Package: kestrel-lang
[News]Kestrel session atBlack Hat USA 2023Kestrel is a threat hunting language aiming to make cyber threat huntingfastby providing a layer of abstraction to build reusable, composable, and
shareable hunt-flow. Starting with:Black Hat USA 2022 session recordingBlack Hat USA 2022 Kestrel hunting labKestrel live tutorial in a cloud sandboxThe GoalSoftware developers write Python or Swift than machine code to quickly turn
business logic into applications. Threat hunters write Kestrel to quickly turn
threat hypotheses into hunt-flow. We see threat hunting as an interactive
procedure to create customized intrusion detection systems on the fly, and
hunt-flow is to hunts as control-flow is to ordinary programs.What does it mean byhunt fast?Do NOT write the same TTP pattern in different data source queries.Do NOT write one-time-use adapaters to connect hunt steps.Do NOT waste your existing analytic scripts/programs in future hunts.Do construct your hunt-flow from smaller reuseable hunt-flow.Do share your huntbook with your future self and your colleagues.Do get interactive feedback and revise hunt-flow on the fly.Kestrel in a NutshellKestrel language: a threat hunting language for a human to expresswhat to
hunt.expressing the knowledge ofwhatin patterns, analytics, and hunt flows.composing reusable hunting flows from individual hunting steps.reasoning with human-friendly entity-based data representation abstraction.thinking across heterogeneous data and threat intelligence sources.applying existing public and proprietary detection logic as analytic hunt steps.reusing and sharing individual hunting steps, hunt-flow, and entire huntbooks.Kestrel runtime: a machine interpreter that deals withhow to hunt.compiling thewhatagainst specific hunting platform instructions.executing the compiled code locally and remotely.assembling raw logs and records into entities for entity-based reasoning.caching intermediate data and related records for fast response.prefetching related logs and records for link construction between entities.defining extensible interfaces for data sources and analytics execution.Basic Concepts and HowtoVisitKestrel documentationto learn Kestrel:Learn concepts and syntax:A comprehensive introduction to KestrelThe two key concepts of KestrelInteractive tutorial with quizLanguage reference bookHunt in your environment:Kestrel runtime installationHow to connect to your data sourcesHow to execute an analytic hunt step in Python/DockerHow to use Kestrel via APIHow to launch Kestrel as a Docker containerKestrel Huntbooks And AnalyticsKestrel huntbook: community-contributed Kestrel huntbooksKestrel analytics: community-contributed Kestrel analyticsKestrel Hunting BlogsBuilding a Huntbook to Discover Persistent Threats from Scheduled Windows TasksPracticing Backward And Forward Tracking Hunts on A Windows HostBuilding Your Own Kestrel Analytics and Sharing With the CommunitySetting Up The Open Hunting Stack in Hybrid Cloud With Kestrel and SysFlowTry Kestrel in a Cloud SandboxFun with securitydatasets.com and the Kestrel PowerShell DeobfuscatorKestrel Data Retrieval ExplainedTalks And DemosTalk summary (visitKestrel documentation on talksto learn details):2023/08Black Hat USA 20232022/12Infosec Jupyterthon 2022[IJ’22 live hunt recording]2022/08Black Hat USA 2022[BH’22 recording|BH’22 hunting lab]2022/06Cybersecurity Automation Workshop2022/04SC eSummit on Threat Hunting & Offense Security(free to register/playback)2021/12Infosec Jupyterthon 2021[IJ’21 live hunt recording]2021/11BlackHat Europe 20212021/10SANS Threat Hunting Summit 2021: [SANS’21 session recording]2021/05RSA Conference 2021: [RSA’21 session recording]Connecting With The CommunityJoin Kestrel slack channel:Get aslack invitationto joinOpen Cybersecurity Alliance workspaceJoin thekestrelchannel to ask questions and connect with other huntersContribute to the language development (Apache License 2.0):Create aGitHub Issueto report bugs and suggest new featuresFollow thecontributing guidelineto submit your pull requestRefer to thegovernance documentationregarding PR merge, release, and vulnerability disclosureShare your huntbook and analytics:Kestrel huntbookKestrel analytics