IBM Cloud Pak for Security

Cloud Pak for Security

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Checking for Log4j breach indicators in CP4S

    Posted Thu December 16, 2021 03:36 PM

    We have a client that is asking if there is a way to check the system logs of OCP4 or CP4S itself to see if there are any signs of a breach related to Log4j (CVE-2021-44228).

    Does anyone have these instructions for CP4S?

     

    US CERT published a tool here.

    Has anyone tried the following?

    Huntress Log4Shell Tool:

    https://log4shell.huntress.com/



    ------------------------------
    Suzanne Russell CISSP, CRISC, GCIH, ITIL
    Security Architect | IBM Alliance | Group Strategic Initiatives & Partnerships
    Capgemini North America | Austin Texas
    Mob.: + 1-512-913-9292
    ------------------------------


  • 2.  RE: Checking for Log4j breach indicators in CP4S

    Posted Thu May 05, 2022 04:59 PM
    I realize I am way too late here, but we have a way to check for log4shell exploits in our Kestrel Threat Hunting Language: 
    https://github.com/opencybersecurityalliance/kestrel-huntbook/blob/main/huntbooks/log4shell%20Detection.ipynb
    https://github.com/opencybersecurityalliance/kestrel-analytics/tree/release/analytics/log4shell

    Maybe we can add this "analytic" to CP4S Data Explorer in a future release (if anyone is still concerned 5 months after the disclosure).

    ------------------------------
    Paul Coccoli
    ------------------------------

    Original Message


Related Content