RITA v4.8 releases: Real Intelligence Threat Analytics
Real Intelligence Threat Analytics (RITA) is an open-source framework for network traffic analysis.
The framework ingests Bro Logs, and currently supports the following analysis features:
- Beaconing Detection: Search for signs of beaconing behavior in and out of your network
- DNS Tunneling Detection Search for signs of DNS based covert channels
- Blacklist Checking: Query blacklists to search for suspicious domains and hosts
- URL Length Analysis: Search for lengthy URLs indicative of malware
- Scanning Detection: Search for signs of port scans in your network
Changelog v4.8
Improvements:
- Change show-long-connections to sort by total duration instead of longest duration by @Zalgo2462 in #790
- Removal of connection count portion of beacon scoring and adjustment of skew by @lisaSW in #792
- Duration Scoring Update by @lisaSW in #793
- Update to bimodal portion of the histogram score by @lisaSW in #794
Bug Fixes:
- Improve useragent aggregation runtime for datasets with many useragents by @Zalgo2462 in #785
- Fix SSL and DNS log filtering by @Zalgo2462 in #788
- Prevent crashing due to malformed IP addresses in Zeek logs by @lisaSW in #791
- Don’t filter internal -> internal DNS traffic by @Zalgo2462 in #797
- Disable SNI connection analysis if SNI beacon analysis is disabled by @Zalgo2462 in #798
Installation
- Download the latest install.sh file from the release page
- Make the installer executable: chmod +x ./install.sh
- Run the installer: sudo ./install.sh
- Start MongoDB: sudo service mongod start
API Keys
RITA relies on the Google Safe Browsing API to check network log data for connections to known threats. An API key is required to use this service. Obtaining a key is free, and only requires a Google account.
To obtain an API key:
- Go to the Google cloud platform console.
- From the projects list, select a project or create a new one.
- If the API Manager page is not already open, open the left side menu and select the API Manager.
- On the left, choose Credentials.
- Click Create credentials and then select the API key.
- Copy this API key to the APIKey field under SafeBrowsing in the configuration file.
- On the left, choose Library.
- Search for Safe Browsing.
- Click on Google Safe Browsing API.
- Near the top, click Enable.
Use
Source: https://github.com/activecm/
