Distributed & real time digital forensics at the speed of the cloud
Перейти к файлу
Aaron Meihm c741cb3a26 [minor] improve flexibility for action expiry handling
Allows jobs to specify the expiry time that is desired for the action in
the configuration file. This also handles increasing the window based on
the job validity time being set in the past.
2015-09-17 23:21:59 -05:00
actions [doc] fix target in demo shellshock action 2015-05-28 11:40:11 -04:00
client [minor] support pre-cacheing gpg passphrase for automated operation 2015-09-17 13:43:11 -05:00
conf [minor] support pre-cacheing gpg passphrase for automated operation 2015-09-17 13:43:11 -05:00
database [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
doc [doc] fix reference to RunnerResult in runner documentation 2015-09-16 10:18:20 -05:00
mig-agent [minor] change folder structure to go get with nice names 2015-08-26 12:22:02 -04:00
mig-api [minor] change folder structure to go get with nice names 2015-08-26 12:22:02 -04:00
mig-runner [minor] improve flexibility for action expiry handling 2015-09-17 23:21:59 -05:00
mig-scheduler [minor] enforce agent heartbeattime and starttime in scheduler 2015-09-14 12:36:04 -04:00
modules [minor] fix filepath comparison in file module tests 2015-09-02 10:58:59 -04:00
pgp [minor] support pre-cacheing gpg passphrase for automated operation 2015-09-17 13:43:11 -05:00
testutil [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
tools [doc] fix rabbitmq mirroring policy in conf script 2015-09-10 09:38:42 -04:00
vendor [minor] initial commit of mig-runner 2015-09-15 14:40:26 -05:00
workers [minor] add import comment to packages declarations 2015-08-26 14:15:40 -04:00
.gitignore [minor] updated gitignore 2015-09-09 13:01:59 -04:00
.travis.yml [minor] change folder structure to go get with nice names 2015-08-26 12:22:02 -04:00
AUTHORS [doc] contributing guidelines 2015-08-23 12:12:55 -04:00
CONTRIBUTING.md [doc] update GOMAXPROCS comment in contributing doc 2015-08-23 13:34:05 -04:00
LICENSE [medium] Makefile support 2014-02-03 10:42:36 -05:00
Makefile [minor] initial commit of mig-runner 2015-09-15 14:40:26 -05:00
README.md [medium] add support for -mismatch searches in file module 2015-08-28 22:02:27 -04:00
acl.go [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
action.go [minor] add -a flag for mig-cmd that can be used to print action json 2015-09-15 12:22:43 -05:00
agent.go [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
command.go [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
constants.go [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
investigator.go [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
logging_posix.go [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
logging_windows.go [doc] add newline after license header to ignore it in godoc 2015-08-27 10:41:13 -04:00
runner.go [minor] initial commit of mig-runner 2015-09-15 14:40:26 -05:00

README.md

MIG: Mozilla InvestiGator

Build Status

Build one-liner:

$ go get mig.ninja/mig && cd $GOPATH/src/mig.ninja/mig && make

MIG is OpSec's platform for investigative surgery of remote endpoints.

MIG is composed of agents installed on all systems of an infrastructure that are be queried in real-time to investigate the file-systems, network state, memory or configuration of endpoints.

Capability Linux MacOS Windows
file inspection check check check
network inspection check check (partial)
memory inspection check check check
vuln management check (planned) (planned)
log analysis (planned) (planned) (planned)
system auditing (planned) (planned) (planned)

Imagine it is 7am on a saturday morning, and someone just released a critical vulnerability for your favorite PHP application. The vuln is already exploited and security groups are releasing indicators of compromise (IOCs). Your weekend isn't starting great, and the thought of manually inspecting thousands of systems isn't making it any better.

MIG can help. The signature of the vulnerable PHP app (the md5 of a file, a regex, or just a filename) can be searched for across all your systems using the file module. Similarly, IOCs such as specific log entries, backdoor files with {md5,sha{1,256,512,3-{256,512}}} hashes, IP addresses from botnets or byte strings in processes memories can be investigated using MIG. Suddenly, your weekend is looking a lot better. And with just a few commands, thousands of systems will be remotely investigated to verify that you're not at risk.

MIG command line demo

MIG agents are designed to be lightweight, secure, and easy to deploy so you can ask your favorite sysadmins to add it to a base deployment without fear of breaking the entire production network. All parameters are built into the agent at compile time, including the list and ACLs of authorized investigators. Security is enforced using PGP keys, and even if MIG's servers are compromised, as long as our keys are safe on your investigator's laptop, no one will break into the agents.

MIG is designed to be fast, and asynchronous. It uses AMQP to distribute actions to endpoints, and relies on Go channels to prevent components from blocking. Running actions and commands are stored in a Postgresql database and on disk cache, such that the reliability of the platform doesn't depend on long-running processes.

Speed is a strong requirement. Most actions will only take a few hundreds milliseconds to run on agents. Larger ones, for example when looking for a hash in a big directory, should run in less than a minute or two. All in all, an investigation usually completes in between 10 and 300 seconds.

Privacy and security are paramount. Agents never send raw data back to the platform, but only reply to questions instead. All actions are signed by GPG keys that are not stored in the platform, thus preventing a compromise from taking over the entire infrastructure.

Technology

MIG is built in Go and uses a REST API that receives signed JSON messages distributed to agents via RabbitMQ and stored in a Postgres database.

It is:

  • Massively Distributed means Fast.
  • Simple to deploy and Cross-Platform.
  • Secured using OpenPGP.
  • Respectful of privacy by never retrieving raw data from endpoints.

Check out this 10 minutes video for a more general presentation and a demo of the console interface.

MIG youtube video

MIG was recently presented at the SANS DFIR Summit in Austin, Tx. You can watch the recording below:

MIG @ DFIR Summit 2015

Discussion

Join #mig on irc.mozilla.org (use a web client such as mibbit ).

Documentation

All documentation is available in the 'doc' directory and on http://mig.mozilla.org .

Bug & Issue tracker

We use Bugzilla to track the work on MIG.