Hello there.
I'm your instructor, Owen Dubiel,
and today we'll be covering everything you need to know around OS
analysis with Nagios in a live environment.
Let's dig right in.
Nagios is a tool that professionals use to centrally manage and monitor
assets that they are responsible for in their environment.
In this course,
we'll be focusing solely on its ability to monitor and provide
analysis into operating‑system‑level activities.
To better teach this concept of OS analysis with Nagios,
I plan to walk you through how to enable monitoring based specifically
around NIST and MITRE frameworks to provide you with a solid key takeaway
that can be applied in a real‑world scenario.
Lastly,
I plan to also review at a high level some of the additional features that
can be enabled in order to enhance your Nagios experience when performing
security investigations. But first some history.
Nagios was first created in 1996 by Ethan Galstad as an MS‑DOS application
designed to perform simple ping operations and server checks.
Throughout the years, Ethan continued to add on to his creation,
forming it towards more of a hosted monitoring and managed service approach.
Eventually,
Ethan revamped the tool to run his solution as a Linux‑based application design.
In 1999,
Ethan released the project as an open source development and named it NetSaint,
which was later changed to Nagios due to trademark concerns with the name Saint.
Throughout the years,
Ethan continued to build out Nagios with features like SNMP traps,
Windows support, Incident Manager, Network Analyzer,
and even a log server.
Fast forward to today,
where Nagios has over 7.5 million user downloads on SourceForge alone.
All right, let's get into the nitty gritty.
What is Nagios, anyway?
Nagios is a monitoring tool used for mission‑critical infrastructure assets.
I'm talking about applications, services,
operating systems, and even network appliances.
With Nagios,
you can walk away with the ability to implement performance monitoring,
incident management, network mapping, and even event alerting.
Okay, so where do I get Nagios?
In order to gain access to Nagios,
you simply have to visit their site at nagios.com to start a
download of the product that you're interested in.
Alternatively, if you head over to SourceForge.com as well,
you can get a community download.
All right, but what makes it special?
Why would I use it?
I'm a member of a security blue team.
What makes it special for me?
So Nagios comes with tons of built‑in add‑on configuration wizards to help
assist you with any type of integration you may be interested in.
These services include Microsoft, AWS, Digital Ocean,
Docker, Google, Oracle, VMware, and more.
At the end of the day,
Nagios helps to streamline operating system
monitoring in a centralized location.
From the blue team perspective,
Nagios makes centralized log management and asset tracking a breeze
with its two options of deployment that are offered,
either an auto‑discovery scan or remote agent deployment.
Both options allow for mass deployment, no matter your network configuration.
And then for blue teams specifically,
Nagios is straight to the point and allows easy mapping into major
security frameworks like NIST or even MITRE TTPs,
which we're going to dig into next.
Taking a quick look at the compliance security side of the house, NIST
provides guidelines to help companies better align their efforts and
resources to achieve a greater security posture.
NIST now organizes its coverage into five topics: Identify,
Protect, Detect,
Respond, and Recover. Today, we'll be focusing solely on the
Detect realm within the NIST framework.
Breaking out that Detect realm a little further, you can see that the
categories are further broken down into subcategories.
This includes examples like anomalies and events, detection processes,
and then the one we'll be focusing on in this course is security
continuous monitoring, or the ability to ensure continuous log monitoring
is ongoing and reputable to provide blue teams with a constant feedback
of security‑related activity.
Now, as we continue to break down the NIST framework here,
we can easily determine that by implementing Nagios for OS‑level analysis,
you are able to check the box for DE.CM‑1, which is The network is
monitored to detect potential cyber security events. If implemented
correctly, Nagios can be configured to provide monitoring and detection
capabilities for specific network‑related events, like if a firewall is
modified or even disabled, which could be a precursor to an attack.
Another NIST box that can be checked with this implementation of Nagios is
DE.CM‑7, or Monitoring for unauthorized personnel, connections,
devices, and software is performed. Over time, as you get used to using Nagios,
you will get a better feel for what is normal activity in your environment.
By using Nagios, you can have instant visibility into unauthorized
activity like the launching of PowerShell or even a specific
file‑related activity that may be occurring.
All right, next we have MITRE, the MITRE ATT@CK framework. Now that we've
really identified what those NIST categories are going to be doing for
us, let's take a deeper and more narrow look at MITRE ATT@CK TTPs, or
Tactics, Techniques, and Procedures that we can effectively detect with
our implementation of Nagios, the first one being T11058.001, or Command
and Scripting Interpreter, more specifically, PowerShell. This TTP is
located under the Execution tactic. It is simply means of being able to
detect the use of PowerShell within a corporate environment.
This is important to alert or monitor on, as PowerShell can be easily
used to carry out additional admin actions and exploits throughout a
network. Ideally, each detection should have a solid use case and
explanation as to why it is triggered, and then whitelist it to prevent
further alerting. This way,
you should only be alerted on PowerShell events that are
unauthorized to you or ones that you are unaware of.
Next we have T1562.007: Impair Defenses: Disable or Modify the Firewall.
This is nested under the Defense Evasion tactic, and has the
ability to detect when firewall‑level changes are made and/or
the firewall could be disabled.
This is a very important alert to have in place to ensure that all firewall
changes are tracked through your change management system,
thus helping you identify if there are any unwarranted changes that
could lead to an attack that may be underway.
Most times,
attackers that have a compromised admin account will have the ability
to open up ports on a firewall to create a command and control
channel, or a C2, over an obfuscated port to carry out remote
activities from afar without your knowledge.
And then lastly, we have T1083: File and Directory Discovery, which is
located under the Discovery tactic and can help security personnel quickly
identify anyone that may be performing recon or lateral movement activities
within the early stages of an attack.
Having the ability to see when someone is performing
directory scans enumerating your network is essential in
stopping an attack before it happens.
Also,
attackers may be able to also traverse files or directories in search of
sensitive data or even additional credentials that allow them access to
other accounts that may contain other sensitive data. In the next video,
we will dive into a demo of how to utilize Nagios in a real‑world
environment for security monitoring.
I'll see you in the next video.