opencybersecurityalliance/kestrel-langLinguagem de caça a ameaças Kestrel: construindo fluxos de caça reutilizáveis, componíveis e compartilháveis em diferentes fontes de dados e inteligência de ameaças.
.. image:: https://github.com/opencybersecurityalliance/kestrel-lang/raw/develop/logo/logo_w_text.png :width: 460 :alt: Linguagem de Caça a Ameaças Kestrel
|readthedocs| |pypi| |downloads| |codecoverage| |black|
|
*Uma caça a ameaças cibernéticas de ponta a ponta geralmente requer execução em múltiplas fontes de dados/ambientes, além de etapas de enriquecimento/ML/visualização em qualquer lugar do fluxo de caça.
.. image:: https://raw.githubusercontent.com/opencybersecurityalliance/data-bucket-kestrel/main/images/kestrel2_example.png :alt: Exemplo do Kestrel2
Kestrel é uma linguagem de caça a ameaças que visa tornar a caça a ameaças cibernéticas rápida, fornecendo uma camada de abstração para construir fluxos de caça reutilizáveis, compostos e compartilháveis. Começando com:
#. Black Hat USA 2024 Kestrel hunting lab_
#. Black Hat USA 2022 Kestrel hunting lab_
#. Black Hat USA 2022 session recording_
Black Hat USA 2024_ para caçar com KestrelCNCF Secure AI Summit 2024_Red Hat Research Quarterly_ (RHRQ)Desenvolvedores de software escrevem Python ou Swift em vez de código de máquina para transformar rapidamente lógica de negócios em aplicativos. Caçadores de ameaças escrevem Kestrel para transformar rapidamente hipóteses de ameaças em fluxos de caça. Vemos a caça a ameaças como um procedimento interativo para criar sistemas de detecção de intrusão personalizados em tempo real, e o fluxo de caça está para as caças assim como o fluxo de controle está para programas comuns.
.. image:: https://github.com/opencybersecurityalliance/kestrel-lang/raw/develop/docs/images/overview.png :width: 100% :alt: Visão geral do Kestrel.
Linguagem Kestrel: uma linguagem de caça a ameaças para um humano expressar o que caçar.
Runtime Kestrel: um interpretador de máquina que lida com como caçar.
Visite a documentação do Kestrel_ para aprender Kestrel:
Aprenda conceitos e sintaxe:
A comprehensive introduction to Kestrel_The two key concepts of Kestrel_Interactive tutorial with quiz_Language reference book_Caça em seu ambiente:
Kestrel runtime installation_How to connect to your data sources_How to execute an analytic hunt step in Python/Docker_How to use Kestrel via API_How to launch Kestrel as a Docker container_Kestrel 2 estreia no Black Hat USA 2024_. Embora mantendo a sintaxe da linguagem do Kestrel 1, redesenhamos completamente o runtime do Kestrel 2 para alcançar melhor desempenho e sintaxe mais flexível em relação a representações de entidade, atributo e relação.
Principais recursos do Kestrel 2:
EXPLAINKestrel 2 está atualmente em beta, saiba mais em Kestrel runtime installation_.
Kestrel huntbook_: huntbooks Kestrel contribuídos pela comunidadeKestrel analytics_: análises Kestrel contribuídas pela comunidade#. Building a Huntbook to Discover Persistent Threats from Scheduled Windows Tasks_
#. Practicing Backward And Forward Tracking Hunts on A Windows Host_
#. Building Your Own Kestrel Analytics and Sharing With the Community_
#. Setting Up The Open Hunting Stack in Hybrid Cloud With Kestrel and SysFlow_
#. Try Kestrel in a Cloud Sandbox_
#. Fun with securitydatasets.com and the Kestrel PowerShell Deobfuscator_
#. Kestrel Data Retrieval Explained_
Resumo das palestras (visite a documentação do Kestrel sobre palestras_ para mais detalhes):
Black Hat USA 2024_CNCF Secure AI Summit 2024_Black Hat USA 2023_Infosec Jupyterthon 2022_ [IJ'22 live hunt recording_]Black Hat USA 2022_ [BH'22 recording_ | BH'22 hunting lab_]Cybersecurity Automation Workshop_SC eSummit on Threat Hunting & Offense Security_ (grátis para registro/reprodução)Infosec Jupyterthon 2021_ [IJ'21 live hunt recording_]BlackHat Europe 2021_Junte-se ao canal slack do Kestrel:
Obtenha um convite do slack_ para entrar no workspace da Open Cybersecurity Alliance_
.. image:: https://opencyberallia.wpengine.com/wp-content/uploads/2022/03/OCA-logo-e1646689234325.png :width: 20% :alt: Logo OCA
Entre no canal kestrel para fazer perguntas e se conectar com outros caçadores
Contribua para o desenvolvimento da linguagem (Apache License 2.0_):
Issue no GitHub_ para relatar bugs e sugerir novos recursosguia de contribuição_ para enviar seu pull requestdocumentação de governança_ sobre merge de PR, lançamento e divulgação de vulnerabilidadesCompartilhe seu huntbook e análises:
Kestrel huntbook_Kestrel analytics_.. _Kestrel live tutorial in a cloud sandbox: https://mybinder.org/v2/gh/opencybersecurityalliance/kestrel-huntbook/HEAD?filepath=tutorial .. _Kestrel documentation: https://kestrel.readthedocs.io/
.. _A comprehensive introduction to Kestrel: https://kestrel.readthedocs.io/en/latest/overview/ .. _The two key concepts of Kestrel: https://kestrel.readthedocs.io/en/latest/language/tac.html#key-concepts .. _Interactive tutorial with quiz: https://mybinder.org/v2/gh/opencybersecurityalliance/kestrel-huntbook/HEAD?filepath=tutorial .. _Kestrel runtime installation: https://kestrel.readthedocs.io/en/latest/installation/runtime.html .. _How to connect to your data sources: https://kestrel.readthedocs.io/en/latest/installation/datasource.html .. _How to execute an analytic hunt step in Python/Docker: https://kestrel.readthedocs.io/en/latest/installation/analytics.html .. _Language reference book: https://kestrel.readthedocs.io/en/latest/language/commands.html .. _How to use Kestrel via API: https://kestrel.readthedocs.io/en/latest/source/kestrel.session.html .. _How to launch Kestrel as a Docker container: https://kestrel.readthedocs.io/en/latest/deployment/ .. _Kestrel documentation on talks: https://kestrel.readthedocs.io/en/latest/talks.html
.. _Kestrel huntbook: https://github.com/opencybersecurityalliance/kestrel-huntbook .. _Kestrel analytics: https://github.com/opencybersecurityalliance/kestrel-analytics
.. _Building a Huntbook to Discover Persistent Threats from Scheduled Windows Tasks: https://opencybersecurityalliance.org/huntbook-persistent-threat-discovery-kestrel/ .. _Practicing Backward And Forward Tracking Hunts on A Windows Host: https://opencybersecurityalliance.org/backward-and-forward-tracking-hunts-on-a-windows-host/ .. _Building Your Own Kestrel Analytics and Sharing With the Community: https://opencybersecurityalliance.org/kestrel-custom-analytics/ .. _Setting Up The Open Hunting Stack in Hybrid Cloud With Kestrel and SysFlow: https://opencybersecurityalliance.org/kestrel-sysflow-open-hunting-stack/ .. _Try Kestrel in a Cloud Sandbox: https://opencybersecurityalliance.org/try-kestrel-in-a-cloud-sandbox/ .. _Fun with securitydatasets.com and the Kestrel PowerShell Deobfuscator: https://opencybersecurityalliance.org/fun-with-securitydatasets-com-and-the-kestrel-powershell-deobfuscator/ .. _Kestrel Data Retrieval Explained: https://opencybersecurityalliance.org/kestrel-data-retrieval-explained/
.. _RSA Conference 2021: https://www.rsaconference.com/Library/presentation/USA/2021/The%20Game%20of%20Cyber%20Threat%20Hunting%20The%20Return%20of%20the%20Fun .. _RSA'21 session recording: https://www.youtube.com/watch?v=-Xb086R0JTk .. _SANS Threat Hunting Summit 2021: https://www.sans.org/blog/a-visual-summary-of-sans-threat-hunting-summit-2021/ .. _SANS'21 session recording: https://www.youtube.com/watch?v=gyY5DAWLwT0 .. _BlackHat Europe 2021: https://www.blackhat.com/eu-21/arsenal/schedule/index.html#an-open-stack-for-threat-hunting-in-hybrid-cloud-with-connected-observability-25112 .. _Infosec Jupyterthon 2021: https://infosecjupyterthon.com/2021/agenda.html .. _IJ'21 live hunt recording: https://www.youtube.com/embed/nMnHBnYfIaI?start=20557&end=22695 .. _Infosec Jupyterthon 2022: https://infosecjupyterthon.com/2022/agenda.html .. _IJ'22 live hunt recording: https://www.youtube.com/embed/8Mw1yyYkeqM?start=23586&end=26545 .. _SC eSummit on Threat Hunting & Offense Security: https://www.scmagazine.com/esummit/automating-the-hunt-for-advanced-threats .. _Cybersecurity Automation Workshop: http://www.cybersecurityautomationworkshop.org/ .. _Black Hat USA 2024: https://www.blackhat.com/us-24/arsenal/schedule/index.html#kestrel--hunt-for-threats-across-security-data-lakes-39321 .. _Black Hat USA 2023: https://www.blackhat.com/us-23/arsenal/schedule/index.html#identity-threat-hunting-with-kestrel-33662 .. _Black Hat USA 2022: .. _BH'22 recording: .. _Black Hat USA 2022 session recording: .. _BH'22 hunting lab: .. _Black Hat USA 2022 Kestrel hunting lab: .. _Black Hat USA 2024 Kestrel hunting lab: .. _Red Hat Research Quarterly: .. _CNCF Secure AI Summit 2024:
.. _slack invitation: https://join.slack.com/t/open-cybersecurity/shared_invite/zt-19pliofsm-L7eSSB8yzABM2Pls1nS12w .. _Open Cybersecurity Alliance workspace: https://open-cybersecurity.slack.com/ .. _GitHub Issue: https://github.com/opencybersecurityalliance/kestrel-lang/issues .. _contributing guideline: CONTRIBUTING.rst .. _governance documentation: GOVERNANCE.rst .. _Apache License 2.0: LICENSE.md
.. |readthedocs| image:: https://readthedocs.org/projects/kestrel/badge/?version=latest :target: https://kestrel.readthedocs.io/en/latest/?badge=latest :alt: Documentation Status
.. |pypi| image:: https://img.shields.io/pypi/v/kestrel-jupyter :target: https://pypi.python.org/pypi/kestrel-jupyter :alt: Latest Version
.. |downloads| image:: https://img.shields.io/pypi/dm/kestrel-core :target: https://pypistats.org/packages/kestrel-core :alt: PyPI Downloads
.. |codecoverage| image:: https://codecov.io/gh/opencybersecurityalliance/kestrel-lang/branch/develop/graph/badge.svg?token=HM4ax10IW3 :target: https://codecov.io/gh/opencybersecurityalliance/kestrel-lang :alt: Code Coverage
.. |black| image:: https://img.shields.io/badge/code%20style-black-000000.svg :target: https://github.com/psf/black :alt: Code Style: Black
SANS Threat Hunting Summit 2021: [SANS'21 session recording]RSA Conference 2021: [RSA'21 session recording]