search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
2.92k stars 406 forks source link

Implement detectionlab #7359

Closed zwinnerman-fleetdm closed 1 year ago

zwinnerman-fleetdm commented 2 years ago

Goal

Writing queries, we need to test the queries on different versions of windows. Detectionlab allows us to quickly spin up windows versions.

TODO

Implement detectionlab https://www.detectionlab.network/deployment/aws/

Figma

TODO

API wireframes

TODO

How?

Frontend

TODO

Backend

TODO

zwinnerman-fleetdm commented 2 years ago

Created these issues to address upstream issues: clong/DetectionLab#838 clong/DetectionLab#840

zwinnerman-fleetdm commented 2 years ago

Working on a forked version because of upstream issues zwinnerman-fleetdm/detectionlab

zwinnerman-fleetdm commented 2 years ago

clong/DetectionLab#841 also created

zwinnerman-fleetdm commented 2 years ago

its deployed, awaiting QA since I have no idea how to tell if this is working or not.

chiiph commented 1 year ago

Assigning to @GuillaumeRoss for review on what we have live.

GuillaumeRoss commented 1 year ago

Osquery and Fleet worked - Active Directory worked. Splunk worked.

I think the main issue is:

rfairburn commented 1 year ago

The subnets and VPC are actually already allowed over VPN, but I am not sure what anything looks like to integrate the private IPs into detectionlab itself (or if it "just works" if you have the private addresses).

zwinnerman-fleetdm commented 1 year ago

What happens when Windows license expiration is hit? Do we have a way to easily kill and rebuild?

I (or anyone with terraform) can taint the instances to refresh them, that should refresh the license expiration

@rfairburn answered the VPN question I think, but I agree with the overall statement.

chiiph commented 1 year ago

This is ready for anybody to use, closing since it's an internal thing.