netflix-skunkworks/diffy

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

Diffy (DEPRECATED) =====

Diffy has been deprecated at Netflix. This software is no longer maintained or supported.

Diffy is a digital forensics and incident response (DFIR) tool that was developed by Netflix's Security Intelligence and Response Team (SIRT).

Diffy allows a forensic investigator to quickly scope a compromise across cloud instances during an incident, and triage those instances for followup actions. Diffy is currently focused on Linux instances running within Amazon Web Services (AWS), but owing to our plugin structure, could support multiple platforms and cloud providers.

It's called "Diffy" because it helps a human investigator to identify the differences between instances, and because Alex pointed out that "The Difforensicator" was unnecessarily tricky.

See Releases for recent changes. See our Read the Docs site for well-formatted documentation.

Supported Technologies

• AWS (AWS Systems Manager / SSM)
• Local
• osquery

Each technology has its own plugins for targeting, collection and persistence.

Features

• Efficiently highlights outliers in security-relevant instance behavior. For example, you can use Diffy to tell you which of your instances are listening on an unexpected port, are running an unusual process, include a strange crontab entry, or have inserted a surprising kernel module.

• Uses one, or both, of two methods to highlight differences:

  • Collection of a "functional" baseline from a "clean" running instance, against which your instance group is compared, and
  • Collection of a "clustered" baseline, in which all instances are surveyed, and outliers are made obvious.

• Uses a modular plugin-based architecture. We currently include plugins for collection using osquery via AWS Systems Manager (formerly known as Simple Systems Manager or SSM).

Installation

Via pip:

pip install diffy

Roadmap

Diffy has been deprecated at Netflix. This software is no longer maintained or supported.

Why python 3 only?

Please see Guido's guidance regarding the Python 2.7 end of life date.

diffy's Issues

Issue warning for smaller host counts.

If no baseline is available, diffy will attempt to cluster the hosts. Diffy should issue a warning that the results of this cluster may not be meaningful when the number of hosts is low, e.g. <30.

Add diffy to pypi

Upload diffy to pypi and ensure that is installable via pip.

Create baseline based on tags?

It looks like diffy only supports creating baselines based on auto-scaling groups.

Unfortunately, I'm not using auto-scaling groups, and it's not an option for me to do so... but I do have tags.

Would it be possible/desirable to allow diffy to work based on tags in addition to ASGs?

I'm writing some PoC code to experiment with this but would love your feedback.

Thanks!

Video for OSDFCon talk

I really would like to understand how Diffy works, and noticed that you gave a talk at OSDFCon. I've checked out the slides, just wanted to know if a video will be released.

Thanks

getting error while executing $ pip install -r dev-requirements.txt

The Error is

`compilation terminated.
error: command 'x86_64-linux-gnu-gcc' failed with exit status 1

----------------------------------------

Command "/home/harry/diffy/env/bin/python3 -u -c "import setuptools, tokenize;file='/tmp/pip-install-xihzs_85/python-levenshtein/setup.py';f=getattr(tokenize, 'open', open)(file);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, file, 'exec'))" install --record /tmp/pip-record-0losak7n/install-record.txt --single-version-externally-managed --compile --install-headers /home/harry/diffy/env/include/site/python3.6/python-levenshtein" failed with error code 1 in /tmp/pip-install-xihzs_85/python-levenshtein/`

Update Jinaj2 due to security issue.

Jinja < 2.10.1 has a security vulnerability. We pull this in via flask, we should roll our web-requirements.in and pickup a newer version for the library with the vulnerability fixed.

Refactor core/baseline() to handle multiple targets.

When creating a baseline, additional targets are ignored (https://github.com/Netflix-Skunkworks/diffy/blob/master/diffy/core.py#L72). However, some TargetPlugin derivatives will submit multiple targets. We should be able to set a dictionary key in target_plugin["options"] indicating multiple targets, pass that using **kwargs, and add decision logic in core.py that acts on multiple or single targets based on the value.

Add a Collection plugin that employs a "trusted" binary/binaries for collection.

The TrustedBinaryCollectionPayloadPlugin is aware of the location of a single trusted binary, or set of trusted binaries, which can be used as an alternative to osqueryi, to profile an instance.

Add travis ci for building and testing Diffy PRs.

Support local baseline capture

Allow users to capture a local baseline of their system, store it, and then compare system state to that baseline at a later date. Useful for demo and test purposes. One example would be to baseline a VM, infect it in someway, and then run analysis to confirm detection of the infection.

Ensure diffy docs are built and deployed to readthedocs.

Create example SSM execution document

Document pre-reqs for each plugin

Create documentation for the prerequisites assumed for each plugin. What does each plugin require, to run?

Allow the comparison of multiple commands.

We allow multiple commands to be specified by:
https://github.com/Netflix-Skunkworks/diffy/blob/master/diffy/config.py#L199

and
https://github.com/Netflix-Skunkworks/diffy/blob/master/diffy/config.py#L194

These are then issued in series on the host. However when multiple commands are passed the output is not properly collected in a valid json format. Moreover we have no way to separate out multiple outputs.

We should allow for multiple collection commands is a format like:

{
    "<command1>": {"some": "output"},
    "<command2>": {"some": "output"}
}

This will likely mean that instead of having the commands executed directly we will need some script to execute and collect the output of multiple commands in the above format.

Add documentation on how to use an SSM document to restrict commands

Add background processing to diffy API.

Today diffy attempts to send all commands within the request window. For larger clusters completion time may exceed a reasonable request limit.

The api should background analysis requests such that it does not block additional web requests. It should return a worker ID that can be queried for status.

Update PyYAML due to security issue.

Snyk informed me that PyYAML is vulnerable to a security issue as well.