Monitoring Kubernetes with Security Onion

Thu, 05 Sep 2024 00:00:00 +0000

Introduction

After adding Kubernetes to my homelab, I wanted to learn how to hack and hunt for malicious activity involving containers. I found Kubernetes GOAT which provides a great way to practice hacking. To do the hunting, we need some additional work to enable telemetry on networks, containers, and Kubernetes. In this post I’ll walk through how I instrumented my Microk8s cluster to hunt for the hacking actions you can do in the GOAT.

SecurityOnion GPT

Mon, 12 Feb 2024 00:00:00 +0000

Introduction

I was recently catching up on some conference videos and saw a talk by Roberto Rodriguez on Empowering Security Teams with Generative AI: GPT models. This got me thinking about how to integrate GPT to hunting with Security Onion.

Goals:

Summarize activity found in Security Onion
Enrich activity with MITRE ATT&CK attribution
Convert English questions to Kibana Query Language to hunt

In this post, I’ll tackle goals 1 and 2. I’ll do goal 3 in a separate post. These experiments will be conducted in Jupyter lab.

Hunting on kimobu

Monitoring Kubernetes with Security Onion

Introduction

SecurityOnion GPT

Introduction