Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Automatic canary folder management #33

Closed
qjerome opened this issue May 10, 2021 · 0 comments
Closed

Automatic canary folder management #33

qjerome opened this issue May 10, 2021 · 0 comments
Labels
enhancement New feature or request next-release feature available in next release

Comments

@qjerome
Copy link
Contributor

qjerome commented May 10, 2021

  • make canary folders configurable
    • configure file extensions
    • configure folder locations
    • actions to handle touched canaries
  • detect when canaries are touched (evaluate two possibilities)
    • generate rule(s) on the fly
    • through event hooks
@qjerome qjerome added the enhancement New feature or request label May 10, 2021
@qjerome qjerome added the next-release feature available in next release label May 21, 2021
qjerome added a commit that referenced this issue Jun 22, 2021
@qjerome
Fixed issues:
26f3610 
    - Implement actionnable rules (#28)
    - Implement event count (#29)
    - Enrich events with signature information (#32)
    - Automatic canary folder management (#33)
    - Ability to configure audit policies from WHIDS (#34)
    - Set File System Audit ACLs from config (#35)
qjerome added a commit that referenced this issue Jun 22, 2021
@qjerome
Refactoring:
9e12a1a 
    - hids package
    - hook functions taking hids as first parameter to easily access config from hooks
    - removed global variables shared between hooks and HIDS
    - manager command handler moved from api package to hids to easily access hids config

Fixed issues:
    - Implement actionnable rules: #28
    - Implement event count: #29
    - Enrich events with signature information: #32
    - Automatic canary folder management: #33
    - Ability to configure audit policies from WHIDS config: #34
    - Set File System Audit ACLs from config: #35
    - Generate IR ready reports on detections: #36
    - Dump process tree: #38
    - Enrich event with Gene process scoring: #40
    - Add Admin API to list and download artifacts dumped: #42
    - Directory listing command: #44
    - Implement hash command: #45
    - Implement osquery command: #46
    - Implement terminate command: #47
    - Implement stat command: #48
    - Implement walk command: #49
    - Implement find command: #50
    - Implement report command: #51
    - Implement processes command: #52
    - Implement drivers command: #53
@qjerome qjerome closed this as completed Sep 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request next-release feature available in next release
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@qjerome