Laika is an object scanner and intrusion detection system that strives to achieve the following goals:
- Work across multiple systems
- High volume of input from many sources
- Modular architecture
- Highly configurable dispatching and dispositioning logic
- Tactical code insertion (without needing restart)
- Generate more metadata than you know what to do with
Each scan does three main actions on each object:
- Extract child objects Some objects are archives, some are wrappers, and others are obfuscators. Whatever the case may be, find children objects that should be scanned recursively by extracting them out.
- Mark flags Flags provide a means for dispositioning objects and for pivoting on future analysis.
- Add metadata Discover as much information describing the object for future analysis.
Laika is composed of the following pieces:
- Framework (
laika.py ) This is the core of Laika BOSS. It includes the object model and the dispatching logic.
- laikad This piece contains the code for running Laika as a deamonized, networked service using the ZeroMQ broker.
- cloudscan A command-line client for sending a local system file to a running service instance of Laika (laikad).
- modules The scan itself is composed of the running of modules. Each module is its own program that focuses on a particular sub-component of the overall file analysis.
Laika BOSS has been tested on the latest versions of CentOS and Ubuntu LTS
Installing on Ubuntu
Install framework dependencies:
Install network client and server dependencies:
apt-get install libzmq3 python-zmq python-gevent python-pexpect
Install module dependencies:
It is also recommend installing jq to parse Laika output.