This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
      • Netwitness XDR
      • EC-Council Training
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
    • Role-Based Training
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions
  • NetWitness Community
  • Discussions
  • Re: lighting effects for SA - Philips Hue integration
  • Options
    • Subscribe to RSS Feed
    • Mark Topic as New
    • Mark Topic as Read
    • Float this Topic for Current User
    • Bookmark
    • Subscribe
    • Mute
    • Printer Friendly Page

lighting effects for SA - Philips Hue integration

RSAAdmin
RSAAdmin Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2013-09-04 07:49 PM

376344097_640.jpg

 

I recently purchased a starter kit of the Philips Hue lighting system. http://www.meethue.com  Why?  They are wifi enabled multi-coloured light bulbs that can be programmed using a REST API.  In my endless search to justify the $249 price of three light bulbs I came up with a crazy idea.  What if I integrated the Hue lights into my SA 10.x deployment.  About 15 minutes later I had invented the first (to my knowledge) SA lighting effects and alerting solution.

philips_hue_starter_pack_iphone.jpg

 

The Hue bulbs work with a smart phone app or anything that can talk to the REST API of the base station.  This base station can turn on and off the lights or change the "hue" of each globe to reproduce any colour.  You can program the controller directly using REST calls (e.g. http://ip.addr/lights/on) or make use of any number of third party email-to-hue solutions.  I am using one of these third-party systems from IFTTT.  Just sign up for an account under an email address that your SA RE box can use and configure your Hue controller to talk via the web site.

 

IFTTT___My_Recipes.png

The first step is to define some if-then-that rules.  I've created some basic ones that will trigger on tags, such as #SSL here.  An email sent from the SARE alert to trigger@ifttt.com with the subject #SSL with trigger an action. In this case, it will turn on all my Hue lights red.  Other actions include blinking lights, cycling colours, turning off and on lights etc.  You could define different colours for different alerts... let your inner child go wild.

 

_ALERT__Define.png

Back in SA you will need to create some SMTP alerts that mirror the ifttt.com rules.  Here is a simple rule that will trigger the #SSL rule and turn the lights red.

 

http://developers.meethue.com/coreconcepts.html The Philips Hue system has a full REST API  so if anyone is keen to build a direct SA REST to Hue REST solution go nuts but please share.

 

Justification for $69 light globes is hard but the coolness factor of being alerted to outbound covert channels when your entire office lights up in red is priceless.

  • Community Thread
  • Discussion
  • Forum Thread
  • NetWitness
  • NW
  • NWP
  • RSA NetWitness
  • RSA NetWitness Platform
  • sa
1 Like
Reply
  • All forum topics
  • Previous Topic
  • Next Topic
6 REPLIES 6

RSAAdmin
RSAAdmin Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2013-09-05 10:29 AM

Was this a paid promo?  Not sure if trolling....

0 Likes
Reply

RSAAdmin
RSAAdmin Beginner
Beginner
In response to RSAAdmin
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2013-09-05 10:35 AM

It must be pretty elaborate trolling if that was the intent... built a SA server just to sell light bulbs.

 

Gees you security people are so paranoid.  😉

0 Likes
Reply

MatthewGardiner
MatthewGardiner Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2013-09-05 04:05 PM

Love it.  Alert type mood lighting...Red flashing light means this....blue means that....brings a little fun to the detection and investigative process!

0 Likes
Reply

SethGeftic
SethGeftic Beginner
Beginner
In response to RSAAdmin
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2013-09-16 11:01 AM

pretty cool.  I want a literal Red Alert in our CIRC now.

0 Likes
Reply

RSAAdmin
RSAAdmin Beginner
Beginner
In response to SethGeftic
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2013-09-17 08:16 AM

Seth I can't find the "Dislike" link for your post

1 Like
Reply

RSAAdmin
RSAAdmin Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2013-09-17 08:28 AM

I've set up my SA "mood lighting" to change colour based on the Country of origin of the alert.  i.e. Red = China, Green = Brazil, Blue = US etc. 

 

Strangely, my office is now permanently coloured red. 

0 Likes
Reply
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.