forked from p34709852/monkey
docs: replace single right quote (U+2019) with apostrophe (ascii 0x27)
This commit is contained in:
parent
cbe9c6776d
commit
5e3a8994d2
|
@ -5,7 +5,7 @@ draft: false
|
|||
pre: "<i class='fas fa-question'></i> "
|
||||
---
|
||||
|
||||
Here are some of the most common questions we receive about the Infection Monkey. If the answer you’re looking for isn’t here, talk with us [on our Slack channel](https://infectionmonkey.slack.com/join/shared_invite/enQtNDU5MjAxMjg1MjU1LWM0NjVmNWE2ZTMzYzAxOWJiYmMxMzU0NWU3NmUxYjcyNjk0YWY2MDkwODk4NGMyNDU4NzA4MDljOWNmZWViNDU), email us at [support@infectionmonkey.com](mailto:support@infectionmonkey.com) or [open an issue on GitHub](https://github.com/guardicore/monkey).
|
||||
Here are some of the most common questions we receive about the Infection Monkey. If the answer you're looking for isn't here, talk with us [on our Slack channel](https://infectionmonkey.slack.com/join/shared_invite/enQtNDU5MjAxMjg1MjU1LWM0NjVmNWE2ZTMzYzAxOWJiYmMxMzU0NWU3NmUxYjcyNjk0YWY2MDkwODk4NGMyNDU4NzA4MDljOWNmZWViNDU), email us at [support@infectionmonkey.com](mailto:support@infectionmonkey.com) or [open an issue on GitHub](https://github.com/guardicore/monkey).
|
||||
|
||||
- [Where can I get the latest Monkey version? 📰](#where-can-i-get-the-latest-monkey-version)
|
||||
- [How long does a single Monkey run for? Is there a time limit?](#how-long-does-a-single-monkey-run-for-is-there-a-time-limit)
|
||||
|
@ -17,11 +17,11 @@ Here are some of the most common questions we receive about the Infection Monkey
|
|||
- [Monkey agent](#monkey-agent)
|
||||
- [Running the Monkey in a production environment](#running-the-monkey-in-a-production-environment)
|
||||
- [How much of a footprint does the Monkey leave?](#how-much-of-a-footprint-does-the-monkey-leave)
|
||||
- [What’s the Monkey’s impact on system resources usage?](#whats-the-monkeys-impact-on-system-resources-usage)
|
||||
- [Is it safe to use real passwords and usernames in the Monkey’s configuration?](#is-it-safe-to-use-real-passwords-and-usernames-in-the-monkeys-configuration)
|
||||
- [What's the Monkey's impact on system resources usage?](#whats-the-monkeys-impact-on-system-resources-usage)
|
||||
- [Is it safe to use real passwords and usernames in the Monkey's configuration?](#is-it-safe-to-use-real-passwords-and-usernames-in-the-monkeys-configuration)
|
||||
- [How do you store sensitive information on Monkey Island?](#how-do-you-store-sensitive-information-on-monkey-island)
|
||||
- [How stable are the exploitations used by the Monkey? Will the Monkey crash my systems with its exploits?](#how-stable-are-the-exploitations-used-by-the-monkey-will-the-monkey-crash-my-systems-with-its-exploits)
|
||||
- [After I’ve set up Monkey Island, how can I execute the Monkey?](#after-ive-set-up-monkey-island-how-can-i-execute-the-monkey)
|
||||
- [After I've set up Monkey Island, how can I execute the Monkey?](#after-ive-set-up-monkey-island-how-can-i-execute-the-monkey)
|
||||
- [How can I make the monkey propagate “deeper” into the network?](#how-can-i-make-the-monkey-propagate-deeper-into-the-network)
|
||||
- [The report returns a blank screen](#the-report-returns-a-blank-screen)
|
||||
- [How can I get involved with the project? 👩💻👨💻](#how-can-i-get-involved-with-the-project)
|
||||
|
@ -77,7 +77,7 @@ The Monkey performs queries out to the Internet on two separate occasions:
|
|||
|
||||
### Monkey Island
|
||||
|
||||
The Monkey Island’s log file can be downloaded directly from the UI. Click the “log” section and choose “Download Monkey Island internal logfile”, like so:
|
||||
The Monkey Island's log file can be downloaded directly from the UI. Click the “log” section and choose “Download Monkey Island internal logfile”, like so:
|
||||
|
||||
![How to download Monkey Island internal log file](/images/faq/download_log_monkey_island.png "How to download Monkey Island internal log file")
|
||||
|
||||
|
@ -98,7 +98,7 @@ The Monkey log file can be found in the following paths on machines where it was
|
|||
- Path on Linux: `/tmp/user-1563`
|
||||
- Path on Windows: `%temp%\\~df1563.tmp`
|
||||
|
||||
The logs contain information about the internals of the Monkey’s execution. The log will contain entries like these ones for example:
|
||||
The logs contain information about the internals of the Monkey's execution. The log will contain entries like these ones for example:
|
||||
|
||||
```log
|
||||
2019-07-22 19:16:44,228 [77598:140654230214464:INFO] main.main.116: >>>>>>>>>> Initializing monkey (InfectionMonkey): PID 77598 <<<<<<<<<<
|
||||
|
@ -124,13 +124,13 @@ The Monkey leaves hardly any trace on the target system. It will leave:
|
|||
- Path on Linux: `/tmp/user-1563`
|
||||
- Path on Windows: `%temp%\\~df1563.tmp`
|
||||
|
||||
### What’s the Monkey’s impact on system resources usage?
|
||||
### What's the Monkey's impact on system resources usage?
|
||||
|
||||
The Infection Monkey uses less than single-digit percent of CPU time and very low RAM usage. For example, on a single-core Windows Server machine, the Monkey consistently uses 0.06% CPU, less than 80MB of RAM and a small amount of I/O periodically.
|
||||
|
||||
If you do experience any performance issues please let us know on [our Slack channel](https://infectionmonkey.slack.com/) or via [opening an issue on GitHub](https://github.com/guardicore/monkey).
|
||||
|
||||
### Is it safe to use real passwords and usernames in the Monkey’s configuration?
|
||||
### Is it safe to use real passwords and usernames in the Monkey's configuration?
|
||||
|
||||
Absolutely! User credentials are stored encrypted in the Monkey Island server. This information is then accessible only to users that have access to the Island.
|
||||
|
||||
|
@ -138,7 +138,7 @@ We advise to limit access to the Monkey Island server by following our [password
|
|||
|
||||
### How do you store sensitive information on Monkey Island?
|
||||
|
||||
Sensitive data such as passwords, SSH keys and hashes are stored on the Monkey Island’s database in an encrypted fashion. This data is transmitted to the Infection Monkeys in an encrypted fashion (HTTPS) and is not stored locally on the victim machines.
|
||||
Sensitive data such as passwords, SSH keys and hashes are stored on the Monkey Island's database in an encrypted fashion. This data is transmitted to the Infection Monkeys in an encrypted fashion (HTTPS) and is not stored locally on the victim machines.
|
||||
|
||||
When you reset the Monkey Island configuration, the Monkey Island wipes the information.
|
||||
|
||||
|
@ -146,9 +146,9 @@ When you reset the Monkey Island configuration, the Monkey Island wipes the info
|
|||
|
||||
The Monkey does not use any exploits or attacks that may impact the victim system.
|
||||
|
||||
This means we avoid using some very strong (and famous) exploits such as [EternalBlue](https://www.guardicore.com/2017/05/detecting-mitigating-wannacry-copycat-attacks-using-guardicore-centra-platform/). This exploit was used in WannaCry and NotPetya with huge impact. But because it may crash a production system, we aren’t using it.
|
||||
This means we avoid using some very strong (and famous) exploits such as [EternalBlue](https://www.guardicore.com/2017/05/detecting-mitigating-wannacry-copycat-attacks-using-guardicore-centra-platform/). This exploit was used in WannaCry and NotPetya with huge impact. But because it may crash a production system, we aren't using it.
|
||||
|
||||
## After I’ve set up Monkey Island, how can I execute the Monkey?
|
||||
## After I've set up Monkey Island, how can I execute the Monkey?
|
||||
|
||||
See our detailed [getting started](../content/usage/getting-started) guide.
|
||||
|
||||
|
@ -175,6 +175,6 @@ The Monkey is an open-source project, and we weclome contributions and contribut
|
|||
|
||||
### How did you come up with the Infection Monkey?
|
||||
|
||||
Oddly enough, the idea of proactively breaking the network to test its survival wasn’t born in the security industry. In 2011, the streaming giant Netflix released Chaos Monkey, a tool that was designed to randomly disable the company’s production servers to verify they could survive network failures without any customer impact. Netflix's Chaos Monkey became a popular network resilience tool, breaking the network in a variety of failure modes, including connectivity issues, invalid SSL certificates and randomly deleting VMs.
|
||||
Oddly enough, the idea of proactively breaking the network to test its survival wasn't born in the security industry. In 2011, the streaming giant Netflix released Chaos Monkey, a tool that was designed to randomly disable the company's production servers to verify they could survive network failures without any customer impact. Netflix's Chaos Monkey became a popular network resilience tool, breaking the network in a variety of failure modes, including connectivity issues, invalid SSL certificates and randomly deleting VMs.
|
||||
|
||||
Inspired by this concept, Guardicore Labs developed its own attack simulator - Infection Monkey - to run non-intrusively within existing production environments. The idea was to test the resiliency of modern data centers against attack and give security teams the insights they need to make informed decisions and enforce tighter security policies. Since its launch in 2017 (?) the Infection Monkey has been used by hundreds of information technology teams from across the world to find weaknesses in their on-premises and cloud-based data centers.
|
||||
|
|
|
@ -24,11 +24,11 @@ The MITRE ATT&CK report is centred around the ATT&CK matrix:
|
|||
The Monkey rates your network on the attack techniques it attempted. For each technique, you can get
|
||||
|
||||
- {{< label danger Red >}}: The Monkey **successfully used** the technique in the simulation. That means your network is vulnerable to this technique being employed.
|
||||
- {{< label warning Yellow >}}: The Monkey **tried to use** the technique, but didn’t manage to. That means your network isn’t vulnerable to the way Monkey employs this technique.
|
||||
- {{< label warning Yellow >}}: The Monkey **tried to use** the technique, but didn't manage to. That means your network isn't vulnerable to the way Monkey employs this technique.
|
||||
- {{< label unused "Dark Gray" >}}: The Monkey **didn't try** the technique. Perhaps it wasn't relevant to this network.
|
||||
- {{< label disabled "Light Gray" >}}: The Monkey **didn't try** the technique since it wasn't configured.
|
||||
|
||||
Then, you can see exactly HOW the technique was used in this attack, and also what you should do to mitigate it, by clicking on the technique and seeing the details. For example, let’s look at the [**Brute Force**](https://attack.mitre.org/techniques/T1110/) technique that’s a part of employing the [**Credentials Access**](https://attack.mitre.org/tactics/TA0006/) tactic:
|
||||
Then, you can see exactly HOW the technique was used in this attack, and also what you should do to mitigate it, by clicking on the technique and seeing the details. For example, let's look at the [**Brute Force**](https://attack.mitre.org/techniques/T1110/) technique that's a part of employing the [**Credentials Access**](https://attack.mitre.org/tactics/TA0006/) tactic:
|
||||
|
||||
![MITRE Report Credentials Access technique](/images/usage/reports/mitre-report-cred-access.png "MITRE Report Credentials Access technique")
|
||||
|
||||
|
|
|
@ -13,10 +13,10 @@ The Guardicore Infection Monkey runs different tests to evaluate your network ad
|
|||
|
||||
## Summary
|
||||
|
||||
This diagram provides a quick glance at how your organization scores on each component of the Forrester’s Zero Trust model with **Failed**, **Verify**, **Passed** and **Unexecuted** verdicts.
|
||||
This diagram provides a quick glance at how your organization scores on each component of the Forrester's Zero Trust model with **Failed**, **Verify**, **Passed** and **Unexecuted** verdicts.
|
||||
|
||||
- {{< label danger Failed >}} At least one of the tests related to this component failed. This means that the Infection Monkey detected an unmet Zero Trust requirement.
|
||||
- {{< label warning Verify >}} At least one of the tests’ results related to this component requires further manual verification.
|
||||
- {{< label warning Verify >}} At least one of the tests' results related to this component requires further manual verification.
|
||||
- {{< label success Passed >}} All Tests related to this pillar passed. No violation of a Zero Trust guiding principle was detected.
|
||||
- {{< label unused Unexecuted >}} This status means no tests were executed for this pillar.
|
||||
|
||||
|
|
|
@ -9,7 +9,7 @@ tags: ["setup", "aws"]
|
|||
|
||||
## Deployment
|
||||
|
||||
On the [Infection Monkey’s AWS Marketplace page](https://aws.amazon.com/marketplace/pp/GuardiCore-Infection-Monkey/B07B3J7K6D), click **Continue to Subscribe**.
|
||||
On the [Infection Monkey's AWS Marketplace page](https://aws.amazon.com/marketplace/pp/GuardiCore-Infection-Monkey/B07B3J7K6D), click **Continue to Subscribe**.
|
||||
|
||||
1. Choose the desired region.
|
||||
1. Choose an EC2 instance type with at least 1GB of RAM for optimal performance or stick with the default recommendation.
|
||||
|
|
|
@ -29,7 +29,7 @@ Errors were encountered while processing:
|
|||
```
|
||||
|
||||
It just means that not all dependencies were pre-installed on your system.
|
||||
That’s no problem! Just run the following command, which will install all
|
||||
That's no problem! Just run the following command, which will install all
|
||||
dependencies, and then install the Monkey Island:
|
||||
|
||||
```sh
|
||||
|
@ -40,7 +40,7 @@ sudo apt install -f
|
|||
|
||||
### Trying to install on Ubuntu <16.04
|
||||
|
||||
If you’re trying to install the Monkey Island on Ubuntu 16.04 or older, you
|
||||
If you're trying to install the Monkey Island on Ubuntu 16.04 or older, you
|
||||
need to install the dependencies yourself, since Python 3.7 is only installable
|
||||
from the `deadsnakes` PPA. To install the Monkey Island on Ubuntu 16.04, follow
|
||||
these steps:
|
||||
|
|
|
@ -11,7 +11,7 @@ tags: ["setup", "docker", "linux", "windows"]
|
|||
|
||||
To extract the `tar.gz` file, run `tar -xvzf monkey-island-docker.tar.gz`.
|
||||
|
||||
Once you’ve extracted the container from the tar.gz file, run the following commands:
|
||||
Once you've extracted the container from the tar.gz file, run the following commands:
|
||||
|
||||
```sh
|
||||
sudo docker load -i dk.monkeyisland.1.9.0.tar
|
||||
|
|
|
@ -4,7 +4,7 @@ date: 2020-05-26T20:57:10+03:00
|
|||
draft: false
|
||||
pre: '<i class="fab fa-windows"></i> '
|
||||
weight: 2
|
||||
tags: ["setup", "windows"]
|
||||
tags: ["setup", "windows"]
|
||||
---
|
||||
|
||||
## Deployment
|
||||
|
@ -20,7 +20,7 @@ After running the installer, the following prompt should appear on the screen:
|
|||
|
||||
### Missing Windows update
|
||||
|
||||
The installer requires [Windows update #2999226](https://support.microsoft.com/en-us/help/2999226/update-for-universal-c-runtime-in-windows). If you’re having trouble running the installer, please make sure to install the update via Windows Update or manually from the link above.
|
||||
The installer requires [Windows update #2999226](https://support.microsoft.com/en-us/help/2999226/update-for-universal-c-runtime-in-windows). If you're having trouble running the installer, please make sure to install the update via Windows Update or manually from the link above.
|
||||
|
||||
### Supported browsers
|
||||
|
||||
|
|
|
@ -9,7 +9,7 @@ weight: 2
|
|||
## Overview
|
||||
|
||||
Infection Monkey can simulate various [ATT&CK](https://attack.mitre.org/matrices/enterprise/) techniques on the network.
|
||||
Use it to assess your security solutions’ detection and prevention capabilities. Infection Monkey will help you find
|
||||
Use it to assess your security solutions' detection and prevention capabilities. Infection Monkey will help you find
|
||||
which ATT&CK techniques go unnoticed and will provide recommendations about preventing them.
|
||||
|
||||
|
||||
|
|
|
@ -16,9 +16,9 @@ where these credentials can be reused.
|
|||
|
||||
## Configuration
|
||||
|
||||
- **Exploits -> Credentials** After setting up the Island add the users’ **real** credentials
|
||||
(usernames and passwords) to the Monkey’s configuration (Don’t worry, this sensitive data is not accessible and is not
|
||||
distributed or used in any way other than being sent to the monkeys, and can be easily eliminated by resetting the Monkey Island’s configuration).
|
||||
- **Exploits -> Credentials** After setting up the Island add the users' **real** credentials
|
||||
(usernames and passwords) to the Monkey's configuration (Don't worry, this sensitive data is not accessible and is not
|
||||
distributed or used in any way other than being sent to the monkeys, and can be easily eliminated by resetting the Monkey Island's configuration).
|
||||
- **Internal -> Exploits -> SSH keypair list** Monkey automatically gathers SSH keys on the current system.
|
||||
For this to work, Monkey Island or initial Monkey needs to have access to SSH key files(grant permission or run Monkey as root).
|
||||
To make sure SSH keys were gathered successfully, refresh the page and check this configuration value after you run the Monkey
|
||||
|
|
|
@ -13,7 +13,7 @@ isolate workloads from one another and secure them individually, typically using
|
|||
the effectiveness of your segmentation is to ensure that your network segments are properly separated, e,g, your
|
||||
Development is separated from your Production, your applications are separated from one another etc. Use the
|
||||
Infection Monkey to verify that your network segmentation is configured properly. This way you make sure that
|
||||
even if a certain attacker has breached your defenses, it can’t move laterally between segments.
|
||||
even if a certain attacker has breached your defenses, it can't move laterally between segments.
|
||||
|
||||
[Segmentation is key](https://www.guardicore.com/use-cases/micro-segmentation/) to protecting your network, reducing
|
||||
the attack surface and minimizing the damage of a breach. The Monkey can help you test your segmentation settings with
|
||||
|
|
|
@ -43,7 +43,7 @@ exploitations by running consecutive Infection Monkey scans.
|
|||
## Credentials
|
||||
|
||||
Every network has its old “skeleton keys” that should have long been discarded. Configure the Monkey with old and stale
|
||||
passwords, but make sure that they were really discarded using the Monkey. To add the old passwords, in the island’s
|
||||
passwords, but make sure that they were really discarded using the Monkey. To add the old passwords, in the island's
|
||||
configuration, go to the “Exploit password list” under “Basic - Credentials” and use the “+” button to add the old
|
||||
passwords to the configuration. For example, here we added a few extra passwords (and a username as well) to the
|
||||
configuration:
|
||||
|
|
Loading…
Reference in New Issue