Merge branch 'main' of github.com:MISP/misp-training

exercise-movie
chrisr3d 2020-09-12 11:57:09 +02:00
commit 0040e066df
36 changed files with 945 additions and 1 deletions

BIN
AUSCERT2020/Sightings2.PNG Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 14 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 147 KiB

BIN
AUSCERT2020/bankaccount.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 53 KiB

BIN
AUSCERT2020/bankview.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 115 KiB

BIN
AUSCERT2020/circl.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 9.5 KiB

244
AUSCERT2020/content.tex Normal file
View File

@ -0,0 +1,244 @@
% DO NOT COMPILE THIS FILE DIRECTLY!
% This is included by the other .tex files.
\begin{frame}
\titlepage
\end{frame}
\begin{frame}
\frametitle{MISP and CIRCL}
\begin{center}
\includegraphics[scale=0.45]{pics/circl.png}
\hspace{2.5em}
\includegraphics[scale=0.35]{pics/misp.pdf}
\end{center}
\begin{itemize}
\item CIRCL is mandated by the Ministry of Economy and acting as the Luxembourg {\bf National CERT for the private sector}.
\item CIRCL runs multiple large MISP communities performing {\bf active daily threat-intelligenge sharing}
\item CIRCL leads the development of {\bf MISP and many other open source softwares}\footnote{AIL-Framework, D4-project, CVE-search, passive-(ssl/dns), lookyloo}.
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{The aim of this presentation}
\begin{itemize}
\item Provide a quick introduction into MISP
\item What sort of issues are we trying to tackle
\item A small update of what has happened around MISP's development over the past year
\item Where we're headed from here
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{What is MISP?}
\begin{itemize}
\item MISP is a {\bf threat information sharing} platform that is free \& open source software
\item A tool that {\bf collects} information from partners, your analysts, your tools, feeds
\item Normalises, {\bf correlates}, {\bf enriches} the data
\item Allows teams and communities to {\bf collaborate}
\item {\bf Feeds} automated protective tools and analyst tools with the output
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{MISP Features Highlights}
\begin{itemize}
\item Extensive Rest {\bf API}
\item Automatic {\bf correlation}
\item Granular distribution levels and {\bf synchronisation} systems
\item A wide range of {\bf ingestion systems}
\item {\bf Visualisation tools} for dashboarding, graphing, statistics
\item A host of {\bf export formats}, covering a wide range of use-cases
\begin{itemize}
\item {\bf IDSes / IPSes}: \texttt{Suricata, Bro/Zeek, Snort}
\item {\bf SIEMs}: \texttt{CEF, STIX}
\item {\bf Host scanners}: \texttt{OpenIOC, STIX, CSV, Yara}
\item {\bf Analysis tools}: \texttt{Maltego}
\item {\bf DNS policies}: \texttt{RPZ}
\end{itemize}
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{MISP's evolution since the last AusCERT}
\begin{itemize}
\item Since the AusCERT 2019 (31/05/2019) we've had:
\begin{itemize}
\item 34 releases
\item 4398 commits
\item 97 contributors contributing to the core software and its components
\end{itemize}
\item COVID-19 didn't negatively impact the progress made all that much
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{So what were the main changes?}
\begin{itemize}
\item Loads of bug fixes
\item A host of improvements to how MISP behaves in general
\item Security fixes, including several CVEs (keep your MISP up to date!)
\item Generally loads of internal tuning for better scaling
\item Massively expanding context libraries
\item Several major features (let's talk about these)
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Timelining in MISP}
\begin{itemize}
\item The goal was to capture activity timelines
\item All attributes and objects can have first-seen/last-seen data
\end{itemize}
\includegraphics[scale=0.25]{images/timeline.png}
\end{frame}
\begin{frame}
\frametitle{Timelining in MISP}
\begin{itemize}
\item Why is this interesting?
\item {\bf IoC lifecycle management} is one of the biggest challenges we face
\item Timeline information allows us to better {\bf express a story}, rather than {\bf share dumps of IoCs}
\item {\bf Time-based correlation} of certain actions helps us understand an incident
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Dashboarding}
\begin{itemize}
\item Outcome of our personal initiatives to track the COVID-19 spread
\item New built-in {\bf dashboarding system} directly available in MISP
\item Dashboard widgets are modular and {\bf easy to build}
\item Create widgets that are {\bf ACL aware}
\item The COVID-19 MISP community turned out to be a massive success
\item COVID-19 use-cases are just an example though (admin widgets, trend widgets, etc)
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Dashboarding}
\includegraphics[scale=0.25]{images/dashboard.png}
\end{frame}
\begin{frame}
\frametitle{Decaying indicators v2}
\begin{itemize}
\item Further improvement on our indicator {\bf life-cycle management} tool
\item {\bf User settings} are now taken into account when crafting queries
\item {\bf Tool specific} user accounts can be pre-configured with decaying settings
\item {\bf Taxonomy} numerical values can be re-mapped to fit internal needs
\item {\bf Sightings} factor into the decay scores
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Massive rewrite of PyMISP}
\begin{itemize}
\item Python 3.6+ is a minimum since the modern PyMISP rework
\item Use of {\bf objects} with a {\bf long list of helpers} allows for easy creation/modification of MISP data
\item PyMISP's {\bf CI testing} suite has grown massively, allowing us to catch more and more issues as we commit changes
\item Automated testing {\bf including synchronising} several MISP instances
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Community management improvements}
\begin{itemize}
\item {\bf User configurations} - manage per user rule sets to alter MISP's behaviour ({\bf alerting rules}, {\bf dashboard configuration}, etc)
\item {\bf Community listings} - to help users find the right communities and negotiate access
\item Various improvements to authorization systems - {\bf E-mail based OTP}, {\bf further integrations with SSO systems}
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Integrations}
\begin{itemize}
\item Long list of {\bf integrations}, both via our export system and module systems and by other tools integrating with MISP
\item Continuous iterations of our connectors using other formats (a massive STIX 2 rework has just dropped)
\item Integrations with analysis tools, such as with {\bf Maltego}
\item Tighter integration with other {\bf OSS frameworks we develop in-house} (AIL, D4)
\item Mapping of libraries to taxonomies/galaxies/object templates
\item ATT\&CK like matrices from other domains (disinformation via AMITT, various sectorial groups)
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{So that's where we are now}
\begin{itemize}
\item Let's have a brief look at what is on our immediate and long-term roadmaps
\item For the long-term ones, priorities shift rapidly
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{MISP galaxy 2.0}
\begin{itemize}
\item MISP galaxies will be fully managed via MISP directly
\item Create, modify, {\bf share your custom galaxies} with the usual sync / ACL mechanisms
\item Fork and {\bf provide your own perspective} to already existing knowledge-base items
\item Build {\bf relationships between galaxy clusters} (Threat actor A uses Tool B and targets Sector C)
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Reports}
\begin{itemize}
\item Create {\bf markdown reports} and share them along with your events
\item Structured information is great for automation, but sometimes plain prose helps telling a story
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Community management at scale}
\begin{itemize}
\item Cerebrate is a new OSS frameworks that we're building
\item Manage organisation, sharing group, encryption key data for communities
\item Instrument MISP instances and the interconnectivity between them via Cerebrate
\item Introduce information signing by validating signatures / ownership via trusted Cerebrate nodes
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Rework of the MISP internals}
\begin{itemize}
\item We are planning on moving MISP to a {\bf more modern stack} (cake4/bs4)
\item Cerebrate also acts as a {\bf test-bed} for this move and relies on MISP internals that have already been ported
\item We have been silently {\bf reworking a lot of the internals} of MISP to make the migration possible (UI generator systems for example)
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{To sum it all up...}
\begin{itemize}
\item Many interesting things are happening
\item We are following {\bf several routes} of development (internal improvements, contextualisation, integrations, operational improvements, community building)
\item We have more ideas than can be implemented with days only having 24 hours, there are {\bf many ways to get involved}
\item Prioritisation is hard. {\bf Let us know what you think we should focus on}!
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Get in touch if you have any questions}
\begin{itemize}
\item Contact CIRCL
\begin{itemize}
\item info@circl.lu
\item \url{https://twitter.com/circl_lu}
\item \url{https://www.circl.lu/}
\end{itemize}
\item Contact MISPProject
\begin{itemize}
\item \url{https://github.com/MISP}
\item \url{https://gitter.im/MISP/MISP}
\item \url{https://twitter.com/MISPProject}
\end{itemize}
\item Join the COVID-19 MISP community
\begin{itemize}
\item \url{https://covid-19.iglocska.eu}
\end{itemize}
\end{itemize}
\end{frame}

BIN
AUSCERT2020/covid.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 426 KiB

BIN
AUSCERT2020/creativity.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 11 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 358 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 119 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 155 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 98 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 148 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 166 KiB

BIN
AUSCERT2020/en_cef.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 12 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 23 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 325 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 146 KiB

BIN
AUSCERT2020/logo-circl.pdf Executable file

Binary file not shown.

5
AUSCERT2020/makefile Normal file
View File

@ -0,0 +1,5 @@
all:
pdflatex -interaction nonstopmode -halt-on-error -file-line-error slide.tex
clean:
rm *.aux *.nav *.log *.snm *.toc *.vrb

BIN
AUSCERT2020/misp.pdf Normal file

Binary file not shown.

BIN
AUSCERT2020/misplogo.pdf Executable file

Binary file not shown.

BIN
AUSCERT2020/object.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 85 KiB

BIN
AUSCERT2020/sighting-n.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 15 KiB

670
AUSCERT2020/slide.log Normal file
View File

@ -0,0 +1,670 @@
This is pdfTeX, Version 3.14159265-2.6-1.40.18 (TeX Live 2017/Debian) (preloaded format=pdflatex 2019.2.21) 11 SEP 2020 08:16
entering extended mode
restricted \write18 enabled.
%&-line parsing enabled.
**slide.tex
(./slide.tex
LaTeX2e <2017-04-15>
Babel <3.18> and hyphenation patterns for 84 language(s) loaded.
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamer.cls
Document Class: beamer 2018/02/20 v3.50 A class for typesetting presentations
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasemodes.sty
(/usr/share/texlive/texmf-dist/tex/latex/etoolbox/etoolbox.sty
Package: etoolbox 2018/02/11 v2.5e e-TeX tools for LaTeX (JAW)
\etb@tempcnta=\count79
)
\beamer@tempbox=\box26
\beamer@tempcount=\count80
\c@beamerpauses=\count81
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasedecode.sty
\beamer@slideinframe=\count82
\beamer@minimum=\count83
)
\beamer@commentbox=\box27
\beamer@modecount=\count84
)
(/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ifpdf.sty
Package: ifpdf 2017/03/15 v3.2 Provides the ifpdf switch
)
\headdp=\dimen102
\footheight=\dimen103
\sidebarheight=\dimen104
\beamer@tempdim=\dimen105
\beamer@finalheight=\dimen106
\beamer@animht=\dimen107
\beamer@animdp=\dimen108
\beamer@animwd=\dimen109
\beamer@leftmargin=\dimen110
\beamer@rightmargin=\dimen111
\beamer@leftsidebar=\dimen112
\beamer@rightsidebar=\dimen113
\beamer@boxsize=\dimen114
\beamer@vboxoffset=\dimen115
\beamer@descdefault=\dimen116
\beamer@descriptionwidth=\dimen117
\beamer@lastskip=\skip41
\beamer@areabox=\box28
\beamer@animcurrent=\box29
\beamer@animshowbox=\box30
\beamer@sectionbox=\box31
\beamer@logobox=\box32
\beamer@linebox=\box33
\beamer@sectioncount=\count85
\beamer@subsubsectionmax=\count86
\beamer@subsectionmax=\count87
\beamer@sectionmax=\count88
\beamer@totalheads=\count89
\beamer@headcounter=\count90
\beamer@partstartpage=\count91
\beamer@sectionstartpage=\count92
\beamer@subsectionstartpage=\count93
\beamer@animationtempa=\count94
\beamer@animationtempb=\count95
\beamer@xpos=\count96
\beamer@ypos=\count97
\beamer@ypos@offset=\count98
\beamer@showpartnumber=\count99
\beamer@currentsubsection=\count100
\beamer@coveringdepth=\count101
\beamer@sectionadjust=\count102
\beamer@tocsectionnumber=\count103
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaseoptions.sty
(/usr/share/texlive/texmf-dist/tex/latex/graphics/keyval.sty
Package: keyval 2014/10/28 v1.15 key=value parser (DPC)
\KV@toks@=\toks14
))
\beamer@paperwidth=\skip42
\beamer@paperheight=\skip43
(/usr/share/texlive/texmf-dist/tex/latex/geometry/geometry.sty
Package: geometry 2010/09/12 v5.6 Page Geometry
(/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ifvtex.sty
Package: ifvtex 2016/05/16 v1.6 Detect VTeX and its facilities (HO)
Package ifvtex Info: VTeX not detected.
)
(/usr/share/texlive/texmf-dist/tex/generic/ifxetex/ifxetex.sty
Package: ifxetex 2010/09/12 v0.6 Provides ifxetex conditional
)
\Gm@cnth=\count104
\Gm@cntv=\count105
\c@Gm@tempcnt=\count106
\Gm@bindingoffset=\dimen118
\Gm@wd@mp=\dimen119
\Gm@odd@mp=\dimen120
\Gm@even@mp=\dimen121
\Gm@layoutwidth=\dimen122
\Gm@layoutheight=\dimen123
\Gm@layouthoffset=\dimen124
\Gm@layoutvoffset=\dimen125
\Gm@dimlist=\toks15
)
(/usr/share/texlive/texmf-dist/tex/latex/base/size11.clo
File: size11.clo 2014/09/29 v1.4h Standard LaTeX file (size option)
)
(/usr/share/texlive/texmf-dist/tex/latex/pgf/basiclayer/pgfcore.sty
(/usr/share/texlive/texmf-dist/tex/latex/graphics/graphicx.sty
Package: graphicx 2017/06/01 v1.1a Enhanced LaTeX Graphics (DPC,SPQR)
(/usr/share/texlive/texmf-dist/tex/latex/graphics/graphics.sty
Package: graphics 2017/06/25 v1.2c Standard LaTeX Graphics (DPC,SPQR)
(/usr/share/texlive/texmf-dist/tex/latex/graphics/trig.sty
Package: trig 2016/01/03 v1.10 sin cos tan (DPC)
)
(/usr/share/texlive/texmf-dist/tex/latex/graphics-cfg/graphics.cfg
File: graphics.cfg 2016/06/04 v1.11 sample graphics configuration
)
Package graphics Info: Driver file: pdftex.def on input line 99.
(/usr/share/texlive/texmf-dist/tex/latex/graphics-def/pdftex.def
File: pdftex.def 2018/01/08 v1.0l Graphics/color driver for pdftex
))
\Gin@req@height=\dimen126
\Gin@req@width=\dimen127
)
(/usr/share/texlive/texmf-dist/tex/latex/pgf/systemlayer/pgfsys.sty
(/usr/share/texlive/texmf-dist/tex/latex/pgf/utilities/pgfrcs.sty
(/usr/share/texlive/texmf-dist/tex/generic/pgf/utilities/pgfutil-common.tex
\pgfutil@everybye=\toks16
\pgfutil@tempdima=\dimen128
\pgfutil@tempdimb=\dimen129
(/usr/share/texlive/texmf-dist/tex/generic/pgf/utilities/pgfutil-common-lists.t
ex)) (/usr/share/texlive/texmf-dist/tex/generic/pgf/utilities/pgfutil-latex.def
\pgfutil@abb=\box34
(/usr/share/texlive/texmf-dist/tex/latex/ms/everyshi.sty
Package: everyshi 2001/05/15 v3.00 EveryShipout Package (MS)
))
(/usr/share/texlive/texmf-dist/tex/generic/pgf/utilities/pgfrcs.code.tex
Package: pgfrcs 2015/08/07 v3.0.1a (rcs-revision 1.31)
))
(/usr/share/texlive/texmf-dist/tex/generic/pgf/systemlayer/pgfsys.code.tex
Package: pgfsys 2014/07/09 v3.0.1a (rcs-revision 1.48)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/utilities/pgfkeys.code.tex
\pgfkeys@pathtoks=\toks17
\pgfkeys@temptoks=\toks18
(/usr/share/texlive/texmf-dist/tex/generic/pgf/utilities/pgfkeysfiltered.code.t
ex
\pgfkeys@tmptoks=\toks19
))
\pgf@x=\dimen130
\pgf@y=\dimen131
\pgf@xa=\dimen132
\pgf@ya=\dimen133
\pgf@xb=\dimen134
\pgf@yb=\dimen135
\pgf@xc=\dimen136
\pgf@yc=\dimen137
\w@pgf@writea=\write3
\r@pgf@reada=\read1
\c@pgf@counta=\count107
\c@pgf@countb=\count108
\c@pgf@countc=\count109
\c@pgf@countd=\count110
\t@pgf@toka=\toks20
\t@pgf@tokb=\toks21
\t@pgf@tokc=\toks22
(/usr/share/texlive/texmf-dist/tex/generic/pgf/systemlayer/pgf.cfg
File: pgf.cfg 2008/05/14 (rcs-revision 1.7)
)
Driver file for pgf: pgfsys-pdftex.def
(/usr/share/texlive/texmf-dist/tex/generic/pgf/systemlayer/pgfsys-pdftex.def
File: pgfsys-pdftex.def 2014/10/11 (rcs-revision 1.35)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/systemlayer/pgfsys-common-pdf.de
f
File: pgfsys-common-pdf.def 2013/10/10 (rcs-revision 1.13)
)))
(/usr/share/texlive/texmf-dist/tex/generic/pgf/systemlayer/pgfsyssoftpath.code.
tex
File: pgfsyssoftpath.code.tex 2013/09/09 (rcs-revision 1.9)
\pgfsyssoftpath@smallbuffer@items=\count111
\pgfsyssoftpath@bigbuffer@items=\count112
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/systemlayer/pgfsysprotocol.code.
tex
File: pgfsysprotocol.code.tex 2006/10/16 (rcs-revision 1.4)
)) (/usr/share/texlive/texmf-dist/tex/latex/xcolor/xcolor.sty
Package: xcolor 2016/05/11 v2.12 LaTeX color extensions (UK)
(/usr/share/texlive/texmf-dist/tex/latex/graphics-cfg/color.cfg
File: color.cfg 2016/01/02 v1.6 sample color configuration
)
Package xcolor Info: Driver file: pdftex.def on input line 225.
Package xcolor Info: Model `cmy' substituted by `cmy0' on input line 1348.
Package xcolor Info: Model `hsb' substituted by `rgb' on input line 1352.
Package xcolor Info: Model `RGB' extended on input line 1364.
Package xcolor Info: Model `HTML' substituted by `rgb' on input line 1366.
Package xcolor Info: Model `Hsb' substituted by `hsb' on input line 1367.
Package xcolor Info: Model `tHsb' substituted by `hsb' on input line 1368.
Package xcolor Info: Model `HSB' substituted by `hsb' on input line 1369.
Package xcolor Info: Model `Gray' substituted by `gray' on input line 1370.
Package xcolor Info: Model `wave' substituted by `hsb' on input line 1371.
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcore.code.tex
Package: pgfcore 2010/04/11 v3.0.1a (rcs-revision 1.7)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmath.code.tex
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathcalc.code.tex
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathutil.code.tex)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathparser.code.tex
\pgfmath@dimen=\dimen138
\pgfmath@count=\count113
\pgfmath@box=\box35
\pgfmath@toks=\toks23
\pgfmath@stack@operand=\toks24
\pgfmath@stack@operation=\toks25
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.code.tex
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.basic.code
.tex)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.trigonomet
ric.code.tex)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.random.cod
e.tex)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.comparison
.code.tex)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.base.code.
tex)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.round.code
.tex)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.misc.code.
tex)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfunctions.integerari
thmetics.code.tex)))
(/usr/share/texlive/texmf-dist/tex/generic/pgf/math/pgfmathfloat.code.tex
\c@pgfmathroundto@lastzeros=\count114
))
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorepoints.code.te
x
File: pgfcorepoints.code.tex 2013/10/07 (rcs-revision 1.27)
\pgf@picminx=\dimen139
\pgf@picmaxx=\dimen140
\pgf@picminy=\dimen141
\pgf@picmaxy=\dimen142
\pgf@pathminx=\dimen143
\pgf@pathmaxx=\dimen144
\pgf@pathminy=\dimen145
\pgf@pathmaxy=\dimen146
\pgf@xx=\dimen147
\pgf@xy=\dimen148
\pgf@yx=\dimen149
\pgf@yy=\dimen150
\pgf@zx=\dimen151
\pgf@zy=\dimen152
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorepathconstruct.
code.tex
File: pgfcorepathconstruct.code.tex 2013/10/07 (rcs-revision 1.29)
\pgf@path@lastx=\dimen153
\pgf@path@lasty=\dimen154
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorepathusage.code
.tex
File: pgfcorepathusage.code.tex 2014/11/02 (rcs-revision 1.24)
\pgf@shorten@end@additional=\dimen155
\pgf@shorten@start@additional=\dimen156
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorescopes.code.te
x
File: pgfcorescopes.code.tex 2015/05/08 (rcs-revision 1.46)
\pgfpic=\box36
\pgf@hbox=\box37
\pgf@layerbox@main=\box38
\pgf@picture@serial@count=\count115
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcoregraphicstate.c
ode.tex
File: pgfcoregraphicstate.code.tex 2014/11/02 (rcs-revision 1.12)
\pgflinewidth=\dimen157
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcoretransformation
s.code.tex
File: pgfcoretransformations.code.tex 2015/08/07 (rcs-revision 1.20)
\pgf@pt@x=\dimen158
\pgf@pt@y=\dimen159
\pgf@pt@temp=\dimen160
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorequick.code.tex
File: pgfcorequick.code.tex 2008/10/09 (rcs-revision 1.3)
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcoreobjects.code.t
ex
File: pgfcoreobjects.code.tex 2006/10/11 (rcs-revision 1.2)
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorepathprocessing
.code.tex
File: pgfcorepathprocessing.code.tex 2013/09/09 (rcs-revision 1.9)
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorearrows.code.te
x
File: pgfcorearrows.code.tex 2015/05/14 (rcs-revision 1.43)
\pgfarrowsep=\dimen161
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcoreshade.code.tex
File: pgfcoreshade.code.tex 2013/07/15 (rcs-revision 1.15)
\pgf@max=\dimen162
\pgf@sys@shading@range@num=\count116
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcoreimage.code.tex
File: pgfcoreimage.code.tex 2013/07/15 (rcs-revision 1.18)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcoreexternal.code.
tex
File: pgfcoreexternal.code.tex 2014/07/09 (rcs-revision 1.21)
\pgfexternal@startupbox=\box39
))
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorelayers.code.te
x
File: pgfcorelayers.code.tex 2013/07/18 (rcs-revision 1.7)
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcoretransparency.c
ode.tex
File: pgfcoretransparency.code.tex 2013/09/30 (rcs-revision 1.5)
)
(/usr/share/texlive/texmf-dist/tex/generic/pgf/basiclayer/pgfcorepatterns.code.
tex
File: pgfcorepatterns.code.tex 2013/11/07 (rcs-revision 1.5)
))) (/usr/share/texlive/texmf-dist/tex/latex/pgf/utilities/xxcolor.sty
Package: xxcolor 2003/10/24 ver 0.1
\XC@nummixins=\count117
\XC@countmixins=\count118
)
(/usr/share/texlive/texmf-dist/tex/generic/oberdiek/atbegshi.sty
Package: atbegshi 2016/06/09 v1.18 At begin shipout hook (HO)
(/usr/share/texlive/texmf-dist/tex/generic/oberdiek/infwarerr.sty
Package: infwarerr 2016/05/16 v1.4 Providing info/warning/error messages (HO)
)
(/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ltxcmds.sty
Package: ltxcmds 2016/05/16 v1.23 LaTeX kernel commands for general use (HO)
))
(/usr/share/texlive/texmf-dist/tex/latex/hyperref/hyperref.sty
Package: hyperref 2018/02/06 v6.86b Hypertext links for LaTeX
(/usr/share/texlive/texmf-dist/tex/generic/oberdiek/hobsub-hyperref.sty
Package: hobsub-hyperref 2016/05/16 v1.14 Bundle oberdiek, subset hyperref (HO)
(/usr/share/texlive/texmf-dist/tex/generic/oberdiek/hobsub-generic.sty
Package: hobsub-generic 2016/05/16 v1.14 Bundle oberdiek, subset generic (HO)
Package: hobsub 2016/05/16 v1.14 Construct package bundles (HO)
Package hobsub Info: Skipping package `infwarerr' (already loaded).
Package hobsub Info: Skipping package `ltxcmds' (already loaded).
Package: ifluatex 2016/05/16 v1.4 Provides the ifluatex switch (HO)
Package ifluatex Info: LuaTeX not detected.
Package hobsub Info: Skipping package `ifvtex' (already loaded).
Package: intcalc 2016/05/16 v1.2 Expandable calculations with integers (HO)
Package hobsub Info: Skipping package `ifpdf' (already loaded).
Package: etexcmds 2016/05/16 v1.6 Avoid name clashes with e-TeX commands (HO)
Package etexcmds Info: Could not find \expanded.
(etexcmds) That can mean that you are not using pdfTeX 1.50 or
(etexcmds) that some package has redefined \expanded.
(etexcmds) In the latter case, load this package earlier.
Package: kvsetkeys 2016/05/16 v1.17 Key value parser (HO)
Package: kvdefinekeys 2016/05/16 v1.4 Define keys (HO)
Package: pdftexcmds 2018/01/21 v0.26 Utility functions of pdfTeX for LuaTeX (HO
)
Package pdftexcmds Info: LuaTeX not detected.
Package pdftexcmds Info: \pdf@primitive is available.
Package pdftexcmds Info: \pdf@ifprimitive is available.
Package pdftexcmds Info: \pdfdraftmode found.
Package: pdfescape 2016/05/16 v1.14 Implements pdfTeX's escape features (HO)
Package: bigintcalc 2016/05/16 v1.4 Expandable calculations on big integers (HO
)
Package: bitset 2016/05/16 v1.2 Handle bit-vector datatype (HO)
Package: uniquecounter 2016/05/16 v1.3 Provide unlimited unique counter (HO)
)
Package hobsub Info: Skipping package `hobsub' (already loaded).
Package: letltxmacro 2016/05/16 v1.5 Let assignment for LaTeX macros (HO)
Package: hopatch 2016/05/16 v1.3 Wrapper for package hooks (HO)
Package: xcolor-patch 2016/05/16 xcolor patch
Package: atveryend 2016/05/16 v1.9 Hooks at the very end of document (HO)
Package hobsub Info: Skipping package `atbegshi' (already loaded).
Package: refcount 2016/05/16 v3.5 Data extraction from label references (HO)
Package: hycolor 2016/05/16 v1.8 Color options for hyperref/bookmark (HO)
)
(/usr/share/texlive/texmf-dist/tex/latex/oberdiek/auxhook.sty
Package: auxhook 2016/05/16 v1.4 Hooks for auxiliary files (HO)
)
(/usr/share/texlive/texmf-dist/tex/latex/oberdiek/kvoptions.sty
Package: kvoptions 2016/05/16 v3.12 Key value format for package options (HO)
)
\@linkdim=\dimen163
\Hy@linkcounter=\count119
\Hy@pagecounter=\count120
(/usr/share/texlive/texmf-dist/tex/latex/hyperref/pd1enc.def
File: pd1enc.def 2018/02/06 v6.86b Hyperref: PDFDocEncoding definition (HO)
)
\Hy@SavedSpaceFactor=\count121
(/usr/share/texlive/texmf-dist/tex/latex/latexconfig/hyperref.cfg
File: hyperref.cfg 2002/06/06 v1.2 hyperref configuration of TeXLive
)
Package hyperref Info: Option `bookmarks' set `true' on input line 4383.
Package hyperref Info: Option `bookmarksopen' set `true' on input line 4383.
Package hyperref Info: Option `implicit' set `false' on input line 4383.
Package hyperref Info: Hyper figures OFF on input line 4509.
Package hyperref Info: Link nesting OFF on input line 4514.
Package hyperref Info: Hyper index ON on input line 4517.
Package hyperref Info: Plain pages OFF on input line 4524.
Package hyperref Info: Backreferencing OFF on input line 4529.
Package hyperref Info: Implicit mode OFF; no redefinition of LaTeX internals.
Package hyperref Info: Bookmarks ON on input line 4762.
\c@Hy@tempcnt=\count122
(/usr/share/texlive/texmf-dist/tex/latex/url/url.sty
\Urlmuskip=\muskip10
Package: url 2013/09/16 ver 3.4 Verb mode for urls, etc.
)
LaTeX Info: Redefining \url on input line 5115.
\XeTeXLinkMargin=\dimen164
\Fld@menulength=\count123
\Field@Width=\dimen165
\Fld@charsize=\dimen166
Package hyperref Info: Hyper figures OFF on input line 6369.
Package hyperref Info: Link nesting OFF on input line 6374.
Package hyperref Info: Hyper index ON on input line 6377.
Package hyperref Info: backreferencing OFF on input line 6384.
Package hyperref Info: Link coloring OFF on input line 6389.
Package hyperref Info: Link coloring with OCG OFF on input line 6394.
Package hyperref Info: PDF/A mode OFF on input line 6399.
LaTeX Info: Redefining \ref on input line 6439.
LaTeX Info: Redefining \pageref on input line 6443.
\Hy@abspage=\count124
Package hyperref Message: Stopped early.
)
Package hyperref Info: Driver (autodetected): hpdftex.
(/usr/share/texlive/texmf-dist/tex/latex/hyperref/hpdftex.def
File: hpdftex.def 2018/02/06 v6.86b Hyperref driver for pdfTeX
\Fld@listcount=\count125
\c@bookmark@seq@number=\count126
(/usr/share/texlive/texmf-dist/tex/latex/oberdiek/rerunfilecheck.sty
Package: rerunfilecheck 2016/05/16 v1.8 Rerun checks for auxiliary files (HO)
Package uniquecounter Info: New unique counter `rerunfilecheck' on input line 2
82.
))
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaserequires.sty
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasecompatibility.sty)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasefont.sty
(/usr/share/texlive/texmf-dist/tex/latex/amsfonts/amssymb.sty
Package: amssymb 2013/01/14 v3.01 AMS font symbols
(/usr/share/texlive/texmf-dist/tex/latex/amsfonts/amsfonts.sty
Package: amsfonts 2013/01/14 v3.01 Basic AMSFonts support
\@emptytoks=\toks26
\symAMSa=\mathgroup4
\symAMSb=\mathgroup5
LaTeX Font Info: Overwriting math alphabet `\mathfrak' in version `bold'
(Font) U/euf/m/n --> U/euf/b/n on input line 106.
))
(/usr/share/texlive/texmf-dist/tex/latex/sansmathaccent/sansmathaccent.sty
Package: sansmathaccent 2013/03/28
(/usr/share/texlive/texmf-dist/tex/latex/filehook/filehook.sty
Package: filehook 2011/10/12 v0.5d Hooks for input files
)))
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasetranslator.sty
(/usr/share/texlive/texmf-dist/tex/latex/translator/translator.sty
Package: translator 2018/01/04 v1.12 Easy translation of strings in LaTeX
))
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasemisc.sty)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasetwoscreens.sty)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaseoverlay.sty
\beamer@argscount=\count127
\beamer@lastskipcover=\skip44
\beamer@trivlistdepth=\count128
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasetitle.sty)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasesection.sty
\c@lecture=\count129
\c@part=\count130
\c@section=\count131
\c@subsection=\count132
\c@subsubsection=\count133
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaseframe.sty
\beamer@framebox=\box40
\beamer@frametitlebox=\box41
\beamer@zoombox=\box42
\beamer@zoomcount=\count134
\beamer@zoomframecount=\count135
\beamer@frametextheight=\dimen167
\c@subsectionslide=\count136
\beamer@frametopskip=\skip45
\beamer@framebottomskip=\skip46
\beamer@frametopskipautobreak=\skip47
\beamer@framebottomskipautobreak=\skip48
\beamer@envbody=\toks27
\framewidth=\dimen168
\c@framenumber=\count137
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaseverbatim.sty
\beamer@verbatimfileout=\write4
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaseframesize.sty
\beamer@splitbox=\box43
\beamer@autobreakcount=\count138
\beamer@autobreaklastheight=\dimen169
\beamer@frametitletoks=\toks28
\beamer@framesubtitletoks=\toks29
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaseframecomponents.sty
\beamer@footins=\box44
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasecolor.sty
\beamer@bg@ht=\dimen170
\beamer@bg@wd=\dimen171
\beamer@bg@dp=\dimen172
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasenotes.sty
\beamer@frameboxcopy=\box45
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasetoc.sty)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasetemplates.sty
\beamer@sbttoks=\toks30
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaseauxtemplates.sty
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaseboxes.sty
\bmb@box=\box46
\bmb@colorbox=\box47
\bmb@boxshadow=\box48
\bmb@boxshadowball=\box49
\bmb@boxshadowballlarge=\box50
\bmb@temp=\dimen173
\bmb@dima=\dimen174
\bmb@dimb=\dimen175
\bmb@prevheight=\dimen176
)
\beamer@blockheadheight=\dimen177
))
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbaselocalstructure.sty
(/usr/share/texlive/texmf-dist/tex/latex/tools/enumerate.sty
Package: enumerate 2015/07/23 v3.00 enumerate extensions (DPC)
\@enLab=\toks31
)
\c@figure=\count139
\c@table=\count140
\abovecaptionskip=\skip49
\belowcaptionskip=\skip50
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasenavigation.sty
\beamer@section@min@dim=\dimen178
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasetheorems.sty
(/usr/share/texlive/texmf-dist/tex/latex/amsmath/amsmath.sty
Package: amsmath 2017/09/02 v2.17a AMS math features
\@mathmargin=\skip51
For additional information on amsmath, use the `?' option.
(/usr/share/texlive/texmf-dist/tex/latex/amsmath/amstext.sty
Package: amstext 2000/06/29 v2.01 AMS text
(/usr/share/texlive/texmf-dist/tex/latex/amsmath/amsgen.sty
File: amsgen.sty 1999/11/30 v2.0 generic functions
\@emptytoks=\toks32
\ex@=\dimen179
))
(/usr/share/texlive/texmf-dist/tex/latex/amsmath/amsbsy.sty
Package: amsbsy 1999/11/29 v1.2d Bold Symbols
\pmbraise@=\dimen180
)
(/usr/share/texlive/texmf-dist/tex/latex/amsmath/amsopn.sty
Package: amsopn 2016/03/08 v2.02 operator names
)
\inf@bad=\count141
LaTeX Info: Redefining \frac on input line 213.
\uproot@=\count142
\leftroot@=\count143
LaTeX Info: Redefining \overline on input line 375.
\classnum@=\count144
\DOTSCASE@=\count145
LaTeX Info: Redefining \ldots on input line 472.
LaTeX Info: Redefining \dots on input line 475.
LaTeX Info: Redefining \cdots on input line 596.
\Mathstrutbox@=\box51
\strutbox@=\box52
\big@size=\dimen181
LaTeX Font Info: Redeclaring font encoding OML on input line 712.
LaTeX Font Info: Redeclaring font encoding OMS on input line 713.
\macc@depth=\count146
\c@MaxMatrixCols=\count147
\dotsspace@=\muskip11
\c@parentequation=\count148
\dspbrk@lvl=\count149
\tag@help=\toks33
\row@=\count150
\column@=\count151
\maxfields@=\count152
\andhelp@=\toks34
\eqnshift@=\dimen182
\alignsep@=\dimen183
\tagshift@=\dimen184
\tagwidth@=\dimen185
\totwidth@=\dimen186
\lineht@=\dimen187
\@envbody=\toks35
\multlinegap=\skip52
\multlinetaggap=\skip53
\mathdisplay@stack=\toks36
LaTeX Info: Redefining \[ on input line 2817.
LaTeX Info: Redefining \] on input line 2818.
)
(/usr/share/texlive/texmf-dist/tex/latex/amscls/amsthm.sty
Package: amsthm 2017/10/31 v2.20.4
\thm@style=\toks37
\thm@bodyfont=\toks38
\thm@headfont=\toks39
\thm@notefont=\toks40
\thm@headpunct=\toks41
\thm@preskip=\skip54
\thm@postskip=\skip55
\thm@headsep=\skip56
\dth@everypar=\toks42
)
\c@theorem=\count153
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerbasethemes.sty))
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerthemedefault.sty
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerfontthemedefault.sty)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamercolorthemedefault.sty)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerinnerthemedefault.sty
\beamer@dima=\dimen188
\beamer@dimb=\dimen189
)
(/usr/share/texlive/texmf-dist/tex/latex/beamer/beamerouterthemedefault.sty)))
! LaTeX Error: File `beamerthemefocus.sty' not found.
Type X to quit or <RETURN> to proceed,
or enter new name. (Default extension: sty)
Enter file name:
! Emergency stop.
<read *>
l.2 \usetheme[numbering=progressbar]{focus}
^^M
End of file on the terminal!
Here is how much of TeX's memory you used:
15567 strings out of 492982
294369 string characters out of 6134896
377237 words of memory out of 5000000
18841 multiletter control sequences out of 15000+600000
4245 words of font info for 16 fonts, out of 8000000 for 9000
1141 hyphenation exceptions out of 8191
56i,0n,55p,811b,277s stack positions out of 5000i,500n,10000p,200000b,80000s
! ==> Fatal error occurred, no output PDF file produced!

25
AUSCERT2020/slide.tex Normal file
View File

@ -0,0 +1,25 @@
\documentclass{beamer}
\usetheme[numbering=progressbar]{focus}
\definecolor{main}{RGB}{47, 161, 219}
\definecolor{textcolor}{RGB}{128, 128, 128}
\definecolor{background}{RGB}{240, 247, 255}
\usepackage[utf8]{inputenc}
\usepackage{tikz}
\usepackage{listings}
\usepackage{adjustbox}
\usetikzlibrary{positioning}
\usetikzlibrary{shapes,arrows}
%\usepackage[T1]{fontenc}
%\usepackage[scaled]{beramono}
\author{\small{\input{../includes/authors.txt}}}
\title{MISP status update}
\subtitle{Improvements since the last MUG and the future roadmap}
\institute{\includegraphics[scale=0.5]{misplogo.pdf}}
\titlegraphic{\includegraphics[scale=0.85]{misp.pdf}}
\date{\input{../includes/location.txt}}
\begin{document}
\include{content}
\end{document}

Binary file not shown.

After

Width:  |  Height:  |  Size: 22 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 146 KiB

BIN
AUSCERT2020/timeline.jpeg Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 102 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 8.9 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 27 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 16 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 20 KiB

BIN
AUSCERT2020/x-isac-logo.png Executable file

Binary file not shown.

After

Width:  |  Height:  |  Size: 39 KiB

View File

@ -29,7 +29,7 @@ given to the materials. We welcome contributions in order to improve the trainin
| [a.2-pymisp](https://www.misp-project.org/misp-training/a.2-pymisp.pdf) | [source](https://github.com/MISP/misp-training/tree/master/a.2-pymisp) |
| [a.3-misp-feed](https://www.misp-project.org/misp-training/a.3-misp-feed.pdf) | [source](https://github.com/MISP/misp-training/tree/master/a.3-misp-feed) |
| [a.4-best-practices](https://www.misp-project.org/misp-training/a.4-best-practices.pdf) | [source](https://github.com/MISP/misp-training/tree/master/a.4-best-practices) |
| [a.5-decaying-indicators](https://www.misp-project.org/misp-training/a.5-decaying-indicators.pdf) | [source](https://github.com/MISP/misp-training/tree/master/a.5-decaying-indicators) |
| [a.5-decaying-indicators](https://www.misp-project.org/misp-training/a.5-bis-decaying-indicators-light-version.pdf) | [source](https://github.com/MISP/misp-training/tree/master/a.5-bis-decaying-indicators-light-version) |
| [a.6-forensic](https://www.misp-project.org/misp-training/a.6-forensic.pdf) | [source](https://github.com/MISP/misp-training/tree/master/a.6-forensic) |
| [a.7-rest-API](https://www.misp-project.org/misp-training/a.7-rest-API.pdf) | [source](https://github.com/MISP/misp-training/tree/master/a.7-rest-API) |
| [a.8-dev-hands-on.pdf](https://www.misp-project.org/misp-training/a.8-dev-hands-on.pdf) | [source](https://github.com/MISP/misp-training/tree/master/a.8-dev-hands-on) |