Hello, welcome to the Tuesday, December 5th, 2017 edition of the Sandstone Storm Center's Stormcast. My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

If you're working in a sock, then you probably have heard of the term of orchestration. It usually refers to writing scripts and somewhat automating

how you respond to certain events. Now Tom today wrote a blog about just such a tool,

the Hive project, actually the cortex part of it is what I sort of would classify somewhat as orchestration here.

But what this all comes down to is to essentially have a better ticketing system for your sock.

The hive can receive events from your SIM, email or other sources also integrates with MISP to track your indicators

of compromise and the like, but then with Cortex, you can, for example, take a file and then run

it through different analyzers and it does support a quite nice and diverse set of pre-written analyzers.

Certainly enough to get started and give the project a try to see if it will simplify your

work and let us know if you like tools like this or if you found any particular tricks or so to apply these tools to your work.

Now, talking about open source tools, I just came across thanks to a Reddit post, to an extension for one of my favorite open source tools, and that's Scapey.

Scapey allows you to create pretty much arbitrary

network packets. Now, the extension I just found appears to be actually around for a while, but

never really seen it before. It does allow you to extend Scapey's capability to S.S.L and TLS. I remember a couple times looking

for just such an extension and nice to see that it's now available. And Apple today

released TVOS 11.2 after releasing iOS 11.2 over the weekend. Now, I mentioned yesterday that there has so far

been no security details available about iOS 11.2. That's still the case as I record this.

Also, no security details about TVOS 11.2.

And this year we had a number of different reports about vulnerabilities and problems with

the Intel management engine or M.E. Well, it looks like a number of vendors are now shipping, in particular, laptops with

Intel M.E, disabled by the vendor.

Dell and System 76 both made announcements that they at least provide an option to ship

...