Kali Purple

https://www.kali.org/blog/kali-linux-2023-1-release/#kali-purple Kali Linux has a new version, for the defender and attacker/defender pairing. Discuss

Imo, it just seems a bit weird? Most of the stuff they're shoving in there is more suited to being individual VM instances in a homelab or bare metal on an appliance than it is components as part of a swiss army knife toolset like Kali. Blue team stuff is all about engineering and architecturing an environment. Like all of these components, from Elastic to Suricata, the little vuln scanners they're putting in, etc, these are all things you would be throwing onto either VM instances or appliances and figuring out how best to monitor the network with them. I just can't wrap my head around what I'm going to do with like Suricata on a Kali image. That's something you throw onto a VM that's in-line somewhere on the environment's network...it doesn't really make sense to have it on your kali box that's bloated with 10,000 other tools. Same with the vuln scanner thing they put it -- you put a vuln scanner on some quiet little box in the corner and it fires off once a week and generates data. All of these are set-and-forget server and appliance type stuff, not tools that you're going to be playing with like all the other stuff in Kali. I think ways they could improve: For the tools they're rolling, maybe maintain a central repo of like pre-built VM images for each component that make setting these things up quick and easy so that you can make a simple lab environment quickly. Maybe maintain some images of test environments as well, like a Windows eval copy, some variegated Linux images, etc, so that you can get your dummy network setup fast. For more kali-like tools to add for blue team functions, I'd throw in: >more malware analysis tools >sandboxing tools >more reversing tools

>>21155 I think perhaps the intention is to help people build out small practice boxes and educational material, the idea of this surpassing security onion does seem absurd, but as a tool for a class, where an instructor can just say "download this kali image" to someone maybe already familiar with Kali seems reasonable.

>>21155 Kali is for education purposes only, I can't imagine anyone non-ironically using this in production. >>21155 >>sandboxing tools I'm really against sandboxing malware on your own computer, even in a VM, even if this VM is running inside a cgroups/container. So many things can go wrong, nothing better than a physical isolated host just for the hypervisor, with physically segregated network. A heavy firewall between the sandbox orchestrator (Cu-ckoo if you are using opensource, lain doesnt let me write the name of the tool) and the hypervisor, and another heavy locked firewall between the VM and the internet. Nowadays running malware without access to the internet is beg for it to detect that is being analyzed and just mess around.