{"id":592,"date":"2026-03-04T15:36:50","date_gmt":"2026-03-04T07:36:50","guid":{"rendered":"https:\/\/myblog.marsrains.top\/?p=592"},"modified":"2026-05-11T15:28:42","modified_gmt":"2026-05-11T07:28:42","slug":"python%e6%a8%a1%e5%9d%97%e5%8c%96%e5%ae%9e%e7%8e%b0siem%e6%9e%b6%e6%9e%84%e4%b8%8e%e5%b7%a5%e4%bd%9c%e6%9c%ba%e5%88%b6","status":"publish","type":"post","link":"https:\/\/myblog.marsrains.top\/?p=592","title":{"rendered":"Python&amp;SO\u2014\u2014SIEM\u67b6\u6784\u4e0e\u96c6\u6210\u5e73\u53f0"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">SIEM<\/h1>\n\n\n\n<p>SIEM\uff08Security Information and Event Management\uff0c\u5b89\u5168\u4fe1\u606f\u548c\u4e8b\u4ef6\u7ba1\u7406\u7cfb\u7edf\uff09\u662f\u4e00\u79cd\u7528\u4e8e\u5b9e\u65f6\u76d1\u63a7\u3001\u68c0\u6d4b\u548c\u54cd\u5e94\u5b89\u5168\u4e8b\u4ef6\u7684\u7efc\u5408\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u3002\u5b83\u7ed3\u5408\u4e86<strong>SIM\uff08Security Information Management\uff0c\u5b89\u5168\u4fe1\u606f\u7ba1\u7406\uff09<\/strong>\u548c<strong>SEM\uff08Security Event Management\uff0c\u5b89\u5168\u4e8b\u4ef6\u7ba1\u7406\uff09<\/strong>\u7684\u529f\u80fd\uff0c\u5e2e\u52a9\u7ec4\u7ec7\u7ba1\u7406\u6d77\u91cf\u65e5\u5fd7\u6570\u636e\u3001\u8bc6\u522b\u6f5c\u5728\u5a01\u80c1\uff0c\u5e76\u81ea\u52a8\u5316\u54cd\u5e94\u6d41\u7a0b\u3002SIEM \u7cfb\u7edf\u5e7f\u6cdb\u5e94\u7528\u4e8e\u4f01\u4e1a\u5b89\u5168\u8fd0\u7ef4\u4e2d\uff0c\u5c24\u5176\u5728\u68c0\u6d4b\u5f02\u5e38\u767b\u5f55\u3001\u5165\u4fb5\u884c\u4e3a\u7b49\u65b9\u9762<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u6838\u5fc3\u67b6\u6784<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1\u3001\u6570\u636e\u91c7\u96c6\u5c42<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4ece\u5404\u4e2a\u6765\u6e90\u6536\u96c6\u65e5\u5fd7\u548c\u65f6\u95f4\u6570\u636e<\/li>\n\n\n\n<li>\u652f\u6301\u591a\u79cd\u534f\u8bae\uff0c\u5982Syslog\u3001SNMP\u3001API\u3001\u6587\u4ef6\u4f20\u8f93\u7b49\u3002\u91c7\u96c6\u5668\u90e8\u7f72\u5728\u6570\u636e\u6e90\u7aef\u6216\u96c6\u4e2d\u5f0f\u670d\u52a1\u5668\u4e0a\uff0c\u786e\u4fdd\u6570\u636e\u4f20\u8f93<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">\u673a\u5236<\/h4>\n\n\n\n<p>\u901a\u5e38\u91c7\u7528push-pull\u6df7\u5408\uff1a<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column has-pale-pink-background-color has-background is-layout-flow wp-block-column-is-layout-flow\">\n<p>Push\u6a21\u5f0f\u7531\u6570\u636e\u6e90\u4e3b\u52a8\u53d1\u9001\u65e5\u5fd7\uff0c\u9002\u5408<strong>\u5b9e\u65f6\u6027<\/strong><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column has-luminous-vivid-orange-background-color has-background is-layout-flow wp-block-column-is-layout-flow\">\n<p>Pull\u6a21\u5f0f\u7531SIEM\u670d\u52a1\u5668\u5b9a\u671f\u62c9\u53d6\uff0c\u9002\u5408<strong>\u4e91\u73af\u5883<\/strong><\/p>\n<\/div>\n<\/div>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u5728\u5f02\u5e38\u767b\u5f55\u573a\u666f\uff0c\u91c7\u96c6Windows Event Logs \u6216 Linux auth.log \u65f6\uff0c\u9700\u8981\u5904\u7406\u65e5\u5fd7\u8f6e\u8f6c\uff08log rotation\uff09\u4ee5\u907f\u514d\u6570\u636e\u4e22\u5931<\/p>\n<\/blockquote>\n\n\n\n<p>\u7f3a\u70b9\uff1a\u6570\u636e\u91cf\u5e9e\u5927\uff0c\u9700\u8981\u538b\u7f29\u4f20\u8f93\u548c\u8fc7\u6ee4\u65e0\u5173\u65e5\u5fd7\u3002Python\u4e2d\uff0c\u53ef\u4ee5\u5229\u7528<mark style=\"background-color:#f78da7\" class=\"has-inline-color\">logging\u6a21\u5757<\/mark>\u6216<mark style=\"background-color:#f78da7\" class=\"has-inline-color\">pywin32<\/mark>\u5904\u7406Windows\u65e5\u5fd7<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2\u3001\u6570\u636e\u6807\u51c6\u5316\u4e0e\u89e3\u6790\u5c42<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u628a\u4e0d\u540c\u683c\u5f0f\u7684\u539f\u59cb\u65e5\u5fd7\u8f6c\u5316\u4e3a\u7edf\u4e00\u7684\u7ed3\u6784\uff0c\u4fbf\u4e8e\u540e\u7eed\u89e3\u6790<\/li>\n\n\n\n<li>\u63d0\u53d6\u5173\u952e\u5b57\u6bb5\uff0c\u5982\u65f6\u95f4\u6233\u3001IP\u5730\u5740\u3001\u7528\u6237ID\u3001\u4e8b\u4ef6\u7c7b\u578b\u7b49<\/li>\n\n\n\n<li>\u8fc7\u6ee4\u566a\u58f0\u65e5\u5fd7\uff0c\u8fdb\u884c\u6570\u636e\u6e05\u6d17\uff0c\u9632\u6b62\u7cfb\u7edf\u8fc7\u8f7d<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">\u673a\u5236<\/h4>\n\n\n\n<p>\u7531\u4e8e\u65e5\u5fd7\u683c\u5f0f\u591a\u6837\u5316\uff08.json\u3001CEF\u3001Syslog\uff09\uff0c\u89e3\u6790\u7528\u6b63\u5219\u6216\u89e3\u6790\u5668\u3002\u63d0\u53d6\u5b57\u6bb5\u540e\uff0c\u6dfb\u52a0\u5143\u6570\u636e\uff08\u5982\u4e8b\u4ef6ID\u3001\u4e25\u91cd\u5ea6\u3001\u9891\u7387\uff09<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u8fd9\u4e00\u5c42\u548c<strong>\u5206\u6790\u5173\u8054\u5c42<\/strong>\u9ad8\u5ea6\u7ed1\u5b9a\uff0c\u540c\u65f6\u4f1a\u7275\u626f\u5230\u4e00\u4e2a\u5371\u9669\u5ea6\u9ad8\u7684\u6f5c\u5728\u653b\u51fb\u2014\u2014APT<\/p>\n\n\n\n<p>\u6ca1\u6709\u7ecf\u8fc7\u6807\u51c6\u5316\u7684\u65e5\u5fd7\u65e0\u6cd5\u5173\u8054\uff0c\u9ad8\u9891\u7684\u4e8b\u4ef6\u62a5\u544a\u53ef\u4ee5\u548cAPT\u5173\u8054\u8d77\u6765\uff0c\u9632\u6b62\u540e\u7eedAPT\u6e17\u900f\u5185\u7f51\u9020\u6210\u4e25\u91cd\u8d22\u4ea7\u635f\u5931<\/p>\n<\/blockquote>\n\n\n\n<p>Python\u5b9e\u73b0\uff1a\u7528<mark style=\"background-color:#f78da7\" class=\"has-inline-color\">re<\/mark>\u6216<mark style=\"background-color:#f78da7\" class=\"has-inline-color\">grok-py<\/mark>\u5e93\u89e3\u6790\uff0c\u7edf\u4e00schema\u5982\uff08\u201ctimestamp\u201d\uff1a\u201c\u2026\u201d\uff1b\u201cevent_type\u201d:&#8221;\u2026\u201d\uff1b\uff09\uff0c\u65b9\u4fbf\u56e2\u961f\u67e5\u770b\u548c\u8fa8\u8ba4<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3\u3001\u5b58\u50a8\u4e0e\u7d22\u5f15\u5c42<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4f7f\u7528\u6570\u636e\u5e93\u5b58\u50a8\u65e5\u5fd7\u6570\u636e\uff0c\u652f\u6301\u5feb\u901f\u67e5\u8be2\u548c\u5f52\u6863<\/li>\n\n\n\n<li>\u6570\u636e\u53ef\u4ee5\u6309\u7167\u65f6\u95f4\u5e8f\u5217\u5b58\u50a8\uff0c\u5e76\u6dfb\u52a0\u7d22\u5f15\u65b9\u4fbf\u5feb\u901f\u68c0\u7d22<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4\u3001\u5206\u6790\u4e0e\u5173\u8054\u5c42\u2014\u2014\u6838\u5fc3\u5f15\u64ce<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u53ef\u4ee5\u63a5\u5165\u5927\u6a21\u578b\uff0c\u5229\u7528\u89c4\u5219\u5f15\u64ce\u3001\u8fdb\u884c\u673a\u5668\u5b66\u4e60\u6216\u884c\u4e3a\u5206\u6790\u68c0\u6d4b\u5f02\u5e38<\/li>\n\n\n\n<li>\u89c4\u5219\u5173\u8054\uff1a\u5c06\u591a\u6b21\u767b\u5f55\u5931\u8d25\u548c\u5f02\u5e38IP\u8bbf\u95ee\u5173\u8054\u8d77\u6765\uff0c\u5224\u5b9a\u4e3a\u66b4\u529b\u7834\u89e3<\/li>\n\n\n\n<li>\u4e8b\u5b9e\u5206\u6790\uff1a\u8bbe\u7f6e\u76d1\u63a7\u9608\u503c\uff0c\u77ed\u65f6\u95f4\u5185\u767b\u5f55\u5931\u8d25\u8fde\u7eed\u8d85\u8fc7\u4e94\u6b21\u81ea\u52a8\u53d1\u9001\u8b66\u62a5<\/li>\n\n\n\n<li>\u9ad8\u7ea7SIEM\u96c6\u6210UEBA\uff08User and Entity Behavior Analytics\uff0c\u7528\u6237\u548c\u5b9e\u4f53\u884c\u4e3a\u5206\u6790\uff09\u6765\u68c0\u6d4b\u5f02\u5e38\u6a21\u5f0f<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">\u89c4\u5219\u5f15\u64ce<\/h4>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>\u7b80\u5355\u89c4\u5219\u7528if-then\uff1b\u590d\u6742\u7528CEP\uff08Complex Event Processing\uff09\u5982Esper<\/strong><\/summary>\n<p>CEP\uff08Complex Event Processing\uff09<\/p>\n\n\n\n<p><strong>\u6982\u5ff5<\/strong> <\/p>\n\n\n\n<p>Complex Event Processing\uff08\u590d\u6742\u4e8b\u4ef6\u5904\u7406\uff09\u662f\u4e00\u79cd\u5b9e\u65f6\u5904\u7406\u6280\u672f\uff0c\u5b83\u4ece\u591a\u4e2a\u4e8b\u4ef6\u6d41\uff08event streams\uff09\u4e2d\u68c0\u6d4b<strong>\u590d\u6742\u6a21\u5f0f<\/strong>\u3001<strong>\u65f6\u95f4\u76f8\u5173\u6027<\/strong>\u3001<strong>\u56e0\u679c\u5173\u7cfb<\/strong>\u6216<strong>\u8d8b\u52bf<\/strong>\uff0c\u800c\u4e0d\u662f\u53ea\u770b\u5355\u4e2a\u4e8b\u4ef6\u3002 \u5b83\u5173\u6ce8\u201c\u4e8b\u4ef6\u7684\u7ec4\u5408\u4e0e\u65f6\u5e8f\u201d\uff0c\u80fd\u8bc6\u522b\u51fa\u7b80\u5355\u89c4\u5219\u5f15\u64ce\u65e0\u6cd5\u53d1\u73b0\u7684\u9ad8\u9636\u5a01\u80c1<\/p>\n\n\n\n<p><strong>\u5178\u578b\u4ee3\u8868\u5de5\u5177<\/strong>\uff1aEsper\uff08\u5f00\u6e90 Java CEP \u5f15\u64ce\uff09\u3001Apache Flink CEP\u3001Drools Fusion\u3001IBM Operational Decision Manager \u7b49<\/p>\n\n\n\n<p><strong>\u4e3b\u8981\u4f5c\u7528<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5b9e\u65f6\u4ea7\u751f\u201c\u590d\u6742\u4e8b\u4ef6\u201d\uff08synthesized event\uff09\uff0c\u7528\u4e8e\u89e6\u53d1\u9ad8\u7ea7\u544a\u8b66<\/li>\n\n\n\n<li>\u68c0\u6d4b\u591a\u4e8b\u4ef6\u5173\u8054\u7684\u590d\u6742\u573a\u666f\uff08\u4f8b\u5982\uff1a5 \u5206\u949f\u5185 3 \u6b21\u5931\u8d25\u767b\u5f55 + \u6765\u81ea\u540c\u4e00 IP \u7684\u7aef\u53e3\u626b\u63cf + \u5f02\u5e38\u6587\u4ef6\u8bbf\u95ee\uff09<\/li>\n\n\n\n<li>\u652f\u6301\u65f6\u95f4\u7a97\u53e3\uff08sliding window\u3001tumbling window\uff09\u3001\u5e8f\u5217\u6a21\u5f0f\uff08A \u540e\u8ddf B \u4f46\u4e0d\u8ddf C\uff09\u3001\u805a\u5408\uff08\u5e73\u5747\u3001\u6700\u5927\u3001\u6700\u5c0f\uff09\u3001\u5426\u5b9a\u6a21\u5f0f\uff08\u67d0\u6bb5\u65f6\u95f4\u5185\u6ca1\u6709\u53d1\u751f\u67d0\u4e8b\u4ef6\uff09<\/li>\n<\/ul>\n\n\n\n<p><strong>\u793a\u4f8b\u573a\u666f <\/strong><\/p>\n\n\n\n<p>\u7528\u6237 A \u6b63\u5e38\u5de5\u4f5c\u65f6\u95f4\u4ece\u4e1c\u4eac\u767b\u5f55\uff0c\u7a81\u7136\u5728\u51cc\u6668\u4ece\u4fc4\u7f57\u65af IP \u767b\u5f55\uff0c\u4e14 2 \u5206\u949f\u5185\u5c1d\u8bd5\u8bbf\u95ee 10 \u4e2a\u654f\u611f\u670d\u52a1\u5668 \u2192 CEP \u53ef\u4ee5\u7528\u4e00\u6761 EPL\uff08Event Processing Language\uff09\u8bed\u53e5\u68c0\u6d4b\u8fd9\u79cd\u8de8\u65f6\u95f4\u3001\u8de8\u6765\u6e90\u7684\u6a21\u5f0f<\/p>\n<\/details>\n\n\n\n<p>\u5173\u8054\u793a\u4f8b\uff1a192.168.xxx.xxx\u5728\u4e94\u5206\u949f\u5185\u767b\u5f55\u5931\u8d25\u8d85\u8fc710\u6b21+\u7aef\u53e3\u626b\u63cf=\u9ad8\u5371\u544a\u8b66<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">ML\u96c6\u6210<\/h4>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>\u7528 UEBA \u68c0\u6d4b\u5f02\u5e38\uff08\u5982\u7528\u6237\u5e73\u65f6\u4ece US \u767b\u5f55\uff0c\u7a81\u7136\u4ece RU\uff0c\u9700\u57fa\u7ebf\u6a21\u578b\uff09<\/strong><\/summary>\n<p><strong>\u6982\u5ff5<\/strong> UEBA = <strong>User and Entity Behavior Analytics<\/strong>\uff08\u7528\u6237\u4e0e\u5b9e\u4f53\u884c\u4e3a\u5206\u6790\uff09\u3002 \u5b83\u5229\u7528<strong>\u673a\u5668\u5b66\u4e60<\/strong>\uff08\u800c\u975e\u56fa\u5b9a\u89c4\u5219\uff09\u4e3a\u6bcf\u4e2a\u7528\u6237\u3001\u4e3b\u673a\u3001IP\u3001\u5e94\u7528\u7b49\u5b9e\u4f53\u5efa\u7acb<strong>\u52a8\u6001\u884c\u4e3a\u57fa\u7ebf<\/strong>\uff08baseline\uff09\uff0c\u7136\u540e\u6301\u7eed\u76d1\u63a7\u5f53\u524d\u884c\u4e3a\u4e0e\u57fa\u7ebf\u7684\u504f\u79bb\u7a0b\u5ea6\uff0c\u68c0\u6d4b\u5f02\u5e38<\/p>\n\n\n\n<p><strong>\u6838\u5fc3\u673a\u5236<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u5b66\u4e60\u9636\u6bb5<\/strong>\uff1a\u6536\u96c6\u5386\u53f2\u6570\u636e\uff08\u767b\u5f55\u65f6\u95f4\u3001\u5730\u70b9\u3001\u8bbf\u95ee\u8d44\u6e90\u3001\u64cd\u4f5c\u9891\u7387\u7b49\uff09\uff0c\u7528 ML\uff08\u5982\u805a\u7c7b\u3001Isolation Forest\u3001Autoencoder\u3001\u7edf\u8ba1\u6a21\u578b\uff09\u6784\u5efa\u201c\u6b63\u5e38\u201d\u753b\u50cf<\/li>\n\n\n\n<li><strong>\u68c0\u6d4b\u9636\u6bb5<\/strong>\uff1a\u5b9e\u65f6\u6253\u5206\uff08risk score\uff09\uff0c\u504f\u79bb\u57fa\u7ebf\u8d8a\u8fdc\u5206\u6570\u8d8a\u9ad8<\/li>\n\n\n\n<li><strong>\u52a8\u6001\u66f4\u65b0<\/strong>\uff1a\u57fa\u7ebf\u4f1a\u968f\u65f6\u95f4\u7f13\u6162\u6f14\u5316\uff08\u4f8b\u5982\u7528\u6237\u6362\u4e86\u5de5\u4f5c\u5730\u70b9\uff09<\/li>\n<\/ol>\n\n\n\n<p><strong>\u4e3b\u8981\u4f5c\u7528<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u53d1\u73b0<strong>\u672a\u77e5\u5a01\u80c1<\/strong>\uff08zero-day\u3001\u6162\u901f APT\u3001\u4f4e\u901f\u6570\u636e\u7a83\u53d6\u3001\u5185\u90e8\u5a01\u80c1\uff09<\/li>\n\n\n\n<li>\u5f25\u8865\u89c4\u5219-based \u68c0\u6d4b\u7684\u76f2\u533a\uff08\u89c4\u5219\u5199\u4e0d\u5168\u6240\u6709\u53ef\u80fd\u653b\u51fb\uff09<\/li>\n\n\n\n<li>\u5178\u578b\u5f02\u5e38\u793a\u4f8b\uff1a\n<ul class=\"wp-block-list\">\n<li>\u7528\u6237\u5e73\u65f6\u53ea\u5728\u7f8e\u56fd\u5de5\u4f5c\u65f6\u95f4\u4ece\u516c\u53f8 VPN \u767b\u5f55\uff0c\u7a81\u7136\u4ece\u4fc4\u7f57\u65af IP \u51cc\u6668\u767b\u5f55<\/li>\n\n\n\n<li>\u8d22\u52a1\u4eba\u5458\u7a81\u7136\u5927\u91cf\u4e0b\u8f7d HR \u76ee\u5f55\u6587\u4ef6<\/li>\n\n\n\n<li>\u670d\u52a1\u5668\u5e73\u65f6\u53ea\u8dd1 Web \u670d\u52a1\uff0c\u7a81\u7136\u542f\u52a8\u6316\u77ff\u8fdb\u7a0b<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p><strong>\u5b9e\u4f8b<\/strong><\/p>\n\n\n\n<p>\u7528\u6237\u5e73\u65f6 9:00\u201318:00 \u4ece\u4e1c\u4eac IP \u767b\u5f55\u516c\u53f8\u90ae\u7bb1\uff0c\u7a81\u7136 03:00 \u4ece\u4fc4\u7f57\u65af IP \u767b\u5f55 \u2192 UEBA \u4f1a\u7ed9\u8be5\u884c\u4e3a\u6253\u9ad8\u98ce\u9669\u5206\uff0c\u751f\u6210\u5f02\u5e38\u4e8b\u4ef6\uff0c\u4f9b\u7b2c 5 \u5c42\u544a\u8b66\u3002<\/p>\n<\/details>\n\n\n\n<h3 class=\"wp-block-heading\">5\u3001\u544a\u8b66\u4e0e\u54cd\u5e94\u5c42<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u751f\u6210\u544a\u8b66\u901a\u77e5\uff0c\u4f8b\u5982\u53d1\u9001\u90ae\u4ef6\u3001SMS\u3001\u540e\u53f0\u7968\u52a1\u7cfb\u7edf<\/li>\n\n\n\n<li>\u652f\u6301\u81ea\u52a8\u5316\u54cd\u5e94\uff0c\u4f8b\u5982\u5c01\u7981IP\u6216\u811a\u672c\u5229\u7528<\/li>\n\n\n\n<li>\u63d0\u4f9b\u53ef\u89c6\u5316\u754c\u9762\u62a5\u544a\u2014\u2014\u8fde\u63a5\u4eea\u8868\u76d8\uff0c\u5c55\u793a\u4e8b\u4ef6\u3001\u5386\u53f2\u8d8b\u52bf\u5e76\u5408\u6210\u76f8\u5173\u62a5\u544a<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">\u673a\u5236<\/h4>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>\u544a\u8b66\u5206\u7ea7\uff08\u9ad8\u5371\/\u4e2d\u5371\/\u4f4e\u5371\/\u65e0\u98ce\u9669\uff09\uff0c\u96c6\u6210SOAR\u81ea\u52a8\u5316\u54cd\u5e94<\/strong><\/summary>\n<p><strong>\u6982\u5ff5<\/strong> SOAR = <strong>Security Orchestration, Automation and Response<\/strong>\uff08\u5b89\u5168\u7f16\u6392\u3001\u81ea\u52a8\u5316\u4e0e\u54cd\u5e94\uff09\u3002 \u5b83\u662f\u4e00\u4e2a<strong>\u6d41\u7a0b\u81ea\u52a8\u5316\u5e73\u53f0<\/strong>\uff0c\u628a\u5b89\u5168\u5de5\u5177\uff08SIEM\u3001EDR\u3001\u9632\u706b\u5899\u3001\u7968\u52a1\u7cfb\u7edf\u3001\u90ae\u4ef6\u7b49\uff09\u4e32\u8054\u8d77\u6765\uff0c\u901a\u8fc7\u9884\u5b9a\u4e49\u7684<strong>playbook<\/strong>\uff08\u5267\u672c\uff09\u81ea\u52a8\u6216\u534a\u81ea\u52a8\u6267\u884c\u54cd\u5e94\u52a8\u4f5c<\/p>\n\n\n\n<p><strong>\u5178\u578b\u4ee3\u8868\u5de5\u5177<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5f00\u6e90\uff1aTheHive + Cortex\uff08\u5206\u6790\u5668\uff09\u3001Shuffle\u3001Demisto\uff08\u73b0 Palo Alto XSOAR \u7684\u524d\u8eab\u5f00\u6e90\u90e8\u5206\uff09<\/li>\n\n\n\n<li>\u5546\u7528\uff1aSplunk SOAR\u3001Swimlane\u3001IBM Resilient\u3001ServiceNow SecOps \u7b49<\/li>\n<\/ul>\n\n\n\n<p><strong>\u4e3b\u8981\u4f5c\u7528<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Response<\/strong>\uff1a\u63d0\u4f9b\u6807\u51c6\u5316\u7684\u54cd\u5e94\u6d41\u7a0b\uff0c\u51cf\u5c11\u4eba\u4e3a\u9519\u8bef\uff0c\u63d0\u9ad8\u54cd\u5e94\u901f\u5ea6<\/li>\n\n\n\n<li><strong>Orchestration<\/strong>\uff1a\u628a\u5206\u6563\u5de5\u5177\u8fde\u6210\u5de5\u4f5c\u6d41<\/li>\n\n\n\n<li><strong>Automation<\/strong>\uff1a\u81ea\u52a8\u6267\u884c\u91cd\u590d\u3001\u4f4e\u4ef7\u503c\u52a8\u4f5c\uff08\u67e5 VirusTotal\u3001\u5c01 IP\u3001\u521b\u5efa Jira ticket\u3001\u9694\u79bb\u4e3b\u673a\uff09<\/li>\n<\/ul>\n\n\n\n<p><strong>\u793a\u4f8b\u573a\u666f<\/strong>\uff08TheHive \u96c6\u6210\uff09 SIEM \u68c0\u6d4b\u5230\u66b4\u529b\u7834\u89e3 \u2192 \u81ea\u52a8\u89e6\u53d1 Shuffle\/TheHive playbook\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u901a\u77e5 Slack\/\u90ae\u4ef6 + \u521b\u5efa\u5de5\u5355<\/li>\n\n\n\n<li>\u67e5 AbuseIPDB \/ VirusTotal \u8bc4\u5206<\/li>\n\n\n\n<li>\u5982\u679c\u5206\u6570\u9ad8 \u2192 \u81ea\u52a8\u521b\u5efa TheHive Case<\/li>\n\n\n\n<li>\u81ea\u52a8\u8c03\u7528 Cortex Analyzer \u5206\u6790 IP<\/li>\n\n\n\n<li>\u81ea\u52a8\u901a\u8fc7 API \u8ba9\u9632\u706b\u5899\u5c01\u7981 IP<\/li>\n<\/ol>\n<\/details>\n\n\n\n<h4 class=\"wp-block-heading\">\u96c6\u6210<\/h4>\n\n\n\n<p>Python\u53ef\u8c03\u7528\u5916\u90e8API\uff08Slack for\u901a\u77e5\u3001iptables for\u5c01\u7981\uff09<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6\u3001\u7ba1\u7406\u4e0e\u5408\u89c4\u5c42<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u914d\u7f6e\u89c4\u5219\u3001\u7528\u6237\u8bbf\u95ee\u63a7\u5236\u3001\u5ba1\u8ba1\u65e5\u5fd7<\/li>\n\n\n\n<li>\u786e\u4fdd\u7b26\u5408\u6cd5\u89c4\uff0c\u6cd5\u89c4\u5305\u62ec\u4e14\u4e0d\u9650\u4e8eGDPR\u3001HIPAA<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u5de5\u4f5c\u673a\u5236<\/h2>\n\n\n\n<p>SIEM\u91c7\u7528\u95ed\u73af\u6d41\u7a0b\u7684\u5de5\u4f5c\u673a\u5236\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u91c7\u96c6\u4e0e\u4f20\u8f93\uff1a\u6570\u636e\u6e90\u751f\u6210\u65e5\u5fd7\uff0c\u91c7\u96c6\u5668\u63a8\u9001\u6216\u62c9\u53d6\u6570\u636e\u5230\u4e2d\u592e\u670d\u52a1\u5668<\/li>\n\n\n\n<li>\u5904\u7406\u4e0e\u5206\u6790\uff1a\u65e5\u5fd7\u8fdb\u5165\u7ba1\u9053\uff0c\u7ecf\u8fc7\u5206\u6790\u3001\u6807\u51c6\u5316\u540e\u8fdb\u5165\u89c4\u5219\u5f15\u64ce\n<ul class=\"wp-block-list\">\n<li>\u89e6\u53d1\u89c4\u5219\u5339\u914d\u65f6\u95f4\u4f1a\u8bc6\u522b\u4e8b\u4ef6<\/li>\n\n\n\n<li>\u89e6\u53d1\u76f8\u5173\u8054\u4e8b\u4ef6\u4f1a\u63d0\u5347\u4f18\u5148\u7ea7<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>\u68c0\u6d4b\u5f02\u5e38\uff1a\u9488\u5bf9\u5f02\u5e38\u767b\u5f55\uff0c\u673a\u5236\u5305\u62ec\uff1a\n<ul class=\"wp-block-list\">\n<li>\u9608\u503c\u68c0\u6d4b\uff1a1\u5206\u949f\u51853\u6b21\u767b\u5f55\u5931\u8d25<\/li>\n\n\n\n<li>\u5730\u7406\u4f4d\u7f6e\u68c0\u67e5\uff1a\u767b\u5f55IP\u4e0d\u5339\u914d\u5386\u53f2\u4f4d\u7f6e<\/li>\n\n\n\n<li>\u884c\u4e3a\u57fa\u7ebf\uff1a\u63a5\u5165\u5927\u6a21\u578b\u5b66\u4e60\u5386\u53f2\u6d4f\u89c8\u884c\u4e3a\uff0c\u6bd4\u5bf9\u5f53\u524d\u884c\u4e3a\u548c\u5386\u53f2\u884c\u4e3a\u5dee\u5f02<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>\u544a\u8b66\u751f\u6210\uff1a\u4e00\u65e6\u68c0\u6d4b\u5230\u5a01\u80c1\uff0c\u751f\u6210\u4e8b\u4ef6\u7968\u636e\uff08Ticket\uff09\uff0c\u901a\u77e5\u5b89\u5168\u56e2\u961f\u3002\u4e25\u91cd\u4e8b\u4ef6\u53ef\u89e6\u53d1SOAR\uff08Security Orchestration, Automation and Response\uff09\u81ea\u52a8\u5316\u54cd\u5e94\u3002<\/li>\n\n\n\n<li>\u56de\u987e\u548c\u4f18\u5316\uff1a\u901a\u8fc7forensic\u5206\u6790\u5386\u53f2\u6570\u636e\uff0c\u4f18\u5316\u68c0\u6d4b\uff0c\u51cf\u5c11\u8bef\u62a5\uff08False Positives\uff09<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-merpress-mermaidjs diagram-source-mermaid\"><pre class=\"mermaid\">graph TB\nA((\u91c7\u96c6\u4e0e\u4f20\u8f93))\nB[\u5904\u7406\u4e0e\u5206\u6790]\nC[\u68c0\u6d4b\u5f02\u5e38]\nD[\u544a\u8b66\u751f\u6210]\nE((\u56de\u987e\u548c\u4f18\u5316))\nA--\u63a8\u9001\u5230\u670d\u52a1\u5668-->B\nB--\u65e5\u5fd7\u8fdb\u5165\u7ba1\u9053-->C\nC--\u89c4\u5219\u5339\u914d\u3001\u9608\u503c\u68c0\u6d4b\u3001\u884c\u4e3a\u5339\u914d-->D\nD--\u751f\u6210\u7968\u636e\uff0c\u544a\u77e5\u56e2\u961f-->E\nE--\u6a21\u578b\u5b66\u4e60\u3001\u5206\u6790\u5386\u53f2-->A<\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Python\u6a21\u5757\u793a\u4f8b<\/h2>\n\n\n\n<p>\u73b0\u5047\u8bbe\u9700\u8981\u5f00\u53d1\u4e00\u4e2a\u6a21\u5757\u6765\u76d1\u63a7Linux\u7cfb\u7edf\u4e0b\u7684<mark style=\"background-color:#ff6900\" class=\"has-inline-color\"><strong><code>\/var\/log\/auth.log<\/code><\/strong><\/mark>\u6587\u4ef6\uff0c\u5b9e\u65f6\u91c7\u96c6\u65e5\u5fd7\uff0c\u68c0\u6d4b\u5f02\u5e38\u767b\u5f55\uff0c\u5e76\u901a\u8fc7\u90ae\u4ef6\u53d1\u9001\u544a\u8b66<\/p>\n\n\n\n<p>\u8fd9\u4e2a\u5b9e\u4f8b\u4f7f\u7528Python\u6807\u51c6\u5e93\u548c\u5c11\u91cf\u5185\u7f6e\u6a21\u5757\uff08\u5982<mark style=\"background-color:#f78da7\" class=\"has-inline-color\"><strong>re<\/strong><\/mark>\u7528\u4e8e\u89e3\u6790\u3001<mark style=\"background-color:#f78da7\" class=\"has-inline-color\"><strong>smtplib<\/strong><\/mark>\u7528\u4e8e\u90ae\u4ef6\uff09\u91c7\u7528\u6587\u4ef6\u5c3e\u968f\uff08tailing\uff09\u673a\u5236\u6a21\u62df\u5b9e\u65f6\u91c7\u96c6\uff08\u7c7b\u4f3clinux\u7684tail -f\u547d\u4ee4\uff09\uff0c\u907f\u514d\u4f9d\u8d56\u5916\u90e8\u5e93<\/p>\n\n\n\n<p>\u4ee3\u7801\u793a\u4f8b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import re\nimport time\nimport smtplib\nfrom email.mime.text import MIMEText # \u7528\u4e8e\u6784\u5efa\u90ae\u4ef6\u5185\u5bb9\nfrom collections import defaultdict # \u7528\u4e8e\u5b58\u50a8\u767b\u5f55\u5931\u8d25\u7684\u65f6\u95f4\u6233\u5217\u8868\nfrom datetime import datetime, timedelta # \u7528\u4e8e\u5904\u7406\u65f6\u95f4\u7a97\u53e3\n\n# \u914d\u7f6e\u53c2\u6570\nLOG_FILE = '\/var\/log\/auth.log'  # \u66ff\u6362\u4e3a\u5b9e\u9645\u65e5\u5fd7\u8def\u5f84\uff08\u9700\u8bfb\u6743\u9650\uff09\nALERT_THRESHOLD = 3  # \u5931\u8d25\u767b\u5f55\u9608\u503c\nTIME_WINDOW = timedelta(minutes=1)  # \u65f6\u95f4\u7a97\u53e3\nSMTP_SERVER = 'smtp.example.com'  # \u66ff\u6362\u4e3a\u4f60\u7684 SMTP \u670d\u52a1\u5668\nSMTP_PORT = 587 # \u66ff\u6362\u4e3a\u4f60\u7684 SMTP \u7aef\u53e3\nSENDER_EMAIL = 'alert@example.com' # \u66ff\u6362\u4e3a\u4f60\u7684\u53d1\u9001\u90ae\u7bb1\nSENDER_PASSWORD = 'your_password' # \u66ff\u6362\u4e3a\u4f60\u7684\u53d1\u9001\u90ae\u7bb1\u5bc6\u7801\nRECIPIENT_EMAIL = 'admin@example.com' # \u66ff\u6362\u4e3a\u4f60\u7684\u63a5\u6536\u90ae\u7bb1\n\n# \u6b63\u5219\u8868\u8fbe\u5f0f\u89e3\u6790 sshd \u767b\u5f55\u65e5\u5fd7\uff08\u793a\u4f8b\uff1aFailed password for user from IP\uff09\nFAILED_LOGIN_PATTERN = re.compile(r'Failed password for (\\w+) from (&#91;\\d.]+) port \\d+ ssh2')\nSUCCESS_LOGIN_PATTERN = re.compile(r'Accepted password for (\\w+) from (&#91;\\d.]+) port \\d+ ssh2')\n\nclass LoginTracker: # \u8ffd\u8e2a\u767b\u5f55\u5931\u8d25\u7684\u7c7b\n    def __init__(self):\n        self.failures = defaultdict(list)  # IP -&gt; list of failure timestamps\n\n    def process_log_line(self, line):\n        failed_match = FAILED_LOGIN_PATTERN.search(line)\n        if failed_match: # \u5982\u679c\u5339\u914d\u5230\u5931\u8d25\u767b\u5f55\n            user, ip = failed_match.groups()\n            now = datetime.now() # \u5f53\u524d\u65f6\u95f4\n            self.failures&#91;ip].append(now) # \u8bb0\u5f55\u5931\u8d25\u65f6\u95f4\n            # \u6e05\u7406\u8fc7\u671f\u8bb0\u5f55\n            self.failures&#91;ip] = &#91;t for t in self.failures&#91;ip] if now - t &lt; TIME_WINDOW] # \u4fdd\u7559\u65f6\u95f4\u7a97\u53e3\u5185\u7684\u8bb0\u5f55\n            # \u68c0\u67e5\u9608\u503c\n            if len(self.failures&#91;ip]) &gt;= ALERT_THRESHOLD:\n                self.send_alert(ip, user, len(self.failures&#91;ip]))\n                self.failures&#91;ip] = &#91;]  # \u91cd\u7f6e\u8ba1\u6570\u4ee5\u907f\u514d\u91cd\u590d\u544a\u8b66\n\n        success_match = SUCCESS_LOGIN_PATTERN.search(line)\n        if success_match:\n            user, ip = success_match.groups()\n            print(f\"Successful login: User {user} from {ip}\")\n\n    def send_alert(self, ip, user, count): # \u53d1\u9001\u544a\u8b66\u90ae\u4ef6\n        msg = MIMEText(f\"Abnormal login detected: {count} failed attempts for user {user} from IP {ip}\") # \u90ae\u4ef6\u5185\u5bb9\n        msg&#91;'Subject'] = 'Security Alert: Abnormal Login'\n        msg&#91;'From'] = SENDER_EMAIL # \u90ae\u4ef6\u53d1\u9001\u8005\n        msg&#91;'To'] = RECIPIENT_EMAIL # \u90ae\u4ef6\u63a5\u6536\u8005\n\n        try: # \u8fde\u63a5 SMTP \u670d\u52a1\u5668\u5e76\u53d1\u9001\u90ae\u4ef6\n            server = smtplib.SMTP(SMTP_SERVER, SMTP_PORT) # \u8fde\u63a5 SMTP \u670d\u52a1\u5668\n            server.starttls() # \u542f\u7528 TLS\n            server.login(SENDER_EMAIL, SENDER_PASSWORD) # \u767b\u5f55 SMTP \u670d\u52a1\u5668\n            server.sendmail(SENDER_EMAIL, RECIPIENT_EMAIL, msg.as_string())\n            server.quit()\n            print(\"Alert sent successfully\") \n        except Exception as e:\n            print(f\"Failed to send alert: {e}\")\n\ndef tail_log_file(file_path): # \u5b9e\u65f6\u8bfb\u53d6\u65e5\u5fd7\u6587\u4ef6\n    with open(file_path, 'r') as f:\n        # \u79fb\u52a8\u5230\u6587\u4ef6\u672b\u5c3e\n        f.seek(0, 2) \n        while True:\n            line = f.readline()\n            if not line:\n                time.sleep(0.1)  # \u8f6e\u8be2\u95f4\u9694\n                continue\n            yield line.strip() # \u8fd4\u56de\u65b0\u884c\n\n# \u4e3b\u51fd\u6570\nif __name__ == '__main__':\n    tracker = LoginTracker()\n    print(\"Starting log monitoring...\")\n    for line in tail_log_file(LOG_FILE): # \u5904\u7406\u6bcf\u4e00\u884c\u65e5\u5fd7\n        tracker.process_log_line(line) # \u89e3\u6790\u65e5\u5fd7\u884c\u5e76\u66f4\u65b0\u767b\u5f55\u72b6\u6001<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Python\u4ee3\u7801\u7247\u6bb5\u793a\u4f8b<\/h2>\n\n\n\n<p>SIEM\u7684\u6838\u5fc3\u67b6\u6784\u901a\u5e38\u88ab\u63cf\u8ff0\u4e3a\u5206\u5c42\u7ba1\u9053\uff08pipeline\uff09\u5f0f\u7ed3\u6784\uff0c\u4ece\u903b\u8f91\u4e0a\u770b\uff0c\u516d\u5c42\u67b6\u6784\u6bcf\u5c42\u5b9e\u73b0\u7684\u6a21\u5757\u5206\u522b\u72ec\u7acb\u8fd0\u884c\u540e\u4ea4\u7ed9\u4e0b\u4e00\u5c42\uff0c\u7ecf\u8fc7\u95ed\u73af\u6d41\u7a0b\u5b9e\u73b0\u8bb0\u5f55\u3001\u7edf\u4e00\u3001\u5b58\u50a8\u3001\u5206\u6790\u3001\u54cd\u5e94\u3001\u4f18\u5316\u3002\u4f46\u4ece\u5b9e\u9645\u7cfb\u7edf\u8fd0\u884c\u4e2d\uff0c\u8fd9\u4e9b\u5c42\u90fd\u662f\u9ad8\u5ea6\u5e76\u884c\u3001\u5f02\u6b65\u3001\u6d41\u5f0f\u5904\u7406\uff0c\u5373\u540c\u4e00\u65f6\u523b\u6210\u5343\u4e0a\u4e07\u5404\u4e8b\u4ef6\u5728\u4e0d\u540c\u5c42\u3001\u4e0d\u540c\u8282\u70b9\u540c\u65f6\u88ab\u5904\u7406\u3002\u4e0b\u9762\u5c06\u9488\u5bf9\u5404\u5c42\u5355\u72ec\u7528\u4ee3\u7801\u4e3e\u4f8b\u89e3\u91ca\uff1a<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u6570\u636e\u91c7\u96c6\u5c42\uff08Data Collection \/ Ingestion\uff09<\/h3>\n\n\n\n<p>\u8d1f\u8d23\u4ece\u5404\u79cd\u6e90\u5934\u5b9e\u65f6\/\u6279\u91cf\u62c9\u53d6\u6216\u63a5\u6536\u65e5\u5fd7\uff0c<strong>\u5178\u578b\u7684\u5b9e\u73b0\u65b9\u5f0f<\/strong>\u6709\uff1a<\/p>\n\n\n\n<p>\u6587\u4ef6tail\u3001Syslog UDP\/TCP\u63a5\u6536\u3001Beats\/Filebeat\u3001API polling\u7b49<\/p>\n\n\n\n<div class=\"wp-block-argon-collapse collapse-block shadow-sm collapsed hide-border-left\" style=\"border-left-color:#ffffff00\"><div class=\"collapse-block-title\" style=\"background-color:#ffffff00\"><span class=\"collapse-block-title-inner\"><strong>Python\u793a\u4f8b<\/strong>\uff08\u6587\u4ef6tail+\u7b80\u5355Syslog UDP\u670d\u52a1\u5668\uff09<\/span><i class=\"collapse-icon fa fa-angle-down\"><\/i><\/div><div class=\"collapse-block-body\" style=\"display: none\"><code># collector.py - \u91c7\u96c6\u5c42\u793a\u4f8b<br>import socket<br>import threading<br>from pathlib import Path<br>import time<br><br>def tail_file(log_path: str, callback): # \u5b9a\u4e49\u4e00\u4e2a\u51fd\u6570\u6765\u6a21\u62df tail -f \u529f\u80fd\uff0c\u5b9e\u65f6\u8bfb\u53d6\u65e5\u5fd7\u6587\u4ef6\u5e76\u8c03\u7528\u56de\u8c03\u51fd\u6570\u5904\u7406\u65b0\u884c<br>    \"\"\"\u6a21\u62df tail -f\"\"\"<br>    path = Path(log_path)<br>    last_size = path.stat().st_size # \u83b7\u53d6\u6587\u4ef6\u521d\u59cb\u5927\u5c0f\uff0c\u4ee5\u4fbf\u540e\u7eed\u8bfb\u53d6\u65b0\u589e\u5185\u5bb9<br>    while True:<br>        time.sleep(0.2)<br>        current_size = path.stat().st_size # \u83b7\u53d6\u5f53\u524d\u6587\u4ef6\u5927\u5c0f\uff0c\u5982\u679c\u6709\u65b0\u589e\u5185\u5bb9\uff0c\u5219\u8bfb\u53d6\u65b0\u589e\u90e8\u5206\u5e76\u8c03\u7528\u56de\u8c03\u51fd\u6570\u5904\u7406<br>        if current_size > last_size: # \u5982\u679c\u6587\u4ef6\u6709\u65b0\u589e\u5185\u5bb9\uff0c\u5219\u8bfb\u53d6\u65b0\u589e\u90e8\u5206\u5e76\u8c03\u7528\u56de\u8c03\u51fd\u6570\u5904\u7406<br>            with open(path, 'r') as f:<br>                f.seek(last_size) # \u79fb\u52a8\u6587\u4ef6\u6307\u9488\u5230\u4e0a\u6b21\u8bfb\u53d6\u7684\u4f4d\u7f6e<br>                new_lines = f.readlines()<br>                for line in new_lines: # \u5904\u7406\u6bcf\u4e00\u884c\u65b0\u589e\u65e5\u5fd7\uff0c\u8c03\u7528\u56de\u8c03\u51fd\u6570<br>                    callback(line.strip()) # \u53bb\u9664\u884c\u672b\u7684\u6362\u884c\u7b26\u5e76\u8c03\u7528\u56de\u8c03\u51fd\u6570<br>            last_size = current_size<br><br>def start_syslog_udp_server(port=514, callback=None): # \u5b9a\u4e49\u4e00\u4e2a\u51fd\u6570\u6765\u542f\u52a8\u4e00\u4e2a\u7b80\u5355\u7684 UDP Syslog \u670d\u52a1\u5668\uff0c\u76d1\u542c\u6307\u5b9a\u7aef\u53e3\u5e76\u8c03\u7528\u56de\u8c03\u51fd\u6570\u5904\u7406\u63a5\u6536\u5230\u7684\u65e5\u5fd7\u6d88\u606f<br>    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) # \u521b\u5efa\u4e00\u4e2a UDP \u5957\u63a5\u5b57<br>    sock.bind(('0.0.0.0', port))<br>    print(f\"Syslog UDP listening on :{port}\")<br>    while True:<br>        data, addr = sock.recvfrom(4096) # \u63a5\u6536 UDP \u6d88\u606f<br>        line = data.decode('utf-8', errors='ignore').strip() # \u89e3\u7801\u6d88\u606f\u5e76\u53bb\u9664\u884c\u672b\u7684\u6362\u884c\u7b26<br>        if callback:<br>            callback(line) # \u8c03\u7528\u56de\u8c03\u51fd\u6570\u5904\u7406\u63a5\u6536\u5230\u7684\u65e5\u5fd7\u6d88\u606f<br><br># \u4f7f\u7528\u793a\u4f8b<br>if __name__ == \"__main__\": # \u5b9a\u4e49\u4e00\u4e2a\u7b80\u5355\u7684\u56de\u8c03\u51fd\u6570\u6765\u6253\u5370\u91c7\u96c6\u5230\u7684\u65e5\u5fd7\u884c<br>    def print_line(line):<br>        print(f\"[\u91c7\u96c6] {line}\") <br><br>    # \u542f\u52a8\u6587\u4ef6 tail<br>    threading.Thread(target=tail_file, args=(\"\/var\/log\/auth.log\", print_line), daemon=True).start()<br><br>    # \u542f\u52a8 UDP Syslog \u63a5\u6536\uff08\u53ef\u9009\uff09<br>    # threading.Thread(target=start_syslog_udp_server, args=(514, print_line), daemon=True).start()<br><br>    while True:<br>        time.sleep(10) # \u4e3b\u7ebf\u7a0b\u4fdd\u6301\u8fd0\u884c\uff0c\u91c7\u96c6\u7ebf\u7a0b\u5728\u540e\u53f0\u5de5\u4f5c # \u53ef\u4ee5\u6839\u636e\u9700\u8981\u6dfb\u52a0\u66f4\u591a\u7684\u91c7\u96c6\u65b9\u5f0f\uff0c\u5982 TCP Syslog\u3001API \u91c7\u96c6\u7b49<\/code><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u6570\u636e\u6807\u51c6\u5316\u4e0e\u89e3\u6790\u5c42\uff08Normalization &amp; Parsing\uff09<\/h3>\n\n\n\n<p>\u628a\u539f\u59cb\u65e5\u5fd7\u8f6c\u5316\u6210\u540c\u4e00\u7ed3\u6784\uff0c\u63d0\u53d6\u5173\u952e\u5b57\u6bb5<\/p>\n\n\n\n<p><strong>\u5178\u578b\u5b9e\u73b0\u65b9\u5f0f\uff1a<\/strong>\u6b63\u5219\/Grok\/CEF\/JSON schema\u6620\u5c04<\/p>\n\n\n\n<div class=\"wp-block-argon-collapse collapse-block shadow-sm collapsed hide-border-left\" style=\"border-left-color:#ffffff00\"><div class=\"collapse-block-title\" style=\"background-color:#ffffff00\"><span class=\"collapse-block-title-inner\"><strong>Python\u5b9e\u4f8b<\/strong>\uff08\u7b80\u5355\u6b63\u5219 + CEF-like \u8f93\u51fa\uff09<\/span><i class=\"collapse-icon fa fa-angle-down\"><\/i><\/div><div class=\"collapse-block-body\" style=\"display: none\"><code># parser.py<br>import re<br>import json<br>from datetime import datetime<br><br># \u793a\u4f8b\uff1asshd \u5931\u8d25\u767b\u5f55\u6b63\u5219<br>FAIL_PATTERN = re.compile(r'Failed password for (\\S+) from ([\\d.]+) port \\d+ ssh2')<br><br>def parse_line(raw_line: str) -> dict | None: # \u89e3\u6790\u65e5\u5fd7\u884c\uff0c\u63d0\u53d6\u4e8b\u4ef6\u4fe1\u606f<br>    ts = datetime.utcnow().isoformat() + \"Z\"  # \u5b9e\u9645\u5e94\u4ece\u65e5\u5fd7\u63d0\u53d6\u65f6\u95f4<br>    event = {<br>        \"timestamp\": ts,<br>        \"raw\": raw_line,<br>        \"source\": \"auth.log\",<br>        \"event_type\": \"unknown\"<br>    }<br><br>    m = FAIL_PATTERN.search(raw_line) # \u5339\u914d\u5931\u8d25\u767b\u5f55\u4e8b\u4ef6<br>    if m:<br>        user, src_ip = m.groups()<br>        event.update({<br>            \"event_type\": \"authentication_failure\",<br>            \"user\": user,<br>            \"src_ip\": src_ip,<br>            \"severity\": \"medium\",<br>            \"category\": \"authentication\"<br>        })<br>        return event<br><br>    # \u53ef\u7ee7\u7eed\u6dfb\u52a0\u6210\u529f\u767b\u5f55\u3001sudo\u3001cron \u7b49\u591a\u79cd\u6a21\u5f0f...<br>    return None  # \u5ffd\u7565\u4e0d\u5173\u5fc3\u7684\u65e5\u5fd7<br><br># \u4f7f\u7528\u793a\u4f8b<br>if __name__ == \"__main__\": # \u6d4b\u8bd5\u89e3\u6790\u529f\u80fd<br>    test_lines = [<br>        'Sep  4 10:15:23 server sshd[1234]: Failed password for invalid user admin from 192.168.1.100 port 12345 ssh2',<br>        'Sep  4 10:16:01 server sshd[5678]: Accepted password for rain from 203.0.113.50 port 54321 ssh2'<br>    ]<br>    for line in test_lines:<br>        parsed = parse_line(line) # \u89e3\u6790\u65e5\u5fd7\u884c,\u8f93\u51fa\u7ed3\u679c<br>        if parsed:<br>            print(json.dumps(parsed, indent=2, ensure_ascii=False))<\/code><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u5b58\u50a8\u4e0e\u7d22\u5f15\u5c42\uff08Storage &amp; Indexing\uff09<\/h3>\n\n\n\n<p>\u628a\u89e3\u6790\u540e\u7684\u4e8b\u4ef6\u5b58\u4e0b\u6765\uff0c\u652f\u6301\u5feb\u901f\u68c0\u7d22\u3002<\/p>\n\n\n\n<p><strong>\u5178\u578b\u5b9e\u73b0\u65b9\u5f0f<\/strong>\uff1aElasticsearch\u3001OpenSearch\u3001ClickHouse\u3001PostgreSQL + TimescaleDB\u3001SQLite\uff08\u539f\u578b\uff09\u3002<\/p>\n\n\n\n<div class=\"wp-block-argon-collapse collapse-block shadow-sm collapsed hide-border-left\" style=\"border-left-color:#ffffff00\"><div class=\"collapse-block-title\" style=\"background-color:#ffffff00\"><span class=\"collapse-block-title-inner\"><strong>Python \u793a\u4f8b<\/strong>\uff08\u4f7f\u7528 SQLite + \u7b80\u5355\u65f6\u95f4\u5206\u533a\u8868\uff09<\/span><i class=\"collapse-icon fa fa-angle-down\"><\/i><\/div><div class=\"collapse-block-body\" style=\"display: none\"><code># storage.py<br>import sqlite3<br>import json<br><br>from parser import parse_line  # \u4ece parser \u6a21\u5757\u5bfc\u5165\u89e3\u6790\u51fd\u6570<br>from datetime import datetime<br><br>DB_PATH = \"siem_events.db\"<br><br>def init_db(): # \u521d\u59cb\u5316\u6570\u636e\u5e93\uff0c\u521b\u5efa\u4e8b\u4ef6\u8868<br>    conn = sqlite3.connect(DB_PATH)<br>    conn.execute(\"\"\"<br>    CREATE TABLE IF NOT EXISTS events (<br>        id INTEGER PRIMARY KEY AUTOINCREMENT,<br>        timestamp TEXT,<br>        event_type TEXT,<br>        src_ip TEXT,<br>        user TEXT,<br>        severity TEXT,<br>        raw TEXT,<br>        json_data TEXT<br>    )<br>    \"\"\")<br>    conn.commit()<br>    return conn<br><br>def store_event(event: dict): # \u5b58\u50a8\u4e8b\u4ef6\u5230\u6570\u636e\u5e93<br>    conn = sqlite3.connect(DB_PATH) # \u8fde\u63a5\u6570\u636e\u5e93<br>    conn.execute(\"\"\"<br>    INSERT INTO events (timestamp, event_type, src_ip, user, severity, raw, json_data) <br>    VALUES (?, ?, ?, ?, ?, ?, ?) # \u4f7f\u7528\u53c2\u6570\u5316\u67e5\u8be2\u9632\u6b62 SQL \u6ce8\u5165<br>    \"\"\", ( <br>        event[\"timestamp\"],<br>        event.get(\"event_type\"),<br>        event.get(\"src_ip\"),<br>        event.get(\"user\"),<br>        event.get(\"severity\"),<br>        event[\"raw\"],<br>        json.dumps(event)<br>    )) # \u5c06\u4e8b\u4ef6\u5b57\u5178\u8f6c\u6362\u4e3a JSON \u5b58\u50a8<br>    conn.commit()<br>    conn.close()<br><br># \u4f7f\u7528\u793a\u4f8b\uff1a\u7ed3\u5408 parser<br>if __name__ == \"__main__\":<br>    init_db()<br>    sample_event = parse_line(\"Failed password for test from 1.2.3.4 port 22 ssh2\") # \u4ece parser \u5bfc\u5165\u89e3\u6790\u51fd\u6570\uff0c\u89e3\u6790\u793a\u4f8b\u65e5\u5fd7\u884c<br>    if sample_event:<br>        store_event(sample_event)<\/code><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u5206\u6790\u4e0e\u5173\u8054\u5c42\uff08Analysis &amp; Correlation\uff09<\/h3>\n\n\n\n<p>\u6838\u5fc3\u68c0\u6d4b\u5f15\u64ce\uff1a\u89c4\u5219\u5339\u914d\u3001\u9608\u503c\u3001\u65f6\u95f4\u7a97\u53e3\u5173\u8054\u3001\u7b80\u5355 ML\u3002<\/p>\n\n\n\n<p><strong>\u5178\u578b\u5b9e\u73b0\u65b9\u5f0f<\/strong>\uff1a\u89c4\u5219\u5f15\u64ce\uff08Sigma\uff09\u3001CEP\u3001\u72b6\u6001\u673a\u3001ML \u5f02\u5e38\u68c0\u6d4b\u3002<\/p>\n\n\n\n<div class=\"wp-block-argon-collapse collapse-block shadow-sm collapsed hide-border-left\" style=\"border-left-color:#ffffff00\"><div class=\"collapse-block-title\" style=\"background-color:#ffffff00\"><span class=\"collapse-block-title-inner\"><strong>Python \u793a\u4f8b<\/strong>\uff08\u7b80\u5355\u6ed1\u52a8\u7a97\u53e3 + \u89c4\u5219\uff09<\/span><i class=\"collapse-icon fa fa-angle-down\"><\/i><\/div><div class=\"collapse-block-body\" style=\"display: none\"><code># analyzer.py<br>from collections import defaultdict, deque <br>from datetime import datetime, timedelta<br><br>class FailureWindow: # \u76d1\u63a7\u77ed\u65f6\u95f4\u5185\u7684\u5931\u8d25\u4e8b\u4ef6<br>    def __init__(self, threshold=5, window_sec=300): # threshold: \u5931\u8d25\u6b21\u6570\u9608\u503c, window_sec: \u65f6\u95f4\u7a97\u53e3\u957f\u5ea6\uff08\u79d2\uff09<br>        self.failures = defaultdict(lambda: deque(maxlen=100)) # \u5b58\u50a8\u6bcf\u4e2aIP\u7684\u5931\u8d25\u4e8b\u4ef6\u65f6\u95f4\u6233\uff0c\u4f7f\u7528deque\u81ea\u52a8\u4e22\u5f03\u8fc7\u65e7\u7684\u8bb0\u5f55<br>        self.threshold = threshold<br>        self.window = timedelta(seconds=window_sec) # \u8f6c\u6362\u4e3atimedelta\u5bf9\u8c61\uff0c\u65b9\u4fbf\u65f6\u95f4\u6bd4\u8f83<br><br>    def add_failure(self, ip: str, ts: datetime): # \u6dfb\u52a0\u5931\u8d25\u4e8b\u4ef6<br>        self.failures[ip].append(ts) # \u6dfb\u52a0\u5f53\u524d\u5931\u8d25\u4e8b\u4ef6\u7684\u65f6\u95f4\u6233<br>        # \u6e05\u7406\u8fc7\u671f<br>        while self.failures[ip] and ts - self.failures[ip][0] > self.window: # \u79fb\u9664\u7a97\u53e3\u5916\u7684\u65e7\u8bb0\u5f55<br>            self.failures[ip].popleft()<br><br>    def is_brute_force(self, ip: str) -> bool: # \u5224\u65ad\u662f\u5426\u8fbe\u5230\u66b4\u529b\u653b\u51fb\u7684\u6761\u4ef6<br>        if len(self.failures[ip]) >= self.threshold: # \u5982\u679c\u5f53\u524dIP\u7684\u5931\u8d25\u4e8b\u4ef6\u6570\u91cf\u8d85\u8fc7\u9608\u503c\uff0c\u8ba4\u4e3a\u53ef\u80fd\u662f\u66b4\u529b\u653b\u51fb<br>            return True<br>        return False<br><br># \u89c4\u5219\u793a\u4f8b\uff1a\u77ed\u65f6\u95f4\u591a\u6b21\u5931\u8d25\u767b\u5f55<br>analyzer = FailureWindow(threshold=4, window_sec=120)<br><br>def analyze_event(event: dict): # \u5206\u6790\u4e8b\u4ef6\uff0c\u5224\u65ad\u662f\u5426\u89e6\u53d1\u66b4\u529b\u653b\u51fb\u89c4\u5219<br>    if event.get(\"event_type\") == \"authentication_failure\": <br>        ts = datetime.fromisoformat(event[\"timestamp\"].replace(\"Z\", \"+00:00\")) # \u89e3\u6790\u65f6\u95f4\u6233\uff0c\u5904\u7406UTC\u683c\u5f0f<br>        ip = event[\"src_ip\"]<br>        analyzer.add_failure(ip, ts)<br>        if analyzer.is_brute_force(ip):<br>            return {<br>                \"alert\": True,<br>                \"type\": \"brute_force_attempt\",<br>                \"ip\": ip,<br>                \"count\": len(analyzer.failures[ip]),<br>                \"time_window\": \"2\u5206\u949f\"<br>            }<br>    return None<\/code><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u544a\u8b66\u4e0e\u54cd\u5e94\u5c42\uff08Alerting &amp; Response\uff09<\/h3>\n\n\n\n<p>\u4ea7\u751f\u544a\u8b66\u3001\u901a\u77e5\u3001\u81ea\u52a8\u5316\u52a8\u4f5c\u3002<\/p>\n\n\n\n<p><strong>\u5178\u578b\u5b9e\u73b0\u65b9\u5f0f<\/strong>\uff1a\u90ae\u4ef6\u3001Slack\/Webhook\u3001SOAR \u811a\u672c\u3001\u9632\u706b\u5899 API\u3002<\/p>\n\n\n\n<div class=\"wp-block-argon-collapse collapse-block shadow-sm collapsed hide-border-left\" style=\"border-left-color:#ffffff00\"><div class=\"collapse-block-title\" style=\"background-color:#ffffff00\"><span class=\"collapse-block-title-inner\"><strong>Python \u793a\u4f8b<\/strong>\uff08\u90ae\u4ef6 + \u7b80\u5355 iptables \u5c01\u7981\uff09<\/span><i class=\"collapse-icon fa fa-angle-down\"><\/i><\/div><div class=\"collapse-block-body\" style=\"display: none\"><code>#alerter.py<br>import smtplib<br>from email.mime.text import MIMEText<br>import subprocess<br><br>def send_email_alert(alert_data: dict, to_email=\"admin@example.com\"): # \u53d1\u9001\u544a\u8b66\u90ae\u4ef6<br>    msg = MIMEText(f\"\u9ad8\u5371\u544a\u8b66\uff1a{alert_data}\")<br>    msg['Subject'] = f\"SIEM Alert - {alert_data.get('type', '\u672a\u77e5')}\"<br>    msg['From'] = \"siem@example.com\"<br>    msg['To'] = to_email<br><br>    with smtplib.SMTP(\"smtp.example.com\", 587) as server: # \u8fde\u63a5SMTP\u670d\u52a1\u5668<br>        server.starttls()<br>        server.login(\"siem@example.com\", \"password\")<br>        server.send_message(msg)<br><br>def auto_block_ip(ip: str): # \u81ea\u52a8\u5c01\u7981IP\u5730\u5740<br>    try: <br>        # \u6ce8\u610f\uff1a\u751f\u4ea7\u73af\u5883\u9700\u8c28\u614e\uff0c\u6700\u597d\u7528 nftables \u6216\u4e13\u7528\u9632\u706b\u5899\u63a5\u53e3<br>        subprocess.run([\"sudo\", \"iptables\", \"-A\", \"INPUT\", \"-s\", ip, \"-j\", \"DROP\"], check=True, timeout=10) # \u4f7f\u7528iptables\u5c01\u7981IP\uff0c\u8bbe\u7f6e\u8d85\u65f6\u907f\u514d\u6302\u8d77<br>        print(f\"\u5df2\u81ea\u52a8\u5c01\u7981 IP: {ip}\")<br>    except Exception as e:<br>        print(f\"\u5c01\u7981\u5931\u8d25: {e}\")<br><br># \u4f7f\u7528\u793a\u4f8b<br>if __name__ == \"__main__\": # \u6a21\u62df\u63a5\u6536\u5230\u4e00\u4e2a\u9ad8\u5371\u544a\u8b66<br>    sample_alert = {\"type\": \"brute_force_attempt\", \"ip\": \"1.2.3.4\", \"count\": 7} # \u6a21\u62df\u4e00\u4e2a\u66b4\u529b\u653b\u51fb\u544a\u8b66<br>    send_email_alert(sample_alert) # \u53d1\u9001\u544a\u8b66\u90ae\u4ef6<br>    auto_block_ip(sample_alert[\"ip\"]) # \u81ea\u52a8\u5c01\u7981\u653b\u51fbIP<\/code><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u5c55\u793a\u3001\u7ba1\u7406\u4e0e\u5408\u89c4\u5c42\uff08Visualization, Management &amp; Compliance\uff09<\/h3>\n\n\n\n<p>\u4eea\u8868\u76d8\u3001\u67e5\u8be2\u3001\u62a5\u544a\u3001\u7528\u6237\u6743\u9650\u3001\u5ba1\u8ba1\u3001\u5f52\u6863\u3002<\/p>\n\n\n\n<p><strong>\u5178\u578b\u5b9e\u73b0\u65b9\u5f0f<\/strong>\uff1aKibana\/ Grafana\u3001\u81ea\u5b9a\u4e49 Flask\/Dash \u754c\u9762\u3001RBAC\u3002<\/p>\n\n\n\n<div class=\"wp-block-argon-collapse collapse-block shadow-sm collapsed hide-border-left\" style=\"border-left-color:#ffffff00\"><div class=\"collapse-block-title\" style=\"background-color:#ffffff00\"><span class=\"collapse-block-title-inner\"><strong>Python \u793a\u4f8b<\/strong>\uff08\u7b80\u5355 Flask + SQLite \u67e5\u8be2 dashboard\uff09<\/span><i class=\"collapse-icon fa fa-angle-down\"><\/i><\/div><div class=\"collapse-block-body\" style=\"display: none\"><code># dashboard.py - \u6781\u7b80 Web \u5c55\u793a<br>from flask import Flask, render_template_string<br>import sqlite3<br><br>app = Flask(__name__)<br><br>HTML = \"\"\"<br>&lt;!doctype html><br>&lt;title>SIEM Mini Dashboard&lt;\/title><br>&lt;h1>\u6700\u8fd1\u544a\u8b66\u4e8b\u4ef6&lt;\/h1><br>&lt;table border=1><br>&lt;tr>&lt;th>\u65f6\u95f4&lt;\/th>&lt;th>\u7c7b\u578b&lt;\/th>&lt;th>IP&lt;\/th>&lt;th>\u7528\u6237&lt;\/th>&lt;th>\u539f\u59cb\u65e5\u5fd7&lt;\/th>&lt;\/tr><br>{% for row in events %}<br>&lt;tr>&lt;td>{{ row[0] }}&lt;\/td>&lt;td>{{ row[1] }}&lt;\/td>&lt;td>{{ row[2] }}&lt;\/td>&lt;td>{{ row[3] }}&lt;\/td>&lt;td>{{ row[6][:100] }}&lt;\/td>&lt;\/tr><br>{% endfor %}<br>&lt;\/table><br>\"\"\"<br><br>@app.route(\"\/\") # \u9996\u9875\u663e\u793a\u6700\u8fd1\u7684\u544a\u8b66\u4e8b\u4ef6<br>def dashboard(): # \u4ece\u6570\u636e\u5e93\u8bfb\u53d6\u6700\u8fd1\u7684\u4e8b\u4ef6\u5e76\u5c55\u793a<br>conn = sqlite3.connect(\"siem_events.db\")<br>cur = conn.cursor() # \u67e5\u8be2\u6700\u8fd1\u7684\u4e8b\u4ef6<br>cur.execute(\"SELECT timestamp, event_type, src_ip, user, severity, raw FROM events ORDER BY timestamp DESC LIMIT 20\")<br>events = cur.fetchall() # \u5173\u95ed\u6570\u636e\u5e93\u8fde\u63a5<br>conn.close()<br>return render_template_string(HTML, events=events) # \u6e32\u67d3 HTML \u6a21\u677f\u5e76\u8fd4\u56de<br><br>if __name__ == \"__main__\": # \u542f\u52a8 Flask \u5e94\u7528<br>app.run(debug=True, port=5005)<br>\u4e4b\u540e\u7ec4\u5408\uff0c\u5f62\u6210\u4e00\u4e2a\u5c0f\u578b\u7ba1\u9053\uff1a<br># main.py \u793a\u4f8b\u7ec4\u5408<br>from collector import tail_file<br>from parser import parse_line<br>from storage import store_event<br>from analyzer import analyze_event<br>from alerter import send_email_alert # \u6216\u5176\u4ed6\u52a8\u4f5c<br><br>def process_line(raw): # \u5904\u7406\u6bcf\u4e00\u884c\u65e5\u5fd7<br>event = parse_line(raw)<br>if event:<br>store_event(event)<br>alert = analyze_event(event)<br>if alert and alert.get(\"alert\"):<br>send_email_alert(alert)<br><br>tail_file(\"\/var\/log\/auth.log\", process_line) # \u76d1\u63a7\u65e5\u5fd7\u6587\u4ef6\u5e76\u5904\u7406\u65b0\u884c<\/code><\/div><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">Security Onion\uff08SO\uff09<\/h1>\n\n\n\n<p>SO\u662f\u4e00\u4e2a\u5f00\u6e90\u7684\u7f51\u7edc\u5b89\u5168\u76d1\u63a7\u3001\u5a01\u80c1\u68c0\u6d4b\u4e0e\u65e5\u5fd7\u5206\u6790\u5e73\u53f0\uff0c\u5e38\u7528\u4e8e\u4f01\u4e1a\u5b89\u5168\u8fd0\u8425\u4e2d\u5fc3\uff08SOC\uff09\u3001\u5165\u4fb5\u68c0\u6d4b\u3001\u5a01\u80c1\u72e9\u730e\u548c\u5e94\u6025\u54cd\u5e94\u573a\u666f\u3002\u8be5\u5e73\u53f0\u6574\u5408\u4e86\u591a\u79cd\u5b89\u5168\u5de5\u5177\uff0c\u5e2e\u52a9\u5b89\u5168\u56e2\u961f\u96c6\u4e2d\u91c7\u96c6\u3001\u5206\u6790\u548c\u544a\u8b66\u7f51\u7edc\u6d41\u91cf\u3001\u4e3b\u673a\u65e5\u5fd7\u4ee5\u53ca\u5b89\u5168\u4e8b\u4ef6\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e3b\u8981\u529f\u80fd<\/h2>\n\n\n\n<p>\u4eceSIEM\u7684\u6838\u5fc3\u67b6\u6784\u51fa\u53d1\u4e0d\u96be\u7406\u89e3SO\u7684\u4e3b\u8981\u529f\u80fd\u548c\u8fd0\u4f5c\u65b9\u5f0f\uff1a<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. \u7f51\u7edc\u6d41\u91cf\u76d1\u63a7<\/h3>\n\n\n\n<p>Security Onion \u53ef\u4ee5\u63a5\u5165\u955c\u50cf\u6d41\u91cf\uff0c\u4f8b\u5982\u4ea4\u6362\u673a SPAN \u53e3\u3001TAP \u8bbe\u5907\u7b49\uff0c\u5bf9\u7f51\u7edc\u6570\u636e\u5305\u8fdb\u884c\u5206\u6790\u3002\u5b83\u53ef\u4ee5\u53d1\u73b0\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7aef\u53e3\u626b\u63cf<\/li>\n\n\n\n<li>\u6f0f\u6d1e\u5229\u7528\u884c\u4e3a<\/li>\n\n\n\n<li>\u6076\u610f\u8f6f\u4ef6\u901a\u4fe1<\/li>\n\n\n\n<li>C2 \u56de\u8fde<\/li>\n\n\n\n<li>\u6a2a\u5411\u79fb\u52a8<\/li>\n\n\n\n<li>\u5f02\u5e38 DNS \u8bf7\u6c42<\/li>\n\n\n\n<li>\u53ef\u7591 HTTP\/HTTPS \u884c\u4e3a<\/li>\n\n\n\n<li>\u6570\u636e\u5916\u4f20\u884c\u4e3a<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2.\u5165\u4fb5\u68c0\u6d4b<\/h3>\n\n\n\n<p>Security Onion \u652f\u6301\u57fa\u4e8e\u89c4\u5219\u7684\u5165\u4fb5\u68c0\u6d4b\u3002\u5e38\u89c1\u68c0\u6d4b\u5f15\u64ce\u5305\u62ec\uff1a<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<ul class=\"wp-block-list\">\n<li>Suricata<\/li>\n\n\n\n<li>Zeek<\/li>\n\n\n\n<li>Sigma<\/li>\n\n\n\n<li>YARA\uff0c\u90e8\u5206\u573a\u666f\u4f7f\u7528<\/li>\n\n\n\n<li>Elastic \u76f8\u5173\u67e5\u8be2\u89c4\u5219<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>\u5176\u4e2d\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Suricata \u504f\u91cd\u4e8e\u57fa\u4e8e\u7b7e\u540d\u7684\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b<\/li>\n\n\n\n<li>Zeek \u504f\u91cd\u4e8e\u7f51\u7edc\u884c\u4e3a\u5206\u6790\u548c\u534f\u8bae\u65e5\u5fd7\u89e3\u6790<\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">3.\u65e5\u5fd7\u96c6\u4e2d\u5206\u6790<\/h3>\n\n\n\n<p>Security Onion \u53ef\u4ee5\u6536\u96c6\u6765\u81ea\u591a\u79cd\u6765\u6e90\u7684\u65e5\u5fd7\uff0c\u4f8b\u5982\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Windows \u4e8b\u4ef6\u65e5\u5fd7<\/li>\n\n\n\n<li>Linux \u7cfb\u7edf\u65e5\u5fd7<\/li>\n\n\n\n<li>\u9632\u706b\u5899\u65e5\u5fd7<\/li>\n\n\n\n<li>VPN \u65e5\u5fd7<\/li>\n\n\n\n<li>DNS \u65e5\u5fd7<\/li>\n\n\n\n<li>\u4ee3\u7406\u670d\u52a1\u5668\u65e5\u5fd7<\/li>\n\n\n\n<li>EDR \u6216\u6740\u6bd2\u8f6f\u4ef6\u65e5\u5fd7<\/li>\n\n\n\n<li>\u4e91\u5e73\u53f0\u65e5\u5fd7<\/li>\n\n\n\n<li>\u5e94\u7528\u7cfb\u7edf\u65e5\u5fd7<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4.\u5a01\u80c1\u72e9\u730e<\/h3>\n\n\n\n<p>\u5b89\u5168\u5206\u6790\u5e08\u53ef\u4ee5\u901a\u8fc7 Security Onion \u7684\u754c\u9762\u67e5\u8be2\u7f51\u7edc\u548c\u4e3b\u673a\u6d3b\u52a8\u3002\u53ef\u4ee5\u8ffd\u8e2a\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u67d0\u4e2a IP \u8bbf\u95ee\u4e86\u54ea\u4e9b\u57df\u540d<\/li>\n\n\n\n<li>\u67d0\u4e2a\u4e3b\u673a\u662f\u5426\u8fde\u63a5\u8fc7\u6076\u610f IP<\/li>\n\n\n\n<li>\u67d0\u4e2a\u8d26\u6237\u662f\u5426\u5b58\u5728\u5f02\u5e38\u767b\u5f55<\/li>\n\n\n\n<li>\u67d0\u4e2a\u6587\u4ef6\u54c8\u5e0c\u662f\u5426\u51fa\u73b0\u8fc7<\/li>\n\n\n\n<li>\u67d0\u4e2a\u5185\u7f51\u4e3b\u673a\u662f\u5426\u5b58\u5728\u626b\u63cf\u884c\u4e3a<\/li>\n\n\n\n<li>\u653b\u51fb\u8005\u662f\u5426\u8fdb\u884c\u4e86\u6a2a\u5411\u79fb\u52a8<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5.\u544a\u8b66\u7ba1\u7406<\/h3>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<ul class=\"wp-block-list\">\n<li>\u67e5\u770b\u544a\u8b66\u8be6\u60c5<\/li>\n\n\n\n<li>\u5173\u8054\u4e0a\u4e0b\u6587\u4fe1\u606f<\/li>\n\n\n\n<li>\u6807\u8bb0\u4e8b\u4ef6\u72b6\u6001<\/li>\n\n\n\n<li>\u8fdb\u884c\u8c03\u67e5\u5206\u6790<\/li>\n\n\n\n<li>\u5c06\u4e8b\u4ef6\u5347\u7ea7\u4e3a Case<\/li>\n\n\n\n<li>\u5bf9\u8bef\u62a5\u8fdb\u884c\u89c4\u5219\u8c03\u6574<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>\u5de6\u4fa7\u548cSIEM\u7684\u544a\u8b66\u7ba1\u7406\u90e8\u5206\u5f88\u76f8\u4f3c\uff0c\u8fd9\u4e5f\u662f\u535a\u4e3b\u79f0\u4e4b\u4e3a\u201c\u96c6\u6210\u5f0f\u5f00\u6e90\u5b89\u5168\u76d1\u63a7\u4e0e\u5a01\u80c1\u72e9\u730e\u5e73\u53f0\u201d\u7684\u539f\u56e0<\/p>\n<\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">\u90e8\u7f72\u65b9\u5f0f<\/h2>\n\n\n\n<p>\u90e8\u7f72SO\u7684\u65f6\u5019\uff0c\u9700\u8981\u786e\u8ba4\u90e8\u7f72\u7684\u73af\u5883\u548c\u914d\u7f6e\u7684\u9ad8\u4f4e\uff0c\u907f\u514d\u9009\u62e9\u9519\u8bef\u7684\u90e8\u7f72\u65b9\u5f0f\u5bfc\u81f4\u65f6\u95f4\u6210\u672c\u589e\u52a0\u548c\u52a0\u5927\u670d\u52a1\u5668\u7684\u8d1f\u8377\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>standalone\u5355\u673a\u90e8\u7f72\u9002\u5408\u5355\u670d\u52a1\u5668\u4e0b\u7684\u5b9e\u9a8c\u73af\u5883\u4e2d\u3002\u8fd9\u6837\u505a\u7684\u4f18\u70b9\u5c31\u662f\u90e8\u7f72\u7b80\u5355\uff0c\u8fc5\u901f\uff0c\u4e0d\u9700\u8981\u7e41\u7410\u7684\u914d\u7f6e\u6b65\u9aa4\uff0c\u53ea\u9700\u8981\u6309\u7167\u9ed8\u8ba4\u914d\u7f6e\u6765\u8bbe\u7f6e\u5373\u53ef\u3002<\/li>\n\n\n\n<li>Distributed\u5206\u5e03\u5f0f\u90e8\u7f72\u9002\u5408\u4e2d\u5927\u578b\u4f01\u4e1a\u4e2d\u7684\u751f\u6210\u73af\u5883\uff0c\u52a0\u5f3a\u751f\u4ea7\u73af\u5883\u7684\u5b89\u5168\u3002\u7f3a\u70b9\u663e\u800c\u6613\u89c1\uff0c\u4f46\u662f\u4f18\u70b9\u4e5f\u5f88\u663e\u8457\uff1a\u6269\u5c55\u80fd\u529b\u5f3a\uff0c\u53ef\u4ee5\u968f\u65f6\u6839\u636e\u5b9e\u9645\u60c5\u51b5\u8c03\u6574\u4f20\u611f\u5668\u548c\u5b58\u50a8\u8282\u70b9\u7684\u6570\u91cf\u3002<\/li>\n\n\n\n<li>Sensor\u4f20\u611f\u5668\u90e8\u7f72\u4e00\u822c\u7528\u5728\u5173\u952e\u7f51\u7edc\u4f4d\u7f6e\uff0c\u901a\u8fc7\u955c\u50cf\u6d41\u91cf\u6765\u76d1\u63a7\u6570\u636e\u4f20\u8f93\u3002\u5e38\u89c1\u7684\u4f4d\u7f6e\u5c31\u6709\u4e92\u8054\u7f51\u51fa\u53e3\u3001\u670d\u52a1\u533a\u6838\u5fc3\u3001\u6570\u636e\u6838\u5fc3\u4ea4\u6362\u533a\u7b49\u3002<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b80\u5355\u7684\u4f7f\u7528\u6d41\u7a0b<\/h2>\n\n\n\n<p>SO\u4e0a\u624b\u4e5f\u5f88\u5bb9\u6613\uff0c\u4e00\u4e2a\u5178\u578b\u6d41\u7a0b\u5982\u4e0b\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u5728\u5173\u952e\u7f51\u7edc\u4f4d\u7f6e\u90e8\u7f72 Sensor<\/li>\n\n\n\n<li>\u63a5\u5165\u955c\u50cf\u6d41\u91cf<\/li>\n\n\n\n<li>\u91c7\u96c6\u4e3b\u673a\u548c\u8bbe\u5907\u65e5\u5fd7<\/li>\n\n\n\n<li>Suricata \u68c0\u6d4b\u6076\u610f\u6d41\u91cf<\/li>\n\n\n\n<li>Zeek \u751f\u6210\u7f51\u7edc\u534f\u8bae\u65e5\u5fd7<\/li>\n\n\n\n<li>Elastic \u5b58\u50a8\u548c\u7d22\u5f15\u65e5\u5fd7<\/li>\n\n\n\n<li>Security Onion Console \u5c55\u793a\u544a\u8b66<\/li>\n\n\n\n<li>\u5206\u6790\u4eba\u5458\u8c03\u67e5\u4e8b\u4ef6<\/li>\n\n\n\n<li>\u6839\u636e\u7ed3\u679c\u8c03\u6574\u89c4\u5219\u6216\u5c01\u5835\u5a01\u80c1<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">\u90e8\u7f72\u6d41\u7a0b\u793a\u4f8b<\/h2>\n\n\n\n<p>\u6ce8\uff1a\u7531\u4e8eSO\u7684\u914d\u7f6e\u811a\u672c\uff0c\u8be5\u811a\u672c\u68c0\u6d4b\u5230\u7f51\u5361\uff0c\u4f1a\u81ea\u52a8\u89e6\u53d1repo\u5f3a\u540c\u6b65\u3002\u5982\u679c\u5185\u7f51\u914d\u7f6e\u4e0d\u5f53\uff0c\u4f1a\u51fa\u73b0DNS\u89e3\u6790\u5931\u8d25\uff0c\u5bfc\u81f4\u65e0\u6cd5\u4ece\u5b98\u65b9\u4ed3\u5e93<strong>securityonion.net<\/strong>\u62c9\u53d6\u914d\u7f6e\u3002\u6240\u4ee5\u5728\u5185\u7f51\u73af\u5883\u90e8\u7f72\u7684\u65f6\u5019\uff0c\u5efa\u8bae\u9009\u62e9Airgap\u95ed\u7f51\u73af\u5883\u8fdb\u884c\u90e8\u7f72\u3002<\/p>\n\n\n\n<p>\u672c\u6b21\u793a\u4f8b\u662f\u5728Proxmox Virtual Environment\uff08PVE\uff09\u4e2d\u90e8\u7f72\uff0c\u5177\u4f53\u7684\u5b9e\u9645\u60c5\u51b5\u8bf7\u53c2\u8003\u5185\u7f51\u4e2d\u7684\u5907\u6ce8\u3002\u5728\u6b64\u53ea\u7b80\u5355\u5730\u9610\u8ff0\u6b65\u9aa4\u6d41\u7a0b\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1.\u5bfc\u5165<\/h3>\n\n\n\n<p>\u4ece<a href=\"https:\/\/github.com\/Security-Onion-Solutions\/securityonion\">https:\/\/github.com\/Security-Onion-Solutions\/securityonion<\/a>\u83b7\u53d6iso\u955c\u50cf\u6587\u4ef6\uff0c\u5bfc\u5165PVE\uff0c\u5f00\u673a\u540e\u4f1a\u81ea\u52a8\u5f00\u542f\u914d\u7f6e\u754c\u9762\u3002\u5177\u4f53\u5982\u4e0b\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-53-1024x693.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"693\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-53-1024x693.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-839\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><figcaption class=\"wp-element-caption\">\u8fd9\u662f\u524d\u9762\u9009\u62e9\u4e86standalone\u90e8\u7f72\u27a1Airgap\u79bb\u7ebf\u5b89\u88c5\u27a1\u8f93\u5165\u8d26\u6237\u540e\u7684\u754c\u9762\uff0c\u8d34\u5728\u6b64\u5904\u4ec5\u4f9b\u53c2\u8003<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">2.\u914d\u7f6e<\/h3>\n\n\n\n<p>\u6b64\u65f6\u5728\u5185\u7f51\u5355\u670d\u52a1\u5668\u73af\u5883\u4e2d\uff0c\u9009\u62e9Airgap\u95ed\u7f51\u73af\u5883\u5b89\u88c5\u3002\u540e\u7eed\u7684IP\u914d\u7f6e\u9009\u62e9\u5185\u7f51\u540c\u7f51\u6bb5\u4e0b\u7684\u6307\u5b9aIP\u4f5c\u4e3a\u7f51\u9875\u524d\u7aef\u5373\u53ef\u3002\u4e2d\u95f4\u6709\u4efb\u4f55\u4e0d\u52a8\u7684\u5730\u65b9\u53ef\u4ee5\u622a\u56fe\u8be2\u95eeLLM\u3002\u4e00\u5b9a\u8981\u8bb0\u4f4f\u6253\u597dsnapshot\uff0c\u65b9\u4fbf\u56de\u9000\u3002SO\u7684\u5b89\u88c5\u6d41\u7a0b\u5373\u4f7f\u662f\u79bb\u7ebf\u4f9d\u7136\u9700\u8981\u82b1\u8d39\u81f3\u5c1130\u5206\u949f\uff01\uff01\uff01\uff01\uff01<\/p>\n\n\n\n<p>\u540e\u53f0\u7684\u8d26\u5bc6\u548c\u9875\u9762\u524d\u7aef\u7684\u8d26\u5bc6\u90fd\u9700\u8981\u8bb0\u5f55\uff0c\u4ee5\u514d\u540e\u7eed\u5fd8\u8bb0\u5bfc\u81f4\u518d\u6b21\u56de\u9000\uff0c\u751a\u81f3\u91cd\u65b0\u5b89\u88c5\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3.\u767b\u5f55<\/h3>\n\n\n\n<p>\u8bbf\u95ee\u6307\u5b9a\u7684IP\uff0c\u767b\u5f55\u540e\u5373\u53ef\u8bbe\u7f6e\u76d1\u63a7\u8282\u70b9\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u95ee\u9898\u6392\u67e51\uff1a\u7ed3\u5408ssh\u5224\u65ad\u95ee\u9898\u65b9\u5411<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u80cc\u666f\u4ea4\u4ee3<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">\u95ee\u98981\uff1a\u7f51\u7edc\u963b\u9694<\/h4>\n\n\n\n<p>\u5728PVE\u540e\u53f0\u786e\u8ba4\u4e86SO\u5728\u6b63\u5e38\u8fd0\u4f5c\u540e\uff0c\u5c1d\u8bd5\u4eceWindows\u7aef\u5bbf\u4e3b\u673a\uff08IP\uff1a10.10.1.131\uff09\u767b\u5f55SO\u9875\u9762\u7ba1\u7406\u7aef\uff08IP\uff1a172.16.11.141\uff09\uff0c\u9875\u9762\u4e00\u76f4\u5904\u4e8e\u52a0\u8f7d\u72b6\u6001\uff0c\u7b49\u5f85\u54cd\u5e94\u540e\u9875\u9762\u62a5\u9519\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-55-1024x555.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"555\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-55-1024x555.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-849\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">\u95ee\u98982\uff1a\u63e1\u624b\u5931\u8d25<\/h4>\n\n\n\n<p>\u5728\u540e\u53f0\u67e5\u8be2\u6d41\u91cf\u548c\u65e5\u5fd7\u7684\u65f6\u5019\uff0c\u7531\u4e8ePVE\u63a7\u5236\u53f0\u7684\u663e\u793a\u8bbe\u7f6e\uff0c\u65e0\u6cd5\u67e5\u8be2\u5b8c\u6574\u7684\u65e5\u5fd7\u884c\uff0c\u6253\u7b97\u901a\u8fc7mobaxterm\u8fdc\u7a0bssh\u7ec8\u7aef\uff0c\u6b64\u65f6\u65b0\u7684\u95ee\u9898\u51fa\u73b0\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-56-1024x555.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"555\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-56-1024x555.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-850\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u5207\u6362Hexhub\u6765\u5c1d\u8bd5\u8fde\u63a5\uff0c\u62a5\u9519\u4e3a\u63e1\u624b\u5931\u8d25\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-57-1024x578.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"578\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-57-1024x578.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-851\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">\u6392\u67e5\u6d41\u7a0b<\/h3>\n\n\n\n<p>\u521d\u6b65\u63a8\u6d4b\u53ef\u80fd\u4e3a\u540e\u53f0so-firewall\u672a\u653e\u884c\uff0c\u5c1d\u8bd5\u624b\u52a8\u6dfb\u52a0\u672c\u673aIP\uff1a10.10.1.131<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo so-firewall include analyst 10.10.1.131\/32\nsudo so-firewall apply\n\nreboot<\/code><\/pre>\n\n\n\n<p>\u91cd\u542f\u540e\u5c1d\u8bd5\u6293\u5305\u67e5\u770b<strong>info<\/strong>\u7ec6\u5219\uff0c\u5728PVE\u7684SO\u7ec8\u7aef\u5f00\u542f\u670d\u52a1\uff0c\u7b49\u5f85\u6570\u636e\u901a\u8fc7\uff0c\u5206\u522b\u5229\u7528MobaXterm\u548ccmd\u8fdc\u8fdeSO\u7ec8\u7aef\uff0c\u8fd4\u56de\u6293\u5305\u7ed3\u679c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-63-1024x269.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"269\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-63-1024x269.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-857\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u518d\u6b21\u5728Windows\u7aef\u8bbf\u95ee\u9875\u9762\uff0c\u4f9d\u7136\u5931\u8d25\u3002\u5728cmd\u67e5\u770b\u6d41\u91cf\u8d70\u5411\uff0c\u67e5\u8be2\u65e5\u5fd7<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -vk https:\/\/172.16.11.141<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-58.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"672\" height=\"142\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-58.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-852\"  sizes=\"auto, (max-width: 672px) 100vw, 672px\" \/><\/div><\/figure>\n\n\n\n<p>\u786e\u8ba4\u4e86<strong>\u95ee\u98981<\/strong>\u548c<strong>\u95ee\u98982<\/strong>\u7684\u5177\u4f53\u539f\u56e0\uff1a\u867d\u7136\u663e\u793a\u7684\u662f\u63e1\u624b\u5931\u8d25\u5bfc\u81f4\u901a\u4fe1\u5931\u6548\uff0c\u4f46\u673a\u5668\u5728TCP\u5c42\u80fd\u901a\u8fc7\uff0c\u8bf4\u660e\u5177\u4f53\u95ee\u9898\u6781\u5927\u6982\u7387\u51fa\u73b0\u5728\u8de8\u7f51\u8def\u5f84\u95ee\u9898\u4e0a\u9762\u3002\u540e\u9762\u52a0\u4e0a\u8d26\u5bc6\u8ba4\u8bc1\uff0c\u5f3a\u5236\u8fde\u63a5ssh\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-62.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"979\" height=\"512\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-62.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-856\"  sizes=\"auto, (max-width: 979px) 100vw, 979px\" \/><\/div><\/figure>\n\n\n\n<p>\u8fd4\u56de\u7ed3\u679c\u663e\u793a\uff1aWindows\u76f4\u8fdeSO\u662f\u51fa\u73b0\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kex_exchange_identification: Connection closed by remote host\nConnection closed by 172.16.11.141 port 22<\/code><\/pre>\n\n\n\n<p>\u8bf4\u660e\u95ee\u9898\u4e0d\u662f MobaXterm\u6216\u8005Hexhub\uff0c\u800c\u662f&nbsp;<strong>Windows \u5230 SO \u7684\u8fde\u63a5\u94fe\u8def\u5f02\u5e38<\/strong>\u3002<\/p>\n\n\n\n<p>\u518d\u901a\u8fc7ssh\u5931\u8d25\uff0c\u67e5\u770b\u65e5\u5fd7 <code>\/var\/log\/secure<\/code>\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-61.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"900\" height=\"202\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-61.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-855\"  sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/div><\/figure>\n\n\n\n<p>SO&nbsp;<code>\/var\/log\/secure<\/code>&nbsp;\u91cc\u51fa\u73b0\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kex_exchange_identification: read: Connection reset by peer\nConnection reset by 10.10.1.131<\/code><\/pre>\n\n\n\n<p>\u8bc1\u660e\u4eceSO\u89c6\u89d2\u770b\uff0c<strong>\u662fWindows\u4fa7\u6216\u4e2d\u95f4\u8def\u5f84\u4e3b\u52a8\u91cd\u7f6e\u8fde\u63a5<\/strong><\/p>\n\n\n\n<p>\u5728PVE\u5f00\u542f\u4e00\u53f0kali\uff0c\u5c1d\u8bd5\u767b\u5f55https:\/\/172.16.11.141\uff0c\u53d1\u73b0\u80fd\u591f\u6b63\u5e38\u8bbf\u95ee<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-59-1024x693.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"693\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-59-1024x693.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-853\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4f9d\u7167\u8fd9\u4e2a\u601d\u8def\uff0c\u901a\u8fc7Kali\u4f5c\u4e3a\u8df3\u677f\u8bbf\u95eeSO\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-60-1024x555.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"555\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-60-1024x555.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-854\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7ed3\u679c\u663e\u793a\u6210\u529f\u3002\u8bc1\u660e\uff1a<strong>\u9ad8\u6982\u7387\u662f Windows \u5230 172.16.11.0\/24 \u8de8\u7f51\u6bb5\u8def\u5f84\u95ee\u9898<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u95ee\u9898\u6c47\u603b<\/h3>\n\n\n\n<p>\u6839\u636e\u4e0a\u8ff0\u7684\u7ed3\u679c\uff0c\u76ee\u524d\u53ef\u4ee5\u786e\u5b9a\u7684\u662f\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security Onion \u6b63\u5e38<\/li>\n\n\n\n<li>Kali \u5230 Security Onion \u6b63\u5e38<\/li>\n\n\n\n<li>Windows \u5230 Security Onion \u7684\u76f4\u8fde\u5f02\u5e38<\/li>\n\n\n\n<li>\u5f02\u5e38\u53d1\u751f\u5728 SSH\/TLS \u63e1\u624b\u9636\u6bb5<\/li>\n\n\n\n<li>\u4e0d\u662f\u8d26\u53f7\u3001\u5bc6\u7801\u3001SO \u670d\u52a1\u6216\u5355\u4e00\u5ba2\u6237\u7aef\u95ee\u9898<\/li>\n\n\n\n<li>\u95ee\u9898\u5e94\u96c6\u4e2d\u5728 Windows \u4fa7\u7f51\u7edc\u6808\u6216 Windows \u5230 172.16.11.0\/24 \u7684\u8de8\u7f51\u6bb5\u8def\u5f84<\/li>\n<\/ul>\n\n\n\n<p>\u76ee\u524dWindows\u7aef\u65e0\u6cd5\u8de8\u7f51\u6bb5\u767b\u5f55SO\u7f51\u9875\u7ba1\u7406\u7aef\u7684\u95ee\u9898\u5148\u6682\u65f6\u6309\u4e0b\u4e0d\u8868\uff0c\u8fd9\u4e2a\u95ee\u9898\u76f8\u5bf9\u4e8e\u5b9e\u9645\u6295\u5165\u4f7f\u7528\u6682\u65f6\u6784\u4e0d\u6210\u592a\u5927\u5f71\u54cd\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u95ee\u9898\u6392\u67e52\uff1a\u540e\u53f0\u6293\u5305\u68c0\u6d4b\u6570\u636e\u76d1\u63a7\u662f\u5426\u6b63\u5e38\u8fd0\u4f5c<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u80cc\u666f\u4ea4\u4ee3<\/h3>\n\n\n\n<p>\u8fdb\u5165\u9875\u9762\u7ba1\u7406\u540e\u53f0\uff0c\u5728<strong>Hunt<\/strong>\u7684\u754c\u9762\u80fd\u770b\u5230\u5df2\u7ecf\u51fa\u73b0\u90e8\u5206\u6570\u636e\u5305\u7684\u6293\u53d6\uff0c\u91cc\u9762\u4e5f\u6709\u76f8\u5173\u7684\u63cf\u8ff0\u3002\u8bf4\u660e\u6b63\u5e38\u529f\u80fd\u7684\u4e00\u90e8\u5206\u5df2\u7ecf\u53ef\u4ee5\u8fd0\u884c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-64-1024x640.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-64-1024x640.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-860\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u5728<strong>Hunt<\/strong>\u91cc\u8fc7\u6ee4\u7279\u5b9a\u7684\u7ec4\u4ef6\uff0c\u67e5\u770b\u6307\u5b9a\u7ec4\u4ef6\u662f\u5426\u8fd0\u884c\u6b63\u5e38<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>event.dataset:zeek.conn\nevent.category:network<\/code><\/pre>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-65-1024x640.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-65-1024x640.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-863\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-66-1024x693.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"693\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-66-1024x693.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-864\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n<\/div>\n\n\n\n<p>\u4ee5\u4e0a\u64cd\u4f5c\u548c\u8fd4\u56de\u7ed3\u679c\u90fd\u8bc1\u660eSO\u4e2d\u5185\u90e8\u7ec4\u4ef6\u901a\u4fe1\u6d41\u91cf\u8fd0\u884c\u6b63\u5e38\uff0c\u540e\u7eed\u5f00\u59cb\u9a8c\u8bc1\u5916\u90e8\u4e3b\u673a\u6d41\u91cf\u76d1\u63a7\uff0c\u67e5\u770b\u662f\u5426\u80fd\u6355\u83b7\u5230Kali\u3001Windows\u3001\u5176\u4ed6\u9776\u673a\u7b49\u5b9e\u9645\u6d41\u91cf\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u521d\u6b21\u9a8c\u8bc1<\/h3>\n\n\n\n<p>\u4f9d\u6b21\u67e5\u770b\uff1a<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1\u3001\u67e5\u770bSO\u5f53\u524d\u7f51\u5361<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ip -br a<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-67.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"371\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-67.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-865\"  sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">2\u3001\u770bZeek\/Suricata\u5b9e\u9645\u76d1\u542c\u63a5\u53e3<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># \u6267\u884c\u524d\u5148\u67e5\u770b\u7ec4\u4ef6\u5bb9\u5668\u7684\u540d\u79f0\uff0c\u53ef\u80fd\u4f1a\u548c\u5b98\u65b9\u6587\u6863\u6216\u672c\u535a\u5ba2\u6709\u51fa\u5165\n\nsudo docker inspect so-zeek | grep -i interface -A3 -B3\nsudo docker inspect so-suricata | grep -i interface -A3 -B3\nsudo grep -R \"interfaces\" \/opt\/so\/saltstack\/local\/ 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-68-1024x381.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"381\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-68-1024x381.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-866\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">3\u3001\u7528tcpdump\u9a8c\u8bc1\u63a5\u53e3\u6709\u65e0\u76ee\u6807\u6d41\u91cf<\/h3>\n\n\n\n<p>\u5982\u679c\u4e0d\u786e\u5b9a\u7ba1\u7406\u63a5\u53e3\uff0c\u53ef\u4ee5\u5bf9\u8bbe\u5b9a\u7684\u4e24\u4e2a\u76d1\u63a7\u63a5\u53e3\uff08enp6s18\u3001enp6s19\uff09\u90fd\u8fdb\u884c\u76d1\u542c\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-69-1024x549.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-69-1024x549.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-867\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7ed3\u5408\u4ee5\u4e0a\u4e09\u70b9\uff0c\u53ef\u4ee5\u753b\u51fa\u5927\u6982\u7684\u76d1\u63a7\u94fe\u8def\uff1a<\/p>\n\n\n\n<div class=\"wp-block-merpress-mermaidjs diagram-source-mermaid\"><pre class=\"mermaid\">graph TD\nA[Kali\/\u9776\u673a\u6d41\u91cf]\nB[PVE\u865a\u62df\u4ea4\u6362]\nC[\u6ca1\u6709\u955c\u50cf\u5230SO\u7684\u76d1\u63a7\u53e3enp6s19\/bond0]\nD[Zeek\/Suricata\u770b\u4e0d\u5230\u771f\u5b9e\u5b9e\u9a8c\u6d41\u91cf]\nA-->B-->C-->D<\/pre><\/div>\n\n\n\n<p>\u521d\u6b65\u5224\u65ad\uff1a\u76ee\u524dSO\u662f\u5728\u8fd0\u884c\uff0c\u4f46Suricata\/Zeek\u76d1\u542cbond0\uff0c\u4f46\u5b9e\u9645\u5e94\u8be5\u76d1\u542cenp6s19\uff0c\u800c\u4e14\u6b64\u65f6bond0\u662fDOWN\uff0c\u5bfc\u81f4enp6s19\u6ca1\u6709\u6536\u5230\u955c\u50cf\u6d41\u91cf\uff0cPVE\u4e5f\u6ca1\u6709\u628a\u76ee\u6807\u6d41\u91cf\u955c\u50cf\u7ed9SO<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u4e8c\u6b21\u9a8c\u8bc1<\/h3>\n\n\n\n<p>\u65b0\u5f00\u4e00\u4e2a\u9776\u673a\uff08IP\uff1a172.16.11.213\uff09\uff0c\u518d\u6b21\u5f00\u542fenp6s19\u7684\u76d1\u63a7\u63a5\u53e3\u3002\u901a\u8fc7Kali\uff08IP\uff1a172.16.11.147\uff09ping\u9776\u673a\uff0c\u89c2\u5bdf\u8fd4\u56de\u7ed3\u679c\uff1a<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-72-1024x549.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-72-1024x549.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-872\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-73-1024x549.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-73-1024x549.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-873\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n<\/div>\n\n\n\n<p>\u8bc1\u636e\u660e\u786e\uff1a\u8fd4\u56de\u7ed3\u679c\u663e\u793a\u80fd\u660e\u786e\u770b\u5230Kali\u548cSO\u4e4b\u95f4\u7684SSH\/HTTPS\u6d41\u91cf\uff08\u4eceenp6s18\u63a5\u53e3\u51fa\u5165\u7684\u6d41\u91cf\uff09\uff0c\u4f46\u662fenp6s19\uff08\u5e94\u8be5\u6709\u6d41\u91cf\u7684\u76d1\u63a7\u63a5\u53e3\uff09\u6ca1\u6536\u5230\u955c\u50cf\u6d41\u91cf\u3002\u4e5f\u548c\u4e4b\u524dSO\u76d1\u542c\u63a5\u53e3\u914d\u7f6e\u51fa\u9519\u6709\u5173<\/p>\n\n\n\n<p>\u7ed3\u8bba\uff1a<strong>PVE\u6ca1\u6709\u628a\u76ee\u6807\u6d41\u91cf\u955c\u50cf\u5230SO\u7684\u76d1\u63a7\u53e3enp6s19<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u89e3\u51b3\u8bb0\u5f55<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">1.\u6d41\u91cf\u590d\u5236<\/h4>\n\n\n\n<p>\u5728PVE root\u7ec8\u7aef\u91cc\u786e\u8ba4tap\u540d\u79f0<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip link | grep tap<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-74-1024x465.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"465\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-74-1024x465.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-874\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>#\u5728PVE\u4e0a\u5f00\u542fSO\u76d1\u63a7tap\u7684\u6df7\u6742\u6a21\u5f0f\nip link set tap25041404i1 promisc on\n\n#\u5728SO\u4e0a\u5f00\u542ftap\u7684\u6df7\u6742\u6a21\u5f0f\nsudo ip link enp6s19 promisc on<\/code><\/pre>\n\n\n\n<p>\u628aKali\u6d41\u91cf\u955c\u50cf\u5230SO\u76d1\u63a7\u53e3\uff0c\u5728PVE root\u4e0a\u6267\u884c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tc qdisc add dev tap25041401i0 clsact\ntc filter add dev tap25041401i0 ingress matchall action mirred egress mirror dev tap25041404i1\ntc filter add dev tap25041401i0 egress matchall action mirred egress mirror dev tap25041404i1<\/code><\/pre>\n\n\n\n<p>\u5728SO\u4e2d\u6267\u884c\u9a8c\u8bc1\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tcpdump -ni enp6s19<\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u518dKali\u4e0a\u8bbf\u95ee\u9776\u673a\uff08IP\uff1a172.16.11.213\uff09<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ping 172.16.11.213<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-75-1024x90.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"90\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-75-1024x90.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-875\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u51fa\u73b0\u8fd4\u56de\u7ed3\u679c\uff0c\u5e76\u4e14\u91cc\u9762\u540c\u65f6\u5305\u542b\u4e86ssh\uff0810.10.1.131 -&gt; 172.16.11.147 -&gt; 172.16.11.141\uff09\u548cping\u5305\uff08172.16.11.147 -&gt; 172.16.11.213\uff09\uff0c\u8bf4\u660e\u76d1\u63a7\u6d41\u91cf\u5df2\u7ecf\u8fdb\u5165SO\u76d1\u63a7\u53e3<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2.\u8c03\u6574\u68c0\u6d4b\u63a5\u53e3<\/h4>\n\n\n\n<p>\u4e4b\u524d\u67e5\u5230Suricata\u76d1\u542c\u7684\u4e8bbond0\u63a5\u53e3\uff0c\u800c\u4e14\u5904\u4e8eDOWN\uff0c\u5148\u5c1d\u8bd5\u4e34\u65f6\u5c06enp6s19 \u52a0\u5165 bond0<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ip link set enp6s19 down\nsudo ip link set enp6s19 master bond0<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-76.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"483\" height=\"74\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-76.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-876\"  sizes=\"auto, (max-width: 483px) 100vw, 483px\" \/><\/div><\/figure>\n\n\n\n<p>\u62a5\u9519\uff1a<strong><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">Invalid argument<\/mark><\/strong>\uff0c\u8bf4\u660e\u5f53\u524d\u4e0d\u80fd\u628aenp6s19\u52a0\u5165bond0\uff0c\u5176\u4e2d\u53ef\u80fd\u7684\u539f\u56e0\u6709\u591a\u79cd\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>bond0<\/code>&nbsp;\u7684 bonding \u6a21\u5f0f\/\u72b6\u6001\u4e0d\u5141\u8bb8\u8fd9\u6837\u52a0<\/li>\n\n\n\n<li><code>enp6s19<\/code>&nbsp;\u8fd8\u88ab NetworkManager \u7ba1\u7406<\/li>\n\n\n\n<li>Security Onion \u7684 bond0 \u662f\u5b89\u88c5\u65f6\u751f\u6210\u7684\u7279\u6b8a\u914d\u7f6e\uff0c\u65e0\u6cd5\u4e8c\u6b21\u914d\u7f6e<\/li>\n<\/ul>\n\n\n\n<p>\u66f4\u6362\u53e6\u4e00\u79cd\u65b9\u5f0f\uff1a\u628aSO\u76d1\u63a7\u63a5\u53e3\u4ecebond0\u6539\u6210enp6s19<\/p>\n\n\n\n<p>\u5148\u786e\u8ba4Zeek\/Suricata\u76d1\u542c\u914d\u7f6e<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo grep -R \"bond0\" \/opt\/so\/saltstack\/local\/ 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-77-1024x110.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"110\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-77-1024x110.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-879\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4ece\u8fd4\u56de\u7ed3\u679c\u5206\u6790<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>bond007\u662fSuricata\u89c4\u5219\u5185\u5bb9\u91cc\u7684\u6076\u610f\u57df\u540d\uff0c\u53ef\u4ee5\u5ffd\u7565<\/li>\n\n\n\n<li>\u771f\u6b63\u7684\u63a5\u53e3\u914d\u7f6e\u662f\u8fd9\u4e00\u884c\uff1a<br><code>\/opt\/so\/saltstack\/local\/pillar\/minions\/so-yxwa_standalone.sls: interface: 'bond0'<\/code><\/li>\n<\/ul>\n\n\n\n<p>\u5e94\u7528\u914d\u7f6e\u4fee\u6539<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># \u5907\u4efd\u6587\u4ef6\nsudo cp \/opt\/so\/saltstack\/local\/pillar\/minions\/so-yxwa_standalone.sls \/opt\/so\/saltstack\/local\/pillar\/minions\/so-yxwa_standalone.sls.bak\n\nsudo vi \/opt\/so\/saltstack\/local\/pillar\/minions\/so-yxwa_standalone.sls\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-79.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"547\" height=\"463\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-79.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-881\"  sizes=\"auto, (max-width: 547px) 100vw, 547px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code># \u6e05\u695a\u539f\u5148\u5bb9\u5668\u914d\u7f6e\u6b8b\u7559\nsudo grep -R \"INTERFACE=bond0\\|interface: 'bond0'\\|bond0\" \/opt\/so\/ 2&gt;\/dev\/null | grep -v all-rulesets\n\n# \u91cd\u65b0\u5e94\u7528Salt\u914d\u7f6e\nsudo salt-call state.highstate\n\n# \u91cd\u542fSO\nsudo reboot\n\n# \u518d\u6b21\u9a8c\u8bc1\nsudo docker inspect so-suricata | grep -i interface -A3 -B3<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-80.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"748\" height=\"153\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-80.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-882\"  sizes=\"auto, (max-width: 748px) 100vw, 748px\" \/><\/div><\/figure>\n\n\n\n<p>\u8fd4\u56de\u7ed3\u679c\u8bf4\u660e\u4fee\u6539\u6210\u529f<\/p>\n\n\n\n<p>\u5f00\u59cb\u6293\u5305\u9a8c\u8bc1\uff1a<\/p>\n\n\n\n<p>\u5728SO\u4e0a\u5f00\u542f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tcpdump -ni enp6s19 host 172.16.11.213<\/code><\/pre>\n\n\n\n<p>Kali\u4e0a\u4ea7\u751f\u6d41\u91cf\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl http:\/\/172.16.11.213<\/code><\/pre>\n\n\n\n<p>Hunt\u67e5\u8be2\uff1a<\/p>\n\n\n\n<p>destination.ip:172.16.11.213<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-81-1024x640.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-81-1024x640.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-883\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u8fd4\u56de\u7ed3\u679c\u4e3a\u6210\u529f\uff0c\u4f46\u54cd\u5e94\u65f6\u95f4\u4f1a\u6709\u5ef6\u8fdf\uff0c\u5ef6\u8fdf\u51e0\u5341\u79d2\u5230\u51e0\u5206\u949f\u90fd\u6b63\u5e38\u3002\u540e\u7eed\u67e5\u8be2\u5c3d\u91cf\u7528<strong>Last 15 minutes<\/strong><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">3.\u6dfb\u52a0\u65b0\u63a5\u53e3<\/h4>\n\n\n\n<p>\u7ed3\u5408\u5148\u524d\u7684\u8de8\u7f51\u6bb5\u95ee\u9898\u548c\u4e0a\u8ff0\u4e24\u4e2a\u89e3\u51b3\u65b9\u6848\u63a8\u65ad\u51fa\uff1aWindows curl\u9776\u673a\u662f\u6210\u529f\u7684\uff0c\u53ea\u662fSO\u201c\u6ca1\u770b\u5230\u201d\uff0c\u56e0\u4e3aPVE\u955c\u50cf\u8303\u56f4\u4e0d\u5305\u542b\u8fd9\u6761\u6d41\u91cf\uff0c\u8fd9\u4e5f\u8bf4\u660e<strong>Windows \u5230\u9776\u673a\u7684\u6d41\u91cf\u6ca1\u6709\u88ab PVE \u955c\u50cf\u5230 SO \u7684 enp6s19<\/strong>\u3002\u539f\u56e0\u4e5f\u5927\u6982\u7387\u662f\uff1a\u4e4b\u524d\u53ea\u955c\u50cf\u4e86 Kali \u7684 tap \u53e3\uff0c\u6ca1\u6709\u955c\u50cf\u9776\u673a\u7684 tap \u53e3\u6216 PVE \u4e0a\u627f\u8f7d Windows \u5165\u7ad9\u6d41\u91cf\u7684\u63a5\u53e3\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">\u65b9\u68481.\u5355\u4e2a\u9776\u573a\u89e3\u51b3,\u624b\u52a8\u6dfb\u52a0\u65b0VM\u7684tap<\/h5>\n\n\n\n<p>\u56e0\u4e3aWindows \u8bbf\u95ee\u9776\u673a\uff0c\u6d41\u91cf\u6700\u7ec8\u4e00\u5b9a\u4f1a\u8fdb\u5165\u9776\u673a\u7f51\u5361\u3002\u6240\u4ee5\u53ea\u8981\u955c\u50cf\u9776\u673a\u7684 tap\uff0cSO \u5c31\u80fd\u770b\u5230\u3002<\/p>\n\n\n\n<p>\u5148\u5728PVE root\u4e0a\u627e\u5230\u9776\u673aVMID<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip link | grep tap<\/code><\/pre>\n\n\n\n<p>\u627e\u5230\u9776\u573a\uff08172.16.11.213\uff09\u5bf9\u5e94\u7684tap\uff0c\u5e76\u5728PVE\u4e0a\u7ed9\u9776\u573atap\u52a0\u955c\u50cf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tc qdisc add dev tap25041402i0 clsact\ntc filter add dev tap25041402i0 ingress matchall action mirred egress mirror dev tap25041404i1\ntc filter add dev tap25041402i0 egress matchall action mirred egress mirror dev tap25041404i1\n\n# \u518d\u6d4b\u8bd5\nsudo tcpdump -ni enp6s19 host 172.16.11.213 \/\/SO\u4e2d\u64cd\u4f5c\n\n# Windows\u6267\u884c\ncurl http:\/\/172.16.11.213<\/code><\/pre>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-82-1024x549.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-82-1024x549.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-888\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-83-1024x549.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-83-1024x549.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-889\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h5 class=\"wp-block-heading\">\u65b9\u68482.\u76f4\u63a5\u63a5\u5165PVE\u94fe\u63a5\u5916\u90e8\u7f51\u7edc\u7684bridge\/uplink<\/h5>\n\n\n\n<p>\u5728PVE root\u7ec8\u7aef\u64cd\u4f5c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tc qdisc add dev vmbr0 clsact\ntc filter add dev vmbr0 ingress matchall action mirred egress mirror dev tap25041404i1\ntc filter add dev vmbr0 egress matchall action mirred egress mirror dev tap25041404i1<\/code><\/pre>\n\n\n\n<p>\u9a8c\u8bc1<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># \u5728SO\u5f00\u542f\u6d41\u91cf\u6293\u5305\nsudo tcpdump -ni enp6s19 host 172.16.11.213\n\n# Windows\u7aefcmd\ncurl http:\/\/172.16.11.213\nping 172.16.11.147<\/code><\/pre>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-85-1024x640.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-85-1024x640.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-891\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-86-1024x640.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-86-1024x640.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-892\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h5 class=\"wp-block-heading\">\u901a\u8fc7\u811a\u672c\u907f\u514d\u624b\u5de5\u6dfb\u52a0\u65b0VM\u7684tap<\/h5>\n\n\n\n<p>\u5f53\u524dSO\u76d1\u63a7\u53e3\u56fa\u5b9a\u662f\uff1a<strong>tap25041404i1<\/strong>\uff0c\u5199\u4e00\u4e2a\u811a\u672c\uff0c\u81ea\u52a8\u628a\u6240\u6709\u76ee\u6807VM\u7684tap\u955c\u50cf\u8fc7\u53bb\uff0c\u5728PVE root\u4e0a\u521b\u5efa\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\n\nSO_TAP=\"tap25041404i1\"\n\nfor IFACE in $(ip -o link show | awk -F': ' '{print $2}' | grep -E '^tap&#91;0-9]+i0$'); do\n    if &#91; \"$IFACE\" = \"$SO_TAP\" ]; then\n        continue\n    fi\n\n    echo \"&#91;+] mirror $IFACE -&gt; $SO_TAP\"\n\n    tc qdisc del dev \"$IFACE\" clsact 2&gt;\/dev\/null\n    tc qdisc add dev \"$IFACE\" clsact\n\n    tc filter add dev \"$IFACE\" ingress matchall action mirred egress mirror dev \"$SO_TAP\"\n    tc filter add dev \"$IFACE\" egress matchall action mirred egress mirror dev \"$SO_TAP\"\ndone\n\n# \u6388\u6743\nchmod +x \/root\/so-mirror.sh\n\n# \u6267\u884c\n\/root\/so-mirror.sh<\/code><\/pre>\n\n\n\n<p>\u4ee5\u540e\u65b0\u9776\u673a\u5f00\u673a\u540e\uff0c\u91cd\u65b0\u8dd1\u4e00\u6b21\u811a\u672c\u5373\u53ef\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">\u5168\u81ea\u52a8\u4f18\u5316<\/h5>\n\n\n\n<p>\u6bcf\u6b21\u65b0\u7684VM\u5f00\u542f\u90fd\u9700\u8981\u91cd\u65b0\u8dd1\u811a\u672c\uff0c\u90a3\u5c31\u8bbe\u8ba1\u4e00\u4e2a\u65b0\u7684\u81ea\u52a8\u5316\u811a\u672c\uff1asystemd \u5b9a\u65f6\u81ea\u52a8\u626b\u63cf\uff0c\u65b0 VM \u5f00\u673a\u540e\u81ea\u52a8\u52a0\u955c\u50cf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong># PVE root\u673a\u521b\u5efa\u811a\u672c<\/strong>\nnano \/root\/so-mirror-auto.sh\n\n#!\/bin\/bash\n\nSO_TAP=\"tap25041404i1\"\nSO_VMID=\"25041404\"\n\n# \u786e\u8ba4 SO \u76d1\u63a7 tap \u5b58\u5728\nip link show \"$SO_TAP\" >\/dev\/null 2>&amp;1 || exit 0\n\n# \u5f00\u542f SO \u76d1\u63a7 tap \u6df7\u6742\u6a21\u5f0f\nip link set \"$SO_TAP\" promisc on 2>\/dev\/null\n\nfor IFACE in $(ip -o link show | awk -F': ' '{print $2}' | grep -E '^tap&#91;0-9]+i&#91;0-9]+$'); do\n\n    # \u8df3\u8fc7 SO \u81ea\u5df1\u7684\u76d1\u63a7\u53e3\n    if &#91; \"$IFACE\" = \"$SO_TAP\" ]; then\n        continue\n    fi\n\n    # \u8df3\u8fc7 SO VM \u7684\u6240\u6709\u7f51\u5361\uff0c\u907f\u514d\u81ea\u955c\u50cf\u5bfc\u81f4\u91cd\u590d\/\u56de\u73af\n    if echo \"$IFACE\" | grep -q \"^tap${SO_VMID}i\"; then\n        continue\n    fi\n\n    # \u5982\u679c\u5df2\u7ecf\u5b58\u5728 clsact\uff0c\u8bf4\u660e\u5904\u7406\u8fc7\uff0c\u8df3\u8fc7\n    tc qdisc show dev \"$IFACE\" | grep -q \"clsact\" &amp;&amp; continue\n\n    echo \"&#91;+] Add mirror: $IFACE -> $SO_TAP\"\n\n    tc qdisc add dev \"$IFACE\" clsact\n    tc filter add dev \"$IFACE\" ingress matchall action mirred egress mirror dev \"$SO_TAP\"\n    tc filter add dev \"$IFACE\" egress matchall action mirred egress mirror dev \"$SO_TAP\"\ndone\n\n# \u6388\u6743\nchmod +x \/root\/sp-mirror-auto.sh\n\n# \u8fd0\u884c\n\/root\/so-mirror-auto.sh\n------------------------------------------\u5206\u5272\u7ebf---------------------------------------------\n<strong># \u521b\u5efasystemd service\n<\/strong>nano \/etc\/systemd\/system\/so-mirror-auto.service\n\n# \u5728so-mirror-auto.service\n&#91;Unit]\nDescription=Auto mirror VM tap traffic to Security Onion\n\n&#91;Service]\nType=oneshot\nExecStart=\/root\/so-mirror-auto.sh\n------------------------------------------\u5206\u5272\u7ebf---------------------------------------------\n<strong># \u521b\u5efasystemd timer<\/strong>\nnano \/etc\/systemd\/system\/so-mirror-auto.timer\n\n# \u5728so-mirror-auto.timer\u4e2d\u8f93\u5165\n&#91;Unit]\nDescription=Run SO mirror auto script periodically\n\n&#91;Timer]\nOnBootSec=30\nOnUnitActiveSec=10\nUnit=so-mirror-auto.service\n\n&#91;Install]\nWantedBy=timers.target\n------------------------------------------\u5206\u5272\u7ebf---------------------------------------------\n<strong># \u542f\u7528<\/strong>\nsystemctl daemon-reload\nsystemctl enable --now so-mirror-auto.timer\n\n# \u67e5\u770b\u72b6\u6001\nsystemctl status so-mirror-auto.timer\n\n# \u67e5\u770b\u65e5\u5fd7 \njournalctl -u so-mirror-auto.service -f\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u95ee\u9898\u6392\u67e53\uff1a\u56de\u6eda\u5bfc\u81f4flow\u8fc7\u671f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u80cc\u666f\u4ea4\u4ee3<\/h3>\n\n\n\n<p>\u5728\u91cd\u542fso\u540e\uff0c\u5982\u679cso\u65e0\u6cd5\u6b63\u5e38\u542f\u52a8\uff0c\u53ef\u80fd\u4f1a\u56de\u6eda\u5230\u4e4b\u524d\u7684snapshot\u3002\u5728\u786e\u8ba4\u5f53\u524d\u7684\u73af\u5883\u65e0\u6cd5\u4fee\u590d\u540e\uff0c\u786e\u8ba4\u9700\u8981\u56de\u6eda\u3002\u56de\u6eda\u7ed3\u675f\u540e\uff0c\u786e\u8ba4so\u5728\u6b63\u5e38\u8fd0\u4f5c\uff0c\u91cd\u65b0\u767b\u5f55\u7f51\u9875\u524d\u7aef\u4f1a\u53d1\u73b0\u5982\u4e0b\u95ee\u9898\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-87-1024x693.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"693\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-87-1024x693.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-899\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u5728\u6e05\u9664\u6d4f\u89c8\u5668\u5185\u7f6e\u7684cookie\u7f13\u5b58\u540e\uff0c\u518d\u6b21\u5237\u65b0\u9875\u9762\u4f9d\u7136\u51fa\u73b0\u5982\u4e0a\u56fe\u7684\u60c5\u51b5\u3002\u8bc1\u660e\u539f\u56e0\u5982\u4e0a\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SO\u4e0eKali\u65f6\u95f4\u4e0d\u4e00\u81f4<\/li>\n\n\n\n<li>SO\u7684\u8ba4\u8bc1\u5bb9\u5668<code>so-kratos\/so-sec\/so-nginx<\/code>\u72b6\u6001\u5f02\u5e38<\/li>\n\n\n\n<li>\u6d4f\u89c8\u5668cookie\u5b58\u50a8\u5f02\u5e38<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">\u89e3\u51b3\u8bb0\u5f55<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">1.SO\u4e0eKali\u65f6\u95f4\u4e0d\u4e00\u81f4\u95ee\u9898<\/h4>\n\n\n\n<p>\u5f53\u524d\u5df2\u786e\u8ba4cookie\u7f13\u5b58\u5df2\u6e05\u9664\u5374\u4ecd\u7136\u767b\u4e0d\u4e0a\u53bb\u7f51\u9875\u524d\u7aef\uff0c\u7740\u624b\u5728SO\u540e\u7aef\u89e3\u51b3\u65f6\u95f4\u4e0d\u4e00\u81f4\u95ee\u9898\u3002\u8fd9\u91cc\u7684\u201c\u65f6\u95f4\u4e0d\u4e00\u81f4\u201d\u6307\u7684\u662f\uff1a<strong>\u8bbf\u95ee Security Onion \u7684\u5ba2\u6237\u7aef\u65f6\u95f4<\/strong>&nbsp;\u548c&nbsp;<strong>Security Onion \u670d\u52a1\u5668\u65f6\u95f4<\/strong>&nbsp;\u5dee\u8ddd\u8fc7\u5927\u3002\u5177\u4f53\u7684\u8fd4\u56de\u7ed3\u679c\u5982\u4e0b\u56fe\u6240\u793a\uff1a<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>SO<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-88-1024x549.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-88-1024x549.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-900\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>Kali<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-89-1024x549.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" data-original=\"https:\/\/myblog.marsrains.top\/wp-content\/uploads\/2026\/03\/image-89-1024x549.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-901\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n<\/div>\n\n\n\n<p>\u76f4\u63a5\u5728SO\u4e0a\u6267\u884c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo timedatectl set-ntp false\nsudo hwclock --hctosys\ntimedatectl\n\n# \u5982\u679c hwclock --hctosys \u4e0d\u751f\u6548\uff0c\u624b\u52a8\u8bbe\u7f6e\nsudo timedatectl set-ntp false\nsudo timedatectl set-time \"2026-05-06 10:40:00\"\nsudo hwclock -w\ntimedatectl\n\n# \u786e\u8ba4\u65f6\u95f4\u53d8\u6210\u5f53\u524d\u663e\u793a\u7684\u65f6\u95f4\u540e\u518d\u7ee7\u7eed\nsudo docker restart so-kratos so-nginx so-soc<\/code><\/pre>\n\n\n\n<p>\u5b8c\u6210\u4e0a\u8ff0\u64cd\u4f5c\u540e\u91cd\u65b0\u5728Kali\u6d4f\u89c8\u5668\u6253\u5f00\u9875\u9762\u524d\u7aef<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">\u540e\u7eed\u7ef4\u6301<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code># \u5982\u679c\u662fAirgap\u73af\u5883\uff0c\u5efa\u8baeSO\u4fdd\u6301<code>sudo timedatectl set-ntp false<\/code>\n# \u6bcf\u6b21\u5feb\u7167\u56de\u6eda\u540e\u68c0\u67e5\ntimedatectl<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>SIEM SIEM\uff08Security Information and Event Management\uff0c\u5b89\u5168\u4fe1 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":100,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_lmt_disableupdate":"","_lmt_disable":"","footnotes":""},"categories":[6,14],"tags":[19],"class_list":["post-592","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-capture-the-flag","category-14","tag-19"],"modified_by":"MarsRain","_links":{"self":[{"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/posts\/592","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=592"}],"version-history":[{"count":25,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/posts\/592\/revisions"}],"predecessor-version":[{"id":904,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/posts\/592\/revisions\/904"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/media\/100"}],"wp:attachment":[{"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=592"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=592"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=592"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}