Distributed Kansa at Enterprise scale

[EagleOneJK]

@davehull Please DM me at your earliest convenience. I am an employee at a large financial institution and we have been continuing development of the Kansa project internally for the last 3 years. We've made a lot of really cool enhancements and we're interested in contributing them back to the community. Our IP/legal/openSource teams have asked me to reach out to you to start a dialog about the best way for us to contribute (pull/merge vs fork vs other). I'd love to talk with you about it.

We have successfully achieved running Kansa realtime against up to 150K endpoints with integration in our ELK stack and live metrics/dashboards, new IR modules, etc...we think the InfoSec community could really benefit from this work, and we could benefit from other contributors adding modules that fit in our enhanced framework. You can reach me on Twitter @Jon14119114

[PolarBearGod]

For anyone following this, there is going to be a talk at the SANS DFIR Summit presenting this.
https://www.sans.org/event/digital-forensics-summit-2020/summit-agenda

[PowerPress]

@EagleOneJK whatever happened with this? Did you end up posting the additions and upgrades you made anywhere?

@PolarBearGod just checked the link which I admit is very late but it is no longer available. Anywhere I can find the upgrades?

[PolarBearGod]

SANS has changed their video and presentation delivery method so you will need to log in with your account and then look through the white papers.

This is the link that I get just by googling it but I don't know if that'll work for you.

https://www.sans.org/presentations/kansa-for-enterprise-scale-threat-hunting/

[EagleOneJK]

@PowerPress The additions were integrated into the project via a pull-request

[EagleOneJK]

you can also view the youtube video of the presentation here https://www.youtube.com/watch?v=ZyTbqpc7H-M

[PowerPress]

you can also view the youtube video of the presentation here https://www.youtube.com/watch?v=ZyTbqpc7H-M

Excellent video. Is the Kansa launcher available anywhere? Any suggestions on how best to build elk for Kansa?

The enhancements made look incredible any chance you could add more documentation on how to use it and generate the commandlines?