GithubHelp home page GithubHelp logo

netflix-skunkworks / diffy Goto Github PK

View Code? Open in Web Editor NEW
632.0 144.0 59.0 1.13 MB

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

License: Apache License 2.0

Python 100.00%
security dfir forensics

diffy's Introduction

Diffy (DEPRECATED)

Diffy has been deprecated at Netflix. This software is no longer maintained or supported.

docs/images/diffy_small.png

No Maintenance Intended https://travis-ci.org/Netflix-Skunkworks/diffy.svg?branch=master https://img.shields.io/gitter/room/nwjs/nw.js.svg?style=flat-square PyPi version Supported Python versions License Status RTD

Diffy is a digital forensics and incident response (DFIR) tool that was developed by Netflix's Security Intelligence and Response Team (SIRT).

Diffy allows a forensic investigator to quickly scope a compromise across cloud instances during an incident, and triage those instances for followup actions. Diffy is currently focused on Linux instances running within Amazon Web Services (AWS), but owing to our plugin structure, could support multiple platforms and cloud providers.

It's called "Diffy" because it helps a human investigator to identify the differences between instances, and because Alex pointed out that "The Difforensicator" was unnecessarily tricky.

See Releases for recent changes. See our Read the Docs site for well-formatted documentation.

Supported Technologies

  • AWS (AWS Systems Manager / SSM)
  • Local
  • osquery

Each technology has its own plugins for targeting, collection and persistence.

Features

  • Efficiently highlights outliers in security-relevant instance behavior. For example, you can use Diffy to tell you which of your instances are listening on an unexpected port, are running an unusual process, include a strange crontab entry, or have inserted a surprising kernel module.

  • Uses one, or both, of two methods to highlight differences:

    • Collection of a "functional" baseline from a "clean" running instance, against which your instance group is compared, and
    • Collection of a "clustered" baseline, in which all instances are surveyed, and outliers are made obvious.
  • Uses a modular plugin-based architecture. We currently include plugins for collection using osquery via AWS Systems Manager (formerly known as Simple Systems Manager or SSM).

Installation

Via pip:

pip install diffy

Roadmap

Diffy has been deprecated at Netflix. This software is no longer maintained or supported.

Why python 3 only?

Please see Guido's guidance regarding the Python 2.7 end of life date.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.