You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It is STRONGLY recommended that you stop ALL Arkime captures and viewers before proceeding. Use 'db.pl http://localhost:9200 backup' to backup db first.
127
127
128
128
There is 1 elastic search data node, if you expect more please fix first before proceeding.
Copy file name to clipboardExpand all lines: Arkime/queries/README.md
+23-14Lines changed: 23 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
Arkime viewer already includes comprehensive documentation under `/help` url, aka *the owl logo*. This section only serves to provide some context and examples. **Please refer to official docs for up-to-date reference for field types, supported expressions, etc**.
4
4
5
5
See your `singlehost` VM Arkime installation for `/help`
6
-
*http://192.168.56.11:8005/help
6
+
* http://<singlehost-ip>:8005/help
7
7
8
8
## Viewer tabs
9
9
@@ -53,15 +53,18 @@ User administration tab. Various user account limitations can be can be configur
53
53
54
54
## Tasks
55
55
56
-
**On exercise Arkime data.**
56
+
**NB! These tasks are meant to be performed on real cyber exercise data (not simulated traffic in `singlehost` VM). Please wait for the instructors to provide credentials and guidelines on accessing the Exercise Arkime environment.**
57
57
58
-
* Find plaintext http on port 443;
59
-
* Filter for traffic that contains data;
60
-
* Investigate time-series data per gamenet host;
61
-
* Drill down to specific protocols;
62
-
* Investigate traffic between workstations;
58
+
* Find plaintext HTTP on port 443;
59
+
*Sometime there's no data in a session. Filter for traffic that contains data;
60
+
* Investigate time-series data per gamenet host (pick some hosts of interest);
61
+
* Drill down to specific protocols (HTTP, SMB, TLS, etc.);
62
+
* Investigate traffic between workstations, don't forget IPv6;
63
63
* Filter only traffic for your team;
64
64
65
+
If you are done with those, more tasks might be available from the instructors.
66
+
67
+
65
68
# API
66
69
67
70
[Arkime v3 API reference](https://arkime.com/apiv3)
@@ -72,24 +75,30 @@ Viewer is nothing more than HTTP endpoint behind digest authentication that aggr
72
75
73
76
# Hunting trip
74
77
75
-
## Task
78
+
## RT sessions in the classroom
79
+
80
+
* We might have someone from various RT sub-teams brief us on their activities during the previous Exercise.
81
+
* Pay attention to: Which machines were involved? When was the attack conducted? Which protocols were used? Was it encrypted or not?
82
+
* Takes notes! This information might be useful later when hunting for those specific attacks/events.
83
+
84
+
## Tasks
76
85
77
86
* Your task is to group up and go on a hunting trip.
78
87
* The goal, if it can be called like that, is to investigate sessions and IP addresses to identify Red team servers, compromised hosts, strange traffic patterns and possible causes, to differentiate scoring and connectivity from malicious traffic, etc.
79
88
***There are no right or wrong answers, no ground truth!!!** Only traffic that is interesting and noise.
80
89
***Note down your findings and possible explanations**.
81
90
* Present your approach and findings at the end!
82
-
* You may be called to give a status update during work. Don't be afraid to say you are stuck - other teams may have ideas or suggestions to help you out.
91
+
* You may be called to give a status update during work. Don't be afraid to say you are stuck - other people (or instructors) around you may have ideas or suggestions to help you out.
83
92
84
-
Some ideas and suggestions for getting started:
93
+
## Some ideas and suggestions for getting started:
85
94
* No one query nor API call will give you the whole picture, you must pivot between queries.
86
95
* Use API to your advantage for collectiong possible indicators, then investigate by hand. Write off sessions that are not interesting, collect new indicators from those that are. Rinse and repeat.
87
-
* Start by looking for common indicators - script tags in user-agents and URL-s, mistyped domains, strange peaks of traffic, IDS alerts, well-known protocols on non-standard ports, non-standard protocol on standardized ports, etc. Then look at involved IP addresses. Anything coming from simulated internet? See what else has that IP doing.
88
-
* IP addresses can be changed but may nevertheless exhibit common patterns, for example ja3 hashes, TLS certificate fingerprints, common URI patterns, cookies, etc.
96
+
* Start by looking for common indicators - script tags in user-agents and URL-s, mistyped domains, strange peaks of traffic, IDS alerts, well-known protocols on non-standard ports, non-standard protocol on standardized ports, etc. Then look at involved IP addresses. Anything coming from the simulated internet? See what else has that IP doing.
97
+
* IP addresses can be changed but may nevertheless exhibit common patterns, for example JA3 hashes, TLS certificate fingerprints, common URI patterns, cookies, etc.
89
98
* Arkime lets you apply views and tag sessions. Use that! If something is not interesting, mark it as such and get rid of it. Whatever is left might be interesting.
90
99
* So, you found one connection going to or coming from a CnC server...and then nothing. It may be initial compromise and interesting traffic is happening through some other IP or protocol. Are there any new streams that started exactly after that initial session?
91
100
* What about traffic between targets and workstations? Any patterns or indicators for filtering out lateral movement?
92
-
* Do not forget that you can also search from packets in Hunt tab. Just be sure to apply a strong expression beforehand. Let's not kill the capture server.
101
+
* Do not forget that you can also search from packets in Hunt tab. Just be sure to apply a strong expression beforehand. There's a lot of PCAPs. Let's not kill the Arkime server.
93
102
* Have a cool idea for search but no idea how to do it in Arkime? Ask the instructurs, that's why we are here.
94
-
* On that note, have a cool idea and making progress? Let us and other teams know. We can mark it down and help out everyone.
103
+
* On that note, have a cool idea and making progress? Let us and others know. We can mark it down and help out everyone.
0 commit comments