STREAMLINING INCIDENT RESPONSE WITH OSQUERY AND KANSA BY

STREAMLINING INCIDENT RESPONSE WITH OSQUERY AND KANSA BY: SAMUEL SANCHEZ

WHAT ARE SOME ISSUES ENCOUNTERED DURING AN INCIDENT RESPONSE? • 91% of respondents to a survey conducted by Enterprise Strategy Group said that response efficiency is limited by the time and effort spent on manual processes • 97% of respondents are either automating or planning to automate some of their incident response plans within the next 18 months • Incident detection and escalation • Lack of a budget

WHAT ARE SOME ISSUES ENCOUNTERED DURING AN INCIDENT RESPONSE? (CONTINUED) • High cost for an inefficient process • Security awareness training • Processes and procedures are not the same across all organizations

WHAT CAN WE DO TO ADDRESS SOME OF THESE ISSUES? • Provide proper security awareness training to employees • Properly identify Incidents so that they can be escalated adequately • Automate where possible to increase efficiency • Take advantage of Open Source tools

WHAT IS KANSA? • Kansa is a powershell based incident response framework • Kansa is modular • Kansa makes it simple to gather important information that can be useful during an Incident. • Works natively with Windows • Is open source

WHAT INFORMATION CAN YOU GATHER WITH KANSA? • Services information • Autorun information • Process dump • ARP data • Netstat information • Local admin information

WHAT IS OSQUERY? • OSQUERY was developed by Facebook in 2014 • Turns operating system into a relational database • Allows you to write SQL queries to “ask” the Operating System questions • OSQUERY is also modular • Cross platform • Large-scale host monitoring

WHAT INFORMATION CAN YOU GATHER WITH OSQUERY? • Running processes • Kernel modules loaded • Active user accounts • Active network connections • Disk events

WHY USE KANSA AND OSQUERY? NOT JUST ONE • Both tools are extremely powerful. I believe using both tools in tangent could be beneficial. While Kansa is great for single endpoint reconnaissance, it (natively) lacks the widespread deployment that osquery supports natively. So if an incident is spreading across an organization, osquery can make it easy to gather all necessary information at once.

WHAT MAKES THESE TOOLS BETTER THAN COMMONLY USED COMMERCIAL TOOLS? • Let’s compare the capabilities of Kansa and osquery with a commonly used IDR solution like Insight. IDR by Rapid 7. In my experience, Insight. IDR is just log based. Meaning that it is just monitoring logs that are generated as they occur. While Kansa and osquery are able to freely explore the entire OS and are not bound to just what the logs give you.