EDR Server Development

OffStrike EDR Web Management Portal

Objectives

This month was very important because the web portal development brings all the pieces together. After the completion of the agent module, we still had no way of interacting with the data and presenting it visually without interacting with Kibana. So, the objectives were to build a web server that will query the data from the Elasticsearch database, and process the data, then display it via the UI.

• Build Indexer
• Build Server

Journey

This month started out with some Flutter based UI designs just to get a feel for the placement of key components and how they fit into the overall user experience of the application. The UI started with the web portal dashboard, which basically provides summary of hosts data and trending log parameters. After, most of the time was spent on developing the threat events management page. This page is the most important asset because it brings all the data together in a sensible and readable structure. The biggest issue was designing the indexer. The indexer is a component of the EDR written in Python, it parses the logs in the lightml Elasticsearch index and sends it to the LLM for processing then, appends the analysis under a new index in Elasticsearch.

After multiple go at it, the indexer was completed. Event logs from the agent could now be analyzed by the LLM. The next step was to integrate all the data interfaces into the UI, it took a while but everything fell right into place. Since the Command-and-Control (C2) is also integrated into the threat events management page/view, it had to be integrated into the UI as well. The initial design of this component referenced a bind-shell, but this became an issue at this stage because Flutter doesn’t have an API for the web application to directly interact with the bind-shell listener via a local port. The entire C2 submodule in the agent had to be redesign and re-implemented as an API module. With the C2 integrated, we decided to update the lightml submodule of the agent to include the prediction accuracy score as a parameter attribute, which the agent pushes to the database along with the other log attributes.

Finally, the threat hunting page was worked on last. This page gives the user the ability to write custom queries on the lightml index in the database, which is a good feature to have because it brings additional flexibility and an almost unlimited way to interact with the raw data from the agents, which means the end-user can write queries to look for specific events, or as a way to cross-reference specific analysis reports from the LLM. This feature is good, but it does come with some security restrictions like the type of queries that can be run and how those queries should be written. With some additional work and time, this feature could definitely be a major asset to the application, but it is beyond the current scope.

Upcoming Server Development Tasks

• Atomic Page Development
• Login Page
• Clean UI
• Deploy Apache Server