Welcome to the Nagios demo.
At a high level,
we are going to review how to set up and enable the free version of Nagios.
Then we will demonstrate how to deploy agents or discovery scans.
We will also deep dive into implementing visibility into
the main MITRE TTPs for this course,
which are command and scripting interpreter with PowerShell,
disable or modify the firewall, or file and directory traversal.
Lastly,
I will review a few additional features that I believe to be very
useful in security triage and investigation.
Let's dig right in.
All right, let's go ahead and enable the free version of Nagios.
You're going to want to head on over to the Admin tab,
and then also the License Information.
Now as you can see under License Type, I have Free already selected.
To select it, you just go up and click the little toggle icon next to Free.
This gives you 7 nodes free to try out within this Nagios XI interface.
The paid version gives you more control from a server
perspective for things like patch management,
deployments, and network visibility,
but the free version in my opinion gives enough general visibility to
get the context needed for further investigation.
All right,
let's go ahead and head to the Configure tab to set up some
of these scans and deploy some agents.
So first,
we're going to head on over to the Auto‑Discovery option on the left‑hand side,
and go ahead and click that to set up an auto‑discovery scan.
Click the bright blue button for a new scan job,
and this is where we'll go ahead and enter the scan target information.
Either a subnet or a singular IP will work,
and any IPs you want to exclude, and then click Submit.
And it's as simple as that.
Next, let's click on Deploy Agent.
Now this is the same general concept.
We're going to go ahead and type in our IP address for a
singular agent that we want to deploy a host on.
Select the operating system from the list that is provided,
the authentication type, enter in the credentials needed,
and then that is the Nagios software, and click Deploy.
And that's it.
If you head on over to the Manage Deployment tab,
you can actually manage and see all the different agents
that you may have deployed out there.
All right, now that we have some hosts added,
let's go ahead and head on over to Configuration Wizards to add in some
logging and context to our host to really give that juiciness.
Right, so we're going to go ahead and type in Windows in the search bar.
And since we have a Windows host, which is a Windows 10 Workstation,
we're going to go ahead and click on the Windows Desktop add‑on wizard.
That's the one right in the middle there.
If you go ahead and click on that,
here you're going to enter your IP of the VM or
Workstation that you're working with,
and I'm going to go ahead and type that in here.
And you can add in your token, which,
in order for within the Nagios instance here,
you just head on over to your admin account and grab the API
key is what it's referring to for token.
So, just copy that, come on back, do the Configuration Wizard again,
Windows Desktop, pop in your token there.
And then just to verify we have the right host,
let's head on over to our Windows VM Workstation anyway and just
double‑check the IP to ensure we have the right one.
Do a little quick ipconfig, if I can type it right.
There we go.
And there is our IP.
We're going to go back on over and plug that in.
As you can see, it's over that unique port 5693.
Now, once you're at this screen here, this is where all the fun happens.
Everything with a blue checkmark is enabled by default,
and you can customize some of those CPU usages or memory usages.
We're going to scroll on down to the fun stuff.
We're going to enable certain services that we want monitored or alerted on.
So, we're going to head on over here to our Windows Workstation again,
and we're just going to verify, for the sake of this demo, what the
service name is for the firewall running on a Windows host.
So I'm going to go over to my Task Manager,
and I'm going to go to the Services tab and search
for that Windows Defender Firewall, which is right here.
Service name mpssvc.
So all we're going to do here,
and this is for any service that you want monitored,
we're just going to go under the Processes and/or Services tab,
depending on what it is, type in that service name,
mpssvc, just a quick description of what it is,
and then make sure you check the box next to it to
have it enabled and monitored.
So as you can see, we're also looking at Windows Defender service as well,
and ensuring that it's running.
Now, just for fun, in the Processes,
we're going to go ahead and select different processes that we
want to be alerted on whenever they are executed,
explore.exe, cmd, right, the command‑line interface,
or even PowerShell.
Now we're just putting one time as an alert instance just for the demo,
but you can customize that to however many you would like.
Also,
I'm going down and enabling the event logs events to pull
those in to provide additional context.
Okay, once that's finished,
this is where you would set your time threshold for this job to run,
and you click Finish, and that's it.
The configuration changes have been made.
So now what you're going to do is go into the Core Configuration Manager,
and this is where you can see all the different configuration changes that
you just enabled in a quick dashboard view and get a bird's eye sense of
what's going on in this host. As you can see,
here's our PowerShell alert, here's our CPU usage, everything that we selected
is ready to roll. All right, now it's time for the fun stuff.
Let's dig into these MITRE TTP s and see how we can use Nagios to
quickly alert on what's happening on a host.
Let's look into PowerShell first.
This is primarily going to be viewed from the Host Status page, but
first we're going to head on over to our VM, and we're going to
actually generate PowerShell alerts. We're just going to open up a
couple instances of PowerShell to give Nagio something to alert on and
something for us to look at.
So you can see I opened up two instances. Head on over to the Host Status page,
and then we're going to go ahead and click on that IP that we enabled the
Windows add‑on for. Next, we're going to head up to the Services tab. Click
that, and it'll give us a breakdown of all the services that are included in
that specific add‑on that we enabled.
Now, as you can see, there's a PowerShell line item,
it's listed as critical, and it's the exact alert that we created. For
every one instance of PowerShell, trigger an alert. And you'll see actually
if you scroll down a couple more line items, there's another line item for
PowerShell. So this is going to trigger every single time PowerShell was
opened. We opened it twice.
This is obviously a very simplistic example of how to detect
PowerShell. You can get much more in‑depth with these,
but you can also do the same thing for that Firewall
mpssvc service that we entered as well.
So if you were to go into that VM, stop the Firewall
service, start it back up. You should get the same exact
alert details within this services page.
This is a great way to get quick visibility into if Windows Defender
is running, if command‑line is running, etc. Also,
if you go ahead and click on Event Log,
this is another way to verify individual events that are occurring
outside of the realm of the ones that you selected as well.
These will give you the individual events as they occur per click,
that is that bullet point that I selected for Event Logs or event
alerts. This will give you all that context needed that's happening
on a host that you actually may not even be aware of, and it'll help
you actually generate better alerting that is fit for whatever use
cases you need.
Lastly, if you go ahead and click on Network Status Map,
I want to review a couple of the cool features that I
found in Nagios while investigating.
Now, as you can see,
it gives you a network topology map of all your assets that
are deployed or discovered through scanning.
Now, if you want a more in‑depth look into your network or your host operations,
go ahead and click on the Graph Explorer under the graphs on the left side, and
that will give you a very high‑level overview of all the different hosts that
you have monitored and the top alerts produced.
You can see our PowerShell ones,
some of the event logs, user counts that are logged in,
different command lines, or even CPU usages, right.
There's other tabs as well, around heartbeats,
host health check, service health.
This gives you quick visibility into maybe some different unusual
activity or spikes i performance within your network.
Now, that's all we have for today.
I hope you enjoyed this class, and I look forward to seeing you in the next one.
Until then, have a good one!