stackstorm - inovex · stackstorm stackstorm matches siem alert to invalid access rule, begins...

10
Stackstorm Event Driven Automation Alexander Köhler Karlsruhe, 25.08.2016

Upload: others

Post on 22-May-2020

7 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

Stackstorm

Event Driven Automation

Alexander Köhler Karlsruhe, 25.08.2016

Page 2: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

2

IFTTT.

Page 3: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

3

Event-Driven

Event Regel Aktion

Page 4: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

Host B

4

Grundprinzip

Host A

st2sensorcontainer

Sensor

st2api

WebHook

Message Q

ueu

e

st2ruleengine

Trigger

Bedingung

st2actionrunner

ActionHost B

Host A

Service

Page 5: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

5

Demo

CLI {Trigger; Actions; Execution History}

Web GUI {Rules}

Webhooks

Page 6: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

Workflow

6

ActionChains

Event Regel

Aktion

AktionAktion

Aktion

Aktion

..oder auch Workflows

Page 7: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

7

Wozu kann man es nutzen?

• Auto-Remedation

• Runbook-Automation

• Chatops

• CI/CD

Page 8: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

8https://www.tomaz.me/slides/event-driven-infrastructure-automation-with-stackstorm/#27

Beispiele

Page 9: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

9

TL; DR

• Weiterentwicklung in Community & Enterprise Edition

• Übergreifende, integrative Plattform

• Scaling: einzelne Teil-Dienste können ausgelagert werden.

• Technologie-Stack: Nginx (FrontEnd), RabbitMQ(MessageQueue), MongoDB (Auditierung), PostgreSql(integrierte Mistral Workflow Engine),

• Community-basedPacks erleichtern den Einstieg (https://github.com/StackStorm/st2contrib)

• Rezentralisieren von Automationen

Page 10: Stackstorm - inovex · StackStorm StackStorm matches SIEM Alert to Invalid Access rule, begins lockdown workflow O Remediation issue opened in Ticket tracking System StackStorm begins

Vielen Dank

Alexander Köhler

DevOps Engineer Linux

inovex GmbH

Ludwig-Erhard-Allee 6

76131 Karlsruhe

[email protected]

0173 3181 034