-
Notifications
You must be signed in to change notification settings - Fork 42
/
security_group_changes.go
104 lines (95 loc) · 3.81 KB
/
security_group_changes.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
package cloudwatch
import (
"fmt"
"github.com/Zeus-Labs/ZeusCloud/rules/types"
"github.com/neo4j/neo4j-go-driver/v4/neo4j"
)
type SecurityGroupChanges struct{}
func (SecurityGroupChanges) UID() string {
return "cloudwatch/security_group_changes"
}
func (SecurityGroupChanges) Description() string {
return "Log metric filter and alarm should exist for security group changes"
}
func (SecurityGroupChanges) Severity() types.Severity {
return types.Low
}
func (SecurityGroupChanges) RiskCategories() types.RiskCategoryList {
return []types.RiskCategory{
types.InsufficientMonitoring,
types.PubliclyExposed,
}
}
func (SecurityGroupChanges) Execute(tx neo4j.Transaction) ([]types.Result, error) {
records, err := tx.Run(
`MATCH (a:AWSAccount{inscope: true})
OPTIONAL MATCH (a)-[:RESOURCE]->(t:CloudTrail)-[:DELIVERS_TO]->(lg:CloudWatchLogGroup)-[:HAS_METRIC_FILTER]->(mf:CloudWatchMetricFilter)
WHERE t.is_multi_region_trail AND
t.is_logging AND
mf.filter_pattern =~ '.*\$\.eventName\s*=\s*"?AuthorizeSecurityGroupIngress"?.+\$\.eventName\s*=\s*"?AuthorizeSecurityGroupEgress"?.+\$\.eventName\s*=\s*"?RevokeSecurityGroupIngress"?.+\$\.eventName\s*=\s*"?RevokeSecurityGroupEgress"?.+\$\.eventName\s*=\s*"?CreateSecurityGroup"?.+\$\.eventName\s*=\s*"?DeleteSecurityGroup"?.*'
OPTIONAL MATCH (al:CloudWatchAlarm)
WHERE al.metric_name IS NOT NULL
AND mf.metric_transformation_name = al.metric_name
WITH a,
COLLECT(CASE WHEN t IS NOT NULL AND lg IS NOT NULL AND mf IS NOT NULL AND al IS NOT NULL THEN t ELSE NULL END) as valid_ts,
COLLECT(CASE WHEN t IS NOT NULL AND lg IS NOT NULL AND mf IS NOT NULL AND al IS NOT NULL THEN lg ELSE NULL END) as valid_lgs,
COLLECT(CASE WHEN t IS NOT NULL AND lg IS NOT NULL AND mf IS NOT NULL AND al IS NOT NULL THEN mf ELSE NULL END) as valid_mfs,
COLLECT(CASE WHEN t IS NOT NULL AND lg IS NOT NULL AND mf IS NOT NULL AND al IS NOT NULL THEN al ELSE NULL END) as valid_als,
SUM(CASE WHEN t IS NOT NULL AND lg IS NOT NULL AND mf IS NOT NULL AND al IS NOT NULL THEN 1 ELSE 0 END) as num_valid
RETURN a.id as resource_id,
'AWSAccount' as resource_type,
a.id as account_id,
CASE WHEN
num_valid = 0 THEN 'failed'
ELSE 'passed'
END as status,
CASE WHEN
num_valid = 0 THEN 'There is no log metric filter and alarm monitoring an active, multi-region CloudTrail trail for security group changes.'
ELSE 'The metric filter ' + valid_mfs[0].filter_name + ' and alarm ' + valid_als[0].arn + ' monitor security group change events.'
END as context`,
nil,
)
if err != nil {
return nil, err
}
var results []types.Result
for records.Next() {
record := records.Record()
resourceID, _ := record.Get("resource_id")
resourceIDStr, ok := resourceID.(string)
if !ok {
return nil, fmt.Errorf("resource_id %v should be of type string", resourceID)
}
resourceType, _ := record.Get("resource_type")
resourceTypeStr, ok := resourceType.(string)
if !ok {
return nil, fmt.Errorf("resource_type %v should be of type string", resourceType)
}
accountID, _ := record.Get("account_id")
accountIDStr, ok := accountID.(string)
if !ok {
return nil, fmt.Errorf("account_id %v should be of type string", accountID)
}
status, _ := record.Get("status")
statusStr, ok := status.(string)
if !ok {
return nil, fmt.Errorf("status %v should be of type string", status)
}
context, _ := record.Get("context")
contextStr, ok := context.(string)
if !ok {
return nil, fmt.Errorf("context %v should be of type string", context)
}
results = append(results, types.Result{
ResourceID: resourceIDStr,
ResourceType: resourceTypeStr,
AccountID: accountIDStr,
Status: statusStr,
Context: contextStr,
})
}
return results, nil
}
func (SecurityGroupChanges) ProduceRuleGraph(tx neo4j.Transaction, resourceId string) (neo4j.Result, error) {
return nil, nil
}