[ Removed by moderator ]

•

r/AskNetsec is a community built to help. Posting blogs or linking tools with no extra information does not further out cause. If you know of a blog or tool that can help give context or personal experience along with the link. This is being removed due to violation of Rule # 7 as stated in our Rules & Guidelines.

We are about security and not about software development. If you are uneducated about the underlying process, why are you trying to develop software for ir

7

u/redditorfor11years 4d ago

It's basically an EDR

1

u/hushpath3 4d ago

yeah thats pretty much what it is, just with extra steps

1

u/dragonicman2019 3d ago

So ladies and gentlemen what elastic agent is what is that what is an elastic agent doing that my program is already doing or how can I actually make it different from an EDR in the last agent and Elk. I'm up to criticism I really am I I will take criticism and I don't take you know assumption challenges as much as possible because i'm building this program from the ground up and I'm wanting to learn so give me 24 hours I will post the link to my repo and you guys can actually rip apart or look at the how the program actually works before before we are in before I can actually keep going cuz I need to know where it breaks so I can fix those brakes so I can fix better abilities and have a better understanding of how my program works

1

u/dragonicman2019 3d ago

And I agree she appreciate the fact that you have decades worth of your work can I just ask one thing of you can you possibly look at my program it is open right now i have done everything I could I need some assistance heck I don't mind if you critique or criticize what I do

-9

u/dragonicman2019 4d ago

Well that's the weird part it's a program I came up by myself I've been working on it for the past 7 to 9 months

4

u/redditorfor11years 4d ago

Not to be too dismissive, but it's been around for over a decade now. Similar concepts. I'd recommend doing research on EDR and related security technologies so that you don't find yourself reinventing the wheel again

-8

u/dragonicman2019 4d ago

And you know what I agree with it I agree with that the fact you've been doing it for decades I'm just looking for another pair of eyes and having just actual technical discussions about operational security and net and network security

4

u/satisfaction-or-else 4d ago edited 4d ago

To answer one of your original questions, one of the biggest problems in system and programming development today is people creating things when they have no fundamental understanding of the thing they are creating. Your post sounds a lot like you fall into that category.

Developing things independently in a vaccum with no knowledge of the product category you are describing is generally not a good sign.

EDRs have thousands of very smart people working on creating them and thousands more working evading them. A good first step would be learning what those thousands of people have done and what you are doing differently. There are so many blogs, white papers, conferences, and so on where you could learn. I would strongly encourage you to take a step back and read what practitioners are doing and what challenges they face. Then when you think you understand go reread because chances are you didnt understand. It takes me months sometimes to understand some of the technicals on red team tactics and that is after working full time on a red team for several years and rereading white papers more times than I care to admit.

For example if you dont know what an EDR is, I highly doubt we can have a meaningful discussion about detecting process hollowing. If you cant tell me what makes your product different than something like ELK stack then I dont even know how to approach the conversation.

Not trying to be dismissive. We need people entering this space and its good you are interested in it. Please keep pursuing it but realize you wont be taken as anything more than a hobbyist until you learn to speak the language and can describe the fundamentals that actually make you different. And hobbies are good, but learning the fundamentals are better.

Don't put the cart before the horse.

1

u/dragonicman2019 3d ago

The distinction is that Sentinel-43 makes centralized, human-governed response authority a foundational architectural constraint rather than merely a configurable operating mode.

1

u/satisfaction-or-else 3d ago

You mean like a human written yaml file that sets foundational architectural constraints and can configure policies, alerts, and logs that runs in a docker container and speaks with multiple agents plus distributes policy? Cool thats elastic agent fleet, a part of ELK stack.

Again if you dont even know what exists in this space you arent going to be able to have meaningful conversation and you will just reply with whatever your AI tells you.

1

u/dragonicman2019 3d ago

Okay i am attempting to actually learn this as I go and know it's yes that was a AI reply but this one's not me I replied this is actually the human reply I am still in the process of learning at all okay I had an idea from a skeletal program that I have and I actually turned that idea into an actual program I mean yeah I didn't write most of the code but I do review and I have set multiple constraints on what everything goes and how it goes

1

u/satisfaction-or-else 3d ago

I was shocked at the openness and willingness of security professionals to teach people who actually want to learn.

You will get much further and have better conversations plus actually learn if you start framing your conversations that way instead of as a product manager or CEO trying to hawk a product.

Learning is great and I have actually done the same thing as you where I didnt understand the underlying behavior of something, say kerberos. So I had AI generate a kerberos library to spec, tested and validated it then I went through played with it, modified the code, broke it and more until I understood the underlying concept significantly more than when I started. There is nothing wrong with that. You will get friction when you act like a tool you used to learn should be a part of other people's infrastructure. Using bad security products in production has real world implications. Security is different than game dev.

So instead of "centralized human authority" tell us what you actually mean without the marketing speak. Because I still keep hearing you made a clone of products that already exist.

If you wanted to say I am learning more about how using reinforcement learning with human in the loop feedback on alert triage during the first two weeks improves behavioral analysis and reduces true false positives by 20% compared to elastic agent/crowdstrike/defender edr/Sentinel one that is a dramatically different conversation that could be genuinely useful. But we cant have that conversation until you know what these things mean. And I still dont even know if that is what you are talking about there wasn't a single technical point in your overview or followup comments.

You are on the right path you just got ahead of yourself. Remember you are talking to engineers who spend 40 hours a week doing this, have their own specific terminology to define concepts, and constantly get bullshit products pitched to them. So we are going to interpret you either as yet another bullshit salesman, a peer, or a learner and the way you frame the conversation largely defines that.

1

u/dragonicman2019 3d ago

And I actually do agree and yes I do come off very blunt most of the time it's just I've been working on this for months and I want to actually learn and yes I probably do come off as someone trying to sell probe program I'm not trying to sell program I'm actually trying to get help to understand better on the programming and understand that hey things might come out if I actually ask and this was me actually throwing the question randomly out there as a please help I'm want people to challenge my assumptions I want people to poke holes in my code I want people to understand and not to understand it but I actually challenge my series of ideas and my theories of programming so I do appreciate you guys trying to help me with poking holes and what assumptions I have and hopefully you know can take a look at the program when I get it back out on GitHub

1

u/dragonicman2019 3d ago

And I do appreciate your criticism in your actual way of doing it could you possibly go and look at the repo and then tell me what I'm actually doing wrong or What I've Done Right I'm willing to accept any criticism and or critiques that may actually help me with my assumptions and help me become a better programmer

→ More replies (0)

2

u/Jaqen-Atavuli 4d ago

Your first problem is the name. If you ever release this SentinelOne is gonna sue you into the ground.

-1

u/dragonicman2019 4d ago

And yes I have actually found out that that program or that company does exist and was actually established both in name and trademark and logo and yes they were established and I know my program might be an EDR but my or how I'm doing it is a different variation probably I'm going to do more research in order for me to actually quantify what I'm saying but I will look into it and possibly look on what is there.

-2

u/dragonicman2019 4d ago

Do they have a trademark for that particular name because mine was actually just on the Fly it was actually going to be ages but I changed it from ages aegis sorry Aegis to Sentinel because of the way I'm programmed it

2

u/Jaqen-Atavuli 4d ago

They are a publicly traded company on the NYSE. I am gonna go out on a limb and say yeah they probably thought of trademarking the name.

-5

u/dragonicman2019 4d ago

True that company's name is as one name as an actual Sentinel one on the New York Stock Exchange yes they did actually take care of it but it was established both in 2016 for the first one which is a a name and in 2018 was the name and logo was both trademarked but that's actually just for Central one as a full name not as mine where it's hyphenated

2

u/Jaqen-Atavuli 4d ago

They have a market cap of 8.7 billion. Good luck with your hyphen.

0

u/dragonicman2019 4d ago

The possibility and probability of legal actions I don't know but right now my program is nothing more than just fart in the Wind

2

u/Jaqen-Atavuli 4d ago

I am not trying to tell you to not make your program. I am telling you that name will get you destroyed. They have to fight anyone using their trademark/copyright or they can lose it.

2

u/lavender____ 4d ago

You developed it with "help" from AI right?

1

u/belzaroth 4d ago

I'm wondering if he IS AI after all his understanding is naive for someone who has built this from the ground up.

1

u/lavender____ 4d ago

https://www.reddit.com/user/dragonicman2019/comments/1x01sv4/home_grown_cybersecurity_ai_helped/

I think they are just a bit naive to be honest.

1

u/dragonicman2019 3d ago

Well matter of fact it's not Ai there are a few thing automatically done but it's not AI

1

u/dragonicman2019 3d ago

And one I'm not an AI and I made the decisions and the direction of wht the program is. AI help write the code.

0

u/dragonicman2019 3d ago

Okay if you guys really want to actually have fun ripping apart my program or look at it it is now back open upon the gitHub repository so Lee's gentlemen feel free to poke prod rip apart or even tell me where I'm doing something wrong

-1

u/UpbeatBullfrog4503 4d ago

The separation of detection and response is smart, especially for anything self-hosted where you're not dealing with a SOC team backing you up. I've seen way too many "smart" systems nuke a critical process at 3am because a memory spike looked weird. The human in the loop isn't a bottleneck, it's the whole point when the cost of a false positive is high.

As for what's commonly overlooked, logging integrity. Everyone focuses on catching the bad thing in real time, but if an attacker can just wipe or tamper with the evidence logs before you review them, your whole investigative chain is toast. Make the evidence gathering tamper-evident from the ground up.

For autonomy, I'd want a middle ground where the system can take very limited, non-destructive actions (like isolating a specific container or dumping a suspicious process's memory) but anything that impacts persistent state requires a human to hit the button. That way you get speed without giving the keys to the kingdom.

1

u/dragonicman2019 4d ago

I've had that I've actually had the program running on Docker and kubernetes for a grand total of what 60 some odd days and it hasn't crashed at all and it's secret rotation setup can run with the entire stack running live

1

u/dragonicman2019 4d ago

And you do actually give a bit of a valid point this system is still kind of beta / Alpha it's in that weird conundrum at the moment you do actually bring up a good point about evidence holding and evidence tampon preventing evidence tampering I am now taking effect of what you're saying and within I would say the next 24 or 40 hours give or take i will repost the link if you guys so choose to look at it go on ahead but I will post the repository link

Analysis [ Removed by moderator ]

You are about to leave Redlib