Using BinderHub to share Security Analytics and knowledge with the community

[Cyb3rWard0g]

Good morning Binder Team,

First of all, Thank you very much for the amazing project you guys put together 🙏 🍻 . One of my main goals when I started my career as a Cyber Security professional was to share as much as I can with the community. Sharing computational environments and connecting them with the cloud to share security concepts with the community is a dream come true!

My name is Roberto Rodriguez and I develop several open source projects for the community: https://github.com/Cyb3rWard0g & https://github.com/hunters-forge (founder)

One of the first projects I developed was the ThreatHunter-Playbook: https://github.com/Cyb3rWard0g/ThreatHunter-Playbook back in March, 2017. The main goal was to share all the security analytics (rules) I came up with to help the community detect potential adversarial techniques using security events produced by endpoints in a network environment. Thank you to the community the project got a lot of attention, and it allowed me to develop more tools to facilitate the collaboration and sharing of research.

I have been working with Jupyter Notebooks for the past two years, and I find it a fascinating tool to share queries and correlation of events with other security analysts. I recently updated the ThreatHunter-playbook to use notebooks as playbooks, and I believe this is going to be an amazing opportunity to keep pushing the concepts of notebooks in the infosec community: https://twitter.com/Cyb3rWard0g/status/1162488899152830465

I was wondering if it was possible to work together to monitor the number of concurrent users on the project. I am also doing two presentations this year where I am planning on sharing this concept and I hope I can get the number of concurrent users up (if it is possible).

Presentation: ThreatHunting Summit Date: October 1st, 2019 Title: Jupyter Notebooks and Pre-recorded Datasets for Threat Hunting Link: https://www.sans.org/event/threat-hunting-and-incident-response-summit-2019/summit-agenda Expected Attendance: 200-250

Presentation: ATT&CKCon Date:October 28th-30th Title: Jupyter Notebooks and Pre-recorded Datasets for Threat Hunting Link: https://www.mitre.org/attackcon Expected Attendance: 200-300 (in person) and Live streaming (open to the world)

I will be sharing the concepts of binder and also calling for collaboration :) Thank you in advance! Happy to have a conversation and once again thank you for all your work!

[betatim]

Hi!

Thanks for using the service and stopping by to say hello :)

For stats about what is being launched and how often we have https://archive.analytics.mybinder.org/. This tracks every time a repository is launched so you can analyse after the fact how popular your work is. An example of using the data is https://github.com/betatim/binderlyzer

We don't track how long people are active once they have launched the repo so a true number of "concurrent users" isn't something we can work out after the fact.

There is a limit of 100 concurrent users per repo that we enforce. Once that is reached users get a message telling them that a repo is too popular for the moment and that they need to come back later. Based on our experience it is very unlikely that you will run into this limit. Of all the repos that use mybinder.org only one or two reach the limit and these are two linked from the front page of jupyter.org.

[Cyb3rWard0g]

Thank you for the information @betatim 😄 👍 I wanted to give you guys a heads up for those two dates, and as the project gets more popular, I hope we can work together in the future to update the concurrent users limit. I am happy to spend time helping to make it a smooth experience for other security analysts in the community. I also read some of your recommendations from here: https://github.com/jupyterhub/mybinder.org-deploy/issues/1123

As with all shared resources we'd appreciate if you could be a good citizen by:

keeping your list of dependencies "minimal" (don't blindly dump all of the PyData ecosystem into your environment.yml, include only what you need)
not adding massive data sets to your images
not constantly rebuilding your repo just because you can

I am updating my Jupyter Docker image to remove python libraries not being used to share the material with the community.

Thank you again!

[betatim]

Sounds good. I'll close this issue now. We can open a new one for a new issue/topic of discussion :)