Tuesday - 11/28/2023

When you set up any network monitoring tool or packet sniffer it’s important to find a place on the network where you can see all the traffic. In the case of AC-Hunter, that includes all traffic going to or coming from the Internet.

Well, almost all traffic.

There’s one important exception to this: scanners. That includes any computers that go out thousands of times to other computers to make quick connections. These might be:

• – Checking to see if the remote system is responding at all,
• – Checking on the remote services on those machines to see if they’re returning valid results,
• – Checking on those remote services to see if they’re vulnerable to any known attacks, or
• – Simply scanning the internet to do some kind of Internet mapping

AC-Hunter is focused on regular connections to a small number of hosts, much like you’d find with a person browsing the web or a piece of malware calling home to a command and control server. The analysis we do to identify these hosts can get overloaded when one or more internal machines are placing extraordinarily large numbers of connections to outside systems, just like you’d find with internal scanning systems.

If you have systems like these, here’s what we recommend:

• – Lock down those systems carefully. They should be fully patched. They should also have as few open ports as possible; a good firewall that restricts client access to just a few admin systems would be great.
• – Tell Zeek to ignore them entirely. This blog post walks you through the needed steps: https://www.activecountermeasures.com/filtering-out-high-volume-traffic . Once you’ve made this change, Zeek will stop recording the outbound connections from the scanner(s).

It may take about a day for these to get filtered out from your AC-Hunter rolling database(s), but after that you should notice that the import happens more quickly and AC-Hunter may become more responsive.

Monday - 06/05/2023

You do not have a supported version of Docker-Compose installed.

An unsupported version of Docker-Compose appears to already be installed. It will be replaced.

The messages showed up because a supporting tool was upgraded after we released AC-Hunter 6.4.0.

Thursday - 05/11/2023

Friday - 02/17/2023

sudo nano /etc/AC-Hunter/rita.yaml

UserAgent:
  Enabled: false

hunt down
hunt up -d --force-recreate

More Detail

The UserAgent module works off an assumption that most computers will have a very small number of ways they negotiate TLS connections (such as HTTPS encrypted connections to web servers). These negotiations are summarized in what’s called a “ja3 hash”. Most computers negotiating encrypted connections will have a small number of these hashes, allowing AC-Hunter to quickly summarize them.

In recent releases we’re seeing huge numbers of hashes show up, both for individual systems and for networks as a whole. Where we expected to see hundreds to low single digit thousands of hashes for an entire network, now we’re seeing tens of thousands or hundreds of thousands of hashes in a given day at some sites. The UserAgent code in AC-Hunter is not able to efficiently process such massive quantities of data, and the import process grinds to a halt.

To test if you’re seeing this issue, we have a test script that will count how many ja3 hashes show up in a given day (using “yesterday” as that should be a complete set of Zeek/Corelight logs.) Please log in to your AC-Hunter system and run the following commands. Note that the second command could wrap on this page, but everything from “wget …” to “…/02/day-hashes.zip” is one command:

cd

wget -O day-hashes.zip https://portal.activecountermeasures.com/wp-content/uploads/2023/02/day-hashes.zip

unzip day-hashes.zip

chmod 755 day-hashes.sh

./day-hashes.sh

The only change this script will make is automatically installing a utility called “jq” to process json logs if your system uses that format.

The script will report a block of lines like the following (one block for each sensor):

Checking /opt/zeek/remotelogs/sensor_name/2023-02-15
24 ssl logs found, good.
These appear to be tsv-format logs.
Please be patient, this may take a few minutes.
You appear to have 1104295 unique ja3 hashes over all systems in yesterday's logs.
This number appears very large - please contact [email protected] with this entire output.

If you have large numbers of unique ja3 hashes – as we see in the 5th line above – you’re likely running into this problem, and we encourage you to disable the UserAgent processing using the steps at the top of this note.

As always, if you have questions about the information above, please contact us.

Thursday - 01/26/2023

Thursday - 01/19/2023

Wednesday - 11/02/2022

Notice About the 11/01/2022 OpenSSL Vulnerability

Background

The openssl project released an advisory about 2 issues with the openssl library. Versions of this library are used in the AC-Hunter suite, as well as the underlying Linux operating system on which that suite runs.

Short Version

AC-Hunter does not need an upgrade to handle this issue. As always, it’s a good idea to apply patches to the underlying Linux distribution regularly just in case the issue needs to be fixed in the underlying operating system.

Openssl Locations

AC-Hunter Software Suite

AC-Hunter uses openssl 1.1 as provided by docker containers, which are not vulnerable to either openssl issue.

Ubuntu Linux Base Distribution

Only Ubuntu 22.04 and 22.10 are vulnerable to this issue. To apply patches for it, run:

sudo apt update
sudo apt upgrade
sudo reboot

Centos Linux/Redhat Enterprise Linux (RHEL) Base Distribution

RHEL 9’s openssl package appears to be the only one affected by these 2 advisories (https://access.redhat.com/security/cve/CVE-2022-3602 and https://access.redhat.com/security/cve/CVE-2022-3786). RHEL 9 is not a supported OS for AC-Hunter at this time.
No action is needed for the supported RHEL 7 or Centos 7 Linux distributions.

This advisory is dated November 1, 2022 at 9:37pm Eastern US time. This, and any updates, will be posted to https://portal.activecountermeasures.com/ .

References:

https://www.openssl.org/news/secadv/20221101.txt
https://lists.ubuntu.com/archives/ubuntu-security-announce/2022-November/006893.html
https://access.redhat.com/security/cve/CVE-2022-3602
https://access.redhat.com/security/cve/CVE-2022-3786

Friday - 09/30/2022

AC-Hunter 6.2.1 Is a Bug Fix Release Only

1. Version 6.2.0 was supposed to include a configuration setting that would disable processing Incoming connections, dramatically reducing the amount of traffic that would need to be processed. The change was unfortunately not included in the final release of 6.2.0 . AC-Hunter 6.2.1 includes this change to the default of “FilterExternalToInternal”. If you’d prefer to make this change by hand rather than reinstalling AC-Hunter, we show the needed steps in the Bug report. Please see the following link for the 6.2.0 FilterExternalToInternal bug report.

2. The safelisting code in 6.2.0 is running into a problem with safelist entries that do not have matching data in a given database. This issue will cause the safelist to half-heartedly apply to any dataset that does not have connections between a safelisted IP pair. Upgrading to v6.2.1 will automatically resolve this issue.

We apologize for these problems.

Friday - 09/30/2022

Bug – Safelist Processing

We uncovered a bug in safelist processing in AC-Hunter 6.2.0 . The safelist program appears to have an issue with safelist entries that no longer match data in one’s data set. For example, if you add an IP pair safelist entry from a laptop in your building to an external server but that laptop is not in the office because its owner is on vacation, the safelist code malfunctions and only partly applies the safelist to that recent dataset.

This issue does not affect versions 6.1.0 and lower.

What This Means

You may run into situations where safelist entries are not being applied. This means you’re being presented with potential threats that should have been safelisted.

Do I Need To Do Anything?

Because effective safelisting is so important in reducing your effort in Threat Hunting, we strongly recommend fixing the issue by upgrading any AC-Hunter 6.2.0 systems to 6.2.1 . There is no workaround available for AC-Hunter 6.2.0 .

Upgrading to Fix the Issue

You can upgrade to version 6.2.1 which contains the fix. Version 6.2.1 is available at https://portal.activecountermeasures.com/my-account/downloads/ .

More Questions

As always, if you have any questions about this, please contact support at https://portal.activecountermeasures.com/support/ .

Tuesday - 09/27/2022

Tuesday - 04/19/2022

Wednesday - 01/19/2022

Wednesday - 12/15/2021

New log4j Advisory

MITRE and the Apache Software Foundation (log4j’s authors) have put out a second advisory (CVE-2021-45046) as an addendum to the original (CVE-2021-44228). These advisories point to a weakness in a software package called log4j that is used behind the scenes in our BeaKer software.

The new advisory points out that the workaround we mention below under “BeaKer Workaround” will not handle all the potential ways this vulnerability could be exploited, and they recommend removing a Java library entirely. Even though the text of CVE-2021-45046 says that this can only be exploited in certain circumstances, and even then, the result is limited to a denial of service, we feel this is worth fixing in the short term.

We’re putting out an interim release of AC-Hunter (5.4.1) that only removes this library and has no other changes. Based on the 2 advisories above we feel that this one change will address both log4j advisories completely. We’re also confident that this sole change will not have any negative effects on BeaKer’s or AC-Hunter’s functionality.

If you are not using BeaKer, you do not need to upgrade to 5.4.1.

If you are running BeaKer, please download AC-Hunter version 5.4.1 from your account here. Perform the upgrade as normal, making sure you upgrade BeaKer.

(optional step) To confirm that this library has been removed, run the following two commands after the upgrade is complete:

sudo docker cp beaker_elasticsearch_1:/usr/share/elasticsearch/lib/elasticsearch-log4j-7.16.1.jar /tmp/5.4.1-elasticsearch-log4j-7.16.1.jar
unzip -l /tmp/5.4.1-elasticsearch-log4j-7.16.1.jar | grep -i jndilookup || echo jndilookup removed.

With the library gone you should get this output back on the next line:

jndilookup removed.

If you run into any issues with the upgrade, please contact us by one of the methods on https://portal.activecountermeasures.com/support/ .

We’ll continue to monitor for new information coming out about this and will keep you posted if additional steps are needed in the future.

Note: the original text below (dated Monday – 12/13/2021) suggested a series of commands that would mitigate this vulnerability. Based on new information, if you are a BeaKer user, we strongly recommend that you instead upgrade to AC-Hunter version 5.4.1 , which contains a more complete fix to the issue.

Additional Questions

If you have other questions not answered by this note, please feel free to contact us using any of the methods found here.

– The Active Countermeasures Team

Monday - 12/13/2021

Handling the log4j Issue

We’ve been looking into how any of our tools use log4j:

(Overall coverage of the issue: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 )

Our own code does not use log4j.

• Specifically, AC-Hunter, Espy, Kibana, passer, pcap_stats, RITA, Winlogbeats, and Zeek do not have the recent issue reported with log4j.
• A supporting package for BeaKer (Elasticsearch) does use it.
• If you do not use BeaKer, you do not need to take any actions and can stop reading here.
• If you are an AIHHosted customer, the workaround listed below has already been applied to your AIHHosted instance; you do not need to take any action to mitigate this.

BeaKer

Details

(Details come from the elastic.co link in References.)
Elasticsearch is not susceptible to remote code execution from this vulnerability. However, Elasticsearch is potentially vulnerable to an information leak (which does not permit access to Elasticsearch data) when running on JDK 8 or below.

AC-Hunter 6.0.0 will include a permanent fix for the issue. Until that is released, we encourage you to use the workaround below.

BeaKer Workaround

First, confirm that you have BeaKer running at all by running:

sudo docker ps | grep -i activecm-beaker/elasticsearch

If this output includes lines with

... activecm-beaker/elasticsearch ...

then you are running BeaKer on this system. If this above command has no output, you are not running BeaKer on this system.

To patch the system against this issue, run

beaker down

Next, edit the following file with your favorite editor under sudo:

sudo nano /opt/BeaKer/docker-compose.yml

In that file, look in in services>environment and change the existing line:

      - "ES_JAVA_OPTS=-Xms3g -Xmx3g"

to

      - "ES_JAVA_OPTS=-Xms3g -Xmx3g -Dlog4j2.formatMsgNoLookups=true"

Please be careful to leave the spaces at the beginning of that line (on the systems we’ve installed there were 6 spaces before the dash) just as they are; the indentation is important. If you are copying the line from this advisory, please make sure both double quotes are standard double quotes and not ‘smart quotes’.

Save the file and exit. Finally, run:

beaker up -d

We do not believe that this will have any negative effect on your use of BeaKer.

For more details on the above workaround, see:
https://www.elastic.co/guide/en/elasticsearch/reference/7.16/advanced-configuration.html#set-jvm-options

Beaker Fixed Release

We intend to make a new AC-Hunter release with fixed code for Beaker. Until this is available, we strongly encourage you to apply the above workaround.

References

Overall coverage of the issue: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

What is/isn’t vulnerable from the Elasticsearch suite:
https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476

Side Note

Our ipfix-rita project, which only worked with Version 2 of RITA and is no longer supported, may have a vulnerability with the Logstash code included in it. We do not recommend you use this package. This is different from the Active-Flow module in AC-Hunter (which is not vulnerable to this issue).

Additional Questions

If you have other questions not answered by this note, please feel free to contact us using any of the methods found here.

– The Active Countermeasures Team

Friday - 09/17/2021

Certificate Screen Being Deprecated

The process of designing and implementing RITA and AC-Hunter has been a fluid one; we’ve looked at customer needs and available data, and have tried to find good matches between the two. In most cases these fit well together and we provide tools that help find Threats in your network.

The Certificate tab hasn’t lived up to what we, and you, need. While it’s nice to know that a certificate on a TLS or SSL server has issues, this rarely (if ever) leads to a Threat in the way that the other investigation features of AC-Hunter do. Since both RITA and AC-Hunter are primarily focused on Threat Hunting, we’ve decided to deprecate the Certificate screen in AC-Hunter and intend to remove it in a release later this year (no sooner than November).

For those that have used this screen to identify certificate issues in the past, it will still be possible to locate the certificates with problems using a command line script that we’ll provide with AC-Hunter. Sample output:

If you have any questions or comments about this, please reach out to us.

– The Active Countermeasures Team

Thursday - 09/09/2021

Version 5.4.0 of AC-Hunter Has Been Released!

“…buckle your seatbelt, Dorothy, ’cause Kansas is going bye-bye.”
 –Cypher, The Matrix

The big change to 5.4.0 is import speed. We know that the speed with which Zeek logs can be pulled into AC-Hunter has a direct impact on how fast a network we can monitor (1 hour logs for high speed networks could, in some cases, take more than an hour to import!)

Our developers took on the task of identifying import bottlenecks. In the process they removed some queries that didn’t need to happen, created some database indexes that sped up other queries, and changed the structure of how the import happened. In our testing the import runs between twice as fast and 4.5 times as fast – a 100% to 350% improvement in speed!

The end results are that AC-Hunter should be able to monitor more heavily loaded networks and it will take less time to present the new data to you each hour.

Additional Improvements in This Release

• Whitelist processing will be faster. In our testing, we found a 100%-200% improvement in speed in most cases. Speed increases will depend upon individual datasets and whitelist entries.
• Improved pagination and scrolling for some modules. This allows for faster loading of some pages.
• Fine-grained control over dataset analysis. You can define a list of specific sensors that will be analyzed, which comes in handy when you have multiple sensors and merge them all into a COMBINED sensor. Restricting analysis to specific individual datasets can result in a performance improvement. For more details, see the “Only importing specific sensors” section of the User Guide.
• The default number of connections for the communication between two IP addresses to be considered a strobe has been lowered to 1 connection per second.
• An option has been added to the RITA configuration file which filters out connections from external hosts to internal hosts when enabled. See “Ignoring incoming traffic” in the Install Guide for more details.

Bug Fixes

• When whitelisting the final beacon for an IP address, the score for that IP address on the dashboard wasn’t being updated. This is fixed in 5.4.0 .
• Proxy beacon analysis now looks at the last 24 hours of data rather than just the current hour.
• FQDN beacon analysis now looks at the last 24 hours of DNS logs rather than just the current hour.
• Adding a wildcard domain entry (e.g., *.microsoft.com) to the whitelist will result in dashboard scores for proxy beacons and FQDN beacons being properly updated.
• Removing entries from the whitelist will result in dashboard scores for proxy beacons and FQDN beacons being properly updated.
• Syslog alerts were not being sent when the scoring breakdown was enabled. This has been fixed.
• We fixed some obscure bugs in the installer.
• Whitelists will automatically be applied to rolling snapshots and manually-imported data rather than on the first time that these datasets are visited.
• Existing whitelists are applied to sample data during the installation process.
• All filter criteria now work properly in the dialog for viewing/searching whitelist entries
• Various bug fixes in the user interface.

When you are picking a dataset you may see a note below the database name that says “This database is currently being filtered.” In the background, AC-Hunter is applying whitelist entries to the database. You’re still welcome to select it and work with it just like any other database, but be aware that recent whitelist changes may not have been applied yet (you may see records that should have been filtered by a recent whitelist addition, or you may not see records that should come back to view after a recent whitelist removal).

The warning note may show up in multiple places:

If you are upgrading from version 5.3.0 or 5.3.1 of AC-Hunter, you will be prompted to allow AC-Hunter to perform processing on your existing datasets. This processing is needed to ensure that your system can take advantage of the latest performance improvements for adding whitelist entries and importing whitelist files. WE HIGHLY RECOMMEND THAT YOU ALLOW AC-HUNTER TO PERFORM THE PROCESSING. If you do not allow AC-Hunter to perform the processing on the existing datasets, it is possible that you will see a decrease in performance for whitelisting.

This processing does not require that AC-Hunter perform a re-import and re-analysis of your datasets, which means that it should be much faster than re-importing the data. The length of time this will take will vary depending on the size and number of your datasets. If you are upgrading from a version of AC-Hunter prior to version 5.3.0, you will likely be prompted to allow AC-Hunter to re-analyze your data, which could be a lengthier process depending on the size and number of your datasets.

Conclusion

As a final note, we’ve also updated the default whitelist with additional domains that are commonly used. The whitelist can be found at https://portal.activecountermeasures.com/whitelist/ , and more details about these additions are in the updated whitelist announcement on this page below.

The most recent version of AC-Hunter can be found at https://portal.activecountermeasures.com/my-account/downloads

As always, this new release includes additional behind-the-scenes improvements to make it more stable and efficient.

For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of this website. If you run into any issues, feel free to contact us.

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

(For our AC-Hunter Hosted SaaS customers, we will be performing upgrades to v5.4.0 on that platform in the coming days.)

Tuesday - 07/27/2021

Version 5.3.1 of AC-Hunter Has Been Released!

5.3.1 is primarily a bug fix release. Here’s how to decide if you need to upgrade to it or not:

If you did not upgrade to 5.3.0:

We encourage you to skip 5.3.0 and upgrade to 5.3.1. There are a number of significant performance and functionality improvements in 5.3.0 (that are also in 5.3.1, obviously).

If you did upgrade to 5.3.0 and had no problems with the upgrade:

This upgrade is optional for you. The only bug fixes not related to the install is a fix to the tooltip for the Long Connections port/protocol/service and a fix to allow Proxy Beacons analysis to work without additional AC-Hunter configuration. If these are not an issue for you, you can skip this upgrade.

If you did upgrade to 5.3.0 and had problems with the upgrade:

We encourage you to upgrade to 5.3.1 . We’ve fixed some issues in the upgrade process.

Bug Fixes and Improvements

• Fix bug where the whitelist collection wasn’t being renamed for some users
• Fix bug where data transfer ssh keys were not transferred if target user did not have a `~/.ssh` directory
• Fix bug where AC Hunter had to be running in order to perform a successful upgrade
• Fix overflow and add tooltip for the port protocol service list in the long connections module

Finally, we have updated the User Guide to provide more context to the Proxy Beacons analysis first introduced in 5.3.0 .

Conclusion

The most recent version of AC-Hunter is available to download now: https://portal.activecountermeasures.com/my-account/downloads

As always, this new release includes additional behind-the-scenes improvements to make it more stable and efficient.

For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of this website. If you run into any issues, feel free to contact us.

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

(For our AC-Hunter Hosted SaaS customers, we will be performing upgrades to v5.3.1 on that platform in the coming days.)

Thursday - 07/15/2021

A New Version of the AC-Hunter Default Whitelist Has Been Released

The default whitelist for AC-Hunter is provided to give you a head-start of building or adding to your own custom whitelist. Included in the default whitelist are commonly known traffic destinations to resources such as; root nameservers, OS and application patch/update servers and NTP servers.

We have a new version of the Default Whitelist available for you. This new list includes some new domains (below) and removes one domain from the previous Default Whitelist (“storage.googleapis.com”) as we believe it has potential to hold untrustworthy content. We encourage you to remove it from your whitelist.

To use this new one, download the file and unzip it with:

unzip ac-hunter-default-whitelist.202107151318.zip

Now go to your AC-Hunter console, click on “Dashboard”, then the gear icon in the upper right, then “Whitelist” and press “Upload Whitelist”. Find the ‘ac-hunter-default-whitelist.202107151318.json’ file and press “Upload”. These new entries will be merged with your existing whitelist and deduplicated.

#Additions:

*.conferdeploy.net

*.cymru.com

*.events.data.microsoft.com

*.microsoft.com

*.msidentity.com

*.paloaltonetworks.com

*.r7ops.com

*.rapid7.com

*.sophos.com

*.sophosxl.net

*.spamcop.net

*.spamhaus.org

*.symantec.com

*.trafficmanager.net

*.windows.net

autopush.prod.mozaws.net

cloud.tenable.com

detectportal.firefox.com

location.services.mozilla.com

login.live.com

login.microsoftonline.com

mtalk.google.com

ntp.barracudacentral.com

ocsp.comodoca.com

ocsp.sectigo.com

push.services.mozilla.com

Access and download the new default whitelist file here.

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

Wednesday - 07/07/2021

Version 5.3 of AC-Hunter Has Been Released!

There’s nothing quite like the smell of a bakery, especially when the baker opens the oven and brings out a tray of fresh-baked AC-Hunter releases.  🙂  We give a tip of the hat to the world’s best development team for preparing version 5.3.0 for you.

New Features

Proxy Beacons

Version 5.3.0 now includes the ability to look for beacons that are sent through an HTTP proxy.  At sites that use an HTTP proxy, we can now look for beacons and report them on the Proxy Beacons and BeaconsFQDN tabs just like we do for beacons identified from network traffic.

You will need a Zeek sensor placed in front of the HTTP proxy. As you might expect, this can report on HTTP proxy traffic but not HTTPS proxy traffic.

Whitelist

We now include the ability to search the whitelist – useful if you have a lot of entries in it.

Now that you can whitelist beacons by fully qualified domain name, we have a new default whitelist available! It’ll be far more efficient than the previous one was. For details on upgrading, please see our blog post, “Upgrading to the new default whitelist“.

IP Address Details

When AC-Hunter is able to display the location of an IP address, it used to display just the City. We now include the State when one is available. We also show the “comm” field (which includes the port, protocol, and service) whether the IP address is public or private.

Open Connections

Zeek, by default, doesn’t show connections until they close. Connections that stay open for weeks or months may never show up in the output.

We now display open connections, allowing you to see these long term ones as well. To enable this you’ll need to reinstall Zeek to your sensor as part of installing AC-Hunter. If you don’t upgrade Zeek, you won’t get the new open connections feature.

Dashboard

You can now search for a specific IP address in the Dashboard Hosts list.

New Utilities

We include a new script that will create a database from a pcap file, import_pcaps.sh . To use it, run:

/usr/local/bin/import_pcaps.sh -p /full/path/to/pcap_filename.pcap -d new_database_name

We also have a tool that will create multiple web UI user accounts at once. See the notes at the top of  ‘/usr/local/bin/bulk_add_users.sh’  for details.

Bug Fixes and Improvements

Alerting

We found a bug introduced in the 5.1.0 release that blocked both syslog and Slack alerts from being sent. The bug has been fixed, so this release will be able to generate both types of alerts again. Once 5.3.0 is installed the alerts will start flowing again – you do not need to take any additional action. We apologize for the broken feature.

Importing/BeaconFQDN

In version 5.2.0 on heavily loaded networks the import process could take an undesirably long time; importing an hour’s worth of data could take longer than an hour. The import code (also part of the open-source RITA project) has been updated in RITA 4.3.0 and AC-Hunter 5.3.0 to process the data more efficiently.

If you had to disable BeaconFQDN processing as a workaround in 5.2.0, you should be able to re-enable that in 5.3.0. We’d love to hear if this one change is sufficient to get BeaconFQDN processing working for you again or not.

Scoring

Now that AC-Hunter has three methods of Beacon analysis (by IP address, by Fully Qualified Domain Name, and for traffic through a HTTP proxy), the total threat score receives twice as much influence from beacon traffic as it should. In 5.3.0 only the larger of the scores is used in the total threat score.

We’ve also introduced optional caps on the individual scores; if you find that one threat type is dominating the total score, you can configure a maximum score cap for that type. See the User Guide for an example (“Setting Maximums for the Threat Activity Scores”).

New Version Check

AC-Hunter will let you know when a new version is available by presenting a banner in the UI.

Certificates

In AC-Hunter versions 5.2.0 and below there was a bug that prevented Invalid Certificate errors from being removed correctly from rolling databases. AC-Hunter 5.3.0 (and RITA 4.3.0) include a fix that correctly removes these from rolling databases.

In both the Certificate and User Agent tabs there may have been times where an entry showed up in multiple places because of a sort issue. That’s now been resolved.

Whitelist

Whitelist modifications are now processed in the background, allowing you to continue working with AC-Hunter while the changes are being applied to all of your existing databases.

In certain circumstances, previous versions of AC-Hunter would fail to apply these changes to all databases if AC-Hunter or the system on which it was running was shut down. 5.3.0 fixes this by having a queue of changes to apply which is restarted when AC-Hunter is restarted.

Ubuntu

We’ve raised Ubuntu 20.04 to fully supported. As always, please let us know if you run across install or operation issues with any supported operating system.

MongoDB

MongoDB has been the database shipped with AC-Hunter. AC-Hunter v5.3.0 uses MongoDB v4.2.0 since previous versions have reached end of life. For upgrade installs, your MongoDB instance will be upgraded. Your previous datasets will be backed up to /opt/AC-Hunter/mongo_backups during the install. These can be reimported into MongoDB in the case that something goes awry.

We hope that the fixes and features in 5.3.0 help you do your work more efficiently. If you had any performance issues with 5.2.0 or below we strongly encourage you to upgrade when possible. If these issues were severe enough that you had to disable BeaconFQDN processing, we ask you to leave this off for a day or two to make sure all is working well, then consider re-enabling BeaconFQDN processing (*).

The most recent version of AC-Hunter can be found at https://portal.activecountermeasures.com/my-account/downloads/ . If you’re upgrading from a previous version, please make sure AC-Hunter is running while doing the installation (i.e., don’t shut it down with the hunt command.

* Edit /etc/AI-Hunter/rita.yaml with:

sudo nano /etc/AI-Hunter/rita.yaml

and change the existing:

BeaconFQDN:
  Enabled: false

To

BeaconFQDN:
  Enabled: true

Save and exit, and restart AC-Hunter with:

hunt up -d --force-recreate

Conclusion

As always, this new release includes additional behind-the-scenes improvements to make it more stable and efficient.

For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of the portal website. If you run into any issues, feel free to contact us.

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

(For our AC-Hunter Hosted SaaS customers, we will be performing upgrades to v5.3.0 on that platform in the coming days.)

Friday - 05/07/2021

A New Version of the AC-Hunter Default Whitelist Has Been Released

The default whitelist for AC-Hunter is provided to give you a head-start of building or adding to your own custom whitelist. Included in the default whitelist are commonly known traffic destinations to resources such as; root nameservers, OS patch/update servers and NTP servers.

Access to the default whitelist file here has changed from My Account/Downloads to a dedicated page on the Main Menu under Support/Whitelist.

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

Thursday - 04/22/2021

Version 5.2 of AC-Hunter Has Been Released!

AC-Hunter 5.2.0 is being released primarily to provide a fix to a current performance issue.

Fix

Whitelisting Performance

Short version: AC-Hunter 5.2.0 will be much faster at adding or removing whitelist entries.

Long version: AC-Hunter 5.1.0 and below applied whitelist changes to all databases before returning the user interface back to you. 5.2.0 applies the whitelist addition or removal to the currently selected database and returns the user interface back to you, and queues up the changes to the other databases to happen in the background.

We’ve also put some time into speeding up the task of applying a single change to a single database, so the system should be orders of magnitude faster at applying changes.

Known Issues With This Release

1. There’s a known problem in 5.2.0 that shows up when deleting a whitelist entry and restarting AC-Hunter soon after. If you ask to delete a whitelist entry and reboot the system, restart AC-Hunter, or install a new version of AC-Hunter (such as 5.3.0) before the deletion has been completely applied to all databases, the deletion will not continue after AC-Hunter restarts.

If it becomes necessary to restart AC-hunter for any reason, we encourage you to run “top” first on the system to see when the AC-Hunter docker containers and Mongo database slow to idle first and reboot after that.

Note; this problem does not show up when adding a whitelist entry; this queued task will continue after rebooting.

2. If your drop-down investigation menu (on an ip address) includes the web site apility.io, that web service no longer exists. If you click on that you’ll get an error that the site no longer resolves. We’ll remove that in the next release. This is only a cosmetic issue.

Workaround: If you’d prefer to remove that now, you can run the following 2 commands on the AC-Hunter system to remove it from the investigation menu. The first command is likely wrapped – everything from “sudo sed” to “/etc/AI-Hunter/config.yaml” is one command. Both of the quotes are single quotes (under double quotes on the keyboard).

sudo sed -i.withapility 's/^\([[:space:]]*\)apility\.io/\1#Service dead. apility.io/' /etc/AI-Hunter/config.yaml

hunt up -d --force-recreate

Conclusion

As always, this new release includes additional behind-the-scenes improvements to make it more stable and efficient.

This newest version of AC-Hunter is available for download now: https://portal.activecountermeasures.com/my-account/ (under Downloads)

For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of this website. If you run into any issues, feel free to contact us!

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

Wednesday - 03/17/2021

Version 5.1 of AC-Hunter Has Been Released!

New Features

Beacon Detection and Whitelisting by Domain Name

The big news in version 5.1.0 is whitelisting by domain name. To explain why, we need to give a little background (don’t worry, this will be brief).

As security professionals we know that a tool that constantly presents benign information to human eyes will not be used for long – one of the reasons why we find log analysis so tiring.

To avoid this AC-Hunter has steadily added new ways to whitelist:
– By source or destination IP
– By IP, ASN, ASN organization, or subnet
– By pairs of IP addresses

These tools get benign traffic off the screen, but they don’t address the question: What do we trust?

Ideally we want to assign trust in a company or organization, which often maps neatly to a domain name. If I state that I want to put trust in the public network of time servers that show up on the beacon screen all the time, now I can whitelist “*.pool.ntp.org.”. That one whitelist entry replaces about 3,600 IP addresses for the entire pool. If I run Ubuntu Linux and want to trust the patch servers and other systems that support those, I can whitelist “*.ubuntu.com.”

Not only does the size of the whitelist shrink dramatically, but you also get to clear off benign traffic more quickly and more accurately. There’s far less chance of trusting an IP at a Cloud provider and never realizing that the IP you whitelisted was later assigned to a different – and far less trustworthy – client.

On a practical note, the AC-Hunter interface now has 2 Beacons tabs. The new one considers connections between your client IPs and external host names. The old one shows connections between internal and external IP addresses (identical to the Beacons tab you’ve worked with before).

As always, we discourage any whitelisting strategy that ends up whitelisting large blocks of cloud services (like “*.amazonaws.com.”) since you’re not placing trust in the cloud provider. Instead, whitelist the domain names your clients look up.

Bug Fixes and Improvements

Whitelist Pairs Are Now Unidirectional

We have one security improvement to whitelisted pairs of IPs. When you entered a pair of addresses (say 1.1.1.1 and 8.8.8.8), earlier releases would allow connections in both directions: from 1.1.1.1 to 8.8.8.8 and from 8.8.8.8 to 1.1.1.1 .

Since these pairs usually are intended for traffic in one direction we decided to return this to unidirectional whitelisting (just from 1.1.1.1 to 8.8.8.8). If you need to allow connections in the other direction, you can add a second whitelisted IP pair (in the above example: 8.8.8.8 to 1.1.1.1).

Ubuntu 20.04 Installer Fix

While Ubuntu 20.04 LTS is not a fully tested platform, we have enough customers using it now to include it in our Beta support program. Please feel free to give it a try and let us know if you find any issues!

The installer in 5.1.0 includes a fix to a packaging bug that affected Ubuntu 20.04; the install should now proceed successfully. We’ve also cleaned up the installer to more gracefully handle other packaging corner cases.

Unfortunately we did have one more bug that showed up late in testing. Before you start the install, run the following command on all systems to work around it:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 656408E390CFB1F5

Additionally

• We check that Docker’s network blocks aren’t in use before trying the install.
• Since a single system can’t run more than one of Zeek, Espy, and Active-Flow, we block that in the installer.
• On the dashboard, instead of showing “>100” Threat Score, we show the actual number.
• In some circumstances we hid the error messages coming out of the tool that patches the system and installs new packages. Now we show those, making it much easier to identify and fix packaging issues. The side effect is that you’ll see more status messages from these tools.
• The IP address information block at the top center of the Beacons, Strobes, and Long connections screens use to provide a long list of all hostnames we’ve found for this IP address (in the field “fqdn”). Starting in 5.1.0 we show the specific name this host requested in the “queried fqdn” field, and all other names we have for this host in the “historic fqdn” field.
• The Dashboard used to refer to “TXT Query Count” * as one of the components of the combined threat score. For detecting c2 over DNS, it is more useful to know how many unique FQDNs have been queried by a particular host, so this field has been updated to reflect this count. It has been relabeled to “Too Many FQDNs Per Domain.”
• In our August 2020 4.0.0 release we mentioned that apility.io was deprecated as an investigation source as it had been acquired by Auth0. It was removed in 5.1.0. If you use this service and have an account there, there’s a line that can be uncommented to enable Auth0 (see “Customizing Investigation Sources” in the User Guide).

Known Issues

Independent of the whitelist-by-domain feature above, we’re aware of a slowdown in adding and removing whitelist entries. We’re investigating it and hope to have an answer for it soon.

Coming Soon

Default Whitelist Improvements

We’ll be updating the Default whitelist to use the new whitelist-by-domain-name feature. When ready you’ll find the updated list in the Portal under Downloads.

Conclusion

As always, this new release includes additional behind-the-scenes improvements to make it more stable and efficient.

This newest version of AC-Hunter is available for download now: https://portal.activecountermeasures.com/my-account/ (under Downloads)

For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of this website. If you run into any issues, feel free to contact us!

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

Thursday - 01/14/2021

AC-Hunter Version 5.0.1 Is Provided to Address an Issue in 5.0.0 Related to Upgrading the Whitelist

This issue only shows up on upgrades (not on fresh installs) and only on some systems that have whitelist entries.
We encourage you to upgrade to 5.0.1 if you have entries in or plan to add entries to your AC-Hunter whitelist.

You should be aware that all upgrade approaches to the 5.0 series (both 5.0.0 and 5.0.1) run some risk of losing misformatted whitelist entries. For that reason we encourage you to make a backup of your whitelist before trying any upgrade. If any whitelist entries are lost during the upgrade and you end up re-entering them you’ll have the old whitelist file for reference.

Tuesday - 01/12/2021

Version 5.0 of AC-Hunter Has Been Released!

There’s nothing quite as peaceful as a light snowfall outside, a lovely fire to keep us warm, and software release notes to kindle the true spirit of the new year. 🙂

Our developers have been working tirelessly to bring you AC-Hunter(*) 5.0.0 . Here are the highlights from this release:

Spotlight Feature

Espy

One of our most-requested features relates to the fact that so many people are working from home. Unlike an office with a network that can be easily monitored by Zeek, we now have hundreds of single-employee homes, making it impractical to set up Zeek sensors at all of them.

We’d like to introduce Espy. Espy is an agent that runs on the employees’ Windows machines. In a manner similar to how BeaKer collects forensic information on network connections, Espy provides the information AC-Hunter needs to perform Threat Hunting with no network sensor! This means that we can monitor for Threats on individual workstations without having to provide all the hardware to run Zeek at every home.

Espy is open-source so you can use it with or without AC-Hunter. It’s also considered to be beta-level; it’s likely we’ll have improvements to it over the next few months.

Upgrading to 5.0 will automatically upgrade recent databases to support the Espy database requirements.

Improvements and Bug Fixes

To save memory, Zeek used to forget connections if they sat idle for more than 5 minutes. It had the side effect that a single actual connection could appear to be tens of connections, filling up the display. We’ve changed the default timeout to 60 minutes to clean up the display and reduce the number of connections to consider.

We had a bug that showed up if one attempted to import a range of IP addresses from a json whitelist file. This only showed up if one attempted to manually edit the whitelist file. It has now been fixed.

AC-Hunter includes the new release of RITA, 4.0. This supports faster data import, has new Threat Intel Feeds to reduce false positives, and supports Espy by allowing logs to combine multiple sysmon feeds. It also removes two lower quality Threat Intel Feeds. This means you should see less noise in your Threat Intel screen.

The timeline connection chart at the bottom of the beacons and threat intel page now shows times in the browser’s local timezone rather than UTC.

Upgrade Notes

Databases created under earlier versions will need to be converted during the AC-Hunter upgrade. The installer will offer to upgrade the most recent 7 days of databases automatically.

The whitelist format has been updated. During the install, the currently active whitelist will be automatically updated. You’ll want to export the whitelist after the upgrade. If you have any saved whitelist files you wish to later import these will need to be manually converted. We’ll have a FAQ entry soon for how to do this at https://portal.activecountermeasures.com/support/faq/.

Errata:
The Active-Flow, Zeek, and Espy packages need to run on separate machines if you’re using more than one of them. The install script does not currently block you from installing them on the same machine, though this check will be added in the next release.

As always, the new release includes additional behind-the-scenes improvements to make it more stable.

We hope you enjoy it and had a good holiday break!
– The ACM Elves

This newest version of AC-Hunter is available for download now in your account. (under Downloads)

For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of the portal website. If you run into any issues, feel free to contact us: [email protected]

* If you haven’t already seen the blog about the name change: https://www.activecountermeasures.com/introducing-ac-hunter/

Thursday - 08/20/2020

Version 4.0 of AI-Hunter Has Been Released!

This release was packed with a lot of improvements behind the scenes, but we still have some goodies to be excited for.

New Features:

More Investigation Menus!

We now support investigation menus for ASN’s, FQDN’s, JA3 hashes, and UserAgent strings. These menus can be found in many more places , and we hope that these new menu types will aid you in your threat hunting adventures. All of these new menu types support the “copy to clipboard” functionality released in v.3.8.

We also now have dropdowns for multiple addresses! If you have a row of multiple sources, requests, or domains, each source in that row has its own submenu, allowing you to hunt each individual address.

There’s also an IP investigation menu for the CONN– IP in deepdive!

New Threat Intel View!

In previous versions, Threat Intel view 1 displayed outbound threats and Threat Intel view 2 displayed inbound threats. These two separate views have now been combined into a single view. The new view displays both inbound and outbound threat intel IP connections.

There’s a new column with an icon that indicates whether the threat connection is inbound or outbound. Notice that the first IP in the table (orange) is an outbound connection, as the arrow is pointing away from the internal IP and out towards the internet. The last IP in the table (blue) is an inbound connection, as the arrow is pointing from the internet towards the internal IP. If an internal IP has both inbound and outbound connections, each connection will display in it’s own row (as shown above) since each connection can have different connection counts, bytes transferred, and comm ports.

More Items in Tables per Page!

Depending on your screen size, the tables across modules will display more items per page, reducing the number of pages you’ll need to flip through.

Installer Now Has a Capture Interface Selection Prompt

There’s now a much nicer selection prompt for choosing which capture interfaces you want Zeek to listen to, including interface recommendation to help clear up any confusion and avoid breaking the install.

Added Auth0 Signals as Disabled Investigation Source

Apility.io has been acquired by Auth0 and will eventually be taken down. It will be replaced with Auth0 Signals. We’ve preemptively added Auth0 Signals as a disabled source in case you’ve decided to move over to their new platform.

Potentially Breaking Changes:

• Disabled external Mongo listening port as it doesn’t need to be seen by the outside world.
• Disabled TLSv1 & TLSv1.1 as these are considered insecure. Since all modern browsers support TLS v1.2 and above, this should have no effect on accessing AI-Hunter.
• Default web account credentials no longer stored in env file
• Install in /opt/AI-Hunter and link scripts in /usr/local/bin so that utilities will be accessible from anywhere.
• Cleanup deprecated scripts
  • Removed `delete-databases.sh`
  • Removed `rita-import.sh`
  • `install_bro.sh` no longer uninstalls RITA on upgrade
• Convert AI-Hunter to use Zeek, replacing the older “Bro”.
• Install Zeek init script
• Removed helpers directory

Bug Fixes:

• Upgrade prompt in installer will only prompt for recent datasets
• BeakerHost entry in YAML config will not be duplicated if it already exists
• Fix bug where Beaker was inaccessible from UI if host had an IPv6 address.
• Fixed sorting in strobes
• Fixed miscellaneous sorting issues
• Fixed bug where dns threshold wasn’t cleared when visiting another page

This newest version of AI-Hunter is available for download now.

For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of the portal website. If you run into any issues, please reach out to us for help.

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

Thursday - 05/21/2020

Known AI-Hunter/BeaKer Bug in 3.8.0 and Above

The Beaker icon in AI-Hunter may not perform any action. If you click on it and it does not open up a new tab with the BeaKer Search page and the BeaKer server has an IPv6 address, see the FAQ entry here.

Tuesday - 05/05/2020

New Version of AI-Hunter Released!

AI-Hunter version 3.8.0 offers:

• The ability to identify what program created a connection
• Submenus for Investigation sources
• The ability to ingest Netflow V9 data from routers and switches

Once a potential threat is found, the next step is figuring out whether the activity is malicious or benign. That commonly includes getting access to the local system, looking at what programs are running, and seeing if you can match up the threat to the running programs. If that program isn’t currently running it’s usually too late to do this.

In response to this, we’ve added a new feature that helps you match up the network traffic to the program that created it! With BeaKer, your Windows systems regularly report on the running programs and what network connections they spawn. The BeaKer server remembers these, so if you need to come back even weeks later and ask “What program was responsible for this connection?”, BeaKer will give you this. While looking at a connection, click on the new “beaker” icon on the beacons page to see what Windows program triggered the traffic.

BeaKer is a separate module, and requires one to install the agent on Windows systems and a collection server. The “install_acm.sh” script used for AI-Hunter will help you set up the collection server. For more information, see “BeaKer Integration” in the User Guide.

Since AI-Hunter included the ability to define custom investigation sources, we’ve had users that have added a large number of them. You can now have nested investigation sources in the drop-down menu on IP addresses, allowing you to organize your links. For more information, see “Customizing Investigation Sources” in the User Guide.

Oh, and one more thing (*). Almost everything we’ve published about AI-Hunter assumes that you have a Zeek sensor feeding logs to it. There are some sites that simply can’t run Zeek for policy, architecture, or performance reasons. We have an alternative called Active-Flow.

A few of our developers have put in a massive behind-the-scenes effort to allow AI-Hunter to ingest Netflow version 9 records generated by one or more routers or switches in your environment. The ingested database can report on some – but not all – of the things you’d see if Zeek was providing the raw data feed. For more details on the difference between the approaches, please see the “Differences between Zeek-sourced and Netflow-sourced data” section in the AI-Hunter user guide.

If you’re unable to run Zeek and would like to try Active-Flow, feel free to get in touch with support . We’d be happy to work with you.

This newest version of AI-Hunter is available for download now. For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of the portal website. If you run into any issues, feel free to contact us.

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

*H/T to Steve Jobs

Wednesday - 04/01/2020

What do you get when you place a group of top-notch programmers in front of their computers for a month with all the pizza and mountain dew they can ingest(*)?  AI-Hunter version 3.7.0!

In this release we focused on customer requests and usability features:

New Features

• Add IP address search capability to the Long Conns, Certificate, Client Signature, and Strobes modules.
• In the Deep Dive module, you can now Pivot! While looking at the deep dive display you can now select one of the IPs around the circle and ask to show a Deep Dive for the new IP by clicking on the “P” (pivot) icon. As an example, this lets you start with an internal IP, find a remote IP that looks suspicious, and immediately switch to a view of the remote IP to see any other internal systems to which that remote ip has talked.
• Whenever we display internal IP addresses, we include their domain names when available.
• AI-Hunter now includes support for Themes – changing the display colors. In this release we add a “daVinci Mode (light)” theme that can be easier to read. To try it out, see the Themes menu under Settings (Gear icon on the dashboard tab)
• In the drop-down Investigation Menu on IP addresses we added “Copy IP to clipboard” so you can easily paste the IP into other programs.
• RITA and AI-Hunter now support Zeek logs in JSON format. This means that Security Onion users no longer have to modify their log configuration.

Minor Changes

• The Rare Client Signature scoring now adds 10 points if any Rare Client Signatures are found, 0 if not. Previously it was adding 5 points for each signature, which skewed the results for some systems if multiple rare signatures were found.
• Additional checks for free drive space and system features.

As always, there are additional bug fixes and other minor changes that happen behind the scenes.

This newest version of AI-Hunter is available for download now. For details on how to install it, please see the Install Guide PDF included in the tarball or the Documentation section of this website.

We encourage you to give it a try! If you run into any issues, feel free to contact us at [email protected]

Enjoy and Happy Threat Hunting!

– The Active Countermeasures Team

* No programmers were harmed in the making of this release, though one QA engineer did get tired of pepperoni.

Wednesday - 01/22/2020

AI-Hunter 3.6.1 is out!

This release is focused on fixes and smaller features. We hope you’ll give it a try!

New Features

• When looking at databases in the database listing, we show the start and end date/time stamps for that database. When a sensor is misconfigured or can’t reach the AI-Hunter server for some reason and logs are no longer flowing, the timestamps will show you that the database has old data.
• We’ve extended the thresholds on the Long Connections and DNS tabs so you can set larger minimums to see just the longest connections or just the more common dns objects. Additionally, we’ve changed the default thresholds to decrease both page load times and the number of low-value results shown.
• Ubuntu Linux 18.04 is now a fully supported OS.

Bug Fixes

• When installing a new Bro/Zeek sensor, the install script in 3.6.0 was unable to find the ja3 plugin needed to fingerprint TLS connections because of file reorganization at the file repository. This has been fixed in 3.6.1.
• There are a number of cosmetic fixes in the installer.
• On the beacons page, the metric bars now fit in the scorebar boundaries.
• Threat Intel exported CSVs now include fields that were missing.
• When clicking a dashboard score the filtered search results displayed will be an exact match to the original IP instead of a partial match that could show unrelated results.

Notes

As always, there are additional behind-the-scenes fixes.

If you have done a new install of Bro/Zeek since November 14th, 2019 we strongly suggest you upgrade to 3.6.1 to install the missing TLS fingerprint plugin. If that’s not the case, you can upgrade AI-Hunter if you’d like one of the new features or are running into one of the bugs.

Enjoy!

For details on how to install it, please see the Install Guide PDF included in the tarball.

Tuesday - 12/17/2019

We’re proud to announce version 3.6.0 of AI-Hunter (the “Early Present” release). Our (elves) developers have been putting in extra hours to give new functionality and fixes, and we hope you enjoy it!

New Features

• Custom Investigation Sources

When looking for more information on a particular IP address, you’ve had a drop-down menu that sends you to AbuseIPDB, apility.io, or the Deep dive with details on that IP. We’ve included several new sources in this release. Also, you can define your own – perfect if you have an internal web site or external service you depend on for IP address details. For more details, see “Customizing Investigation Sources” in the User Guide. Teaser – AI-Hunter subscribers will be getting early access to a brand new investigation source; look for an email in early January!

• Alerting

Previously you got alerts in syslog and Slack when a system first showed up with a too-high threat score, when that score increased, and when that score decreased. Now you can individually tune whether you want to get alerts on a score increase or decrease. For more information, see “Modifying threat scores and Configuring alerts” in the User Guide.

• RITA

AI-Hunter now includes the latest release of RITA, version 3.1.1. This includes bug fixes as well as a new import flag that allows you to reimport an existing database.

• Whitelisting

Previously, you could whitelist entries completely from the Dashboard. However, whitelisting elsewhere in AI-Hunter would not recalculate the Dashboard host scores. With this release if you whitelist a host elsewhere, in Beacons for instance, it will now update that host’s score in the Dashboard.

• Threat Intel

We’ve added some more background info on why a host is listed there, including the fully qualified domain name and the type of traffic being sent to the blacklisted host.

• Databases

If you have more than 1 sensor and want to view all data from all sensors at once, we include a new tool that pulls all the data from all sensors into one called COMBINED__0000. For more information on this, see the “View all sensors in a single database” section of the User Guide.

Note About the Install

During the installation you’ll be prompted to upgrade your existing databases, and asked how many you’d like to upgrade. This upgrade only applies to the dated snapshots (“-rolling” databases will be upgraded automatically over the next 24 hours), and the only change is applying the current whitelist to the Dashboard in each. The upgrades can take some time, and while this is happening, AI-Hunter will not be available.

If you choose not to upgrade a particular database the new whitelisting features from this release won’t apply to the dashboard, but your databases should otherwise function as normal. For that reason we encourage you to only upgrade the dated databases that you expect to work with. If you never access the dated snapshot databases, you can enter “0” for the number of days to upgrade. If you do upgrade some, we encourage you to upgrade a small number of recent databases.

Additional Fixes

• Database Upgrades

During the install, if you have any databases whose format has changed, the install will prompt you to upgrade them automatically.

• User Interface

When you whitelist an IP or switch views on the Beacons page, you’re no longer sent back to the first page of results.

When host names are truncated, we now have a popup box that will show the full name.

Notes

As always, the release includes lots of smaller cleanups and bugfixes. Please give this a try, and let us know what you think!

For details on how to install it, please see the Install Guide PDF included in the tarball.

Thursday - 09/19/2019

We’ve provided a new release of AI-Hunter, which is in your Account under Downloads. Version 3.5.0 includes the following:

• “Blacklisted” is now renamed “Threat Intel” to match the intent of the feature.
• The log transport mechanism now handles Bro logs in non-default directories.
• Rita has been updated to version 3.0.6 .
• “rita import” can now import individual files (in addition to directories that it could import in previous versions).
• Additional cosmetic fixes, cleanups, and error checking related to syslog alerting, configuration defaults, the installer, database copies, and the aih_status script.

If you’re installing AI-Hunter for the first time, we encourage you to use this new version. If you’re on version 3.4.0 (*) we encourage you to upgrade to 3.5.0 as soon as convenient as this will resolve some fairly important bugs in 3.4.0. If you’re running version 3.4.1, 3.4.1 includes these fixes as well so this is not a critical upgrade, but we do encourage you to upgrade when time allows.

We do have one known issue with 3.4.1 and 3.5.0. In the Blacklist/Threat Intel tab, the box displaying additional information about IP addresses is not showing the correct details. As a temporary workaround, we encourage you to use an external web site to see additional details. Click on the IP address in question and you’ll see a drop-down menu; click on apility.io and you’ll be taken to a page with these details.

* To see your version, log in to AI-Hunter, select the Dashboard, click on the Gear icon in the upper right, and click on “About”.

Monday - 08/19/2019

We’ve provided a new release of AI-Hunter, which is in your Account under Downloads. Version 3.4.1 resolves two bugs that made it into 3.4.0:

1. After upgrading to 3.4.0, new data is not flowing into the rolling databases. This came out of a database change. The bug wasn’t apparent until after release and further QA testing.
2. A second error in the snapshotting process meant that instead of trying to create a new snapshot named after yesterday’s date, it was trying to create the same snapshot name every day.

We encourage all 3.4.0 users to upgrade to this version as soon as possible. If you’re on 3.3.0 or below we still encourage you to upgrade to 3.4.1 as, in addition to the above bug fixes, there are many usability and workflow improvements from 3.4.0 that have been carried forward.