HomeHealthBlack Hat Europe 2023 NOC: Risk Looking

Black Hat Europe 2023 NOC: Risk Looking

Cisco is a longtime associate of the Black Hat NOC and 2023 was our seventh 12 months supporting Black Hat Europe. Cisco is the Official Cellular Gadget Administration, Malware Evaluation and DNS (Area Identify Service) Supplier.

We work with the opposite official suppliers to carry the {hardware}, software program and engineers to construct and safe the community, for our joint buyer: Black Hat.

  • Arista: Wired and Wi-fi Community Gear
  • Corelight: Community Analytics and Detection
  • NetWitness: Risk Detection & Response, Identification
  • Palo Alto Networks: Community Safety Platform

The first mission within the NOC is community resilience. The companions additionally present built-in safety, visibility and automation, a SOC contained in the NOC.

Exterior the NOC had been associate dashboards for the attendees to view the amount and safety of the community visitors.

From Malware to Community Visibility

Cisco was first requested to supply automated malware evaluation, again in 2016. Our contributions to the community and safety operations advanced, with the wants of the client.

The NOC leaders allowed Cisco (and the opposite NOC companions) to usher in extra software program to make our inside work extra environment friendly and have larger visibility; nonetheless, Cisco will not be the official supplier for Prolonged Detection and Response, Community Detection and Response or collaboration.

  • Cisco XDR: Risk Looking / Risk Intelligence Enrichment / Government dashboards / Automation with Webex
  • Cisco XDR Analytics (Previously Safe Cloud Analytics / Stealthwatch Cloud): community visitors visibility and menace detection
  • Cisco Webex: Incident notification and staff collaboration

The Cisco XDR Command Middle dashboard tiles made it straightforward to see the standing of every of the linked Cisco Safe applied sciences, and the standing of ThousandEyes brokers.

When the companions deploy to every convention, we arrange a world class community and safety operations heart in a couple of days. Our aim stays community up time and creating higher built-in visibility and automation. Black Hat has the decide of the safety trade instruments and no firm can sponsor/purchase their means into the NOC. It’s invitation solely, with the intention of range in companions, and an expectation of full collaboration. As a NOC staff comprised of many applied sciences and corporations, we’re constantly innovating and integrating, to supply an general SOC cybersecurity structure answer.

Beneath are the Cisco XDR integrations for Black Hat Europe, empowering analysts to analyze Indicators of Compromise (IOC) in a short time, with one search.

We recognize alphaMountain.ai, Pulsedive and Recorded Future donating full licenses to Cisco, to be used within the Black Hat Europe 2023 NOC.


A core built-in know-how within the Black Hat NOC for Cisco is NetWitness sending suspicious information to Risk Grid (now Safe Malware Analytics). We expanded this in Black Hat Asia 2023 with Corelight additionally submitting samples. Over 4,600 samples had been submitted.

The NOC analysts additionally used Malware Analytics to analyze suspicious domains, with out the chance of an infection. An instance was an alert for cryptomining on the community by Umbrella, accessed by a pupil in a Black Hat coaching course.

Slightly than going to the web site on a company or Black Hat belongings, we had been capable of work together with the web site within the glovebox, together with downloading and putting in the web site payload.

We allowed the payload to make the adjustments on the digital machine, because the person skilled.

For cryptomining, we permit the exercise to happen, however alert the person that their system is getting used for that function.

Because the payload was not malicious, we didn’t notify the person of an an infection.

XDR Analytics, by Abhishek Sha

XDR Analytics (previously Safe Cloud Analytics, or Stealthwatch Cloud) lets you achieve the visibility and steady menace detection wanted to safe your public cloud, non-public community and hybrid surroundings. XDR Analytics can detect early indicators of compromise within the cloud or on-premises, together with insider menace exercise and malware, coverage violations, misconfigured cloud belongings, and person misuse. These NDR (Community Detection and Response) capabilities are native performance inside Cisco XDR. Cisco XDR was out there beginning July 31st 2023, so we had some expertise below our belt for using its capabilities.

XDR Analytics outfitted us with the aptitude to establish a variety of alerts, considerably enhancing our cybersecurity measures at Black Hat.

Deciphering Cyber Threats: A Black Hat Case Examine in XDR Analytics

Whereas scanning web hosts is a typical observe in cybersecurity, it’s necessary to notice that the context and goal of those scans can considerably influence the seriousness of the scenario. If these scans had been to shift focus in the direction of different convention members or, extra critically, in the direction of the community infrastructure itself, it could immediate a extra severe response.

This state of affairs underscores the necessity for steady vigilance and a proactive method in monitoring and responding to potential cyber threats. That is the essence of efficient cybersecurity administration – a course of that’s continuously examined, improved, and fortified within the face of potential threats.

Throughout our community vigilance at Black Hat, Ivan and I encountered a state of affairs that clearly highlighted the essential position of XDR Analytics. XDR Analytics raised an alert when it detected that a number of inside IP addresses had been speaking with sure exterior IP addresses. Intriguingly, these exterior IP addresses had been on our blocklist for manufacturing safety environments.

Leveraging the netflow telemetry we had been receiving, we employed the Occasion Viewer function on XDR Analytics to discern the kind of visitors being transmitted to these addresses. On all noticed logs, the one protocol was ICMP.

A full search confirmed that no visitors except for ICMP linked to the exterior IPs.

By using graphs in XDR Analytics, we gained insights into the amount of visitors despatched to the exterior IP addresses. This proved instrumental in figuring out whether or not any potential ICMP tunneling was going down, primarily based on the scale of the general visitors.

We then centered our investigative efforts on these suspicious exterior IP addresses utilizing Cisco XDR. The examination revealed that this IP was flagged on different blocklists as nicely.

Additional evaluation on the Cisco XDR graph disclosed a community of different endpoints that had additionally been interacting with these doubtful IP addresses. This revelation uncovered the far-reaching affect of those IPs and enabled us to visualise the varied interconnected actions.

Lastly, we resolved the IP addresses on Umbrella and deduced that these IP addresses had been related to a “Personal Web Entry VPN”. It appeared that the endpoint was testing the reachability of all these relays hosted in numerous places.

Regardless of this visitors being innocuous, we capitalized on XDR and XDR Analytics to realize a greater understanding and context of this incident. This expertise underscores the efficacy of those instruments in enhancing cybersecurity defenses.

Mastering Risk Detection with Assault Chains

XDR Assault Chain is a function that enables us to correlate a number of alerts into a bigger investigation. We use extracted alert meta information to find out what the alerts have in widespread, which we confer with as widespread indicators. Frequent indicators embody gadgets, IP addresses, host names, and usernames. We then comply with the MITRE ATT&CK® framework to additional establish the techniques, strategies, and procedures (TTPs) to mannequin the sequencing of actions and menace behaviors which could possibly be early indications of an assault.

On this occasion, we’re observing an assault chain comprising a number of “Suspected Port Abuse (Exterior)” occasions. Sometimes, with out an assault chain, every of those occasions would must be investigated individually, a course of that could possibly be time-consuming and doubtlessly much less efficient.

Nonetheless, the great thing about an assault chain lies in its means to consolidate a number of alerts right into a singular, interconnected occasion. This technique gives a holistic overview of the varied alerts, the gadgets concerned, and their respective roles, all inside the framework of a single mixed occasion.

The facility of this method is that it eliminates the necessity for an exhaustive investigation of every separate alert. As a substitute, it presents a complete, contextualized view of the scenario, enabling a extra environment friendly and efficient response to potential threats.

With this info, we had been capable of work with the menace hunters of NetWitness, Palo Alto Networks and Corelight, to find out the chance to the community and attendees. Actions involving malware what could be blocked on a company community have to be allowed, inside the confines of Black Hat Code of Conduct.

Black Hat Insights: Cisco Telemetry Dealer

Cisco Telemetry Dealer (CTB) acts as a foundational pillar for the clever telemetry aircraft, thereby future-proofing the telemetry structure. It enhances visibility and context into the telemetry that drives the merchandise that depend on it, facilitating telemetry brokering, filtering, and sharing. The Telemetry Dealer is the end result of years of administration, troubleshooting, reworking, and sharing telemetry to empower Safety and Community Analytics merchandise.

On the Black Hat occasion, we employed the Telemetry Dealer to course of a SPAN (Switched Port Analyzer is a devoted port on a change that takes a mirrored copy of community visitors from inside the change to be despatched to a vacation spot) of all community visitors, together with the Netflow generated from Palo Alto Networks firewalls. This was a part of our NOC collaboration and integrations. We then made all this information out there to the menace hunters in Cisco XDR.

A typical Telemetry Dealer deployment necessitates each a dealer node and a supervisor node. To reduce our on-premises footprint, we selected to handle the dealer node by means of XDR Analytics. This performance was activated by the XDR Analytics Engineering staff on our Black Hat XDR Analytics portal from the backend, as it’s at present in beta. This enabled us to handle the dealer node and evaluation the metrics straight from the cloud.

We additionally put in an extra plugin generally known as the Circulation Generator Plugin. This plugin enabled us to generate Netflow telemetry from the ingested SPAN visitors. With the beta code, we had been lucky to have the help of the engineering staff to check the newest and most superior know-how Cisco has to supply. A particular shoutout to the engineering staff for his or her invaluable help.

Unleashing the Energy of Cisco XDR Automate at Black Hat Europe

With the ever-evolving technological panorama, automation stands as a cornerstone in reaching XDR outcomes. It’s certainly a testomony to the prowess of Cisco XDR that it boasts a totally built-in, sturdy automation engine.

Cisco XDR Automation embodies a user-friendly, no-to-low code platform with a drag-and-drop workflow editor. This modern function empowers your Safety Operations Middle (SOC) to hurry up its investigative and response capabilities. You may faucet into this potential by importing workflows straight from Cisco or by flexing your inventive muscle tissues and crafting your individual.

Cisco XDR introduces a trailblazing idea generally known as Automation Guidelines. This contemporary tackle automation guarantees to revolutionize the best way you work together with the system. Through the Black Hat Europe occasion, we flexed our creative muscle tissues and dropped at life an XDR Automate workflow. This workflow was designed to spring into motion each time XDR Analytics posted an incident. The workflow would delve into the guts of the alert, extracting essential particulars such because the alert description, publish time, entity teams, and observations. The parsed outcomes had been then broadcasted on Webex Groups by way of a message and concurrently posted on Slack. This ensured that different menace hunters may readily devour the knowledge. Moreover, the workflow might be shared on GitHub, encouraging a wider viewers to grasp and recognize the automation course of.

The automation output is under. Within the realm of cybersecurity, Cisco XDR Automate is pushing the boundaries, redefining how we understand automation and its limitless prospects.

“Collaboration” and “Continuity” – for profitable menace searching, by Ivan Berlinson

Throughout Black Hat, the NOC opens early earlier than the occasion and closes later after the trainings/briefings full for the day. Which means each analyst place have to be lined by a bodily, uninterrupted presence for about 11 hours per day. Even with the utmost dedication to your position, generally you want a break, and a brand new potential incident doesn’t wait till you’ve completed the earlier one.

Abhishek and I shared the position of Cisco XDR analyst, with morning and afternoon shifts. We now have labored carefully collectively to deal with incidents or alerts from Cisco XDR analytics and to actively hunt threats. It was an incredible collaboration! It was necessary that we didn’t work in silos and that we acted as a staff to verify we maximized all our efforts. To do that, we in fact wanted good communication, however we additionally wanted a platform that may help us and allow us to doc and share info shortly and simply (the incident we’re at present engaged on, what we’ve discovered, what we’ve finished…).

The Cisco XDR incident supervisor and ribbons (with its browser extension) had been an incredible assist and saved us quite a lot of time. Let’s shortly see how we used them in a typical investigation.

Whereas I used to be performing a menace hunt primarily based on a Malware Analytics (Risk Grid) report displaying phishing indicators, XDR analytics alerted us about a number of communications to locations on a listing of nations to be monitored and utilizing a non-standard protocol/port mixture.

Cisco XDR – Incident abstract

I took a fast have a look at the incident, and because of XDR assault chain and automated enrichment, I had an prompt view of the belongings impacted and the a number of locations concerned.

Cisco XDR – Incident principal view (with auto-enrichment)

Telemetry from the NetWitness integration enriched the incident and confirmed the visitors, however the built-in menace intelligence sources didn’t present any malicious verdicts or menace indicators associated to those IP addresses. Additional investigation was required to verify this potential incident.

Investigation with telemetry from NetWitness

I added a observe to the incident as a part of the “Affirm Incident” step of the response plan, however as I used to be already on one other exercise, I requested Abhishek to get into the sport.

Cisco XDR – Guided Response

Abhishek was capable of additional examine communication to these IPs within the uncooked community flows collected by XDR analytics and collaborate with the NetWitness staff, who can look deep inside packet. However he doesn’t want to write down down the IPs on paper or memorize them, we will use the Cisco XDR ribbon built-in in our browser to in one-click extract any observables in an internet web page.

Add observables to casebook utilizing Cisco XDR ribbon (browser-plugin)

We will then add them to a casebook shared robotically between us and out there in all places.

Casebook out there for Abhishek within the XDR Analytics console

A couple of minutes later, I had completed with my earlier file and was assured about going to lunch, figuring out that Abhishek was on the case and had all the knowledge he wanted.

With the assistance of the Palo Alto analyst, it was confirmed that the visitors was authentic (QUIC – HTTP/3).

Affirmation from Palo Alto

Listed here are the browser extensions in your personal SOC use:

Community Visibility with ThousandEyes, by Adam Kilgore and Alicia Garcia Sastre

Black Hat Europe 2023 is the third consecutive convention with a ThousandEyes (TE) presence, following a proof of idea in Black Hat Asia 2023 and an preliminary deployment at Black Hat USA 2023. Constructing upon our first full deployment in Vegas, we had been centered on improving deployment course of, information baselining, and monitoring procedures.

{Hardware} and Deployment Course of

A number of the {hardware} we dropped at the convention

Similar to Black Hat USA 2023, we deployed 10 TE brokers on Raspberry Pi’s. Nonetheless, since ExCel London is a smaller venue, we had the identical variety of brokers to unfold throughout a smaller space—we nonetheless didn’t really feel like we had a full Thousand Eyes, however undoubtedly extra visibility. We unfold that visibility throughout core switching, Registration, the Enterprise Corridor, two- and four-day coaching rooms, and Keynote areas.

We additionally added a couple of equipment from classes realized in Vegas. Deploying TE brokers on micro-SDs is a time-consuming course of which requires connecting the micro-SD to a laptop computer utilizing a USB adapter. We invested in two adapters that may join 4 USB adapters without delay for extra streamlined deployment and scaling.

Economies of scale

At BH USA, we additionally developed a technique for deploying TE brokers wirelessly on Raspberry Pi (as lined on this weblog publish), regardless that this performance isn’t technically supported. At BH Europe, our intention was to depend on wired Pi brokers for the majority of the monitoring; nonetheless, the wi-fi entry factors shipped to the convention didn’t have a free ethernet port. Due to this we ended up doing a primarily wi-fi deployment once more, plus two wired brokers linked to switching infrastructure. The brand new wi-fi deployment revealed some documentation and course of enhancements to roll into the prior weblog publish.

Enabling wi-fi on the ThousandEyes Pi picture additionally makes the Pi extra vulnerable to overheating. The server room in London ExCel the place we did our preliminary provisioning had a cooling drawback and reached 28 levels Celsius (82 F) at one level. The warmth within the room induced a really quick failure of the wi-fi adapter, which initially made it seem that the wi-fi was not working in any respect. Nonetheless, we finally untangled the documentation and warmth associated issues and received all of the Pi’s deployed, the place they functioned stably all through the convention, with only some overheating incidents.

Modifications in out there personnel and {hardware} additionally necessitated a change within the Linux platform for configuring the scripts for persistent wi-fi deployment. We went with Ubuntu by way of VMWare Fusion on Mac laptops, which offered a clean deployment sequence.

Monitoring, Alerting, and Baselining

The wi-fi community at BH Europe had much less latency variation than BH USA, which required tuning of alert thresholds to scale back noise. At BH USA, we deployed a rule that fired when the latency on any agent exceeded two commonplace deviations above baseline. Nonetheless, in BH Europe this alert was firing on latency adjustments that had been statistically vital, however very minor in actual world phrases. For instance, the alert under fired when latency elevated 5.4ms+ above a 7.3ms baseline.

To regulate for smaller variations, we added a minimal threshold of 30ms change above baseline. This resulted in a a lot smaller set of extra helpful alerts, whereas nonetheless sustaining visibility into altering latency situations earlier than latency reached noticeably degraded ranges.

Trains, Planes, and Wi-fi Entry Factors

On the final day of the convention, NOC morning employees discovered the wi-fi community was inaccessible half-hour earlier than the convention opened for the day. Nothing will get the blood pumping like a community failure proper earlier than enterprise hours. Nonetheless, an expedited investigation revealed that solely the NOC was affected, and never the broader convention wi-fi infrastructure.

Troubleshooting revealed that the SSID was out there, however a lot of the endpoints couldn’t detect it. A fast collaboration with our buddies at Arista revealed that the endpoints making an attempt to hook up with 5 GHz had been having points, whereas the endpoints that had been linked at 6 GHz had been all fantastic—an necessary element.

This was in line with what we noticed within the ThousandEyes portal. There was one engineer with a ThousandEyes endpoint agent working earlier than the outage occurred. We jumped to agent views to test Wi-Fi stats.

Whereas we had been investigating, the SSID got here again at 5 GHz.

Reviewing the TE endpoint logs, we discovered that the endpoint was linked to wi-fi channel 116 earlier than the outage.

After restoration the endpoint was linked to channel 124.

Through the outage the endpoint was not able to connecting to the Wi-Fi, creating a niche within the logs the place no channel or sign power was out there. The channel change was indicative of the SSID coming again up and recalculating the most effective channel to promote the SSID.

So why did the wi-fi channel of the SSID change and what was the set off? Right here comes the fascinating half: The Black Hat convention is hosted at ExCeL London, lower than 4 km away from the London Metropolis airport. Keep in mind the preliminary channel of the SSID? It was 116, which is a Dynamic Frequency Choice (DFS) channel. These channels share the spectrum with climate radar and radar techniques.

To share using these channels in Wi-Fi, a mechanism was put in place by regulators to prioritise radar utilization, and that is precisely what DFS does. Wi-Fi gadgets will hear for radar occasions and both cease utilizing the channels or robotically transfer off these channels once they detect radar occasions.

As we’re so near the airport, will not be uncommon that one DFS occasion occurred. We’re simply fortunate it didn’t occur extra typically.

Do you wish to see the entire evaluation for your self? Because of a really useful function of ThousandEyes, you’ll be able to. All the knowledge of this mini outage was captured in a net accessible report. Be happy to click on round and discover all of the related info for your self. The outage began at 7.31 am. Probably the most insightful view may be discovered at Scheduled checks -> Community -> Click on on the dotted traces to reveal all of the nodes within the path visualization and see metrics extra clearly.

Meraki Methods Supervisor, by Paul Fidler and Connor Loughlin

Our eighth deployment of Meraki Methods Supervisor because the official Cellular Units Administration platform went very easily, and we launched a brand new caching operation to replace iOS gadgets on the native community, for pace and effectivity. Going into the occasion, we deliberate for the next variety of gadgets and functions:

  • iPhone Lead Scanning Units: 68
  • iPads for Registration: 9
  • iPads for Session Scanning: 12
  • Variety of gadgets deliberate in complete: 89

We registered the gadgets prematurely of the convention. Upon arrival, we turned every system on.

Then we ensured Location Companies enabled, all the time on.

As a substitute of utilizing a mass deployment know-how, like Apple’s Automated Gadget Enrollment, the iOS gadgets are “ready” utilizing Apple Configurator. This consists of importing a Wi-Fi profile to the gadgets as a part of that course of. In Las Vegas, this Wi-Fi profile wasn’t set to auto be part of the Wi-Fi, leading to the necessity to manually change this on 1,000 gadgets. Moreover, 200 gadgets weren’t reset or ready, so we had these to reimage as nicely.

Black Hat Europe 2023 was completely different. We took the teachings from US and coordinated with the contractor to arrange the gadgets. Now, for those who’ve ever used Apple Configurator, there’s a number of steps wanted to arrange a tool. Nonetheless, all of those may be actions may be mixed right into a Blueprint.

For Black Hat Europe, this included:

  • Wi-Fi profile
  • Enrollment, together with supervision
  • Whether or not to permit USB pairing
  • Setup Assistant pane skipping

In Meraki Methods Supervisor, we managed the purposes by the assigned use, designated by Tags. After we got here in on the primary morning of the Briefings, three iPhones wanted to be modified from lead scanning within the Enterprise Corridor, to Session Scanning for the Keynote, so the attendees may fill the corridor sooner. Reconfiguring was so simple as updating the Tags on every system. Moments later, they had been prepared for the brand new mission…which was necessary because the Keynote room stuffed to capability and needed to go to an overflow room.

We additionally had been capable of affirm the bodily location of every system, if wiping was required as a consequence of loss or theft.

Beneath you’ll be able to see web page one in every of 4 pages of Restrictions imposed by Meraki Methods Supervisor.

When it was time for the attendees to register, they only displayed their QR code from their private cellphone, as obtained in e-mail from Black Hat. Their badge was immediately printed, with all private particulars secured.

This goes with out saying, however the iOS gadgets (Registration, Lead Seize and Session Scanning) do have entry to non-public info. To make sure the safety of the info, gadgets are wiped on the finish of the convention, which may be accomplished remotely by means of Meraki Methods Supervisor. 

Content material Caching

One of many greatest issues affecting the iOS gadgets in BH USA 2023 was the fast have to each replace the iOS system’s OS as a consequence of a patch to repair a zero-day vulnerability and to replace the Black Hat iOS app on the gadgets. There have been a whole lot of gadgets, so this was a problem for every to obtain and set up. So, I took the initiative into trying into Apple’s Content material Caching service constructed into macOS.

Now, simply to be clear, this wasn’t caching EVERYTHING… Simply Apple App retailer updates and OS updates.

That is turned on withing System Setting and begins working instantly.

I’m not going to get into the weeds of setting this up, as a result of there’s a lot to plan for. However, I’d recommend that you just begin right here. The setting I did change was:

I checked to see that we had one level of egress from Black Hat to the Web. Apple doesn’t go into an excessive amount of element as to how this all works, however I’m assuming that the caching server registers with Apple and when gadgets test in for App retailer / OS replace queries, they’re then advised the place to look on the community for the caching server.

Instantly after turning this on, you’ll be able to see the default settings and metrics:

% AssetCacheManagerUtil settings

Content material caching settings:

    AllowPersonalCaching: true

    AllowSharedCaching: true

    AllowTetheredCaching: true

    CacheLimit: 150 GB

    DataPath: /Library/Software Help/Apple/AssetCache/Information

    ListenRangesOnly: false

    LocalSubnetsOnly: true

    ParentSelectionPolicy: round-robin

    PeerLocalSubnetsOnly: true

And after having this run for a while:

% AssetCacheManagerUtil settings

Content material caching standing:

Activated: true

    Energetic: true

    ActualCacheUsed: 528.2 MB

    CacheDetails: (1)

        Different: 528.2 MB

    CacheFree: 149.47 GB

    CacheLimit: 150 GB

    CacheStatus: OK

    CacheUsed: 528.2 MB

    MaxCachePressureLast1Hour: 0%

    Mother and father: (none)

    Friends: (none)

    PersonalCacheFree: 150 GB

    PersonalCacheLimit: 150 GB

    PersonalCacheUsed: Zero KB

    Port: 49180

    PrivateAddresses: (1)



    RegistrationStatus: 1

    RestrictedMedia: false

    ServerGUID: xxxxxxxxxxxxxxxxxx

    StartupStatus: OK

    TetheratorStatus: 1

    TotalBytesAreSince: 2023-12-01 13:35:10

    TotalBytesDropped: Zero KB

    TotalBytesImported: Zero KB

    TotalBytesReturnedToClients: 528.2 MB

    TotalBytesStoredFromOrigin: 528.2 MB

Now, helpfully, Apple additionally pop this information periodically right into a database positioned at:

Library/Software Help/Apple/AssetCache/Metrics/Metrics.db in a desk referred to as ZMETRICS

Visualising this information: Studying from macOS Metrics.db

Impressed by a weblog I learn (impressed as a result of I couldn’t get the ruby script to work) I set off to try to create a entrance finish to this utilizing Grafana. After putting in a SQLIte plug in into Grafana, I may finally see information in Grafana, which was nice, however the Unix date appeared VERY from 1993. I spent two hours making an attempt to wrangle the info into one thing usable and viewable on a graph to no finish, so I gave up.

Nonetheless, it’s superb the distinction a day makes. I went again to Grafana and the SQLite db, and had some success:

This diagram reveals the cache vs utilization of cache. Keep in mind that there was a single OS replace, and solely a handful of purposes on the managed iOS gadgets (in addition to updates for the Mac Mini that caching server is working on).

I additionally perservered with a historical past of cache utilization:

Attempt as I would, I couldn’t discover a method to present the dates throughout the X Axis. I’ll persevere with this for Black Hat Asia 2024.

Visualising this information: Studying from my very own database

Firstly, I reused a few of the easy code to govern the info from the AssetCacheManagerUtil settings command. I then created a script that first created a SQLite database, after which, each 900 seconds, put the info into it. The code to do that is right here on GitHub.

After working with the info in right here, it appears incomplete. I’ll endeavor to work on this in order that the info is extra plausible for Singapore. In principal, nonetheless, this appears like a greater method to retailer the info. Cache Stress, for instance, doesn’t seem within the database.

Area Identify Service Statistics and Streamlining NOC Risk Looking by Alex Calaoagan

Since 2017, now we have been monitoring DNS stats on the Black Hat conferences, and 12 months over 12 months (besides over the course of the pandemic), the present has continued to develop. That progress is mirrored within the DNS visitors that we seize.

With over 38M DNS requests made, BH Europe 2023 has been, by far, the biggest London present on file. The large bounce in DNS requests may be attributed not simply to progress, but in addition to the visibility developments we made at BH Asia 2023, earlier this 12 months in Singapore.

*Fast reminder from Singapore: Working with Palo Alto Networks, we compelled attendees, by way of a firewall redirect initiated by Palo Alto Networks, to make use of our resolvers. With out this transformation, Umbrella wouldn’t see the visitors in any respect, as these machines with hardcoded DNS, whether or not it was (Cloudflare) or (Google), had been capable of bypass our Digital Home equipment.

The Exercise quantity view from Umbrella provides a top-level degree look of actions by class, which we will drill into for deeper menace searching. On pattern with the earlier BH Europe occasions, the highest Safety classes had been Malware and Newly Seen Domains.

In a real-world surroundings, of the 38M requests that Umbrella noticed, over 6,000 of them would have been blocked by our default safety insurance policies. Nonetheless, since it is a place for studying, we usually let all the things fly (extra on that later).

App Discovery in Umbrella provides us a fast snapshot of the cloud apps in use on the present. In keeping with Black Hat’s progress through the years, the variety of cloud apps in play has steadily risen. This quantity tends to comply with attendance ranges, so no shock right here.

2021: 2,162 apps

2022: 4,159 apps

2023: 4,340 apps

Interested by what apps attendees hit probably the most? Right here you go. The one surprises had been Slack (WhatsApp being the incumbent…we’re in Europe, proper?) and 9 Chronicles (who knew Block Chain MMORPG gaming was a factor? I definitely didn’t).

Umbrella additionally identifies dangerous cloud purposes. Ought to the necessity come up, we will block any utility by way of DNS, corresponding to Generative AI apps, Wi-Fi Analyzers, or the rest that has suspicious undertones. Once more, this isn’t one thing we’d usually do on our Basic Wi-Fi community, however there are exceptions. For instance, occasionally, an attendee will study a cool hack in one of many Black Hat programs or within the Arsenal lounge AND attempt to use stated hack on the convention itself. That’s clearly a ‘no-no’ and, in lots of circumstances, very unlawful. If issues go too far, we are going to take the suitable motion.

A helpful Cisco XDR Automate workflow, deployed by Adi Sankar and up to date by Abhishek Sha (as talked about in a publish above), helps streamline our menace searching efforts by way of a Webex plugin that feeds alerts into our collaboration platform, considerably enhancing menace response occasions. Do you’ve a number of product person interfaces and menace intelligence sources to log-in to? Integration and enhancing intelligence supply helps ease the overhead of combing by means of mountains of information.

Making use of this plug-in to our NOC menace searching duties, we had been capable of shortly establish a tool that was beaconing out to a number of recognized malicious websites.

After additional investigation and looking out DNS information for *hamster*, we discovered that one other person was a bit of distracted on their system through the convention. It’s also possible to see under how we permit Coaching rooms to hook up with new (and doubtlessly malicious) domains for instructional functions.

Digging into the problem of the person repeatedly connecting to a number of recognized malicious websites, utilizing one more visibility enhancement we made at Black Hat Singapore 2023, we recognized every community zone the person traversed through the present. Once more, if this had been a company surroundings and an actual menace was recognized, this information could possibly be used to zero on particular compromised gadgets, giving the community staff a map of tips on how to reply and doubtlessly quarantine within the occasion a menace has unfold. We will even use this to assist decide “Affected person Zero,” or the origin of the compromise itself.

*Fast reminder: We mapped out each Black Hat community zone on the ExCel heart in Umbrella to assist us establish what areas of the present flooring requests originated from.

Going even deeper, utilizing Cisco Safe Cloud Analytics, we discovered the system to seemingly be an iPhone. With this new info in hand, it’s a secure assumption that the system was already compromised earlier than the attendee walked within the constructing. The NOC leaders licensed Palo Alto Networks to place up a captive portal to warn the person that the machine was contaminated.

As I discussed above, Umbrella would usually block these recognized malicious requests and porn visits (in case your community admin deemed crucial) in the actual world, proper off the bat. Right here at Black Hat nonetheless, as a result of it is a studying surroundings, we usually permit all requests. To assist educate and serve the convention attendees higher, moderately than kicking them off the community, we give them notification by way of a captive portal. If the attendee disregards our warning (corresponding to conducting illegal actions), we are going to once more take the suitable motion.

All in all, we’re very happy with the collaborative efforts made right here at Black Hat Europe by each the Cisco staff and all of the taking part distributors within the NOC. Nice work everyone!

Black Hat Asia might be in April 2024, on the Marina Bay Sands, Singapore…hope to see you there!


Thanks to the Cisco NOC staff:

  • Cisco Safety: Ivan Berlinson, Abhishek Sha, Alejo Calaoagan, Adam Kilgore and Alicia Garcia Sastre
  • Meraki Methods Supervisor: Paul Fidler and Connor Loughlin
  • Extra Help and Experience: Adi Sankar, Ryan Maclennan, Robert Harris, Jordan Chapian, Junsong Zhao, Vadim Ivlev and Ajit Thyagarajan

Additionally, to our NOC companions NetWitness (particularly David Glover, Iain Davidson and Alessandro Zatti), Palo Alto Networks (particularly James Holland), Corelight (particularly Dustin Lee), Arista Networks (particularly Jonathan Smith), and all the Black Hat / Informa Tech employees (particularly Grifter ‘Neil Wyler’, Bart Stump, Steve Fink, James Pope, Michael Spicer, Jess Stafford and Steve Oldenbourg).

About Black Hat

For over 25 years, Black Hat has offered attendees with the very newest in info safety analysis, improvement, and developments. These high-profile world occasions and trainings are pushed by the wants of the safety neighborhood, striving to carry collectively the most effective minds within the trade. Black Hat evokes professionals in any respect profession ranges, encouraging progress and collaboration amongst academia, world-class researchers, and leaders in the private and non-private sectors. Black Hat Briefings and Trainings are held yearly in america, Europe and USA. Extra info is out there at: Black Hat.com. Black Hat is dropped at you by Informa Tech.

We’d love to listen to what you assume. Ask a Query, Remark Beneath, and Keep Related with Cisco Safety on social!

Cisco Safety Social Channels



Supply hyperlink



Please enter your comment!
Please enter your name here

Most Popular

Recent Comments