2191-csec465-group6/lab4

Use DevOps tools to deploy software useful for security monitoring and auditing in an enterprise environment

lab4's Issues

Create Infrastructure in RLES

Create a vApp on RLES in the Metropolis Transit org that meets that contains the following hosts: a Windows 2016 server with AD configured, a Windows 10 host joined to the domain, and two Ubuntu VMs. Your VMs should be joined to the RLES NAT Network

Develop an Ansible Role to install osquery

1. Installs osquery on a Windows host
   a. Ensure that osquery has access to Windows events
2. Installs osquery on a Linux host

Develop an Ansible Role that queries Linux using osquery

1. Querying basic host information including:
   1. Host name and Domain (if applicable) info
   2. OS and OS Patch level
   3. IP information
   4. List of local users
2. Querying installed software including:
   1. Installed server components
      1. AD, IIS, etc.
   2. Querying installed application software
   3. Querying software to be run on boot
3. Query information that may be useful for incident response
   1. Recent user logons
      1. May make your own assumptions about “recent”
   2. Running processes
      1. Include: The process ID, the process name, the user id, the parent process id, and the path to the process’ binary
   3. Suspicious (other than 80,443) outbound connections

Develop an Ansible Role that queries Windows using osquery

1. Querying basic host information including:
   1. Host name and Domain (if applicable) info
   2. OS and OS Patch level
   3. IP information
   4. List of local users
2. Querying installed software including:
   1. Installed server components
      1. AD, IIS, etc.
   2. Querying installed application software
   3. Querying software to be run on boot
3. Query information that may be useful for incident response
   1. Recent user logons
      1. May make your own assumptions about “recent”
   2. Running processes
      1. Include: The process ID, the process name, the user id, the parent process id, and the path to the process’ binary
   3. Suspicious (other than 80,443) outbound connections

Develop an Ansible Role that queries Windows using native tools

1. Querying basic host information including:
   1. Host name and Domain (if applicable) info
   2. OS and OS Patch level
   3. IP information
   4. List of local users
2. Querying installed software including:
   1. Installed server components
      1. AD, IIS, etc.
   2. Querying installed application software
   3. Querying software to be run on boot
3. Query information that may be useful for incident response
   1. Recent user logons
      1. May make your own assumptions about “recent”
   2. Running processes
      1. Include: The process ID, the process name, the user id, the parent process id, and the path to the process’ binary
   3. Suspicious (other than 80,443) outbound connections

Update README.md to include information on creating new roles with Ansible Molecule

Add Molecule test stage to travis-ci

Develop an Ansible Role that queries Linux using native tools

1. Querying basic host information including:
   1. Host name and Domain (if applicable) info
   2. OS and OS Patch level
   3. IP information
   4. List of local users
2. Querying installed software including:
   1. Installed server components
      1. AD, IIS, etc.
   2. Querying installed application software
   3. Querying software to be run on boot
3. Query information that may be useful for incident response
   1. Recent user logons
      1. May make your own assumptions about “recent”
   2. Running processes
      1. Include: The process ID, the process name, the user id, the parent process id, and the path to the process’ binary
   3. Suspicious (other than 80,443) outbound connections