Skip to content

Commit

Permalink
Temp.
Browse files Browse the repository at this point in the history
  • Loading branch information
sanason committed Jul 2, 2024
1 parent f6e32a2 commit 0e18b3e
Showing 1 changed file with 1 addition and 33 deletions.
34 changes: 1 addition & 33 deletions .github/workflows/log_check_reminder.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,36 +17,4 @@ jobs:

steps:
- name: Set current date
run: echo "YESTERDAY=$(date -v-1d '+%Y-%m-%d')" >> "$GITHUB_ENV"
- name: Create audit log review issue
run: |
gh issue create \
--title "$TITLE" \
--assignee "$ASSIGNEES" \
--label "$LABELS" \
--body "$BODY"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_REPO: ${{ github.repository }}
TITLE: REMINDER! Review audit logs for month ending ${{ env.YESTERDAY }}
ASSIGNEES: sanason
LABELS: audit-log-review
BODY: |
This issue is an automated monthly reminder to review the audit logs of all DAP systems for indications of inappropriate or unusual activity.
# Acceptance criteria
1. Complete and check off each of the tasks in the Audit Tasks list. Keep a list of any findings.
2. If there are any findings in your list, email them to:
- sergio.mendoza-jimenez@gsa.gov (ISSM)
- sue.frederick@gsa.gov (ISSO)
- marina.fox@gsa.gov (System owner)
3. Close the ticket with a comment "Closed with findings" or "Closed without findings", as appropriate. Feel free to add any other comments as well.
# Audit Tasks
- [ ] Review Cloud Foundry events in the gsa-opp-analytics organization (available through the Cloud Foundry web UI). See https://cloud.gov/docs/compliance/auditing-activity/.
- [ ] Verify ssh disabled for production applications and spaces.
- [ ] Review application logs on https://login.fr.cloud.gov/ for organization gsa-opp-analytics.
- [ ] Review the GA4 Account Change History (viewing instructions at https://support.google.com/analytics/answer/9305465?hl=en).
- [ ] Review CloudTrail logs for AWS S3 and CloudFront.
- [ ] Review Github Organization Audit Logs for the following repos:
- [ ] Review NrAuditEvent events in New Relic.
run: echo "YESTERDAY=$(date --date='1 day ago' '+%Y-%m-%d')" >> "$GITHUB_ENV"

0 comments on commit 0e18b3e

Please sign in to comment.