Community Meetup April 13th, 2022: Product updates, Security Use Cases - n8n Service Accounts

so today's icebreaker question is as usual personal to me so i recently got a playstation 5 like just last saturday uh and i want to know which is your favorite game or if you're not into video games which is your favorite sport because i am an avid sports person i used to play football a lot and i'm trying to get back into sports so if not video games which is your favorite sport just let me know in the chat i am really excited to see what you folks love fortnite paintball martial arts these are okay the chat is just popping up for me so it's really difficult to catch up with everything uh let's see chess cycling then chess also gets a fresh one uh roller coaster tycoon i'll turn off okay spinning wow okay this is really interesting and wow now i honestly cannot differentiate which of these are video games and not because chess you can play on the video game as well as you can play with your friends uh but it's really exciting to see all these wonderful suggestions coming in yes max i agree on that paint paul is a blast all right uh i am gonna leave this person open for everyone to you know answer and you know just break the ice and kind of introduce yourself to each other and while you do that i am gonna go ahead and give you a quick idea of what the agenda looks like so we already went through the housekeeping rules once again for those who just joined in the meetup is being recorded so if you are not comfortable feel free to turn off your webcam if you have any questions ask them in the chat i am continuously monitoring the chat and i am gonna ask your questions uh to our speakers in the q a session and then be respectful and mindful of what you shared today all right so taking a look at the agenda as usual we got product updates from none other than max and there are so many new features that are coming up that we are excited to share with you all next we got wes lambert who works as a principal engineer at security onion solutions wes will talk about applying automation to security use cases with an attempt which is something interesting and i am really looking forward to and lastly no meetup is complete without a talk from jason so we got jason joining in to share some tips on how to keep your second team shame and after this we'll have a quick q a well again i am going to ask your questions to the speakers and then we'll have a small networking activity all right uh it takes a lot of time and effort to

design new features and max knows it well but when max is working on these features i am sure all he dreams of about is coming on this meetup and sharing it with you all uh so without further ado uh handing it over to max to share product updates with us all take it over max thanks so much for the warm introduction as always let me just share my screen here we can get stuck into it um does everyone see a slide check we're gonna go with i see some thumbs up okay so it's april hi everyone another month uh very excited to share what we've all been working on in the last month um i'd also like to take a quick moment to thank all of my amazing colleagues in our passionate community uh today i'm celebrating my two year anniversary at naden and it feels like we're just getting started but on that note let's dig into some fun stuff so the first thing i want to give you an update about is the node details you that we teased i think in the last meet up so the no details view this is the view when you have a node open and you're configuring its settings um we're releasing this refactor in a few different tranches the first one actually came out in the last and they then release overall across all the tranches our goals are to make this experience more intuitive clean and professional we also want to reinforce this concept that nodes accept input data you manipulate that data and then output that data so we're seeing here this isn't the version that's out now but we can see that metaphor being reinforced we have the input pane you set up some step the data goes through that input plane and goes out the other side to the output but one of the big things that we want to do for existing users is reduce the context switching you have to do between the canvas because of this input pane here you'll be able to see the immediate data flowing into this node it's also a drop down to select data early in your flow um and um this also will tease some exciting things that we want to do with data mapping we're envision focusing to be able to drag and drop parameters onto or drag and drop data from the input pane onto the parameters pane that'll be something that comes out after this features out um so the first transcends out now um there's a look and feel update it's also laying the foundation for a lot of the upcoming stuff so you might not feel a whole lot of new functionality but we're laying the groundwork for this stuff that you're seeing here um what it does add there's a sticky table header if you're used to using the table view um so the header stays as you scroll past lots of data there's improved ux for output branches and i can give you a quick demo of that if you haven't had a chance to update your an instance yet um so just quickly do that so this very simple workflow if i open up the function node here um we can see that we've got this new style output pane um if i were actually to constrain my viewport quickly here we can see just one second um when i make this shorter you can see that we got the sticky header there there's also an update to the json view etc so again this is just the foundation that we're making um in the if node you can see there's a bit of refactor as well on how we treat input and output branches and a few other um basically polishments and whatnot um but i think what we're all really excited about is this next challenge that's coming out that's going to add in this input pane from various user testing and whatnot we saw that it really did help folks not have to context switch um so this is a quick preview of it in figma we'll give you a little behind the scenes as well of what we're expecting to add with the input pane um but that will have um various empty states improvements for existing users you might not see as much benefit from that if you already know how to use it in we envision this is going to help newcomers um but how we envision this working is that um you have the center panel you have your inputs and your outputs and from time to time depending on the context you will be able to adjust this parameters pane to grow and shrink the input and output panels so we have a look here a little behind the scene sneak peek we can see the interaction pattern where when hovering on the parameters pane have this guy here and you can actually adjust that to grow and shrink those panes so um this is going to be the initial version of this refactor obviously there'll be a lot more coming down the line the second tranche we've already started on now that the first one's out and then the third tranche will be a smaller one collection of other tweaks and stuff that we basically didn't want to delay releasing outputs of the input pane on so that's going to be coming down the line pretty soon here the next feature that we've been busy on our work for canvas notes so this is something that we get a tease of um in the previous meetup um i'll be candid we hope to already release this feature um but there's quite a bit of complexity around the interaction patterns since it's something that's happening on the canvas and there's actually a lot of really functionality interactions keyboard shortcuts that sort of thing on the canvas um so we basically just need a bit more time on a few revisions to make sure it's a high quality v1 um i don't want to put a firm date on this um but i would anticipate that it will be out in april um so uh do watch this space for that um for those of you who weren't on the last meet up this will allow you to leave notes in your flow in this example we can see it could be things like a very small little note it could be something like a setup guide if you're sharing workflow templates internally or in the community and we also have designed it um some sort of rules in the z index or where uh is rendered on the canvas you can also use it for containers to sort of group processes um to make it a bit more understandable for other people um it does support markdown from v1 so as you can see here um numbered and unordered lists titles links emojis that sort of thing is supported we're using markdown library so there's a lot of other stuff that will also likely be supported out of the box um like any feature once this is out if there's things that you would like for it you know we do have an official post when it features out on the community forums do please get chatty in there um the next thing this is maybe a bit of a smaller feature but one i'm excited about nonetheless um we're going to be releasing dragging and dropping nodes from the nodes panel so something we notice a lot of user tests is folks when they use an editing for the first time they try to drag and drop from the nodes panel and we don't currently support that so this is a little sort of nice to have thing that we've been passionate about putting on the board we've got some new joiners some new front-end joiners so this is one of the tasks that they're knocking out um it's a small improvement i expect it'll be out in the next release or the one thereafter which is polishing up and shoring up a few edge cases that are browser-specific the next feature um is a little update on our public api we teased this in the last meet up and so just as a little update on where that's at the first resource is almost done it's the user's resource so this will allow you to programmatically manage users creating them updating and deleting them as you can imagine to get the first resource sort of working there was a lot of scaffolding needed to get it ready like authentication so we expect that adding more resources should be a lot faster than this first one i don't have a formal eta on this um but we're making great progress there's a lot of interest for this feature again the scaffolding is all set up so i expect it um to be out sooner than later the v1 there um as we usually do we don't want to hold back functionality and have it sit privately so we likely will release the entrances having some of the most important resources out collecting your feedback and then releasing out further coverage um thereafter um so after the public api another feature we're really excited about that we've got some traction already is our community node repository um so the idea behind this feature is that node creators out in the community will be able to submit their custom and it node packages to the npm public registry and then we're going to ship an in-app feature this is an example of it here excuse me that will allow users to install these packages via the ui so you don't have to be a system admin or get your hands dirty in terminal also so that you update and remove these packages via the ui so the goal of this feature is twofold um the first one is you know we do get feedback that our pr account github is relatively high we actually have a team working to chip away at that because we do really appreciate when you contribute and we see the community node repo is going to be another way to alleviate some of that pressure you know when you have a useful utility node or maybe you have some nodes that aren't quite meeting the ux uh standards or something to be put into the core repo you know have this opportunity where they can be pushed here you can get feedback on them um and perhaps in the future those could be ingested in it and um but this is also a step to sort of democratize this because just because some node doesn't meet the stringent criteria we might have doesn't mean that it might not be valuable for some community members um so we expect that this is going to allow us to share um there are some private nodes that we've seen some of you have and we really hope that you will contribute to this if you have any cool notes sitting around the design for this feature is finished back end is almost finished um we expect the front end to move relatively quickly as we're starting to see the benefits of the ended in design system that you're seeing in certain parts of the app being rolled out um so when this feature is closer to being ready we'll be posting on the community forums and probably on various channels asking for you to upload your custom node packages if you have them also have some docs on how to do that um so watch this space if you have some useful ones um i know some of you do i've gotten your emails and they seem really cool and we're excited for the global community to be able to use them soon um so that's the list of uh stuff that we're sharing as i always uh say this isn't everything that we're working on it's just sort of a scoop off the top um and if you have any feedback on what you'd like to see in these product updates more behind the scenes stuff more in depth on features that are out please do let me know you can reach me at twitter max to catch it's m-a-x-t-k-a-c-z or max nadendo io before i close up here um as always i just want to thank a whole team for their hard work on all of this stuff you know i get the privilege of sharing these updates but it's a lot of talented and motivated folks who bring this all to fruition um i would say probably one of my the biggest pleasures of my job is you know you're wearing over in pixel land and then you get the ping from an engineer it's ready for review you get to check it out you get to see what come alive so thanks to every one of my colleagues and our community members for making these features or realizing them and also the feedback that makes them actually helpful so thanks to all of you all right uh thank you max uh i can already see the ex excitement about these features in the chat and there are a lot of questions for you which i'm going to ask in the q a session but once again thank you for sharing the updates again a quick reminder for you all i am collecting your questions and will be asking them in the q a so if you have any questions formats don't forget to share them in the chat moving forward our next speaker west

lambert is a principal engineer at security union solutions where he helps companies to implement enterprise security monitoring solutions and better understand their computer networks west loves to solve problems and enhance organizational security and in today's talk wes is going to walk us through server ideas and give us an example implementation to get the wheels turning for analysts and engineers over to you yes hey how's it going everybody give me just a second here to share my screen can you see me okay our shield all right yes uh let's see okay just let me know if you're good with that and then i'll go ahead and get you all right well thank you guys again thank you for the introduction uh my name is wes lambert i just wanted to talk to you guys today about uh just some ways in which you can start thinking about how to automate security use cases if you aren't already uh just some simple kind of ways to get started with nan and what types of nodes you might use and that sort of thing so continuing with that i am a husband to an amazing beautiful wife and father of four crazy kids as mentioned i'm a principal engineer at security indian solutions where uh we have an enterprise security monitoring platform that is free and open that we help folks to implement and uh we maintain that their security and in solutions uh security ending and uh i have about 10 years a little over 10 years experience in iit and information security kind of in that same discipline in that same vein and really enjoy building those solutions that help security analysts and engineers work smarter uh you know more efficiently and not harder so that's what i kind of want to get folks thinking about today uh and really you know when we think about security and you know we hear about it all the time about uh you know these threats and these breaches and everything else as a blue teamer security can be hard right i mean there are a lot of different areas uh like compliance um you know a lot of different technical controls right just different things i mean the whole discipline is huge and there's so many things to think of and you know as a blue teamer it's often said that you know we have to think of all the ways that uh bad guys can break in and they just have to find a one way to break in right um so it can definitely be hard and uh you know the fact that there are these secure coding methodologies and uh practices that are in place these don't always necessarily equate to secure software right in these next generation firewalls um just having one in place does not necessarily mean that you have next level uh enterprise security um there are always going to be gaps and vulnerabilities right bad guys are always going to be finding ways to get in to poke at the software and find these little holes and you know they're always going to be just bad guys or even just people playing around and having opportunistic um you know fun with your um with your attack surface so um again security is hard and you know we just have to keep that in mind and keep in mind that they're we're always going to have to keep at it um you know there's never really going to be a stopping point uh and the solution right so what is the solution uh again there's no silver bullet right no one-size-fits-all approach everybody's enterprise is different everybody's attack surface and threat model is different and really the most important thing here is to be able to no matter what your resources you know a lot of times folks uh you know today or businesses today uh they may not have that many uh people on their security team they might not have a dedicated security team so we have to be able to scale these operations these folks that are in these roles we have to be able to scale analysis and scale response and be able to do that efficiently and effectively right so that's one of the goals of what i want to talk about today and the overall goals i think with these you know these folks and these teams really uh first and foremost to reduce that alert fatigue right so there may be um you know aside from tuning there may be hundreds or thousands or you know maybe even millions of alerts uh in some alert queue that an analyst is going to be investigating on a regular daily basis um we want to try to automate that and really reduce that fatigue and try to you know make things more efficient when we can and in doing so really focusing on those tasks that are repetitively uh performed or you know performed day in day out again and again by analysts that don't really make sense for them to keep doing you know going off and clicking and kind of doing the same thing to arrive at maybe a yes or no or some kind of answer that can be selected from a box right like um we don't want to eliminate the analysts either right so we want to keep the analysts in the equation we need that human factor right machines aren't the best at everything we need that human you know that cognitive ability that ability to discern given certain context and that's what's really important here is is providing a lot of context to an analyst more quickly so they can come to a decision around an investigation uh you know more quickly and resolve that investigation with that alert so that's really the goal here to increase the amount of context available and to do it quickly right empower the analyst so one common use case here and i'm going to be going through these kind of quickly because i've got a little bit to cover here um it's going to be initial alert triage right or reputation check typically an analyst might be sifting through an alert queue going through some ids alerts or other types of alerts from a security system right so one of the things that we might want to do is pull the system for new alerts or maybe send a notification if we get a new alert from a certain security system maybe it's an ids maybe it's a network-based ids or maybe it's a host-based ids intrusion detection system uh maybe it meets a certain threshold right maybe we want to query virus title for it and see if it has any context available for us or maybe some other source of information maybe some internal data some repository that we have and maybe we want to send an external alert right or some sort of notification if it exceeds that threshold or it matches some value this is you know one of those use cases that we might want to look into to help analysts get that context more quickly and be able to resolve that investigation and that alert more quickly right focus on the things that matter and make the best use of their time so in doing that here's a simple example workflow i don't have a link for it here but i can definitely produce that later but again to get a feel of what you might use here you might use something like an integral trigger to basically perform that pulling at an interval there may be a better way to do this i'm certainly not an expert so um but that's one way is using the interval trigger say every minute or every 30 seconds or even 10 seconds to pull if you have an elasticsearch database where your ids or whose space intrusion detection alerts are housed or other types of alerts a sim uh we can query that and then we can use that you know we can use the http node to query that and then transform that data with that function node and then if we need to submit that data however it's transformed we can submit that to virustotal you know some internal repo and then we can come to some determination more quickly and we can even chain these events together right so if we don't really know that this is you know potentially malicious yet we can kind of shift these around because this is a very contrived use case um but we can continue chaining those outputs and building that context right and then so based on that switch node if we feel like it's not necessarily malicious or something that we're deeming noteworthy right now we can acknowledge or dismiss healer right and then we can send an email if we do feel like that's something that we want to investigate further and maybe it's slack or you know maybe it's discord um or you know it's some additional piece of information uh we could use an http node to add on to that alert right to tack on additional details uh back into the sim or back into that data platform uh so that might be one way that you can achieve that right again a very simple example um but just a way kind of to get started thinking about how you might chain that together and produce the results that you're looking for make some water open now continuing on from use case one another use case and i'm sorry i said okay so um let me back up a little bit so one repository uh here like if you're running security in so um yeah i've worked for security in solutions obviously but that might be an example here i realized i just forgot to go back and address this but uh security enemy would hold house both those host space and audience baseball loads and other types of alerts and data that you can kind of uh you know pivot from there if you want to work from that workflow but going forward if you want to use something like an edr platform or you know something like an endpoint visibility tool maybe we have a use case where we want to search all of our hosts across our enterprise that are enrolled in that platform for a particular ioc right maybe we've gone through and we have an alert and we've investigated that alert to a certain degree on one host and we found this malicious executable or this file or whatever what if we want to search all other hosts and see if it's present there you know what's a quick easy way to do that well we can do that in somewhat automated fashion if we want to right so we could indicate this observable as an ioc in something like security in or another case management platform we can have something watching right if that particular platform has the ability to send to a web hook we can do that and send to the web hook trigger or we can use that http polling input again and we can also again route the observable if it's a hash or a file name we can route that based on the type and then we can perform a call to you know some edr platform to search that to the post for that particular ifc right and maybe if an ioc is found in that box maybe something that we know to be malicious we want that host to be quarantined right away right we want to cut off access so maybe if it's you know trying to perform c2 and x field data we want to cut off that communication and really only be able to connect to it from that endpoint or that er platform so that might be something we want to do as well so an example of that would be again i mentioned if that case management platform supports sending notifications to webhook we can use the webhook trigger here and edit in and that switch node to route by observable type so if it's a hash then we can go over here to the hash hunt and for velociraptor for example our edr tools choice here we can perform a hunt across all of our enrolled clients so every machine that we have enrolled in velociraptor and search for that hash on disk right and if it's found um i'll show you here's some other magic in just a minute we can then perform additional actions either through n8n or the edr tool itself and these hash hunts right here are really used or i'm sorry utilized by the execute command node so what we're doing here is actually just executing a local command a local python client to go off and perform that call i'm going to talk more about that and get in detail in just a minute with kind of an example implementation of what i put together everybody gets so far everybody follow along good okay awesome all right so tying it all together um a while back and this is i think uh kind of how hershel and i uh started talking i put together an article about using um security on in with the hive a free and open source platform or i'm sorry free and open platform they've kind of changed their licensing model now but for case management and incident management uh n8n and velociraptor to each to kind of take on the role of that you know that data platform with the intrusion detection system uh the log management the automation case management and edr platform so it's really an article put together to kind of walk you through how to set all this up together and i call it soar lab just because it's security ending and you know with automation and responses it's not necessarily a complete store but you can check out those links there and what i'm going to do next is just kind of walk through a couple of those components that are in there so the overall workflow is going to be that you know we see an interesting alert and security on it and then we create a case for that alert and then we have a platform called the last alert running which is going to be polling itself those that data in security and it's going to tell us whenever an observable or an ioc is added to a case in security in it and then from there it's going to hit that naden web hook and go through that workflow i described earlier and this link down here is going to be an example of that workflow that you can implement along with this or lab resources on github so going into a little bit more uh here's an example of a case that was created from an alert security ending so what happened here was a file was extracted out of the network stream and analyzed by a tool called stroka and what stroker did was it applied a yara to the rule or i'm sorry to the file and then it detected that it was indeed a malicious batch file and then it created an alert and security in it and then from there we escalated to a case inside of security and created a case from that alert and then we created an observable here from that event so this file it had an md5 hash yes i know md5 is not obviously not the best of hashes for files but for academic purposes we'll use it here so we have the md5 hash here from the event that was related to that file and that file was called poker. bat it was a batch file that was detected and then we've added an observable and security and in to associate it to that case that we created and when we did that what happened was in a last alert rule i was going off and it was perusing the data it was checking to see if there were any new observables added to a case and then once there was it went off and hit the in it in web hook right here and then once it hits that web hook what's going to happen is obviously it's going to receive the notification and then it's going to go through it's going to hit that switch node it's going to see that it's a hash i know this is empty here maybe not the best example but it's going to see that it's a hash so it's going to move on to that execute command node and what is going to happen here is what i mentioned before was it's going to execute that local python client and then it's going to start a hunt in velociraptor for this hash across all endpoints right so now what we're doing is we're taking you know some automation from inadena and we're also doing some other components from other platforms right we don't necessarily have to do everything during it in we could separately call each i you know call that a hunt and then results and do everything else but for our purpose we're just going to call a hunt and then it's going to go hunt for that data and what velociraptor has is these things called artifacts with some cat which encapsulate expert knowledge and it's going to go off and actually perform that action and perform that fun so we can see that it's going off and it's looking on a local endpoint it's performing a query for that particular hash and it did find that file and that hash on an endpoint and what it's going to do here is once it finds it this particular artifact here is actually going to check and say are there any completed flows that you know completed successfully basically and you know do they meet this criteria were they executed by security onion and did they have this particular artifact a regular expression in there and it's going to say if so then if there are results then i need to quarantine this host so then it executes this windows remediation quarantine here which is going to basically put that endpoint into a quarantined status to where we can go investigate it manually with velociraptor or do other uh perform other response actions right so again we could call out we could call the quarantine artifact or action from and it didn't if we wanted to manually but sometimes it's just best to utilize you know certain components of platforms that work best and just you know maybe use naden as the glue to get there and then and go from there right it just depends on your use case so again we've basically taken that observable data that we found from that alert and secured in it we've taken it all the way through inaden it's used velociraptor and it's api to execute a hunt across maybe a thousand endpoints and then automatically quarantined all of those hosts right and then if we want to go off and send an additional notification from there saying that all of these endpoints were quarantined we can certainly do that as well but if you want to check that out in more detail i'll stop rambling and you can go off and watch that in your own time later there is a video on youtube there an example video about how to set all that up um i will mention that we do not use the hive anymore in security endings so it would be without this hive component here and i will be rewriting that particular article and putting up a new video very soon to address that but uh you know if you do have questions or you have an interest in that please let me know uh other than that i think that is all that i have and uh you know if you want to ask any questions on twitter please feel free to reach out to the real w lambert or if you want to check out that code please be sure to check out my github there and i'll be glad to answer any questions that you have in the q a and elsewhere so thank you all right awesome uh thank you so much uh wes for sharing this i can see already people are finding this really useful and they are gonna try out anytime in the security cycle space if they haven't thank you once again for sharing this uh so moving forward uh we're gonna move on to the next talk now you might have interacted with the

next speakers it might be on the community forum on discord or on twitter so jason today has uh probably used an attend for almost everything i can say and uh today he is gonna talk about how you can create automation and still keep your check out teams shame so take it over jason hi okay i'm just going to stop sharing the screen listen you might not uh now be able to do it there we go all right and i'll even share my camera because wouldn't be a ending in session if i didn't have my hawaiian shirt on so i'm just going to share my screen if i can find the right one uh there we are all right i'm assuming everybody can see my screen yep uh so um today gonna be a little bit of a different presentation than what i typically do usually i come on here and show you some crazy thing i've done in naden uh but we're going to focus a little bit more because we're talking about security today focus a little bit more on how you set up and uh configure your nadn workflows in order to make sure that you don't break security policies uh can keep your secops teams sane by making their lives easier and we're going to do that by using um using the using service accounts within anything so i guess right off the bat you know what is a service account we don't necessarily hear about service accounts uh all the time uh quite often that's a new concept to people so i figured we'd spend a couple of minutes just kind of talking a little bit more about what the service account is so service accounts are actually a uh their special account for non-interactive processes which guess what that's what intent is what you do is you set up these accounts so that when you are doing different work and so on this is the account that's being used it's actually a commonly seen on most server-based operating systems so windows linux mac all these different systems have these service accounts built into them and so if you've ever run an apache server you might run across the www data service account so that's the account that's being used for um running all the apache servers and everything in behind the scenes so right now let's talk about how most no code low code systems work with credentials uh so typically what you'll do is you'll go in and um you'll use your unique credentials to access the platform so you'll blog in with your account but then once you get into the platform they ask you to do something which has always kind of thrown up a red flag for me to ask you to give your personal credentials to access all the other systems so if you want to access your mail account um your google drive what have you it always asks you for your personal account and that's always kind of made me nervous i tend to be a nervous person when it comes to stuff like that um and uh often that's in the form of like a third party um uh authorization so you're handing over your the keys to your google account or your facebook account for example and uh so when i look at that i'm going you know do i really trust this platform all right is it just me or has jason frozen for everyone else as well uh all right okay uh all right never mind uh while jason joins us back again let's go ahead and i have a lot of other questions uh to ask you now earlier i asked you questions around sports and video games well now it's a question that i think i might have asked you but times have changed and i think it was the first community meetup that we did so what is you know the app that you use kind of every day or you feel like you cannot live without you mean excluding n-a-n right yep excluding we got slack we got notion we got stretch it is pretty important got koda next cloud notion okay i think notion is winning this round let's see if we got more notion folks life code that's a new one for me i'm just gonna google that after the meetup we got tinder we got koda and kenwa all right uh figma is airplane interesting huh these are some interesting apps and i am familiar with most of them so i really like the choices that we have over here and jason is back uh jason just giving you the permissions you're good to go my apologies folks um i don't know if you've heard the old joke about how do you determine the best mechanic in town you look for the one with the worst car uh that's kind of what just happened to me my i've been having trouble with my computer lately and it just decides to reboot whenever it wants to and uh i've just been so busy working with naden workflows and stuff that i haven't had time to fix my own computer so anyway let's get back to where we left off um so i just finished talking about how you know handing over my personal credentials and so on kind of stresses me out a little bit when it comes to um to doing uh some of the stuff within a lot of these no code platforms and so i thought myself well there's got to be a better way to do this and um because really when you take a look at how we do it now you know there's really no differentiation between the user and the automation because there's no differentiation all kinds of problems come up so first of all you've got no independent control of your automation is always doing things as the user and so there's really no way to control it independently um second you kind of relinquish your control to the automation itself so that you know if the automation wants to do something as me i really can't stop it unless i have to go in and start working with the automation itself it's also pretty much impossible to audit the automation you know if um the automation looks like me and behaves like me and acts like me it is me and so if i have the second ops team go in and trying to figure out what happened you know to my account or what happened to uh something you know my email is missing they have no way of knowing if i deleted an email or the automation and then finally again i kind of alluded to this earlier um though you can't disable the automation from your side you have to go into the automation itself and stop it because if you do you're going to be stuck with disabling your own account so for example if you're using your email credentials in the automation and it's you know sending off random emails to people the only way that you can stop it without having access to the automation itself is to disable your own email account and that's just a disaster waiting to happen so this is where the service accounts come in my recommendation is that whenever you can create a separate service account for your automation so i will often create an anything account uh when i'm doing stuff i will create an automations account um for the um the startup that i'm uh i'm working with um you know we have an account called oasis and that's our automation account and so we know that whenever we see this account we see this information popping up we know that this is an automation doing this um so it gives us a bunch of things and the big part of it is around that isolates the automation from the user um so you can independently control the automation uh you know from the user you can disable the account enable the account and it's not going to have any effect on your personal account secondly you the user maintains control of his own account so it's not like stuff's going to be happening under your name it's all completely isolated the automations are very easily auditable because you'll have a different account name showing up as performing the different actions within the system and finally i if the if an automation goes rogue or something happens that shouldn't be happening it will very quickly be able to go and disable that account and stop it from doing things even if you don't have access to the naden dashboard or any of the other ending processes so how do you set up service accounts for any of that um it it really varies depending upon what platform you're going to be uh going in and working with so let's take a use case here uh just kind of give you guys an example so you're consulting to a business and that business wants you to have the ability to read their calendar information uh from nan to see people's availability they're using the g suite of systems so normally what you would do is you'd get that person's credentials and go in and access their uh information from their calendar two challenges come up to that so one what if you have a company of 100 people getting 100 people to come into nan put in all their credentials set up all that information especially with google because google's can be a challenge with all the different pieces that they need to do with the google console it's you're easily looking at a couple of hours per person and that's a pretty long project now mind you if you're billing that might not be a bad thing but um you may get some questions on your invoice if you create and enable an account within g suite for accessing the calendars then all you need to do is set up that naden account and then all the users can share their calendars with that ending automation account and then they've got the ability to look at different people's accounts look at their calendars whether they're busy what's available so on and so forth for other systems so going away from g suite what you might be able to do is create a separate account for them all together and in if you don't need to share information but just access it then you control the permissions so hubspot for example you go in create the account in hubspot and then hubspot uh would give ending and the ability to access what it needs based on the roles that it has uh so to summarize you keep independent control of the automation from over from the user maintains control of his own account the automation's actions are easily auditable and automation can be stopped from the uh the user or the automation side it's really the big advantages that you get from the service account and with that open to some questions or maybe i'll just pass it over to partial and uh we'll kind of keep on with the rest of the uh of the event here thank you so much jason for sharing this uh like this small tips uh can make a lot of difference and we don't realize that so thank you uh you know for sharing those tips and helping us realize how important such small things can be all right uh moving to uh the q and a part folks again if you have any

questions just pop it up in the chat and i am gonna ask our speakers all your questions all right uh the first question is how can we get hold of the logo is it for sale somewhere and i follow a similar question to that is i want to light up an intent logo behind herself so is there an stl file available max what do you think so firstly that's a very big compliment um thank you very much um when we made that sign we made a one-off we didn't expect that someone would run a door in their house with it but on that note um some of you maybe saw some tears about the naden rebrand i'm going to be a bit streamed there but there is one coming and i guess we've talked about it before as part of that we are looking at exciting things we can do with swag we get a lot of requests on this um i can imagine 3d light up and it ends signs won't be on the mvp list of that um but if you do want them keep asking for them because uh interest is going to be what's going to turn that from an idea to something gets shipped to your house so that's what i'll say on that wonderful uh on a more serious topic uh someone had a question on what is the purpose of the public api can you share a couple of use cases where the public api can be really useful absolutely so i think the immediate one if we think about any embedders people who are using it in their own product is to programmatically create users right you got hundreds of users you obviously don't want to be doing that manually that would be one way from there i think that the nice thing about apis is it's you know we're giving you the toolbox to do anything you like so some of the use cases that we've talked about with users are things like programmatically creating workflows so you have some sort of template you're making some sort of changes um and you can uh you should be able to crud those workflows right create read update and delete them um and other things could be things like activating deactivating workflows um potentially cred credential management that sort of thing in my mind i see there's a lot of sort of syncing between um instances and that sort of thing so really i would you know position to a tool of our users what are you going to do with it um you know we have k use cases that we've modeled and whatnot but assume they'll come out in tranches but assume any sort of top level entity we have in n and in the midterm we will have coverage for that so if you think about entities credentials workflows um community node packages you know envision that you'll be able to create read update and delete those all the sorts of things you would do with a rest api um and let your imagination run well then please tell us what you're going to do with it so we can ensure that that case is supported in future versions if it's not from the first one fantastic and talking about uh community notes we have a question over here can we create custom nodes and share with the community if yes what is the process or what would the process look like sure so you know today custom node packages are something that's possible right so you could theoretically post it on the forum somewhere and then someone could basically have to go through a manual process to install that get their hands dirty with the community node repo that's the exact intention is to have a sort of a home for these places and the reason why i say home is you know it's it has a network effect right it's going to be more valuable the more that it is a centralized repo with all these amazing nodes and everyone's publishing to that so um when that feature is being released we will have documentation how to do this there's a bit of a teaser on that we're going to be leveraging um npm keywords so there'll be a prefix in the name that you have to put in there that's just a requirement already event in you'll add the keyword that we're going to use for this um so then what we'll be able to use is to serve people npm views with that keyword pre-populated so they just see a list of all these nodes so there will be docs when that's ready to come out what i would say is if you already have something in a custom node package the prep work is going to be very minimal you're basically going to be npm has this package. json has a bit of metadata in there if you ever read me that kind of stuff it's going to probably take a short session to get that ready and publish it that's amazing and you also showed how you know people can use this custom nodes uh in any time uh but would that also allow us to install npm packages or it is or is it just for the nodes sure so um at the moment this functionality will be for community note packages themselves um a bit of context on that if we open up you know the more flexible features more cases we have the more edge cases we have and the more complicated the future gets so we made a conscious decision to limit it to community node workflows right now so we can focus make sure that there's a high quality viewing feature and roll that out um i assume uh in future you know on the roadmap especially if it's something that's requested by users we could use some of the underlying functionality we have to build for this to allow um generally installing npm packages through the ui so if that's something you want to do check in the form if there's someone's already asked for that upvote it if not create that and upvote it um right now we'll just be community node packages so it's going to do a quick check that the name's correct and whatnot and we will have a block list which we don't really intend to use too much but it'll be in the background if there's ever anything malicious that's known in the community as a sort of a initial defense so that you don't uh inadvertently install that it's a really nice way to segment to the next question which is what is the process that you define which platform is eligible to be a part of anything node can you please clarify the question uh so i am assuming they are asking you know how do we make sure like which node becomes a native node in a tan and which node remains as a community node sure so when it comes to as you can imagine there's a few different sources where we're getting requests let's say there's some that even come from different internal stakeholders various community and we have a forum that's a big one so generally how we prioritize these is we try to take a data-based approach um one of my colleagues niv is doing some great work on organizing that i believe there's some ended in workflows involved also potentially in making that happen but so we're gathering all this data and just like you prioritize most things it's the impact the effort and these sorts of things i would say there's no rubric for what would and wouldn't be allowed as a node i think the great thing about it again is community member builds something that you know some um close source product wouldn't deem worthy on their roadmap for a few years if it's high quality it's meets our ux standards you know we'll merge that in um so i would say there's no hard criteria on what types of services will accept um other than the node itself has to meet um various criteria in terms of quality now one thing i would say us internally talk about is we need to do a bit of a better job of communicating what that is there's various efforts on that so you can expect that will be more transparent etc but again our big push right now is the community notary books we have um give our community opportunity to be posting a note somewhere people using them getting value from that as we shore up a little bit the official process for node submission communicating how we expect that a sort of a native ended end mode should look and feel awesome uh thank you so much max for answering the questions i think those were all the questions i had for you uh wes i have a question for you uh which is the most common thread that you think everyone should automate sure so um this one i didn't actually demo because um i guess the others tied in a little better with the other with the project but uh like phishing email right like business email compromise um it's probably one of the largest right so um either analysis like proactive analysis of emails um you know or like automating the submission of those emails to sandboxes or whatever something like that something around phishing and uh business email compromise thank you so much for answering that well i'll say one more i'll add on somewhere as well because they're you know they're kind of hand in hand uh some ransomware and business email compromise yeah awesome fantastic thank you so much uh and i got last question for jason is jason still in the call i think he is restarting his machine no worries uh in the meantime uh i think max has some announcements to make uh and while we have get jason back on the call let's max i wanted to take it over thanks very much marshall um so soon our gracious host harshal um we'll be leaving nine as he takes on some new and exciting challenges um and behalf of everyone here at n i'd like to thank you for being so passionate about the product about what you do and about our community um when talking with harshal about this change i asked him what achievements he was most proud of with his time here and i like this question that i think it sort of the answers you receive really paint a picture of a person's character he mentioned he was really proud of helping community members on forums creating educational content and hosting meetups and i can say those activities absolutely had a meaningful impact on so many community members um and from harshal's answers i think it's clear to me that he thoroughly intrinsically enjoys helping others that's an amazing quality um to have and i'm sure you're going to make a lot more people smile in your next role harsher so partial thank you so much for your hard work nurturing our community and truly from the bottom of my heart good luck in this next chapter we all are rooting for you and excited to see what you do next um so on that note i'd like to introduce uh emma one of our new joiners she's going to be our new community manager taking the torch from harshall and i want to assure everyone that you're in very good hands yes hi everyone it's lovely to just start in the meetup and with such really amazing talks um thank you also for intro max um yeah really great talks today as well for max jason and wes i'm really hyped about updates as well especially the community node repo and yeah i'm the new community manager at nn so maybe just a bit about me a quick introduction um yeah and just some things i'm excited about um you know i'm originally from england i lived in germany now for eight years i started my career many years ago as like an avid community member myself with a lot of like motivation to share my ideas and yeah to be a community builder as well and kind of from that hobby i initiated my career in community management initially in the gaming industry which i felt was a lot of fun until i discovered open source developer communities and yeah i was working with a framework for building contextual chat bots and i would just say the community was a lot less covert than gaming communities and since then i haven't really looked back um yeah i just wanted to share maybe some of the things why or why i find my developer community so cool uh i really love how eager folks are to kind of learn from each other experiment like push limits of like extra making extraordinary projects uh like the sense of fellowship amongst other developers like to collaborate and build stuff together and share knowledge in general and yeah and just some things maybe that i want to share to ensure that you know we continue and that's really just like recognizing rewarding all of these really great technical and support contributions um maybe also recognition involves sending a neon signs at some point um but yeah that also um there are also like things like um that our platform remains a really great place for meaningful discussion and maintaining that great connection that you already have um with any and team here that um harsha's done a great job to mediate and uh yeah with all that being said i really look forward to getting to know all of you through our channels and events and initiatives that we all share together and just continuing with the great work of hashel and everyone here so yeah thank you so much and to really look forward to the future thank you so much everyone uh i honestly don't have a lot of stuff to see say like i am almost out of words but thank you so much everyone uh let's just continue uh and go ahead with the meetup uh jason uh i'm not sure what uh if he's gonna join us or not but he had a really cool giveaway so i am gonna check in with jason uh and see you know if you can do it async but uh emma let's maybe continue with the networking session yeah definitely so um yeah i will start to host the breakout rooms we have around 35 folks so about 11 rooms let's do one second um so i guess a good maybe icebreaker for folks as well maybe while i just set this up in case you struggle to find something to start with i think it's cool maybe to mention something like a current workflow that you're working on um and for example i'm working on something that will also acknowledge the achievements of members in the forum so stay tuned for that and now i will actually automatically assign the breakout rooms there we go and open all the rooms first time all right so the folks who are doing it for the first time you might now get a pop-up on your screen that is going to ask you to join a room just go ahead and click on the join button and you would be automatically uh paired up with someone from the community and you can go ahead and have a chat with them and you know just go and build your network and make new friends thank you i will move folks that are alone here uh you