夜莺是⼀款开源云原⽣监控⼯具，是中国计算机学会接受捐赠并托管的 第⼀个开源项⽬，在GitHub上有超过8500颗星，上百位社区贡献者， 上万家企业⽤户，是国内领先的开源可观测性解决⽅案。 创始团队均来⾃国内⼀线互联⽹公司：创始团队在 等互联⽹公 司，⻓期担任基础设施、云计算、稳定性保障等⽅向的负责⼈。 公司简介：快猫星云是⼀家云原⽣智能运维科技公司 由国内顶级投资机构连续投资。 INTERNAL OR Categraf • 是⼀款 All-in-One 的开源的 telemetry 数据采集器，⽀持指标、⽇志采集； • ⽀持 Tracing 数据的收集； • ⽀持物理机、虚拟机、交换机、容器、K8s、多种中间件/数据库的数据采集，云上云下，均可监控； • 汇聚领域最佳实践，开箱即⽤； INTERNAL OR RESTRICTED, ALL RIGHTS RESERVED © 北京快猫星云科技有限公司 © 北京快猫星云科技有限公司 告警⽇历 INTERNAL OR RESTRICTED, ALL RIGHTS RESERVED © 北京快猫星云科技有限公司 通过告警升级的机制，有效的协调⼀线和⼆线的⼯作安排，避免告警漏处理。 告警升级 INTERNAL OR RESTRICTED, ALL RIGHTS RESERVED © 北京快猫星云科技有限公司 告警通知 INTERNAL OR

Tutorials and standards ii. Google – Single repository with over 1B files and over 2B SLOC, over 25K engineers for every Google property d. SPREAD KNOWLEDGE BY USING AUTOMATED TESTS AS DOCUMENTATION versions of the same library iii. 2014 Verizon PCI Data Breach Investigation Report – studies over 85K cardholder breaches. 10 vulnerabilities accounted for 97% of the exploits used. 8 of the 10 exploits telemetry to help fulfill infosec objectives and integrate security telemetry into the same tools k. CREATING SECURITY TELEMETRY IN OUR APPLICATIONS i. Create relevant telemetry 1. Successful/unsuccessful

Google – single, share repository of billions of files. 50% of code is changed each month. 40K code commits/day, 120K automated test suites, 75M tests cases/day e. CONTINUOUSLY BUILD, TEST, AND INTEGRATE unreliable tests and false positives iv. Focus on automating tests that genuinely validate business goals k. INTEGRATE PERFORMANCE TESTING INTO OUR TEST SUITE i. Discovering performance issues in production

Taking criminals down hard; no respect for “bad guys” vs Think about what others need Complaints $70k per, 2-3/month Cutting 100M from budget Finding a way to keep others from cutting their budgets vs

infrastructure – shared databases iv. Bounded context – compartmentalized and well-defined interfaces k. KEEP TEAM SIZES SMALL (THE “2-PIZZA TEAM” RULE) 10. Ch. 8 How to Get Great Outcomes by Integrating

亦可通过云(Windows vps)直接反控⽬标管理员个⼈机 CVE- 2019-0887 ] 利⽤补丁服务器下发执⾏ 利⽤EDR主控端定向下发执⾏ 从 Windows 平台 横向⾄ *inux 平台 li k 或者 基于Wi d SSH库⾃⾏开发各种远程执⾏⼩⼯具 plink 或者 基于Windows SSH库⾃⾏开发各种远程执⾏⼩⼯具 从 *inux 平台 横向⾄ Windows 平台 ⼀般都会将