Sistem g\u00fcvenli\u011fi, modern bilgi i\u015flem ortamlar\u0131nda en kritik \u00f6nceliklerden biridir. K\u00f6t\u00fc niyetli sald\u0131r\u0131lar, veri ihlalleri ve sistem kesintileri gibi tehditler, i\u015fletmeler ve bireyler i\u00e7in ciddi sonu\u00e7lar do\u011furabilir. Bu tehditlere kar\u015f\u0131 koymak i\u00e7in proaktif ve s\u00fcrekli bir g\u00fcvenlik izleme stratejisi benimsemek elzemdir. Geleneksel g\u00fcvenlik ara\u00e7lar\u0131 genellikle statik analizler veya belirli olaylar\u0131 takip etme \u00fczerine kuruluyken, dinamik ve esnek bir yakla\u015f\u0131m sunan ara\u00e7lar, g\u00fcvenlik analistlerine daha derinlemesine g\u00f6r\u00fcn\u00fcrl\u00fck sa\u011flar. \u0130\u015fte bu noktada, SQL benzeri sorgularla i\u015fletim sistemi verilerini sorgulamam\u0131z\u0131 sa\u011flayan a\u00e7\u0131k kaynakl\u0131 bir ara\u00e7 olan osquery devreye girer. Bu makalede, Ubuntu 16.04 i\u015fletim sistemi \u00fczerinde osquery’yi kurma, yap\u0131land\u0131rma ve sistem g\u00fcvenli\u011fini etkin bir \u015fekilde izlemek i\u00e7in nas\u0131l kullanaca\u011f\u0131m\u0131z\u0131 ayr\u0131nt\u0131l\u0131 olarak inceleyece\u011fiz.<\/p>\n
Sistem g\u00fcvenli\u011fi izleme, bir sistemdeki g\u00fcvenlik olaylar\u0131n\u0131, anormallikleri ve potansiyel tehditleri s\u00fcrekli olarak takip etme s\u00fcrecidir. Bu s\u00fcre\u00e7, yetkisiz eri\u015fim giri\u015fimlerini, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m faaliyetlerini, sistem yap\u0131land\u0131rma de\u011fi\u015fikliklerini ve di\u011fer g\u00fcvenlik ihlallerini erken a\u015famada tespit etmeye yard\u0131mc\u0131 olur. G\u00fcvenlik izleme olmadan, bir sald\u0131r\u0131n\u0131n ne zaman veya nas\u0131l ger\u00e7ekle\u015fti\u011fini anlamak, hasar\u0131 s\u0131n\u0131rlamak ve gelecekteki sald\u0131r\u0131lar\u0131 \u00f6nlemek son derece zorla\u015f\u0131r.<\/p>\n
osquery, Facebook taraf\u0131ndan geli\u015ftirilen ve i\u015fletim sistemini y\u00fcksek performansl\u0131 bir ili\u015fkisel veritaban\u0131 gibi ele almam\u0131z\u0131 sa\u011flayan g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r. Dosya sistemi, \u00e7al\u0131\u015fan s\u00fcre\u00e7ler, a\u011f ba\u011flant\u0131lar\u0131, y\u00fckl\u00fc paketler, kullan\u0131c\u0131 hesaplar\u0131 ve \u00e7ok daha fazlas\u0131 gibi i\u015fletim sistemi verilerini standart SQL sorgular\u0131 kullanarak sorgulayabiliriz. Bu yakla\u015f\u0131m, g\u00fcvenlik analistlerine ve sistem y\u00f6neticilerine, sistemin anl\u0131k durumunu ve ge\u00e7mi\u015f olaylar\u0131n\u0131 anlamak i\u00e7in benzersiz bir esneklik ve g\u00fc\u00e7 sunar. Ubuntu 16.04 gibi sunucu ortamlar\u0131nda, osquery, g\u00fcvenlik duru\u015funu g\u00fc\u00e7lendirmek ve potansiyel tehditleri proaktif olarak tespit etmek i\u00e7in paha bi\u00e7ilmez bir ara\u00e7 haline gelir.<\/p>\n
osquery, i\u015fletim sistemini bir SQL veritaban\u0131 gibi sorgulaman\u0131z\u0131 sa\u011flayan a\u00e7\u0131k kaynakl\u0131, platformlar aras\u0131 bir ara\u00e7t\u0131r. Geleneksel g\u00fcvenlik ara\u00e7lar\u0131n\u0131n aksine, osquery, sistemdeki de\u011fi\u015fiklikleri veya belirli olaylar\u0131 izlemek i\u00e7in \u00f6nceden tan\u0131mlanm\u0131\u015f kurallara dayanmaz. Bunun yerine, sistemi s\u00fcrekli olarak sorgulayarak veya olay bazl\u0131 verileri toplayarak, g\u00fcvenlik analistlerinin kendi \u00f6zel ihtiya\u00e7lar\u0131na g\u00f6re dinamik sorgular olu\u015fturmas\u0131na olanak tan\u0131r.<\/p>\n
osquery’nin temelinde, i\u015fletim sistemi \u00fczerindeki \u00e7e\u015fitli veri kaynaklar\u0131n\u0131 temsil eden “sanal tablolar” bulunur. \u00d6rne\u011fin, osquery iki ana bile\u015fenden olu\u015fur: G\u00fcvenlik a\u00e7\u0131s\u0131ndan osquery’nin faydalar\u0131 \u015funlard\u0131r: Ubuntu 16.04 (Xenial Xerus), Nisan 2016’da piyasaya s\u00fcr\u00fclen bir Uzun S\u00fcreli Destek (LTS) s\u00fcr\u00fcm\u00fcd\u00fcr. Her ne kadar g\u00fcncel bir s\u00fcr\u00fcm olmasa da, bir\u00e7ok kurumsal ortamda hala kullan\u0131lmakta olan veya ge\u00e7i\u015f s\u00fcrecinde olan sistemler bulunmaktad\u0131r. Bu nedenle, bu platform \u00fczerinde g\u00fcvenlik izleme yeteneklerini anlamak ve uygulamak hala \u00f6nem ta\u015f\u0131maktad\u0131r. osquery, Ubuntu 16.04 dahil olmak \u00fczere bir\u00e7ok Linux da\u011f\u0131t\u0131m\u0131nda sorunsuz bir \u015fekilde \u00e7al\u0131\u015f\u0131r ve sa\u011flad\u0131\u011f\u0131 g\u00fcvenlik g\u00f6r\u00fcn\u00fcrl\u00fc\u011f\u00fc, eski sistemlerin g\u00fcvenlik duru\u015funu modern tehditlere kar\u015f\u0131 g\u00fc\u00e7lendirmeye yard\u0131mc\u0131 olabilir.<\/p>\n Ubuntu 16.04 \u00fczerinde osquery kurmak olduk\u00e7a basittir. osquery ekibi, Debian tabanl\u0131 sistemler i\u00e7in resmi APT depolar\u0131 sunar.<\/p>\n 1. GPG Anahtar\u0131n\u0131 Ekleme:<\/strong> osquery paketlerinin do\u011frulu\u011funu sa\u011flamak i\u00e7in GPG anahtar\u0131n\u0131 sisteminize eklemeniz gerekir.<\/p>\n 2. osquery Deposunu Ekleme:<\/strong> osquery deposunu 3. Paket Listesini G\u00fcncelleme:<\/strong> Yeni depoyu tan\u0131mas\u0131 i\u00e7in APT paket listesini g\u00fcncelleyin.<\/p>\n 4. osquery Kurulumu:<\/strong> \u015eimdi osquery paketini kurabilirsiniz.<\/p>\n 5. Kurulumu Do\u011frulama:<\/strong> osquery’nin ba\u015far\u0131yla kuruldu\u011funu ve \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulamak i\u00e7in s\u00fcr\u00fcm kontrol\u00fc yapabilir ve etkile\u015fimli kabu\u011fa girebilirsiniz.<\/p>\n osquery’nin g\u00fcc\u00fcn\u00fc anlamak i\u00e7in baz\u0131 temel sorgularla ba\u015flamak \u00f6nemlidir. Bu sorgular, sisteminizin anl\u0131k durumu hakk\u0131nda an\u0131nda bilgi edinmenizi sa\u011flar.<\/p>\n Kurulumdan sonra, osquery’deki sorgular standart SQL s\u00f6zdizimini kullan\u0131r: \u0130\u015fte g\u00fcvenlik izleme ba\u011flam\u0131nda kullanabilece\u011finiz baz\u0131 temel sorgular:<\/p>\n 1. Kullan\u0131c\u0131 Hesaplar\u0131n\u0131 Listeleme:<\/strong><\/p>\n Bu sorgu, sistemdeki t\u00fcm kullan\u0131c\u0131lar\u0131n UID, GID, kullan\u0131c\u0131 ad\u0131, a\u00e7\u0131klama, ana dizin ve kabuk bilgilerini listeler. Yetkisiz veya \u015f\u00fcpheli yeni kullan\u0131c\u0131 hesaplar\u0131n\u0131 tespit etmek i\u00e7in kullan\u0131labilir.<\/p>\n 2. \u00c7al\u0131\u015fan S\u00fcre\u00e7leri G\u00f6r\u00fcnt\u00fcleme:<\/strong><\/p>\n Sistemde \u00e7al\u0131\u015fan t\u00fcm s\u00fcre\u00e7lerin PID, ad\u0131, y\u00fcr\u00fct\u00fclebilir yolu, komut sat\u0131r\u0131 arg\u00fcmanlar\u0131, \u00e7al\u0131\u015fma dizini, kullan\u0131c\u0131 ve grup kimli\u011fi gibi detaylar\u0131n\u0131 g\u00f6sterir. Bilinmeyen veya \u015f\u00fcpheli s\u00fcre\u00e7leri tespit etmek i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n 3. A\u00e7\u0131k A\u011f Portlar\u0131n\u0131 Listeleme:<\/strong><\/p>\n Sistemde dinlemede olan t\u00fcm TCP\/UDP portlar\u0131n\u0131, ilgili s\u00fcre\u00e7 PID’sini, protokol\u00fc, adresi ve durumu listeler. Yetkisiz bir hizmetin \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 veya k\u00f6t\u00fc ama\u00e7l\u0131 bir yaz\u0131l\u0131m\u0131n bir arka kap\u0131 (backdoor) a\u00e7\u0131p a\u00e7mad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in idealdir.<\/p>\n 4. Son Giri\u015f Yapan Kullan\u0131c\u0131lar\u0131 G\u00f6r\u00fcnt\u00fcleme:<\/strong><\/p>\n Sisteme son giri\u015f yapan kullan\u0131c\u0131lar\u0131, giri\u015f tipini (tty, ssh vb.), kaynak ana bilgisayar\u0131 ve zaman\u0131 g\u00f6sterir. \u015e\u00fcpheli giri\u015fleri veya yetkisiz kullan\u0131c\u0131lar\u0131n varl\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in faydal\u0131d\u0131r.<\/p>\n 5. SUID\/SGID Bitli \u00c7al\u0131\u015ft\u0131r\u0131labilir Dosyalar\u0131 Bulma:<\/strong><\/p>\n Sistemdeki SUID (Set User ID) veya SGID (Set Group ID) bitleri ayarlanm\u0131\u015f t\u00fcm \u00e7al\u0131\u015ft\u0131r\u0131labilir dosyalar\u0131 listeler. Bu dosyalar genellikle ayr\u0131cal\u0131k y\u00fckseltme (privilege escalation) sald\u0131r\u0131lar\u0131nda kullan\u0131l\u0131r, bu y\u00fczden anormallikleri izlemek \u00f6nemlidir.<\/p>\n 6. Ba\u015flang\u0131\u00e7 \u00d6\u011felerini G\u00f6r\u00fcnt\u00fcleme:<\/strong><\/p>\n Sistem ba\u015flang\u0131c\u0131nda otomatik olarak \u00e7al\u0131\u015fan programlar\u0131 ve betikleri listeler. K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar genellikle kal\u0131c\u0131l\u0131k sa\u011flamak i\u00e7in ba\u015flang\u0131\u00e7 \u00f6\u011felerini kullan\u0131r.<\/p>\n Bu sorgular, osquery’nin sundu\u011fu y\u00fczlerce tablodan sadece birka\u00e7 \u00f6rnektir. Her bir tablo, sistemin farkl\u0131 bir y\u00f6n\u00fc hakk\u0131nda bilgi sa\u011flar ve g\u00fcvenlik analistlerinin kapsaml\u0131 bir g\u00f6r\u00fcn\u00fcm elde etmesine yard\u0131mc\u0131 olur.<\/p>\n osquery’yi g\u00fcvenlik izleme i\u00e7in kullan\u0131rken, belirli tehdit vekt\u00f6rlerini hedefleyen sorgular ve yap\u0131land\u0131rmalar olu\u015fturmak \u00f6nemlidir. \u0130\u015fte baz\u0131 yayg\u0131n g\u00fcvenlik senaryolar\u0131 ve osquery’nin bunlar\u0131 nas\u0131l ele alabilece\u011fi:<\/p>\n 1. Dosya B\u00fct\u00fcnl\u00fc\u011f\u00fc \u0130zleme (FIM):<\/strong> osquery, kritik dosyalar\u0131n ve dizinlerin de\u011fi\u015fikliklerini izlemek i\u00e7in * Sorgu (ancak 2. \u015e\u00fcpheli S\u00fcre\u00e7leri \u0130zleme:<\/strong> Bu sorgu, son 5 dakika i\u00e7inde ba\u015flat\u0131lan s\u00fcre\u00e7leri g\u00f6sterir. Zamanlanm\u0131\u015f bir sorgu olarak \u00e7al\u0131\u015ft\u0131r\u0131larak yeni s\u00fcre\u00e7lerin anormalliklerini tespit edebilir. Bu, sistem kaynaklar\u0131n\u0131 a\u015f\u0131r\u0131 kullanan s\u00fcre\u00e7leri bulmaya yard\u0131mc\u0131 olur, ki bu da k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m aktivitesinin bir g\u00f6stergesi olabilir. 3. SUID\/SGID Dosyalar\u0131ndaki De\u011fi\u015fiklikleri \u0130zleme:<\/strong><\/p>\n Bu sorguyu d\u00fczenli olarak \u00e7al\u0131\u015ft\u0131rarak yeni SUID\/SGID bitli dosyalar\u0131n eklenip eklenmedi\u011fini veya mevcut dosyalar\u0131n izinlerinin de\u011fi\u015fip de\u011fi\u015fmedi\u011fini kontrol edebilirsiniz.<\/p>\n 4. Cron \u0130\u015flerindeki De\u011fi\u015fiklikler:<\/strong> K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar genellikle kal\u0131c\u0131l\u0131k sa\u011flamak i\u00e7in cron i\u015flerini kullan\u0131r.<\/p>\n Bu sorguyu d\u00fczenli olarak \u00e7al\u0131\u015ft\u0131rarak beklenmedik yeni cron i\u015flerini tespit edebilirsiniz.<\/p>\n 1. Yetkisiz Dinleme Portlar\u0131:<\/strong><\/p>\n Bu sorgu, sistemde dinlemede olan t\u00fcm portlar\u0131 ve ilgili s\u00fcre\u00e7leri g\u00f6sterir. Bilinmeyen bir uygulaman\u0131n bir port a\u00e7\u0131p a\u00e7mad\u0131\u011f\u0131n\u0131 veya k\u00f6t\u00fc ama\u00e7l\u0131 bir yaz\u0131l\u0131m\u0131n bir arka kap\u0131 olu\u015fturup olu\u015fturmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in \u00f6nemlidir.<\/p>\n 2. \u015e\u00fcpheli Giden Ba\u011flant\u0131lar:<\/strong><\/p>\n Bu sorgu, sistemden d\u0131\u015far\u0131ya do\u011fru yap\u0131lan t\u00fcm aktif ba\u011flant\u0131lar\u0131 listeler. Bilinmeyen bir hedefe ba\u011flant\u0131 kurmaya \u00e7al\u0131\u015fan s\u00fcre\u00e7leri veya k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n komuta ve kontrol (C2) sunucular\u0131yla ileti\u015fim kurup kurmad\u0131\u011f\u0131n\u0131 tespit etmek i\u00e7in kullan\u0131labilir.<\/p>\n 3. DNS Cache \u0130zleme:<\/strong><\/p>\n DNS \u00f6nbelle\u011fini kontrol ederek \u015f\u00fcpheli alan adlar\u0131na yap\u0131lan \u00e7\u00f6z\u00fcmleri veya DNS zehirlenmesi (DNS poisoning) giri\u015fimlerini tespit edebilirsiniz.<\/p>\n 1. Yeni veya De\u011fi\u015ftirilmi\u015f Kullan\u0131c\u0131 Hesaplar\u0131:<\/strong><\/p>\n Bu sorguyu zamanlanm\u0131\u015f olarak \u00e7al\u0131\u015ft\u0131rarak 2. Sudo Olaylar\u0131:<\/strong> osquery, Bu, ayr\u0131cal\u0131k y\u00fckseltme giri\u015fimlerini veya yetkisiz sudo kullan\u0131m\u0131n\u0131 tespit etmek i\u00e7in \u00f6nemlidir.<\/p>\n 3. Giri\u015f Ge\u00e7mi\u015fi:<\/strong><\/p>\n Bu sorgu, sistemdeki kullan\u0131c\u0131lar\u0131n son giri\u015flerini g\u00f6sterir. Yetkisiz giri\u015fleri veya \u015f\u00fcpheli kaynak IP adreslerinden gelen giri\u015fleri tespit etmek i\u00e7in kullan\u0131labilir.<\/p>\n 1. Y\u00fckl\u00fc Paketleri Kontrol Etme:<\/strong><\/p>\n Bu sorgu, sistemde y\u00fckl\u00fc t\u00fcm Debian paketlerini listeler. Bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131na sahip eski yaz\u0131l\u0131m s\u00fcr\u00fcmlerini veya yetkisiz paketlerin y\u00fcklenip y\u00fcklenmedi\u011fini kontrol etmek i\u00e7in kullan\u0131labilir.<\/p>\n 2. \/etc\/hosts Dosyas\u0131n\u0131 \u0130zleme:<\/strong><\/p>\n 3. Kernel Mod\u00fcllerini Kontrol Etme:<\/strong><\/p>\n \u015e\u00fcpheli veya bilinmeyen \u00e7ekirdek mod\u00fcllerinin y\u00fcklenmesi, rootkit gibi geli\u015fmi\u015f k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n bir g\u00f6stergesi olabilir.<\/p>\n osquery’nin tam potansiyelini kullanmak i\u00e7in osquery’nin ana yap\u0131land\u0131rma dosyas\u0131 genellikle Temel Yap\u0131land\u0131rma B\u00f6l\u00fcmleri:<\/strong><\/p>\n 1. 2. Bu sorgu her saat \u00e7al\u0131\u015farak son bir saat i\u00e7inde olu\u015fturulan kullan\u0131c\u0131lar\u0131 bulur. * De\u011fi\u015fen SUID\/SGID Binaries:<\/strong><\/p>\n * \u015e\u00fcpheli \u00c7al\u0131\u015fan S\u00fcre\u00e7ler:<\/strong><\/p>\n 3. 4. Yap\u0131land\u0131rma dosyas\u0131n\u0131 de\u011fi\u015ftirdikten sonra, de\u011fi\u015fikliklerin etkili olmas\u0131 i\u00e7in osquery, toplad\u0131\u011f\u0131 verileri \u00e7e\u015fitli hedeflere loglayabilir. Varsay\u0131lan olarak, loglar * Bu JSON loglar\u0131, bir G\u00fcvenlik Bilgileri ve Olay Y\u00f6netimi (SIEM) sistemi (\u00f6rne\u011fin, Splunk, ELK Stack, Graylog) taraf\u0131ndan kolayca ayr\u0131\u015ft\u0131r\u0131labilir ve analiz edilebilir. osquery, loglar\u0131 do\u011frudan bir * Syslog Entegrasyonu (\u00f6rnek):<\/strong><\/p>\n Bu yap\u0131land\u0131rma, loglar\u0131 yerel syslog daemon’una g\u00f6nderir. Daha sonra syslog’u bir uzak SIEM’e y\u00f6nlendirebilirsiniz.<\/p>\n * TLS Entegrasyonu (\u00f6rnek):<\/strong><\/p>\n TLS entegrasyonu, loglar\u0131 do\u011frudan \u015fifreli bir ba\u011flant\u0131 \u00fczerinden merkezi bir SIEM sunucusuna g\u00f6nderir. Bu, daha g\u00fcvenli ve \u00f6l\u00e7eklenebilir bir loglama y\u00f6ntemidir.<\/p>\n osquery’nin esnekli\u011fi, sadece temel g\u00fcvenlik kontrolleriyle s\u0131n\u0131rl\u0131 de\u011fildir; ayn\u0131 zamanda tehdit avc\u0131l\u0131\u011f\u0131 ve olay m\u00fcdahalesi gibi daha geli\u015fmi\u015f senaryolarda da parlar.<\/p>\n Tehdit avc\u0131l\u0131\u011f\u0131, bilinen g\u00f6stergeler olmadan sistemlerdeki potansiyel tehditleri proaktif olarak aramakt\u0131r. osqueryi, bu s\u00fcre\u00e7te interaktif bir ara\u00e7 olarak \u00e7ok de\u011ferlidir.<\/p>\n * \u00d6rnek Senaryo: Bilinmeyen Bir S\u00fcrecin K\u00f6kenini Ara\u015ft\u0131rma:<\/strong> 2. S\u00fcrecin A\u00e7t\u0131\u011f\u0131 A\u011f Ba\u011flant\u0131lar\u0131n\u0131 Kontrol Edin:<\/strong><\/p>\n 3. S\u00fcrecin \u00c7al\u0131\u015fma Dizinindeki De\u011fi\u015fiklikleri Kontrol Edin (e\u011fer processes<\/code> tablosu \u00e7al\u0131\u015fan t\u00fcm s\u00fcre\u00e7ler hakk\u0131nda bilgi sa\u011flarken, users<\/code> tablosu sistemdeki kullan\u0131c\u0131 hesaplar\u0131n\u0131 listeler. listening_ports<\/code> tablosu a\u00e7\u0131k a\u011f portlar\u0131n\u0131 g\u00f6sterirken, deb_packages<\/code> tablosu y\u00fckl\u00fc Debian paketlerini listeler. Bu sanal tablolar, ger\u00e7ek zamanl\u0131 i\u015fletim sistemi verilerini yans\u0131t\u0131r ve standart SQL sorgular\u0131 ile eri\u015filebilir hale getirir.<\/p>\n
\n* osqueryi:<\/strong> Etkile\u015fimli bir kabuk (shell) sa\u011flar. Bu kabuk \u00fczerinden anl\u0131k olarak SQL sorgular\u0131 \u00e7al\u0131\u015ft\u0131rabilir ve sistemin o anki durumunu inceleyebilirsiniz. \u00d6zellikle olay m\u00fcdahalesi ve tehdit avc\u0131l\u0131\u011f\u0131 (threat hunting) senaryolar\u0131nda \u00e7ok kullan\u0131\u015fl\u0131d\u0131r.
\n* osqueryd:<\/strong> Bir arka plan hizmeti (daemon) olarak \u00e7al\u0131\u015f\u0131r. Bu hizmet, \u00f6nceden tan\u0131mlanm\u0131\u015f zamanlanm\u0131\u015f sorgular\u0131 (scheduled queries) periyodik olarak \u00e7al\u0131\u015ft\u0131r\u0131r ve sonu\u00e7lar\u0131 bir loglama hedefine (varsay\u0131lan olarak disk veya bir SIEM sistemine) g\u00f6nderir. Bu, s\u00fcrekli g\u00fcvenlik izleme i\u00e7in kritik \u00f6neme sahiptir. Ayr\u0131ca, dosya de\u011fi\u015fiklikleri, s\u00fcre\u00e7 etkinlikleri gibi olaylar\u0131 ger\u00e7ek zamanl\u0131 olarak izlemek i\u00e7in olay tabanl\u0131 (event-based) tablolar\u0131 da destekler.<\/p>\n
\n* G\u00f6r\u00fcn\u00fcrl\u00fck:<\/strong> Sistemdeki her t\u00fcrl\u00fc aktiviteye (s\u00fcre\u00e7ler, a\u011f, dosya, kullan\u0131c\u0131lar vb.) derinlemesine g\u00f6r\u00fcn\u00fcrl\u00fck sa\u011flar.
\n* Tespit:<\/strong> K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m, yetkisiz de\u011fi\u015fiklikler, yap\u0131land\u0131rma hatalar\u0131 ve di\u011fer g\u00fcvenlik anormalliklerini tespit etmek i\u00e7in \u00f6zel sorgular olu\u015fturulabilir.
\n* Olay M\u00fcdahalesi:<\/strong> Bir g\u00fcvenlik olay\u0131 s\u0131ras\u0131nda h\u0131zl\u0131 bir \u015fekilde bilgi toplamak ve olay\u0131n kapsam\u0131n\u0131 anlamak i\u00e7in etkile\u015fimli sorgular kullan\u0131labilir.
\n* Tehdit Avc\u0131l\u0131\u011f\u0131:<\/strong> Bilinen veya bilinmeyen tehditleri proaktif olarak aramak i\u00e7in sistem verilerini sorgulayarak \u015f\u00fcpheli davran\u0131\u015flar\u0131 ortaya \u00e7\u0131kar\u0131r.
\n* Uyum (Compliance):<\/strong> G\u00fcvenlik politikalar\u0131na uyumu do\u011frulamak i\u00e7in sistem yap\u0131land\u0131rmalar\u0131n\u0131 d\u00fczenli olarak denetleyebilir.<\/p>\nNeden Ubuntu 16.04?<\/h3>\n
osquery Kurulumu<\/h3>\n
Ubuntu 16.04 \u00dczerine Kurulum Ad\u0131mlar\u0131<\/h4>\n
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B<\/code><\/pre>\nsources.list.d<\/code> dizinine ekleyin. Ubuntu 16.04 i\u00e7in xenial<\/code> kod ad\u0131n\u0131 kullanmal\u0131s\u0131n\u0131z.<\/p>\necho \"deb [arch=amd64] https:\/\/pkg.osquery.io\/deb deb-xenial main\" | sudo tee \/etc\/apt\/sources.list.d\/osquery.list<\/code><\/pre>\nsudo apt update<\/code><\/pre>\nsudo apt install osquery<\/code><\/pre>\nosqueryi --version\n osqueryi<\/code><\/pre>\nosqueryi<\/code> komutunu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda, osquery><\/code> komut istemini g\u00f6rmelisiniz. Buradan SQL sorgular\u0131n\u0131z\u0131 \u00e7al\u0131\u015ft\u0131rabilirsiniz. \u00c7\u0131kmak i\u00e7in .exit<\/code> yaz\u0131p Enter tu\u015funa bas\u0131n.<\/p>\nosquery Temelleri: \u0130lk Sorgular\u0131n\u0131z<\/h3>\n
osqueryd ve osqueryi<\/h4>\n
osqueryd<\/code> hizmeti varsay\u0131lan olarak arka planda \u00e7al\u0131\u015fmaya ba\u015flar ve yap\u0131land\u0131rma dosyas\u0131nda tan\u0131mlanan zamanlanm\u0131\u015f sorgular\u0131 y\u00fcr\u00fct\u00fcr. osqueryi<\/code> ise sadece etkile\u015fimli sorgular i\u00e7in kullan\u0131l\u0131r ve bir oturumdan sonra kapan\u0131r. G\u00fcvenlik izleme i\u00e7in genellikle osqueryd<\/code> kullan\u0131l\u0131rken, olay m\u00fcdahalesi ve tehdit avc\u0131l\u0131\u011f\u0131 i\u00e7in osqueryi<\/code> tercih edilir.<\/p>\nTemel Sorgu Yap\u0131s\u0131<\/h4>\n
SELECT kolonlar FROM tablo [WHERE ko\u015fullar] [ORDER BY kolon] [LIMIT say\u0131];<\/code>.<\/p>\nSELECT uid, gid, username, description, directory, shell FROM users;<\/code><\/pre>\nSELECT pid, name, path, cmdline, cwd, uid, gid FROM processes;<\/code><\/pre>\nSELECT pid, port, protocol, family, address, state FROM listening_ports;<\/code><\/pre>\nSELECT username, type, host, time FROM logged_in_users;<\/code><\/pre>\nSELECT path, filename, uid, gid, mode FROM suid_bin;<\/code><\/pre>\nSELECT name, path, type FROM startup_items;<\/code><\/pre>\nSistem G\u00fcvenli\u011fini \u0130zlemek \u0130\u00e7in osquery Kullan\u0131m\u0131<\/h3>\n
K\u00f6t\u00fc Ama\u00e7l\u0131 Yaz\u0131l\u0131m ve Yetkisiz De\u011fi\u015fiklik Tespiti<\/h4>\n
file_events<\/code> tablosunu kullanabilir. Bu tablo, dosya olu\u015fturma, de\u011fi\u015ftirme ve silme olaylar\u0131n\u0131 kaydeder. Ancak, bu olay tablosu y\u00fcksek performans maliyetine sahip olabilir ve dikkatli yap\u0131land\u0131rma gerektirir.
\n * Yap\u0131land\u0131rma:<\/strong> \/etc\/osquery\/osquery.conf<\/code> dosyas\u0131nda file_paths<\/code> anahtar\u0131n\u0131 kullanarak izlenecek yollar\u0131 belirtmelisiniz.<\/p>\n\"file_paths\": {\n \"etc\": [\n \"\/etc\/passwd\",\n \"\/etc\/shadow\",\n \"\/etc\/hosts\",\n \"\/etc\/crontab\",\n \"\/etc\/sudoers.d\/%\"\n ],\n \"binaries\": [\n \"\/usr\/bin\/ssh\",\n \"\/bin\/login\"\n ]\n }<\/code><\/pre>\nfile_events<\/code> do\u011frudan sorgulanmaz, olaylar loglan\u0131r):<\/strong> osqueryd<\/code> bu olaylar\u0131 toplayacak ve log dosyalar\u0131na yazacakt\u0131r. Daha sonra bu loglar\u0131 SIEM sisteminizde analiz edebilirsiniz.<\/p>\n
\n * Yeni veya Bilinmeyen S\u00fcre\u00e7ler:<\/strong> processes<\/code> tablosunu belirli bir zaman aral\u0131\u011f\u0131nda ba\u015flat\u0131lan s\u00fcre\u00e7leri bulmak i\u00e7in kullanabilirsiniz.<\/p>\nSELECT pid, name, path, cmdline, start_time FROM processes WHERE start_time > (strftime('%s', 'now') - 300);<\/code><\/pre>\n
\n * Y\u00fcksek CPU\/Bellek Kullanan S\u00fcre\u00e7ler:<\/strong><\/p>\nSELECT pid, name, resident_size, total_size, user_time, system_time FROM processes ORDER BY resident_size DESC LIMIT 10;<\/code><\/pre>\n
\n * \u015e\u00fcpheli Yollardan \u00c7al\u0131\u015fan S\u00fcre\u00e7ler:<\/strong> K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar genellikle \/tmp<\/code> veya \/dev\/shm<\/code> gibi ge\u00e7ici dizinlerden \u00e7al\u0131\u015f\u0131r.<\/p>\nSELECT pid, name, path, cmdline FROM processes WHERE path LIKE '\/tmp\/%' OR path LIKE '\/dev\/shm\/%';<\/code><\/pre>\nSELECT path, filename, uid, gid, mode, type FROM suid_bin;<\/code><\/pre>\nSELECT command, path, hour, minute FROM crontab;<\/code><\/pre>\nA\u011f Aktivitesi \u0130zleme<\/h4>\n
SELECT pid, port, protocol, address, state, process_name FROM listening_ports;<\/code><\/pre>\nSELECT local_address, remote_address, remote_port, family, protocol, pid, process_name FROM socket_open_connections;<\/code><\/pre>\nSELECT hostname, address, type, time FROM dns_cache;<\/code><\/pre>\nKullan\u0131c\u0131 ve Yetki \u0130zleme<\/h4>\n
SELECT uid, username, description, directory, shell, create_time FROM users;<\/code><\/pre>\ncreate_time<\/code> veya di\u011fer alanlardaki de\u011fi\u015fiklikleri izleyerek yeni kullan\u0131c\u0131lar\u0131n eklenip eklenmedi\u011fini veya mevcut kullan\u0131c\u0131lar\u0131n \u00f6zelliklerinin de\u011fi\u015ftirilip de\u011fi\u015ftirilmedi\u011fini tespit edebilirsiniz.<\/p>\nsudo_events<\/code> tablosu arac\u0131l\u0131\u011f\u0131yla sudo komutlar\u0131n\u0131n kullan\u0131m\u0131n\u0131 izleyebilir (e\u011fer olaylar etkinle\u015ftirildiyse).<\/p>\nSELECT uid, username, command, time FROM sudo_events;<\/code><\/pre>\nSELECT username, host, time FROM last;<\/code><\/pre>\nSistem Konfig\u00fcrasyonu ve Zafiyet Y\u00f6netimi<\/h4>\n
SELECT name, version, arch, source FROM deb_packages;<\/code><\/pre>\nSELECT address, hostnames FROM etc_hosts;<\/code><\/pre>\n\/etc\/hosts<\/code> dosyas\u0131ndaki de\u011fi\u015fiklikler, DNS zehirlenmesi veya k\u00f6t\u00fc ama\u00e7l\u0131 alan adlar\u0131n\u0131n yerel olarak \u00e7\u00f6z\u00fcmlenmesi giri\u015fimlerini g\u00f6sterebilir.<\/p>\nSELECT name, path, author, license FROM kernel_modules;<\/code><\/pre>\nosquery Konfig\u00fcrasyonu: G\u00fcvenlik \u0130zleme \u0130\u00e7in Optimizasyon<\/h3>\n
osquery.conf<\/code> yap\u0131land\u0131rma dosyas\u0131n\u0131 anlamak ve d\u00fczenlemek \u00e7ok \u00f6nemlidir. Bu dosya, osqueryd<\/code> daemon’unun nas\u0131l davranaca\u011f\u0131n\u0131, hangi sorgular\u0131 ne s\u0131kl\u0131kla \u00e7al\u0131\u015ft\u0131raca\u011f\u0131n\u0131 ve loglar\u0131 nereye g\u00f6nderece\u011fini belirler.<\/p>\nYap\u0131land\u0131rma Dosyas\u0131 (osquery.conf)<\/h4>\n
\/etc\/osquery\/osquery.conf<\/code> konumunda bulunur. Bu dosya JSON format\u0131ndad\u0131r.<\/p>\n{\n \"options\": {\n \"config_plugin\": \"filesystem\",\n \"logger_plugin\": \"filesystem\",\n \"schedule_splay_percent\": 10,\n \"disable_events\": false,\n \"enable_file_events\": true,\n \"events_expiry\": 3600,\n \"verbose\": false,\n \"pack_delimiter\": \"\/\"\n },\n \"schedule\": {\n \"users_check\": {\n \"query\": \"SELECT uid, username, description FROM users;\",\n \"interval\": 3600\n },\n \"listening_ports_check\": {\n \"query\": \"SELECT pid, port, protocol, address FROM listening_ports;\",\n \"interval\": 300\n },\n \"suid_binaries_check\": {\n \"query\": \"SELECT path, filename FROM suid_bin;\",\n \"interval\": 7200\n }\n },\n \"file_paths\": {\n \"critical_configs\": [\n \"\/etc\/passwd\",\n \"\/etc\/shadow\",\n \"\/etc\/sudoers\",\n \"\/etc\/cron.d\/%\",\n \"\/etc\/ssh\/sshd_config\"\n ],\n \"web_server_root\": [\n \"\/var\/www\/html\/%\"\n ]\n },\n \"packs\": {\n \"incident-response\": \"\/usr\/share\/osquery\/packs\/incident-response.conf\",\n \"osquery-monitoring\": \"\/usr\/share\/osquery\/packs\/osquery-monitoring.conf\"\n }\n}<\/code><\/pre>\noptions<\/code>:<\/strong> osquery daemon’unun genel davran\u0131\u015f\u0131n\u0131 kontrol eden anahtarlar\u0131 i\u00e7erir.
\n * config_plugin<\/code>: Yap\u0131land\u0131rma dosyas\u0131n\u0131n nereden y\u00fcklendi\u011fini belirtir (genellikle filesystem<\/code>).
\n * logger_plugin<\/code>: Loglar\u0131n nereye g\u00f6nderilece\u011fini belirler (filesystem<\/code>, syslog<\/code>, tls<\/code> vb.).
\n * schedule_splay_percent<\/code>: Zamanlanm\u0131\u015f sorgular\u0131n ba\u015flang\u0131\u00e7 zamanlar\u0131n\u0131 rastgele yayarak CPU y\u00fck\u00fcn\u00fc dengelemeye yard\u0131mc\u0131 olur.
\n * disable_events<\/code>: Olay tabanl\u0131 tablolar\u0131n devre d\u0131\u015f\u0131 b\u0131rak\u0131l\u0131p b\u0131rak\u0131lmayaca\u011f\u0131n\u0131 kontrol eder. false<\/code> olarak ayarlanmal\u0131d\u0131r.
\n * enable_file_events<\/code>: Dosya olaylar\u0131n\u0131n izlenmesini etkinle\u015ftirir. true<\/code> olarak ayarlanmal\u0131d\u0131r.
\n * events_expiry<\/code>: Olaylar\u0131n ne kadar s\u00fcreyle saklanaca\u011f\u0131n\u0131 belirler (saniye cinsinden).<\/p>\nschedule<\/code>:<\/strong> Periyodik olarak \u00e7al\u0131\u015ft\u0131r\u0131lacak SQL sorgular\u0131n\u0131 tan\u0131mlar. Her sorgu i\u00e7in benzersiz bir anahtar, query<\/code> (\u00e7al\u0131\u015ft\u0131r\u0131lacak SQL sorgusu) ve interval<\/code> (sorgunun ka\u00e7 saniyede bir \u00e7al\u0131\u015ft\u0131r\u0131laca\u011f\u0131) belirtilir.
\n * \u00d6rnek G\u00fcvenlik Sorgular\u0131:<\/strong>
\n * Yeni Kullan\u0131c\u0131 Tespiti:<\/strong><\/p>\n\"new_users_check\": {\n \"query\": \"SELECT uid, username, description, directory, shell FROM users WHERE create_time > (strftime('%s', 'now') - 3600);\",\n \"interval\": 3600,\n \"description\": \"Her saat yeni olu\u015fturulan kullan\u0131c\u0131lar\u0131 kontrol et.\"\n }<\/code><\/pre>\ncreate_time<\/code> alan\u0131 osquery’nin baz\u0131 versiyonlar\u0131nda olmayabilir, bu durumda users<\/code> tablosundaki di\u011fer alanlar\u0131 kullanarak (\u00f6rne\u011fin, kullan\u0131c\u0131lar\u0131n bir \u00f6nceki sorgudaki listeyle kar\u015f\u0131la\u015ft\u0131r\u0131lmas\u0131) de\u011fi\u015fiklikleri tespit etmek gerekir. osquery genellikle differential<\/code> anahtar\u0131n\u0131 kullanarak \u00f6nceki sonu\u00e7larla farklar\u0131 raporlar.<\/p>\n\"new_users_differential\": {\n \"query\": \"SELECT uid, username, description, directory, shell FROM users;\",\n \"interval\": 3600,\n \"description\": \"Kullan\u0131c\u0131 hesaplar\u0131ndaki de\u011fi\u015fiklikleri raporla.\",\n \"snapshot\": false,\n \"platform\": \"linux\",\n \"removed\": false\n }<\/code><\/pre>\nsnapshot: false<\/code> ve removed: false<\/code> ile differential sorgular, sadece yeni eklenen veya de\u011fi\u015fen sat\u0131rlar\u0131 loglar.<\/p>\n\"suid_bin_differential\": {\n \"query\": \"SELECT path, filename, uid, gid, mode FROM suid_bin;\",\n \"interval\": 86400,\n \"description\": \"SUID\/SGID bitli dosyalardaki de\u011fi\u015fiklikleri g\u00fcnl\u00fck olarak kontrol et.\",\n \"snapshot\": false,\n \"platform\": \"linux\",\n \"removed\": false\n }<\/code><\/pre>\n\"suspicious_processes\": {\n \"query\": \"SELECT pid, name, path, cmdline, uid FROM processes WHERE path LIKE '\/tmp\/%' OR path LIKE '\/dev\/shm\/%';\",\n \"interval\": 300,\n \"description\": \"Ge\u00e7ici dizinlerdeki \u015f\u00fcpheli s\u00fcre\u00e7leri her 5 dakikada bir kontrol et.\"\n }<\/code><\/pre>\nfile_paths<\/code>:<\/strong> file_events<\/code> tablosunun hangi dosya ve dizinleri izleyece\u011fini tan\u0131mlar. Wildcard (%<\/code>) kullan\u0131m\u0131yla dizinler alt\u0131ndaki t\u00fcm dosyalar izlenebilir.
\n * Kritik sistem dosyalar\u0131 (\/etc\/passwd<\/code>, \/etc\/shadow<\/code>, \/etc\/sudoers.d\/<\/code>, \/var\/log\/<\/code>)
\n * Web sunucusu k\u00f6k dizinleri (\/var\/www\/html\/<\/code>)
\n * Kullan\u0131c\u0131 ana dizinleri (\/home\/%\/.ssh\/authorized_keys<\/code>)<\/p>\npacks<\/code>:<\/strong> \u00d6nceden tan\u0131mlanm\u0131\u015f sorgu setlerini (pack’leri) i\u00e7erir. osquery, genel g\u00fcvenlik izleme, olay m\u00fcdahalesi veya uyumluluk i\u00e7in bir\u00e7ok haz\u0131r pack ile gelir. Bu pack’ler, \/usr\/share\/osquery\/packs\/<\/code> dizininde bulunur.
\n * incident-response.conf<\/code>: Olay m\u00fcdahalesi s\u0131ras\u0131nda faydal\u0131 olabilecek sorgular\u0131 i\u00e7erir.
\n * osquery-monitoring.conf<\/code>: osquery daemon’unun kendisini izlemek i\u00e7in sorgular i\u00e7erir.
\n * Bu pack’leri etkinle\u015ftirmek i\u00e7in sadece adlar\u0131n\u0131 yap\u0131land\u0131rma dosyas\u0131na eklemeniz yeterlidir.<\/p>\nosqueryd<\/code> hizmetini yeniden ba\u015flatman\u0131z gerekir:<\/p>\nsudo systemctl restart osqueryd<\/code><\/pre>\nLoglama ve Entegrasyon<\/h4>\n
\/var\/log\/osquery\/<\/code> dizinine JSON format\u0131nda yaz\u0131l\u0131r.<\/p>\nosqueryd.results.log<\/code>:<\/strong> Zamanlanm\u0131\u015f sorgular\u0131n sonu\u00e7lar\u0131n\u0131 i\u00e7erir.
\n* osqueryd.events.log<\/code>:<\/strong> Olay tabanl\u0131 tablolar\u0131n (file_events, process_events vb.) olaylar\u0131n\u0131 i\u00e7erir.<\/p>\nsyslog<\/code> sunucusuna veya TLS \u00fczerinden bir SIEM’e g\u00f6ndermek i\u00e7in de yap\u0131land\u0131r\u0131labilir.<\/p>\n\"options\": {\n \"logger_plugin\": \"syslog\",\n \"syslog_pipe_path\": \"\/dev\/log\"\n }<\/code><\/pre>\n\"options\": {\n \"logger_plugin\": \"tls\",\n \"tls_hostname\": \"your-siem-server.com\",\n \"tls_port\": 8443,\n \"tls_server_certs\": \"\/etc\/osquery\/certs\/server.pem\",\n \"tls_client_certs\": \"\/etc\/osquery\/certs\/client.pem\",\n \"tls_client_key\": \"\/etc\/osquery\/certs\/client.key\"\n }<\/code><\/pre>\nGeli\u015fmi\u015f \u0130zleme Senaryolar\u0131 ve \u0130pu\u00e7lar\u0131<\/h3>\n
Tehdit Avc\u0131l\u0131\u011f\u0131 (Threat Hunting)<\/h4>\n
\n Bir sistemde \u015f\u00fcpheli bir s\u00fcre\u00e7 (evil_process<\/code>) tespit ettiniz.
\n 1. S\u00fcrecin Detaylar\u0131n\u0131 Al\u0131n:<\/strong><\/p>\nSELECT pid, name, path, cmdline, cwd, uid, gid, start_time FROM processes WHERE name = 'evil_process';<\/code><\/pre>\nSELECT * FROM socket_open_connections WHERE pid = file_events<\/code> etkinse):<\/strong>
\n Bu t\u00fcr bir ara\u015ft\u0131rma i\u00e7in genellikle loglara bakmak gerekir, ancak file_events<\/code> tablosu do\u011frudan sorgulanabilir olmasa da, olaylar\u0131 loglar.
\n 4. S\u00fcrecin \u00dcst S\u00fcrecini (Parent Process) Bulun:<\/strong><\/p>\nSELECT p.pid, p.name, p.path, p.cmdline, p.uid, p.gid, pp.name AS parent_name, pp.path AS parent_path FROM processes p JOIN processes pp ON p.parent = pp.pid WHERE p.name = 'evil_process';<\/code><\/pre>\n