Basics of OpenKAT

Contains references to the documentations of the Basics of OpenKAT

Contents

• Basics of OpenKAT
• How does OpenKAT work?
  • General notes
  • Basic concepts
    • Objects, the data model and recursivity
    • Indemnification
    • Users and organizations
  • System design
    • Collection: Boefjes and Whiskers
    • Storage: Bytes and Octopoes
    • Analysis: Bits
    • Reports
• Modules
  • Rocky - frontend
  • Mula - scheduler
  • Octopoes - datamodel
  • Bytes - raw data storage
  • Boefjes and whiskers - scanners and normalizers
  • Manon - styling
• Scan levels, clearance & indemnities
  • Indemification by user
  • Inheritance
  • Extended profiles
    • L0: Do not scan
    • L1: Do not touch
    • L2: Touching at the normal user level
    • L3: Detectable scan
    • L4: Intensive scan
• Working with objects
  • Properties
  • Start scan
  • View Findings
• Boefjes
• Bits
• Normalizers
  • Burp Suite
• Questions & Configs
  • Disallowed CSP hostnames
  • OOIs in headers
  • Port mapping
• Users and organizations
  • Organizations
  • Users
  • Rights and functions per user type
  • User management
  • Adding users through a CSV file
    • How does it work?
    • How should I prepare the CSV file?
    • User notification
  • API token authentication
• Plugins for OpenKAT: boefjes, whiskers and bits
  • What types of plugins are available?
  • How does it work?
  • Where to start?
  • Existing boefjes
    • Object-types, classes and objects.
    • Example: the boefje for shodan
      • boefje.json
      • schema.json
      • main.py
    • Normalizers
      • normalizer.json
      • normalize.py
      • Yielding a DeclaredScanProfile
  • Adding object-types
  • Bits: businessrules
  • Configurable bits
    • Question object
    • My first question object
    • What happens in the background?
    • Advantages and outlook
  • Add Boefjes
• Trusted timestamps in OpenKAT
  • About the protocol
  • Available timestamp servers
  • How to verify a timestamp?
    • Download the raw data
    • Verify the hash
    • Verify the timestamp
    • Automation of the verification process