Please enable JavaScript.

Coggle requires JavaScript to display documents.

1️⃣ Preparation Phase 🛡️, 🟢 Phase 1 - Preparation (Enterprise Linux…

- - - - Logs may not exist
      - Evidence may be lost
      - Attack timeline cannot be created
      - Root cause analysis becomes impossible
      - Recovery becomes slow
    - - Faster detection
      - Better investigation
      - Legal evidence preservation
      - Reduced downtime
      - Compliance readiness
- - - - Responsible:
        
        Overall incident coordination
        
        Communication with management
        
        Decision making
    - - Responsible:
        
        Monitor alerts
        
        Analyze logs
        
        Detect malicious activity
    - - Responsible:
        
        Server investigation
        
        System isolation
        
        Evidence collection
    - - Responsible:
        
        Firewall investigation
        
        Network traffic analysis
        
        Blocking malicious IP addresses
    - - Responsible:
        
        Disk analysis
        
        Memory analysis
        
        Evidence preservation
    - - Responsible:
        
        Regulatory reporting
        
        Business decisions
- - - - Defines:
        
        What is a security incident
        
        Who responds
        
        How incidents are classified
        
        Escalation procedure
        
        Communication process
  - - - Example:
        
        Virus
        
        Trojan
        
        Ransomware
    - - Example:
        
        Stolen credentials
        
        Brute force SSH attack
    - - Example:
        
        Sensitive information exposure
    - - Example:
        
        Normal user becomes root
    - - Example:
        
        Server resource exhaustion
- - - - hostname
    - - hostnamectl
    - - ip addr
    - - cat /etc/os-release
    - - uname -r
    - - systemctl list-units --type=service
- - - - ↓
    - - ↓
    - - ↓
    - - ↓
- - - - RHEL / CentOS:
        
        /var/log/secure
      - Ubuntu:
        
        /var/log/auth.log
      - Contains:
        
        SSH login attempts
        
        sudo usage
        
        failed authentication
    - - /var/log/messages
      - Contains:
        
        Kernel messages
        
        Services
        
        System events
    - - /var/log/kern.log
    - - /var/log/
- - - - Linux system logs
      - Authentication logs
      - Application logs
    - - Central log server
      - SIEM platform
  - - - yum install rsyslog -y
    - - apt install rsyslog -y
  - - - /etc/rsyslog.d/siem.conf
    - - . @@10.10.10.50:514
    - - .
        
        Send all logs
      - @
        
        TCP protocol
      - 10.10.10.50
        
        SIEM server IP
      - 514
        
        Syslog port
- - - - grep "Failed password" /var/log/secure
- - - - yum install chrony -y
    - - apt install chrony -y
- - - - User accounts
    - - Password hashes
    - - Groups
  - - - grep useradd /var/log/secure
    - - cat /etc/passwd
    - - cat /etc/sudoers
    - - ls /etc/sudoers.d/
- - - - Purpose:
        
        File integrity
        
        Root detection
        
        Log monitoring
    - - Purpose:
        
        File change detection
    - - Purpose:
        
        Linux audit tracking
    - - Purpose:
        
        Mandatory Access Control
  - - - Packet capture
    - - Traffic analysis
    - - Network IDS
- - - - -w /etc/sudoers -p wa -k sudo_changes
- - - - Any event that violates security policy.
      - Unauthorized access.
      - Malware infection.
      - Ransomware.
      - Data theft.
      - Privilege escalation.
      - Insider attack.
      - Web server compromise.
      - Denial of Service attack.
    - - Any activity occurring on a system.
      - Login.
      - Logout.
      - File creation.
      - Service restart.
      - Network connection.
    - - Warning generated by monitoring tools.
      - SIEM
      - IDS
      - IPS
      - Endpoint Detection and Response
      - Antivirus
    - - Preparation
      - Identification
      - Containment
      - Eradication
      - Recovery
      - Lessons Learned
  - - - Leads investigation
      - Makes decisions
      - Coordinates response
    - - Monitor alerts
      - Initial investigation
      - Escalation
    - - Deep investigation
      - Log analysis
      - Threat validation
    - - Advanced malware analysis
      - Threat hunting
      - Root cause analysis
    - - Server isolation
      - Patch management
      - User management
      - Service recovery
      - Log collection
    - - Firewall
      - Switches
      - Routers
      - VLAN
      - VPN
    - - Disk image
      - Memory acquisition
      - Timeline analysis
      - Evidence preservation
  - - - Web Servers
      - Database Servers
      - DNS Servers
      - Mail Servers
      - File Servers
      - Application Servers
      - Virtual Machines
    - - Critical
      - High
      - Medium
      - Low
    - - RHEL
      - Rocky Linux
      - AlmaLinux
      - Ubuntu Server
      - Oracle Linux
      - SUSE Linux Enterprise
  - - - /etc/sudoers
      - /etc/sudoers.d/
      - visudo
    - - /etc/ssh/sshd_config
      - PermitRootLogin no
      - PasswordAuthentication no
      - AllowUsers
      - AllowGroups
  - - - Detect attacks
      - Investigate incidents
      - Compliance
      - Forensics
    - - /var/log/
      - /var/log/messages
      - /var/log/secure
      - /var/log/auth.log
      - /var/log/syslog
      - /var/log/audit/
      - /var/log/httpd/
      - /var/log/nginx/
      - /var/log/journal/
  - - - AIDE
      - Tripwire
      - OSSEC
    - - ClamAV
      - YARA
      - rkhunter