We continue with Crowdsec! we have already seen in previous documents the basic concepts and how to deploy it centrally and even in a Windows, so today we will see the steps we must follow if we want to install the Crowdsec agent on a Linux computer to protect it from external threats.
Well, we have already seen in the previous document a little bit of the concepts and ideas of how to deploy Crowdsec in our organization, today what we have in the menu is how to install Crowdsec on a Windows machine and protect it. Protect it from botnets, Attacks, Curious, Boring…
A must in any organization is to control and allow access to its servers, regardless of having segmentations with VLANs, or have control through physical firewalls, A good idea is to implement micro-segmentation, or in some cases to simplify, also enable control on the OS's own firewall.
Something that I have told you many times, is that I find in many organizations half-assembled firewalls, This is (among others), that rules that protect end-user browsing are not enabled. That is, that viruses and malware can end up being downloaded. Today I propose a hodgepodge with Eicar and Centreon that maybe can help us.
With this indigestible title, let's try to explain what makes Crowdsec a brown beast… as it will be usual to have the Crowdsec agent on each of our machines in the organization, We will make it possible for them to communicate with each other to prevent attacks.
Have I ever told you that Crowdsec is a marvel?? 😛 for any type of company… that will protect us from external or internal attacks! It's not a turkey snot.! Crowdsec teams will share a blacklist of IPs, So when a team is attacked, the rest will be protected. But it is also that, This blacklist can be sent to our perimeter firewall, so that he may protect us!
In this post we are going to try to collect certain metrics from Fortigate, if we have this fabulous UTM firewall (or now called Next-Generation Firewall) we will be able to obtain this data through SNMP and visualize it in real time, thanks to Telegraf, InfluxDB and Grafana, It's a great thing!
In this post we will see a very interesting Panel for Grafana, a Sankey-type panel, A way to visualize (with the eyes) data that we have in text and by having a relationship between them, We will exploit them (Elasticsearch logs).
Well, and this time we're going to exploit the IP addresses that we have stored in Elasticsearch indexes, we will visualize them on a World Map and thus we will understand where our data is going from or where it is going.
We continue with another document where we will try to centralize all our LOGs in Elasticsearch, this time it's our turn of Fortigate firewalls. The idea will not only be to collect the LOGs but also to understand them visually and have tools that help us in our day-to-day lives.
Do Tailor-made training
Windows Server – VMware vSphere – Citrix Virtual Apps & Desktops – Centreon
|
We are a consulting firm that cares and pampers
|
 |
|
With quality and added value
|
 |
|
¡Let's work together!
|
 |
