Closed zwinnerman-fleetdm closed 1 year ago
Created these issues to address upstream issues: clong/DetectionLab#838 clong/DetectionLab#840
Working on a forked version because of upstream issues zwinnerman-fleetdm/detectionlab
clong/DetectionLab#841 also created
its deployed, awaiting QA since I have no idea how to tell if this is working or not.
Assigning to @GuillaumeRoss for review on what we have live.
Osquery and Fleet worked - Active Directory worked. Splunk worked.
I think the main issue is:
The subnets and VPC are actually already allowed over VPN, but I am not sure what anything looks like to integrate the private IPs into detectionlab itself (or if it "just works" if you have the private addresses).
What happens when Windows license expiration is hit? Do we have a way to easily kill and rebuild?
I (or anyone with terraform) can taint the instances to refresh them, that should refresh the license expiration
@rfairburn answered the VPN question I think, but I agree with the overall statement.
This is ready for anybody to use, closing since it's an internal thing.
Goal
Writing queries, we need to test the queries on different versions of windows. Detectionlab allows us to quickly spin up windows versions.
TODO
Implement detectionlab https://www.detectionlab.network/deployment/aws/
Figma
TODO
API wireframes
TODO
How?
Frontend
TODO
Backend
TODO