Zentral aggregate w/ osquery and Google Santa

2. Zentral
Event Aggregation with osquery and Santa
Henry Stamerjohann
@head_min

3. Partner at Apfelwerk since 2 years
Systems Engineer, Consultant
Focus on Mac, automation, managed services
Previously systems engineer in enterprise
and broadcast
Whoami
Henry Stamerjohann
Apfelwerk GmbH & Co. KG, based in Hamburg / Germany
@head_min
@henry #macadmins

4. Common experience ?
You have Mac based inventory
You use client management tools !
You learned your thread scenario !!
You work to improve security policies !!!
How do you manage all that ?

5. Detection = endpoint monitoring
Analysis = research events, root cause
Remediation = block execution, quarantine endpoints
Incident Management

6. Magic Quadrant
Leaders
Visionaries
Challengers
Niche Players

7. Trust
Value
Productivity
Reliability
Flexibility
Commercial vs. OSS

8. Zentral

9. Aggregated Inventory
Organized Inventory
(Devices, Groups, BusinessUnits, Apps)
Events / Filtering with Probe types
Setup / simple Enroll.pkg
Direct linked Tools (Kibana, Grafana)
First look
2 3
1
3
3
1
2
4
5
4
52

10. Zentral
Open-source project (OSS)
Event-Driven monitoring solution
Connect inventory and events
Integrate Endpoint security tools
Probes (Filters, Actions)
Bridge technology in one place

11. Inventory
Complement existing management tools (JAMF, Munki)*
Inventory aggregation and change events
Connect multiple inventory sources simultaneously
JAMF Pro (Inventory, JSS API, JAMF WebHooks)
Munki (Inventory, install/uninstall events)
* General support via REST API connection

12. Probes are Sensors for events (Filters, Rules, Actions)
Different Probe Models (Events, Osquery, Santa, Munki)
Tailored Filters for data (Inventory, Metadata, Payload)
Rules for "if this, then that" (Actions on various events)
Trigger Actions (Tags, Notifications, REST API calls)
Probes

13. Unified server for osquery & Google Santa (TLS)
Deploy and manage configurations (dynamic)
Aggregate query results / events from endpoints
Santa and osquery do the hard work
Zentral operates agent-less (less issues)
Zentral TLS Server
Santa
osquery

14. osquery

15. osquery
Ask questions about infrastructure (Linux, macOS)
Query system state with simple SQL syntax (tables)
Not hidden (like other tools)
No restrictions on users or system
Great community
Multi platform support
select name, uid, version
from safari_extensions;
select * from sip_config;

16. Osquery Probes
Events
view in Zentral,
link to Elasticsearch/Kibana 1
1
2
Osquery
Multiple queries
3
3
Filters
BU, Tags, Platform,
Device type, EventAttribute
2
2

17. Osquery Probes
Events
view in Zentral,
link to Elasticsearch/Kibana 1
1
2
Osquery
Multiple queries
3
3
Filters
BU, Tags, Platform,
Device type, EventAttribute
2
2
Actions
Notify, Email, set Tags,
create tickets
4
4

18. Metrics / Events

19. Metrics / Events

20. Google Santa

21. Google Santa
A binary whitelisting/blacklisting system
Event logging to sync server (API)
Keeps track of binaries in macOS
(naughty and nice)
Kernel Extension and daemon
MONITOR and LOCKDOWN (default deny)

22. binary execution actively blocked by Google Santa Kernel extension

23. binary execution actively blocked by Google Santa Kernel extension

24. binary execution actively blocked by Google Santa Kernel extension

25. Create Santa Probes
Rule type
Binary, Certificate
2
2
sha256
like a fingerprint
3 3
Policy
Blacklist, Whitelist
1
1

26. Santa Probes
Events
view in Zentral,
link to Elasticsearch/Kibana
1
1
2
Policies
Multiple white/black-lists
3
3
Actions
Notify, Email, set Tags,
create tickets
4
4
Filters
BU, Tags, Platform,
Device type, EventAttribute
2
2

27. Metrics / Events

28. Metrics / Events

29. Detection = Santa/osquery monitor endpoint events
Analysis = Research all events in Zentral / Kibana
Remediation = Actively block binary execution
Notify = Receive incident event notification
Simple Incident Response
2 3
4
1

30. Demo

31. SIEM* Options
Control binary black/whitelisting
Intrusion detection, change detection
Automated Remediation
Custom IR for your thread scenario
Integrate with tools already in place
Transparency and visibility
*Security Incident and Event Management

32. Deployment
AWS AMI based Zentral all in one (Simple)
Search for "Zentral all in one"
(AWS Regions: US, EU, Australia)
Docker-Compose (flexible)
i.e. Docker for Mac

33. Time-series metrics, indexed, full-text search DB (ES)
Discover and visualize data over time (Kibana 5)
ElasticSearch / Kibana (ELK)
https://www.elastic.co/

34. INTRO TO ZENTRAL
COORDINATE OPEN SOURCE SECURITY TOOLS
FOR THE MAC
HENRY STAMERJOHANN
Take Control with Osquery,
Google Santa and Zentral.
Bundle exciting open source
Endpoint Security tools
specifically tailored for macOS.
Ressources / Tutorials
+20 Tutorial Videos
https://goo.gl/qsIVkl
Documentation on Github
https://github.com/zentralopensource/docs
eBook (work in progress)
https://leanpub.com/zentral

35. Support
Contact us:
info@zentral.io
Custom support available on request
i.e. Custom integrations
SLA: response next workday

36. Project on Github
https://github.com/zentralopensource/zentral
https://github.com/zentralopensource/docs
@zentral_io

37. ElasticSearch
Zentral Integrations
MDM
Output
Notifications Sub-Systems
Email
Prometheus
Grafana
Munki
Inventory, Events, MetricsEndpoint Security Tools Endpoint Managed Software Solutions
osquery
Google Santa
Input
Sal
ZentralTagsZentralCmd