nel 2018 ed avviare altre iniziative sempre legate a questo ambito (seguici su twitter per rimanere aggiornato).
Riporto qui di seguito, a beneficio anche di altri che potrebbero essere interessati a fare la stessa cosa, i passi da seguire per costituire un’associazione di promozione sociale che NON svolge attività commerciale: Continue reading “[ITA] Come costituire un’associazione di promozione sociale”
Tutto è iniziato a Gennaio 2017 quando a Milano ho conosciuto Mario Anglani, l’organizzatore di HackInBo. Quel giorno quando Mario mi ha parlato di HackInBo, incuriosito, ho deciso di avvicinarmi a questa community inviando una mia proposta di talk per l’imminente spring edition 2017.
Non avevo troppe speranze a dire il vero, ma la voglia di raccontare la mia esperienza, le mie idee e confrontarmi con altre persone – fino ad allora sconosciute – era grandissima.
Il mio talk fu selezionato e per me è stata un’esperienza stupenda ed indimenticabile che mi ha permesso di conoscere tantissime persone e di condividere con loro idee, problemi e soluzioni. Un “mondo” per me sconosciuto fino ad allora – lavoravo comunque nella Security operativamente da quasi 6 anni – e che mi ha immediatamente conquistato.
In questi sei mesi sono successe tantissime cose che mi hanno convinto di tentare di restituire alla community – il famoso give back – un po’ di quello che ho “preso”. E così insieme ad altri amici – DavideP e Federico – abbiamo prima di tutto deciso di costituire un’associazione di promozione sociale che abbiamo chiamato Cyber Saiyan (sito web , twitter) che “persegue la promozione di iniziative di qualsiasi genere con la finalità di divulgare tematiche relative a cyber security ed ethical hacking“.
Presto organizzeremo qui a Roma un incontro per presentare l’associazione, con l’obiettivo minimo di realizzare nel 2018 un evento di sicurezza su Roma che abbia il pieno supporto della community.
Oggi per me è un nuovo inizio e spero che nel 2018 Cyber Saiyan possa regalarci delle stupende iniziative.
merlos
This post is the fourth of a series on Threat Intelligence Automation topic.
Post 1: Architecture and Hardening of MineMeld
Post 2: Foundation: write a custom prototype and SOC integration
Post 3: Export internal IoC to the community
Post 5: Connect to a TAXII service
After having laid the foundations for building a community with the previous posts, it’s now time to make some advanced analysis of the received IoC.
In post 2 I integrated MineMeld output nodes into Splunk SOC near-real-time engine to automate SOC IoC access detection. This configuration strengthens the analysis and response capabilities of our SOC.
With this post I show you how to integrate MineMeld miners IoC events (update and withdraw of remote IoC) into Splunk engine so you can use Splunk search advanced features to have a deeper look into the IoC received from the miners.
This is also an important information for a SOC because if you have an IoC hit the first think to do is to understand where the IoC come from, if it was sent by more than one source etc
This post is the third of a series on Threat Intelligence Automation topic.
Post 1: Architecture and Hardening of MineMeld
Post 2: Foundation: write a custom prototype and SOC integration
Post 4: Search received IoC events with Splunk
Post 5: Connect to a TAXII service
After building the architecture and integrating the InfoSec feeds from italian CERT-PA into MineMeld and the near-real-time SOC engine, it’s time to put another brick to build an effective community: export internal IoC to the community in a standard format so authorized parties can get it and use them as they want.
The ultimate goal is to build a community that can share IoC using a standard language and a transport mechanism (STIX/TAXXI) getting data from heterogeneous sources (more integration examples in next posts) and injecting data into the community network.
So let’s start with the configuration steps. Continue reading “MineMeld: threat intelligence automation – export internal IoC to the community [3]”
This post is the second of a series on Threat Intelligence Automation topic.
Post 1: Architecture and Hardening of MineMeld
Post 3: Export internal IoC to the community
Post 4: Search received IoC events with Splunk
Post 5: Connect to a TAXII service
On the first post of my threat intelligence automation jurney I wrote why I choosed MineMeld, the architecture implemented and the hardening steps. One of the goals is to connect MineMeld to heterogeneous external sources to get IoC (Indicators of Compromise) and integrate it into our i-SOC (Information Security Operation Center) near-real-time engine to get evidences of security events to be analyzed by i-SOC analysts.
In this post I show the foundation of the threat intelligence automation model: how I wrote a custom prototype to get the InfoSec feeds from italian CERT-PA (Public Administration – italian web site) and how I integrated these feeds into Splunk near-real-time engine.
I started with this integration because InfoSec has very good feeds (IP, URLs, domains) that are not just copy&paste from OSINT sources but are often updated and automatically analyzed to check that IoC are still “alive”.
This page and this page give you all the information needed to understand how MineMeld works, so RTFM before moving on 😉 Continue reading “MineMeld: threat intelligence automation – foundation: write a custom prototype and SOC integration (Splunk) [2]”
This post is the first of a series on Threat Intelligence Automation topic
Post 2: Foundation: write a custom prototype and SOC integration
Post 3: Export internal IoC to the community
Post 4: Search received IoC events with Splunk
Post 5: Connect to a TAXII service
Last slide at my HackInBo talk (italian) was about how to automatically integrate threat intelligence feeds into our near-real-time Information Security Operation Center (i-SOC) SPLUNK engine to reduce the time spent by SOC security analysts on IoC (Indicators of Compromise) analysis.
At the time I was testing an open source project from PaloAlto: MineMeld. It was the right choice; after extensive tests MineMeld now help me to solve the challenges I had in the past while playing with IoC coming from various threat intelligence sources: collection automation, unduplication, aging and SOC integration.
MineMeld can also share our internal IoC to the italian infosec community we are now building from the ground. We are working hard on this and I’m really confident we will succeed (want to join? DM me on twitter or in the comments). Continue reading “MineMeld: threat intelligence automation – architecture and hardening [1]”
Scubarda 