GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → mvelazc0 → Oriana

mvelazc0 / Oriana

Licence: bsd-3-clause
Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

Programming Languages

python
139335 projects - #7 most used programming language

Labels

dfirincident-responsethreat-hunting

Projects that are alternatives of or similar to Oriana

MindMaps
#ThreatHunting #DFIR #Malware #Detection Mind Maps
Stars: ✭ 224 (+47.37%)
Mutual labels:  incident-response, dfir, threat-hunting
Mthc
All-in-one bundle of MISP, TheHive and Cortex
Stars: ✭ 134 (-11.84%)
Mutual labels:  dfir, incident-response, threat-hunting
Beagle
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
Stars: ✭ 976 (+542.11%)
Mutual labels:  dfir, incident-response, threat-hunting
ir scripts
incident response scripts
Stars: ✭ 17 (-88.82%)
Mutual labels:  incident-response, dfir, threat-hunting
fastfinder
Incident Response - Fast suspicious file finder
Stars: ✭ 116 (-23.68%)
Mutual labels:  incident-response, dfir, threat-hunting
Threatpinchlookup
Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension
Stars: ✭ 257 (+69.08%)
Mutual labels:  dfir, incident-response, threat-hunting
rhq
Recon Hunt Queries
Stars: ✭ 66 (-56.58%)
Mutual labels:  incident-response, dfir, threat-hunting
Threathunt
ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
Stars: ✭ 92 (-39.47%)
Mutual labels:  dfir, incident-response, threat-hunting
Threathunting
A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
Stars: ✭ 738 (+385.53%)
Mutual labels:  dfir, threat-hunting
Cortex4py
Python API Client for Cortex
Stars: ✭ 22 (-85.53%)
Mutual labels:  dfir, incident-response
Thehive4py
Python API Client for TheHive
Stars: ✭ 143 (-5.92%)
Mutual labels:  dfir, incident-response
My Arsenal Of Aws Security Tools
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
Stars: ✭ 6,464 (+4152.63%)
Mutual labels:  dfir, incident-response
Patrowldocs
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 105 (-30.92%)
Mutual labels:  incident-response, threat-hunting
Cyberchef Recipes
A list of cyber-chef recipes and curated links
Stars: ✭ 619 (+307.24%)
Mutual labels:  dfir, incident-response
Historicprocesstree
An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.
Stars: ✭ 46 (-69.74%)
Mutual labels:  dfir, incident-response
Scripting
PS / Bash / Python / Other scripts For FUN!
Stars: ✭ 47 (-69.08%)
Mutual labels:  dfir, incident-response
Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
Stars: ✭ 676 (+344.74%)
Mutual labels:  dfir, incident-response
Yeti
Your Everyday Threat Intelligence
Stars: ✭ 1,037 (+582.24%)
Mutual labels:  dfir, threat-hunting
Sysmon Modular
A repository of sysmon configuration modules
Stars: ✭ 1,229 (+708.55%)
Mutual labels:  dfir, threat-hunting
Signature Base
Signature base for my scanner tools
Stars: ✭ 1,212 (+697.37%)
Mutual labels:  dfir, threat-hunting
View All Similar Projects ➔

Oriana

Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

Oriana was built using Python, the Django Web Framework, the Postgres database and Bootstrap. The Windows Event exporting script was written in PowerShell.

For more information on how Oriana works, visit the Wiki https://github.com/mvelazc0/Oriana/wiki

To see Oriana in action, check the demos https://github.com/mvelazc0/Oriana/wiki/Demos

Oriana was initially presented at Derbycon VII (https://www.youtube.com/watch?v=hVTkkkM9XDg) and released at the SANS Threat Hunting Summit (https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1536265369.pdf)

Quick Start Guide

Prerequisites

On Windows

Download & install Python 2.7 https://www.python.org/downloads/
Download & install Postgres https://www.postgresql.org/download/windows/

On Linux

sudo apt-get install postgresql postgresql-contrib

Installation

git clone https://github.com/mvelazc0/Oriana.git
pip install -r Oriana/requirements.txt

Hunting

Export Events

Oriana relies on a PowerShell script to export certain Windows events into CSV files. The files will be written to a network share specified on the source code (dont forget to change this !) that can then be loaded into the database for indexing and analysis. The script needs to run in the context of an Administrator and can be deployed in different ways:

  • Using a software deployment platform like SSCM
  • Command Execution through an agent
powershell.exe -File \\path\GetEvents.ps1
  • Powershell Remoting
 Invoke-Command -ComputerName PC1,PC2 -FilePath C:\path\GetEvents.ps1

Setup Database

python oriana.py -A createdb
python oriana.py -A startdb

createdb will ask for a Postgres username/password and will create a database as well as update the Django configuration files that allow it to connect to Postgres. Note: settings.py will contain the password in clear text.

startdb will initialize oriana's database schema.

Load Events

python oriana.py -A load -d [path_to_logs]

The load action will read the CSV files located on the path and store all events in the database.

Run Analytics

python oriana.py -A analytics

Analytics details can be found on the Wiki.

Start Web Server

python oriana.py -A runserver

Oriana will run on port 8080 of the loopback interface http://127.0.0.1:8000

Happy Hunting !

Authors

Contributors

License

This project is licensed under the BSD 3-Clause License - see the LICENSE file for details

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].