For our first speaker today, we have Brian on generating labeled data from adversary simulations with MITRE ATTACK. Please give it up for him. Thank you very much for coming so early on Sunday morning. That's awesome. I appreciate you guys coming and listening to this for a little bit. I wanted to talk to you about a couple of things and just give you a little bit of background on how I see this problem set. So the general premise here is that whatever I'm looking at, whether it's prologs or whatever the problem is that I'm trying to solve, I try to recognize the biases that I have. So I looked at this last week, I looked at this last month, that kind of idea. So if I can abstract away some of that bias and have a repeatable methodology, something that's based on math, maybe I can find some insights. And the interesting thing about what I'm talking about today is for me it's not theoretical at all. We have an internal red team that's really proficient. Is anyone here from the red team? We have a red team that sometimes will perform some activities based on MITRE ATTACK. And whether that's DNS exfiltration like we're talking about today or some other technique, they'll hit a canary URL first. So think about white box and overt out in the open versus black box. So if you heard of the threat hunting, the hypothesis, I think that there might be DNS exfiltration and therefore you come up with a plan and look for the artifacts. We'll get into that in a minute. But for me it's not theoretical at all. I know based on what I saw here that those guys, my friends that I drank beer and bourbon with, that they ripped us off. They broke in and they stole some stuff on May 18th, 2018. And that was the white box overt time where they hit the canary URL. And I know from patterns that means that they probably broke in again in a covert black box way. So when we talk about assumed reach, completely not theoretical, whether you believe in that philosophy or not, which I do, I know that these guys that bought me a beer the other night, they're probably sitting on some data that they exfilt. So that's kind of the background that we'll get into here with the threat hunting and how this ties in. But here's the quick agenda. Do a very quick intro. Believe it or not, the MITRE ATTACK is going to be real quick. Love MITRE ATTACK, absolutely do. But I think a lot of CFPs, a lot of cons, a lot of stuff's getting saturated, right? So if anybody wants more information that I'm going to provide in the slides here, please come up. I'll talk about it as long as you want to afterwards. But I'm going to trim that down just a little bit because I think everyone's probably heard a lot about it recently. So harvesting labeled training data. I'll get into what I mean by that. EDA, exploratory data analysis, machine learning, worked example. And I'll talk about just very candidly some challenges that I've run into and a little bit about future work. So before I do that, I just wanted to get a quick sense of what the background is in the room. So if we could just start here and we'll go around and tell everybody what you do and name. Okay, well, how about, could I just see a show of hands? How many people do something like threat hunting? How many people do any kind of data analytics outside of Excel? Awesome. And how many people have some sort of program where you're doing adversary simulation, where you've got actual purple team, both folks internal. Okay, cool. Thank you very much. That was a terrible idea. I don't know what I was thinking. All right, so real quickly about me. My name is Brian. I'm a threat hunting lead at a Fortune 100 financial services company. I also help out with the threat intelligence and now security orchestration, automation, response or SOAR. But the bottom line for me is that there's one prime directive. It's find evil. You know, Rob Lee from Sands talks about no normal find evil. I mean, I think about this all day, sometimes all night, I hear about that a little bit from my wife sometimes, but she's been very patient with that. It's almost an obsession. So minor attack framework, we're probably mostly familiar with it, but just to level set. It's tactics techniques, common knowledge, and it's a curated knowledge base and model for cyber adversary behavior, reflecting the various phases and adversaries lifecycle and the platforms they're known to target. So my buddy Zach, the lead red team guy at our place in Milwaukee, we did a talk at Derby Con in 2016. It's a small world. Anybody see that talking 2016 Derby Con? So we were just talking about very open, kimono, very transparent. Here's what we were trying to do with limited resources and budget and everything else. Because there's a lot of techniques. Here's what we tried. Here's why we're doing it. And here were the results. So I didn't put the attack timeline on here, but I know that we have pre attack now. But at that point, we were just primarily focusing on the later stages of attack. So that's the context in which I'm talking about some of these techniques. So in particular, and we're talking about exfiltration over alternative protocol. You know, I didn't blow this up because I wanted to fit everything on there. So you don't need to see what's on there. I will, I will make sure that I have my Twitter handle, which is just at Brian Gens. If anybody wants to watch that, I'll have all these slides up by Tuesday, Tuesday, midnight, central daylight time. So exfiltration over alternative protocol. Here, I'm focused on DNS. So as anybody think of any tools that you might use for DNS exfiltration, go ahead and shout it out. Somebody said iodine. Yep. Anybody else? Cobalt strike fans or write your own. So there's a lot of different ways you can do this, right? Interestingly, I don't want to create an overfitted model. If anybody ever see that thing, there was some kind of picture I saw on Twitter from the Bay Area and it was talking about overfitting a model. I can't verify whether this is true or not, but maybe somebody in the back can tell me if you heard about this, essentially that a lot of the models were trained on roads, the Tesla's with the self-driving car mode in the Bay Area. And then when they were driving on roads that were outside of that area, that didn't fit the initial kind of things that was used to. There were five salt lines that were laid down by a salt truck and that that was just messing with that. So if anybody heard about that, cool. If not, it's one example in my mind of how if I try to detect my buddies that are breaking in and stealing data, because if I can't detect them, I can't detect somebody else doing it, right? If I focus only on what it looks like with cobalt strike, that's too narrow, right? You use i9, maybe I'll catch it, maybe I won't. So the point is that this is one of many techniques, but it's one that we focused on because we had the instrumentation and the telemetry to dig into. So really, for me, all minor attack is it's a true north. It's a true north where I and we can sit in front of our CISO and executive leadership and say, certainly there are compliance requirements, there are other things that we have to do and boxes that need to be checked. But let's focus on what the attackers are doing. They don't have to do something off the menu, on the menu, off the menu, it's up to them. But let's start with known TTPs and tighten up our monitoring and our detection engineering efforts. So I'm not going to spend a lot of time on this. If you follow this stuff, you're probably familiar with Katie Nichols and there's a couple other folks who did that. But MITRE has got Caldera, Red Canaries, got Atomic Red Team, Uber's got Meta, and Games got Red Team Automation. They're varying degrees of what they're automating, but it's essentially helping teams, these are open source, helping teams figure out how to do repeatable processes for adversary simulation. And then CyberwarDog, Roberto Rodriguez, I think is at SpectreOps now and DevonKer and GameRank. I had an article that this will be linked to if you want to go to it when I send the slides out. Basically, they were using the API and hooking it in with basically letting you dig into that. Hang on just a minute. I'll get some more vodka. Just kidding. And then that talk that we did is online if you want to look at that. So there I was, my name is Alan Business. Red Team's sitting here, I'm sitting on the right, and the Red Team is lighting things up, probably Cobalt Strike at the time. And honestly, I can see them, they hit enter, and they're waiting for something to call back and then starts popping up. I think that they're counting the milliseconds to okay, I got a call back here. And then they're kind of looking at me, like, are your systems lighting up yet? Why aren't you guys hunting for this? Why aren't you guys looking at a ticket from Splunk or whatever Simi use? I looked back at it and there were 300 rows that were specifically related to what my buddy Matt and Zach had done. Has anybody heard of Low Cards Exchange Principle? So every contact leaves a trace. If a burglar breaks in, might break a window, might leave some skin, might leave some hair, some kind of sample that law enforcement could use to trace back at a DNA sample. Footprints outside of its muddy, this is what we're trying to do with Mitre Attack to identify Chris Sanders who has the investigation theory course. We brought him in in December to do some training for our folks. And he talks about a triangle of pyramids he's got of four different kinds of evidence sources. And he breaks it down like network, host, memory and OSINT. And I want to know what are the digital artifacts that are left when my buddies or somebody else breaks in and steal stuff? And our architecture is not like yours. Your architecture probably isn't exactly like it was six months ago or a year ago. So I think there's a lot of value in seeing what this looks like. And why is everything moving on the screen because it's early? I know how this goes. It was slightly amusing to do that because it's parallax and that's better than PowerPoint animation. So I think that counts. I don't think that's against the rules. But something that moves. So how many people have heard of EDA, exploratory data analysis? Well, let's start with, and again, don't worry about trying to read the small texture. What I wanted to show is the entirety of this rectangle, which is from Coralite's Brochi sheet. And this is all the DNS log fields and the type and the description of that. So in a minute when we're trying to figure out how do we represent the knowledge of what we're seeing on the network, how do we represent that and convert it into a feature? Or think of a column in a spreadsheet, right? How do we convert that into a feature that we can kind of hook into? And just in the same way that maybe you're training a child in some experiment, I don't know, to classify a fork versus a spoon, if none of that's labeled, if you don't know what the ground truth is, you're dependent on somebody coming and doing that. Otherwise, all you can do is kind of cluster them based on similarities, right? But the first thing we have to do before we make those decisions is understand what AA is. What does that mean in your environment? Protocol, proto, and then there's some other stuff we'll get into in a minute. But when I say ADA, I'm talking about starting with that. Jupyter Notebook used to be iPython Notebook. This is actually from Clarence's book that I've got here. Shameless plug. But I say that because this is from Chapter 2 of one of my new favorite books. Did anybody else buy data-driven security in 2014, like the day it came out? Yeah. This is something I've been digging into and it's very helpful. And it just reminds me that there's always something to learn and I always find extremely valuable to get somebody else's perspective here. So this is actually from the O'Reilly GitHub. And it's just an example of bringing in some imports, loading the data, and just kind of standard pieces there. Pandas, data frame just oversimplify if you haven't heard of it before. But I like to think of it visually as an Excel spreadsheet. I'm probably going to have pitchforks and torches after that comment. But I think it's tabular so you could think of it right now, but it does much, much more. Has anybody heard of KitWear's Bro Analysis Tools? So there's a guy named Brian. He's one of the developers there. And I just can't say enough good things about these folks too because I wasn't at BroCon last year. I saw the video that he'd done. And again, there'll be a link in this one at the bottom. And I contacted Brian because I was stuck on something on his open source code. I don't like to do that. I don't like to ask people to Google stuff for me to figure something out.  I said, you know, I'll figure this out. I'm just not sure how long it's going to take. And I just sent him my question. And without getting into the details, it was essentially around why can't I join two of these data frames together? And it was because of something on the back end, the way they were doing the pre-processing with Bro Analysis Tools, which they describe as a software bridge. So you can get from Bro to Pandas and then from Pandas to Scikit Learn, which we'll talk about in a minute. But he appreciated the feedback from somebody kind of in the field, in the trenches, saying, this is what I'm trying to do. And he explained to me what the workaround was because it was a different data type. So just another great example of people, you know, pitching in the open source community. And I mean, I sent the dude an email at like nine or 10 at night and he responded that night by midnight. So it just, it's really encouraging when you're kind of working through something and somebody else helps you out a little bit. So feature engineering, again, we're trying to figure out what, what are the things that we can use to categorize something? You know, this is, you could talk about height, diameter, top. So in the same way, we want to find ways to represent the knowledge to describe what's going on, on the network with DNS. And hopefully that's going to allow us to figure out what features we can hook into and then train a model so we can catch my buddies the next time they break in. Okay. Griffin data science virtual environment. This is Charles Gevray. He does a class here with Austin Taylor and sometimes with J Jacobs from daily driven security. Awesome folks. He's got, I don't know if this is accurate. I've always thought of it as the Cali Linux for data science. So I use this. It's, it's pretty decent. And again, there'll be a link there. So I said, we're going to do a machine learning worked example. I pulled, I pulled some stuff out of this after listening to some of the other talks just because I wanted to make sure that I don't cram some kind of crazy algorithm in and, and try to show everything that I'm doing. Because again, I mentioned I'm doing a little bit of orchestration automation. So I want to kind of have that cycle going where I'm getting an internal IP address, you know, going forward and then enriching that with friendly intelligence or okay, here's the IP address, which host grab that let's assume 24 hour lease from in it. Okay, which host, which internal host name has it? Who's the last logged in user with that then go collect some other stuff. The more you can find out in the faster you can find out, feed that back in. There might be a feature or column that you can compute or some other insight. I'm gonna say reputation score. I know it's terrible example, but some other verifiable piece of information that you can create another column about and a very fine print in the bottom. I'm being very explicit about giving credit to Charles Gevry because I literally lifted this from his slide. I just made a different color. So thank you, Charles. There's different descriptions of how this works.  Now some of this stuff. This is naive of me. When I thought bro logs, I'm like, bro logs are pretty structured, right? I'm not gonna have a lot of this. No, because there's a lot of getting it from where it is to where it needs to go. A lot of the data engineering and the pipeline that kind of stuff. And believe it or not ID dot O R I G underscore H. That's the one I'm going to think of as the source IP that initiated that DNS request. Just the fact anybody think of a problem when you start doing stuff in Python and the label, the field or column name is called dot something. So you're going to throw an error, right? And it's just simple things like that where you'll see that in a few minutes here where we have a column that's renamed, not a big deal. But I wouldn't have thought that I'd run into that. It's just a different use than maybe we originally thought of for it. But then with the pre processing feature engineering, bro analysis tools, again, Kitware describes that as an open source software bridge that's going to kind of do some of the behind the scenes heavy lifting. So you can just use it kind of as a gray box and move forward with what you're trying to analyze. And then advanced feature selection. Then we have the data that we're going to split into train and test and then we'll build the model and we'll evaluate the model. And I tried a couple of different things. So I'll show you a couple of differences. But the main thing that popped into my head when we started talking about this is if I have labeled data, if I can use labeled data when we train that model, now I can move from unsupervised, which is clustering to supervised. Now we've got, I know from the 300 records that are from the DNS exfiltration from cobalt strike or whatever it is, I know what they did when they did it on May 18. So I have another column where it's one, if it's known malicious, and it's zero if it's not. Does that solve everything? No, there's some issues there because what are the attackers and red team want to do? You want to be stealthy. And the better your trade craft is, the more stealthy you are. The more stealthy you are and the quieter you are, the fewer artifacts that I have, which leads to something we call class imbalance. And you can correct for that. You can adjust for that. But I kind of wonder sometimes, do I want to? Do I want to make that seem like it's a bigger part of the log data than it really is? So I'm importing pandas. And then we just have a as pd. I'm importing numpy, get into the matrix, and then from bat, bro analysis tools, which he's going to change the name after they change the name at some point. So keep in mind that this will be called something else because bro itself is changing the name of their offering. But import log to data frame. And then a lot of times you'll say df equals, I just put dns underscore df equals. And I'm calling log to data frame dot log to data frame path to this is one hour's worth of logs. One hour's worth of logs. And then next I see dns df dot rename columns. So you see what I was talking about the id.origin. So if you have something dot id.origin, you're going to throw an error. And anything I say, there's two or three ways you could probably get around that. This is the quickest for me. Filtered dns df. All I'm saying there is the data frame, we call the dns df. The data frame is after the equal sign. So we're saying dns underscore df, we're referencing that panda's data frame. And then in the square brackets, we're saying id underscore origin underscore h, that's the host that initiated that dns request dot string contains. And you know, I masked this, but there is a there's a large subnet that wasn't relevant to this. And I won't get into that for opposite reasons, of course, but the point is, you know, you might segment that through, you might go through and convert the IPs to integers. You might, you know, you can do ranges, you can do a lot of different stuff with that. And I think that's actually covered in the data-driven security book, among other places. And then I did the type filtered just to make sure, you know, after I talked to Brian from Kitware. So I'm kind of leaving myself some breadcrumbs and going through. I pulled all the comments out of this just to make it easier to have less on the screen. So this is just a nuance, but filtered dns df dot is copy equals false. It's trying to be helpful if you don't do that and say, hey, you keep slicing these things off and you're trying to do things on a copy. So I had to Google that and it turns out if you just do equals false, then it stops throwing those errors. Sounds pretty scientific, right? Filter dns df query length. So here, what I'm doing, this is the, the current version of the data frame or the tabular data structure that we're dealing with. And then I say query length in quotes equals. And then I'm saying add a new column. And what I want in that column for each row is the data frame and then give me the length of what's in the query. So again, when you start talking about malicious URLs, when you start talking about message length and that kind of stuff, this might seem like one of the go-to things. However, I took a bunch of the other stuff off because originally, you know, when I'm trying to do this in a production environment, I want to know for that IP address, for that time period, or maybe expand it to longer, like 24 hours, does that IP address, and what does that look like in terms of the con.log? A lot of you, I'm sure, are familiar with con.log. But if you're not, I think of con.log and bro as the closest I'm going to get to 100% net flow, right? So basically just the phone record and set of the phone conversation. So I'm trying to take an entity-based view of this, a user 360 and a device 360 and essentially understand what behaviors are being exhibited by that host during that time frame. So just real quick aside, how many people have heard of Black Hills Information Security's RETA? Is anybody using RETA? I think I've got a link in there. I'll make sure it is before I send it out. But I've been using that for a while.  I should be more precise.  And Jon Stran and a couple guys did a talk at Derby County a couple places. They're using some kind of crazy math behind the scenes like fast Fourier transform and looking at the signals. And what you get, I just use the command line, but they've got an AI Hunter product. What you get is basically a table or a CSV. And when I cat it out on the command line, what I see is a score on the left. Yeah, we're 99% sure this thing's beaconing. Well, there's other stuff that looks like beaconing, right? So I don't ever want to have one view into something. I want to have a more holistic approach and enrich these things by either computing new features, add a column, perform an operation on a different column. And now I know something else about that entity and that record. So the next one, 22. In 22, you have to put percent matplotlib inline so that you can have the plot actually display in a minute here. And the rest of this is just in 22, just the formatting for how I want that plot to look. There's a lot of cleaner and more sophisticated looking things. I just wanted to have the basics out there. And then in 23, we're just saying import math. And we're going to look at entropy. So entropy, you might have something along the lines of base 64, base 32 encoded, or you might have some encryption. So either way, I find that to be pretty helpful. Filter DNS. Again, we're creating a new column entropy. We're running Lambda. So in the data frame, you don't have to do four loops, shouldn't do four loops. You want to, you know, map or apply or use a Lambda function. And you're hitting it on that series, which is that column, right? So essentially, very quickly, I'm populating the value of this new column entropy with the results of that mathematical function. And now I know two more things about each of these rows. I know the message length, and I know the entropy. When I look at the length after I filtered out that other, those segments I didn't need were at 14,000. In 27, do you remember I was talking about that Canary URL? It's not actually called Canary URL. I did a sophisticated find and replace, and I masked it, because that's also scientific. So I'm trying to understand length of all of that inside the parentheses, which means just to zoom back out for a minute, that my friends on the red team internally have 121 records or DNS message requests or messages that were logged during 8 to 9 a.m. Well, look at that 121 out of 14,000. That's what I'm talking about in terms of the class imbalance. So Mitre attack, here's one of the ways this fits in. I can help do the detection engineering. I can help look for those artifacts. Every contact leaves a trace. I can help that will help me dig in and start dissecting things. And I have one goal in mind. I'm trying to protect this house. I'm trying to find how they did the X fill and then see if there's any similarities that I can come up with. And if that works out mathematically, then maybe I can run that against everything else from May 18th until yesterday and see what I find. So, you know, the point is I keyed in on that Canary URL, and now I can isolate the traces that they left based on that overt white box attack. And from there, this is a little bit early, you know, I don't really need to add this column just yet, but that's where it was and I didn't want to mess around with it. Excuse me. So essentially what I'm doing is filter DNSDF. I'm creating a new column called is malicious. This is my label. I'm going to have essentially it's, if it contains this Canary URL, is malicious is going to have a value of one. Notice I did a dot map. It's going to hit everything. The other interesting thing that I saw, has anybody ever seen bro logs with DNS, with DNS X fill, where once in a while you'll see a API dot encrypted string, 200 characters long, and then a post dot. Anybody have any ideas what that is? Yeah. Yes sir. No, I was hoping you told me, man. Now, so basically, again, this is a pattern. So I don't know this. That's kind of a Hail Mary when I throw that out there. Normally, I'm going to look at the make sure that these variables aren't related. I'm going to make sure that I look at the feature importance. We're not going to get into that right now because of time. Someone hurry up just a little bit. If it has post in it, now I'm looking for a string, right? So this is the thing about the spy versus spy. Anybody in here in the room that sees how I'm doing this, you're going to come up with a different way around it. So that's why I have to keep doing this and making sure that the model doesn't degrade and I don't get lazy in the detection here. We talked about query length. So I just said for the data frame, filter DNSDF, and then I want to know about the column that has the values that we computed, which is the query length. So we computed the feature, populated the column for each row, and now we have a histogram. So it might be kind of hard to see in the back. I didn't blow this up. There's some different things you can do on the scale here and that visualization didn't look much better. But you see a preponderance, try to work that word in on a Sunday morning, every possible chance. You see a high number over 14,000, it looks like, of DNS requests that are what, 25, 30, and then way over there on the right, you see just a few, I'm guessing like, not 121, maybe like 106 or something, that are 200. Can you write a signature? Can you write a rule that says, hey, anything that's got message length and DNS over 40 is malicious and flag it? What's going to happen when you do that? Yeah, it's going to light up, right? Because there's stuff that looks like that. Now, we computed two things, though. We figured out the entropy. You know, what's the degree of randomness? And in a moment, I'll show what the ranges are for the values. But in the upper right-hand corner, that's weird, right? So we've got, when we look at entropy against query length, something's definitely unique about those. So I'm going to bust through a lot of this, short on time. Thank you. I'll get it. Anybody has any questions about this? Again, I'll have the slides up by Tuesday at Brian Gens on Twitter. I'll put out the link there, but I'm going to push through the rest of this. So I said, here are the columns that I want for features. So now I made a new data frame. I said, I may have a new tabular data structure here, but only give me the data that's in these columns in series. And that's my new features underscore DF. We imported some other things. And again, the scikit-learn, we had a software bridge from bro to pandas to scikit-learn and bro analysis tools. And bro analysis tools is doing a lot of this transformation for us. Again, without us doing adversary simulation, I'm stuck with clustering because I don't have any ground truth labels. So where's the evil? Where's Waldo? Where's my buddy Zach and Matt? Anybody have any idea which one's malicious? You shouldn't be able to tell. I mean, you might have some ideas, but this is one issue that I run into with just clustering stuff. So with minor attack, I've got a column that's got one if it's known malicious because my buddy just did it. And there's a zero if I don't know, right? I don't know that it's so what I'm doing here is creating another data frame. And I'm going to push past that. Essentially, I'm going to split that into train and test sets, train the classifier model, make predictions. I'm using logistic regression, not maybe the kind you might think about from stats. And then I'm saying, Hey, predict, you know, how well is this model going to do once we get to the results? And in this case, it was 99.85% accurate when we look at the model evaluation or model results. But that's not the whole story. Overall, it had in the 2775, you know, we're okay with the top left and the bottom right, the four on the bottom left, that means there were four malicious ones that I told the model that those are malicious. And we, we miss those. So again, it has to do with your threshold and how it works. So again, that's the model we looked at. We need new slash right, more signal, less noise.  If anybody has any other perspectives on it, come see me afterwards and be interested to hear your perspective. But I just think that the more stealthy attackers are, the fewer footprints, the fewer contacts are going to leave, which makes it harder for me to hook into something future work. I'll just push through that. But like I said, looking at other bro logs, I want to generate some features based on the presence or absence of beaconing. So take the insight that I'm getting out of Rita from black hills information security or offensive countermeasures now, enrich that, and then do some other enriching IP addresses. Also very excited to look at some Neo4j and some graph history stuff as well. So thank you very much for coming out on a Sunday morning. I appreciate your time. I'll be in the back and I hope you have a great rest of the conference.


It doesn't do you any good to make insurance sales if you're just going to lose them all, right? So we had a comment recently, one of our YouTube videos, about six ways to increase insurance customer retention. And I want to talk through that. We have six different ways you want to stay engaged and you want to write these down. Probably a couple things that you may not have heard before, right? So I'm going to go through them, okay? The first one that is pretty standard, you've probably heard this, is to send a thank you card after, immediately after you get back from making the sale. So you add a client, you get back to the office and you write a thank you card to that client, right? I always try to reference. I'm going to take, I'm going to add some ad lib and add some things with this. I always try to add something that was personal that I remember, okay? So one thing that's personal. So let's just say that they said, you know, let's just say, maybe they introduced you to their family, right? Hey, enjoyed meeting you, loved hanging out with your family, right? Try to add something personal. Maybe if it was a hobby, you know, hey, hope your golf game goes well the rest of the year, okay? So start to, I always try to think through, what's something personal that can help our relationship? That's why I like to ask those type of things. That's why I like to ask things about family, occupation, recreation, things that they care about, right? So that's one way. That's a common way. It's pretty generic, pretty simple, but most insurance agents aren't doing it. Most of you watching right now are not doing this and you should be, right? It's something I always did because it is important. It's one thing to sell it, but we make money off of balance first year commissions, renewals, them buying more policies, them referring us to people. And so retention actually ends up adding a lot of additional revenue to your business that you don't normally think about, right? So that's the first thing. Second thing is a monthly newsletter. For those that have followed my channel for a while, you know that I used to mail out a monthly newsletter to every single one of my clients every single month. And what I would do is I would always have a recipe, a chance to call into a gift card, maybe something about my family or my wife or getting a dog or a new house or whatever. I would reference a new, a certain product, maybe long-term care or something different that they may not have. And so I always liked when I did a monthly newsletter to design it, have a theme for the month, maybe it's February, maybe it's Valentine's related, all right? And I like to reference those things. And that's something that not only they remember, I will still see clients that come into the office, they'll meet with my dad now instead of me. And they'll reference a newsletter that I haven't sent out for five or six years that I used to send out all the time. And so that's one thing to always be top of mind. Because the point of doing this is if they're going to buy something insurance related, you want them to call you. If they've got a family that talks about it, you want them to refer you. And if they're thinking about buying a new fridge or getting rid of their insurance policy, you want them to keep the insurance policy. This is some way to stay top of mind. A quick story that I always think about is with a monthly newsletter is I had a client that I would send that wasn't even actually a client of mine. It was an orphan policyholder of the company. I had sent them so many newsletters. I just add them to my newsletter list, even though I took over service in their account, didn't make any money off of it and never actually sold them anything. I sent them a newsletter every month for a few years. They finally called me out of the blue. And I remember his name was Roger and last name started with a B. And he said, Cody, I need to buy some life insurance on my wife. And you send us this newsletter every month. He's like, I don't know why, but you have been for a few years. So I think because of how well you service your clients or non clients, I think I should just do business with you. What do you think? I'm like, well, it paid off. I think you should. So that's another way to stay top of mind, whether it's clients or non clients, if it's family and friends, add them to your monthly newsletter. Super important. This got me so much of a personal relationship and credibility with my clients, probably more than anything else I'm going to talk about. This was it was time sensitive. It costs some money. Let's just say that let's just say that you have 500 clients and maybe it costs you 250 bucks to actually send this out because maybe it's 50 cents a piece once you have paper envelope and postage. And then you got to have somebody do it. Most people don't have 500 clients, but even if you do, it's worth that small investment to stay top of mind and to keep a really solid relationship with your clients. The third thing that I want to touch on is a birthday card, but I'm going to put a spin on the birthday card that most people have probably never heard of. I'm going to give you the $1 idea. I may have referenced this on a past video, but I've referenced it very little, so I'm going to reference it again. This isn't my idea. I can't say that every idea I've ever mentioned is original. I've probably heard it from somebody else, and I probably did with this one as well. I heard from an agent one time that they sent out a birthday card to every one of the clients on their birthday, and they would write Betty, hope you have an amazing birthday. Back in 1942, it cost five cents for a can of Coke. It cost a little more today. However, have a Coke on me, and they would have a birthday, and they would leave a dollar in the card. You think about that. Yeah, maybe it cost you $500 a year. Who cares? Most people that sent out a birthday card, it's always related to, hey, thank you for your business with me, and they put a business card in it, and they make it real business-y. Don't. Make it personal. Think outside the box. Be creative. Send a dollar. It's a freaking dollar, and that is one way that people will always remember, and it's extremely creative, and I've always been impressed by that. I also know an agent that does annual calls to all of his clients. He has thousands of clients, and he has some service people that actually do this for him. He does it for an annual review, potentially, to set appointments, to get people in his office. But typically, it's just, hey, you could use it to do that. But he typically does this like, hey, I want to check in. I want to check on you. How's everything going? And they end up getting so many additional lines of business and referrals that they never intend, or rewrites that they never intended on getting, all because they did this. And by doing this and making these 3,000 calls a year every May that they do this in Arkansas, this one agent's office, his name is Dan, and they get so much business out of that because they spend time doing that in every May, like clockwork, they do this. And it works, and it pays off for them. Okay, so it'll pay off for you too. The fifth thing is, and I know some local agents that their names are Ty and Matt, and they do a customer appreciation event every single year.  Maybe it cost them a couple grand to put it on. But they got so much additional, not only did they get additional business, but they got so much more additional loyalty because they're selling Medicare, then not only did they get business from new business referrals, cross-selling, people wanting to buy annuities and life insurance, everything else, but they got, they engaged with their clients, and their clients felt like they want to stay with them because very few people actually do this. And it creates a bond, it creates loyalty with that client. Super important, something you should definitely consider. And then the sixth thing that I wanted to add, and it's more relevant nowadays, it's probably not on most, it's probably not on most videos that people put out about customer attention, it's probably not on people's mind. But your brand matters.  But I would encourage you that if they have a Facebook, add them on Facebook and engage with them every once in a while. You know, them seeing your post and you seeing theirs is only going to help keep you top of mind. And it's only going to help that bond and that loyalty and that engagement. And it's important, right? If it's their birthday, also shoot them a video in Facebook Messenger. Hey, buddy, hey, happy birthday. I've got a special gift coming out to you. Hope you're having an amazing day. Just want to let you know. Hope you have a great birthday and an awesome year. I'm here if you ever need me. Okay, thank you so much. And just keep it simple, right? Who can't pull out their phone and do a video like that? You know, so think about social engagement. It's important nowadays. Social, most of your clients are on Facebook. If you're not, you need to also be on Facebook. And why not add them as a friend on Facebook as long as they're cool with it, I would bring it up at the end of an appointment or end of a call. I think that this is one thing that most people don't think about, but it can, it can absolutely increase the engagement and continue to keep you relevant and in front of them. The only reason we do a good amount of business here is because we put out videos like this constantly and ads and Facebook and Instagram and everything else. And you see us a lot, which maybe creates a little more bond between you and I. And so I want you to think outside the box and think about these six things over the coming months and years to increase customer retention. And if you love our podcast and you want to know how to create a six-figure renewal income, go check it out with my buddy Brandon Clay. It's right there. Click on it and I'll see you there. A final expense agent is a grinder. They're a poor, chopping, door knocking warrior. That's the way I characterize them. And that's affectionate and it's a compliment. I've got at least a hundred agents.


Aloha and welcome to Eyes on Hawaii on Think Tech Hawaii. I'm your host Carol Cox. Today my guest is Ms. Kathy Gogill, president and founder of Animal Rights Hawaii. We will be talking about the proposed administrative rule change regarding cats at harbors throughout Hawaii. And welcome back. The recent conversations we've had on cats and humane treatment of cats and other animals have been something that has been about us for a while. But there's a new problem now and we're calling this a, I guess a rally cry of an emergency to alert you the public of what is going on and educate you. The Department of Land and Natural Resources is proposing a bill, a change of the administrative rules and to make it specific, Chapter 13232. Feeding of colonies strays while life of federal animals prohibited, while on any property under the jurisdiction of the division of no person shall feed or deliberately introduce any food material substance or attractant directly to or in the vicinity of any colony stray while life of our feral. And so having said that, we'll touch on the law again this rule, new rule proposed and come back to it. But Kathy Gogill, thank you again for joining me. It's always a pleasure. My pleasure as well. Thank you. What is this? You want to introduce yourself first and I'm anxious to talk about this bill or this rule change, a proposed rules change. Yes. Well Carol, Animal Rights Hawaii has been advocating for animals since 1977 and we've covered a broad spectrum of issues from feral pigs to animals and laboratories to livestock. And feral cats and these have come up many, many times. About 20 years ago there was a proposal by the Department of Health to have a feeding ban throughout the state of Hawaii period on all state lands.  But there is a constant movement by people who don't like to see feral cats, don't want to have them around. And we are very, very concerned about the progress that the invasive species committees have been making and this proposed rule would actually cause great hardship for cats.  Cats originally came to Hawaii on ships. The Vikings were believed to have spread cats throughout northern Europe during their explorations because cats kill rats and mice and they want them to have them on board. So almost every ship has a ship's cat. So that's how cats got to Hawaii and unfortunately they have thrived and we who care for the cats don't want to see huge quantities of cats. What we want is humane population control and that is through trap, neuter, return and manage. And this is quite possible to maintain that population or eliminate the presence of cats if we had a complete participation from government bodies, from humane bodies, nonprofits and the general public. If we work together as one, I've spoken with a number of cat caretakers and in that process, speaking with them, they're not claiming to want any cats in but the fact is that the cats are there. And so they want a humane treatment of these cats whether it be if you're going to starve them out because that's just what it will be. You will be starving them out which is inhumane and the population will continue to grow because let's face it. There are many projects that the state of Department of Land and Natural Resources can't manage and won't manage because it's not a priority, it's about money. My biggest concern here is that yes cats do prey on birds, yes cats do pose a problem to endangered birds or migratory birds, but the problem does not lie with the cats. The problem lies with the management and the administration of these programs and the failure to put money and put these things and participate and incorporate people like your organization. Instead what I've found and observed is that they demonize you or others that are out there addressing a problem that is upon us now. Not in theory, the reality is people dump, they abandon them, they get there, they escape, they're not neutered, they have babies and in Hawaii three possible breeding periods in a year because of the tropical setting. So to thrust this up on the public once again, it's always the wrong approach and we'll speak about, is it really about saving birds and animals, native species because if it is, I have a laundry list of things that they could be doing. If they're going to insist on killing and maiming and just, you know, euthanizing animals, let's start with the African canary who competes with other native birds that are found in the area that are escaped cage birds. Let's see an unaggressive effort to ban any imports of birds or citizens or anything into the state. Let's ban the pet shops from carrying certain animals. So I think it's disingenuous on the part of the DLNR to focus on one spot and then it's going to result in we, while sitting back doing nothing, we will condone the inhumane treatment of cats and other animals. Well, we, and I call myself we because I volunteer at a spay neuter clinic, are working constantly to try to keep the population under control. And I would like to see the government, the state government, Department of Agriculture should not allow the importation of intact dogs and cats without a breeder's permit or license. The people who make money from breeding these animals have fought for many years against having any kind of controls over their activity. They don't, a lot of them don't pay the excise taxes and they are contributing to the overpopulation. We also want to see the U.S. military become proactive when members, PCS out, it's very hard for them to take their pets with them. We think it should be a rule that the military should take care of transport of companion animals for those families as well. Well, it's like taking a shovel and trying to clear out the ocean. This little effort that they have, there's so many other things that I've pointed out. Let's go back to the Department of Land and Natural Resources whose proposal is just recently, give you an example. An officer was just promoted to a high level position, but that officer on Maui was involved in the illegal use of a helicopter to gather Hihiwai and other aquatic species to feed people at a wedding. And yet the current administrator, Suzanne Case, failed to do anything upon her arrival in this, which we communicated these things to her, did nothing. So I question the motivation. Is it just a ruse? We know it's not going to be effective because there's so many other things that are competing and consuming or taking on birds or whatever. And many of the birds that you find now are doves. They're not native birds, cardinals, Brazilian cardinals, northern cardinals. So I question the sincerity and the need for this rather than become humane in our approach and be more aggressive. And again, you've got to incorporate and quit demonizing the people that are doing something because of the people that are feeding.  It's not happening. No. The state legislature just felt this last year apportioned over four million dollars for the invasive species committees. And yet the people who are taking care of the feral cat populations, the colonies, are paying for veterinary care, for medications, for food, for treatments. They're not getting a penny of government money. And we're not asking for that. We are stakeholders and we want to be considered to be that. I'm tired of being called a little old cat lady because little old cat ladies can really get angry when we're pushed to the edge. Well, there are so many other angles to approach this and to reduce the threat of any alien species. We don't need to throw money at them to believe it or not. We need to do things such as this. The Department of Agriculture is a culprit in this whole scheme of things. They are the ones who determine which animals can come into the state and which cannot. Those people that come on the plane and they voluntarily sign off, but there's nobody there to greet them at the airports. They could be smuggling anything, as I've found in years gone by, where one person smuggled a cougar in, smuggled snakes in, in bags, alive snakes in both the planes. At one point you could buy scorpions and spiders and frogs and snakes in pet shops right here in Hawaii. So until the state adopts a stance that it really wants to protect endangered species and the native flora and fauna here, I would say there's something amiss here. There's something wrong and I think it's an abusive process. I agree and one of the subcommittees that advises the Board of Agriculture on whether specific animals could be allowed into the state is the owner of a very large pet shop here. So I think he may have a particular point of view that is not really in the interest of our state and of our native animals. I really hope that the public will become active on this. We have until August 5th to respond regarding the proposed administrative rule. And then it will go to the Board of Land and Natural Resources for hearing. And we haven't seen any of the testimony, we haven't seen anything. There has been no transparency on the part of the Department of the Land and Natural Resources or DOBOR. At the last hearing, one of the people who were giving testimony asked a question and was told, we're not here to answer questions. Wow, we've got so much to finish up with and talking about this, but the last day is August 5th to respond and you can respond by going to dlnr.harrevewe at hawaii.gov and offer your comments there. We will be taking a break and this is Eyes on Hawaii on Think Tech Hawaii. I'm your host Carol Cox, we will be right back. Welcome back to Eyes on Hawaii on Think Tech Hawaii. I'm your host Carol Cox. My guest is Ms. Kathy Gogell, President and Founder of Animal Rights Hawaii. We're talking about the proposed administrative rule change regarding cats at harbors throughout Hawaii. And Kathy, taking up where we left off, I can only think when I travel to the big island, I hear the Koki Frog. But much more numerous and the loud volume, but they eat bugs and they eat native species and what have you. And they compete for space from other native species. So here's the question, why don't we see any aggressive nature on that from the dlnr to ban the import of plants, potted plants or bromeliads or prohibit or create a list, but the state agriculture does not want to create a list because it would create a black list of people that have infestation of these frogs. And by the way, that is how it started. They knew where the frogs were. They knew which nursery the frogs existed, but they were reluctant to do anything because it would impact business. So why would we stand by and witness them and humanely treat and euthanize cats that human beings are responsible for putting there? Well, I have to say that I don't agree with you on Koki Frogs. And Koki's frogs are loved in their native Puerto Rico. The sound is beloved and I really think that they are not an agricultural pest and I think that killing them with citric acid is a horrible, horrible way to go. And I know that there are problems with animals like brown tree snakes that I would not like to see here coming into Hawaii, but I'd give the Koki Frogs. Well, we're not here to issue death warrants on anyone, but the point that I was trying to stress is that if the reality is from their yoke, from their view and their vantage points, they're saying their motivation for this is because it competes with native species, it consumes native species. So my question is that's only soliciting the questions. Why don't they be as aggressive not to say how beautiful the frog sings or what he is in other native habitat, but to emphasize there must be something wrong with this system and with this approach that we would be selective enough and be so aggressive in one aspect, but the other things it's rather telling that I question the veracity of the serious sincerity of this program. Well, I think it's another case that follows the money. The environmentalists, once they finish their education, have to get jobs and a lot of them end up in government and a lot of them go on living on grants and the grants are pretty large, pretty large. Oh, yeah. And so it becomes an industry, the killing and disposal of animals that people don't like have become an industry. And not just on the pest control level, but on the level of PhDs who spend a lot of time and a lot of taxpayer money up in the mountains.  They are not transparent. I have found dead cats in traps all over the state. And ultimately that's where we get around to the humane treatment of these animals. For example, I contribute to an article in Honolulu Weekly in one time called Health or Shelter. And just the whole thing is out of kilt because on one hand the city and county of Honolulu has a program in sanctions trapped new to release.  It's microchip to you. You become the quote owner of it. So therefore if it is trapped it is returned. That is supposed to be the humane way of through attrition and eliminating the population or reducing the population of cats. So why then are they going to allow this law? It's going to conflict or contradict what is already written. How can they just automatically, they're not saying we're opposed to TNR. They're saying don't feed them, which means the TNR program you're going to starve it to death. And for them to require cruelty like that makes them in violation of the state cruelty statute. So it's a conundrum. And I just don't see how this, they may be trying to ram it down our throats, but it's wrong. And we need, we have a problem. We need to seek a humane alternative to killing. On a scale of one to ten, how transparent do you think the DLNR, the Department of Land and Natural Resources has been with this effort? Oh, maybe a one. We haven't seen anything. And you won't be privy to the testimonies or yet are you? No. The public is not of it. And then so the process is going to be they are going to sit and hold the hearings as they have already. They're going to take that information with and then not share the results of the meetings or the testimonies with people like yourself or me or other interested parties.  Yes, precisely. And we will have a six days notice when it is planned. And hopefully we can get a hold of the agenda and the submittal in a timely manner. The government agencies have a long history of trying to complete what they want to do without too much input from outsiders because it's so inconvenient for them. So with the Open Meetings Law, with the Sunshine Law, Uniform Information Practices Act, we do have supposed access, but there are many times that things do not get posted in a timely manner. I have a concern that in an observation and maybe Suzanne Case, if she would ever lend herself to communicating or conversing with me on this show, I'd invite her. And that is, I believe that the board is one-sided. It's influenced by what she's formulated Nature Conservancy. Yes. There's another member on the board and nothing to impugn their integrity, but as a public body, I have concerns with that and how this is being introduced to the public. I won't call it force-fed. It's more of a sheepish way of feeding the people tidbits and then later return to the table and say, well, here's the finished product. I will not do this. And the fines, $50 or $1,000, or in prison. That's cruel and inhumane in itself to a person. You just abruptly sever all relationships with this practice that you've been doing. Well, I have been upset for a very long time with the lack of transparency by both the Board of Land and Natural Resources and the Board of Agriculture, which are the two major agencies that I deal with in advocating for animals. And that goes to the larger issue of open government and participation of the public. It's very hard to participate in government unless you really try. Things are not just put out there. Phone calls, phone calls, phone calls. Who are you? Who do you represent? That what is supposed to be public information, they want to know who you are and why you want to know this information. I have a question for you. Sorry to disturb you. Have you been contacted or any outreach on the part of DLNR, Suzanne Case or anyone? You being animal rights Hawaii, you've been quite active in the community here for years as you've shown us. Have you had any outreach from that entity to speak with you, ask you your consideration, your membership or anything? No, not a one. So are you an enemy of the state or what? Well, when people ask, when I call and ask a question, they say, well, who are you with? And I say, well, I'm just a taxpayer and that should be enough. Right, or a concerned citizen because lack of transparency, the inhumane. Our government should not be involved in any act that is inhumane and any act that is conflicting with something that's in place that resembles humane treatment of animals or anything. Or people. But then I'm afraid to say currently what we see now with the way we heard human beings, the homeless people and the unfortunate ones, it bothered me. So I'm thinking we're dealing with a different entity now that going to rely on the cruel and unusual practices of starving people, the cats to death. And then that brings on big questions, diseases. And I'm not offering this as a defense or to try and distort the truth. The reality is I've been out there on the ground. I know I'm a conservationist. I'm an environmentalist and I just don't, I'm not the party, the groupie conservationist. I have the same concerns. So we've got about one minute left and anything in closing? Well, I hope that people will start to participate in the process of government. Administrative rules have to go to public hearings and they're held on all the islands and it is a way for the public to get involved. And when legislative session starts up in the beginning of next year, people should go to their, they have a room on the fourth floor, public access room. Where you can learn how to participate in government. And I think that's a really good way to go. Well, Kathy Gogell, thank you for joining me on Hawaii Think Tech and Eyes on Hawaii. I appreciate it. And for you, the viewers out there, please write this address down. D-L-N-R dot H-A-R-R-E-V-I-E-W at Hawaii.gov. And offer your comments and if you care to ask the government to hold off on this and do not pass such a rule change or approve it, that will be good for you and good for us. So it'll make us all feel good. And that's about it. If you're interested in getting on our mailing list, go to ThinkTechHawaii.com. Thank you for joining me today on Eyes on Hawaii on ThinkTechHawaii. Thanks to Jay Fidel, our executive director, our technical support team, Robert McClain, Ray Sangolan, and Nick Sexton. I'll see you again in two weeks. I'm Carol Cox, Aloha.


President Mohamed Abu-Hari says Niger will continue to pursue peace and progress in Africa and other parts of the world. This is by consistently pushing for justice, fairness and inclusiveness in global affairs. The president's spokesman, Mr. Fermi Adeshinar, in a statement on Saturday in Abu-Jus said the president stated these are the sidelined meeting with the prime minister of Palestine Mohamed Shattai, which was at an ongoing African Union meeting in Addis Ababa in Ethiopia. According to him, Niger remains on wavering and supporting democracy, development and good governance, particularly in ensuring the rights of individuals and institutions.