5 ms·

I'm a little confused as to running the Suricata, Zeek and the Elasticsearch stack on Kali. I think of these tools run on a server, rather than a desktop. And

I'm a little confused as to running the Suricata, Zeek and the Elasticsearch stack on Kali. I think of these tools run on a server, rather than a desktop. And it seems like SecurityOnion scratches this niche. I do like the idea of Kali Purple though - curious to check it out.

_8j50 4y ago
Yeah, very unusual. Purpleteam is usually over some prod or prod-like environment. I think they want you to put this in your purpleteam lab not as your actual defensive stack. Might work for some folks but imo, the logging/detection/alerting part should alway be your actual prod stack but you can simulate attacks in a lab environment. What I have seen in the industry at large is a lot of purpleteam excercises are done in production, a red team excercise blended with a blue team investigation and response.
milkshakes 4y ago
These tools (-elasticsearch) run on a server that's usually connected to a network tap that collects traffic from endpoints and servers alike. Running them locally, a tap, and a server are unnecessary.
mr_toad 4y ago
If you have local logs and you’re not in an enterprise environment it makes sense to analyse the logs locally.
wronglebowski 4y ago
IMO this is lowering the barrier of entry to newbies. I work in this space and often users coming out of boot camps that want to set up their own labs for learning have a steep learning curve. Such is the difficulty with entering cybersecurity without an IT background, for better or worse.
lorenzo95 4y ago
From what I can tell they call it a soc in a box. They have a wiki on how you are supposed to build it (on proxmox). Here is a link to their architecture diagram for it. https://gitlab.com/kalilinux/kali-purple/documentation/-/raw/main/pictures/Kali-Purple-03-Architecture.png https://gitlab.com/kalilinux/kali-purple/documentation/-/raw... It is intended mostly for training purposes. I think it looks pretty neat for a start. We'll see where the community takes it over the next couple of years.

_8j50 4y ago

Yeah, very unusual. Purpleteam is usually over some prod or prod-like environment. I think they want you to put this in your purpleteam lab not as your actual defensive stack. Might work for some folks but imo, the logging/detection/alerting part should alway be your actual prod stack but you can simulate attacks in a lab environment. What I have seen in the industry at large is a lot of purpleteam excercises are done in production, a red team excercise blended with a blue team investigation and response.

milkshakes 4y ago

These tools (-elasticsearch) run on a server that's usually connected to a network tap that collects traffic from endpoints and servers alike. Running them locally, a tap, and a server are unnecessary.

mr_toad 4y ago

If you have local logs and you’re not in an enterprise environment it makes sense to analyse the logs locally.

wronglebowski 4y ago

IMO this is lowering the barrier of entry to newbies. I work in this space and often users coming out of boot camps that want to set up their own labs for learning have a steep learning curve. Such is the difficulty with entering cybersecurity without an IT background, for better or worse.

lorenzo95 4y ago

From what I can tell they call it a soc in a box. They have a wiki on how you are supposed to build it (on proxmox). Here is a link to their architecture diagram for it. https://gitlab.com/kalilinux/kali-purple/documentation/-/raw/main/pictures/Kali-Purple-03-Architecture.png https://gitlab.com/kalilinux/kali-purple/documentation/-/raw... It is intended mostly for training purposes. I think it looks pretty neat for a start. We'll see where the community takes it over the next couple of years.