Useful Informartion

---

Baseline Inventories

HOME_NET = DAL (Defended Asset List)

The automated baseline uses the IPs and subnets set in HOME_NET - configured in either Zeek or Suricata (Zeek taking precedence) as the focus for producing these baseline inventories. If HOME_NET is not set, or neither Zeek or Suricata are installed - the automated baselining will not run.

A cron job on the Controller executes a script (/opt/tfplenum/inventory-baseline.sh) to update baseline inventories every 5 minutes. It queries and correlates data from Elasticsearch indices to produce and update the baseline inventory indices listed in the table below:

Elasticsearch Index	Inventory Description
inventory-ip	IP Addresses observed within a specified list of networks
inventory-mac	MAC Addresses observed within a specified list of networks
inventory-flow	Network Flows to/from/within a specified list of networks
inventory-pps	Ports, Protocols, and Services observed within a specified list of networks
inventory-process	Processes observed within host data
inventory-service	Services observed within host data
inventory-software	Installed Software observed within host data
inventory-user	User Accounts observed within host data

---

Data Sources & Indices

Elasticsearch Indices

tip

The more data sources available in Elasticsearch, the more detailed the output baselines will be.

The following Elasticsearch indices are queried to help produce the baseline inventories:

Data Source Description	Elasticsearch Index
Zeek CONN logs	logs-zeek.conn*
Zeek DNS logs	logs-zeek.dns*
Zeek DHCP logs	logs-zeek.dhcp*
Zeek NTLM logs	logs-zeek.ntlm*
Winlogbeat/Elastic-Agent logs	logs-windows*
Sysmon logs	logs-windows.sysmon*
Auditbeat logs	logs-auditbeat*
Endgame streamed logs	logs-endgame.stream*
Metasponse host data	ms-hosts
Metasponse Netstat data	ms-netstat
Metasponse Process data	ms-process
Metasponse Service data	ms-services
Metasponse Software data	ms-apps
Metasponse User data	ms-accounts
262COS Custom Metasponse data	ms-262*
262COS Custom Metasponse Netstat data	ms-262_netstat
262COS Custom Metasponse Process data	ms-262_process
262COS Custom Metasponse Service data	ms-262_services
262COS Custom Metasponse Software data	ms-262_installed_programs
262COS Custom Metasponse Accounts data	ms-262_user_accounts
Imported Nmap data	nmap

Metasponse Plugins

The following Metasponse plugins generate data that is queried to help produce the baselines:

• Built-in Plugins
  • Accounts Collector
  • ARP Cache Collector
  • DHCP Collector
  • Netstat Collector
  • Survey Collector
  • Applications Collector
• 262COS Custom Plugins
  • 262 - [🔧Config Info] Installed Programs
  • 262 - [💾Persistence] Services
  • 262 - [💾Persistence] User Accounts
  • 262 - [🔥Volatile Info] ARP Cache
  • 262 - [🔥Volatile Info] Netstat
  • 262 - [🔥Volatile Info] Processes

---