AWS - xpander 1852 #25339

johnnywilkes · 2023-03-16T23:14:03Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

https://jira-hq.paloaltonetworks.local/browse/EXPANDR-1852

Description

"AWS - Security Group Remediation v2" playbook is an improvement on V1 because instead of just applying a limited security group, this determines which SG is over-permissive and creates a copy of it without the over-permissive parts.

Screenshots

N/A

Minimum version of Cortex XSOAR

6.0.0
6.1.0
6.2.0
6.5.0

Does it break backward compatibility?

Yes
- Further details:
No

Must have

Tests
Documentation

content-bot · 2023-03-16T23:16:00Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @daryakoval will know the proposed changes are ready to bereviewed.

…-1852

johnnywilkes · 2023-03-18T22:08:16Z

@yucohen , i shared demo with you

…-1852

yucohen

@johnnywilkes Great work!!! Please see my comments :)
@efelmandar Do you think we need a demo for the playbook? Or the linked demo will do?

yucohen · 2023-03-20T13:48:54Z

Packs/AWS-Enrichment-Remediation/README.md

+Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules, and replace them with a copy of the security group that has only the over-permissive portion removed.  Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
+
+TODO ADD LINK AFTER PR


Just a reminder so we won't forget to change

Yuval's feedback

yucohen · 2023-03-20T13:51:13Z

Packs/AWS-Enrichment-Remediation/Scripts/AWSRecreateSG/AWSRecreateSG.py

+    Returns:
+        Dict: Dict of the new SG to be used
+    """
+    info = sg_info[0]['Contents']['AWS.EC2.SecurityGroups(val.GroupId === obj.GroupId)'][0]


if sg_info is a dict, why trying to get the first element?

Good catch! it is a list so I will change docstrings and types

Yuval's feedback

yucohen · 2023-03-20T13:57:03Z

Packs/AWS-Enrichment-Remediation/Scripts/AWSRecreateSG/AWSRecreateSG.py

+        raise ValueError('failed to pull information on EC2 instance')
+
+
+''' COMMAND FUNCTION '''


As scripts are running in the following structure: !<script-name> arg1=... I think we can remove this comment

not a problem, will remove

Yuval's feedback

yucohen · 2023-03-20T13:57:33Z

Packs/AWS-Enrichment-Remediation/Scripts/AWSRecreateSG/AWSRecreateSG.py

+''' COMMAND FUNCTION '''
+
+
+def aws_recreate_sg_command(args: Dict[str, Any]) -> str:


and also can change the method name, as it is not an XSOAR command

changing to aws_recreate_sg

Yuval's feedback

yucohen · 2023-03-20T14:00:55Z

Packs/AWS-Enrichment-Remediation/Scripts/AWSRecreateSG/AWSRecreateSG.py

+    for mapping in int_sg_mapping.keys():
+        for sg in int_sg_mapping[mapping]:


Suggested change

for mapping in int_sg_mapping.keys():

for sg in int_sg_mapping[mapping]:

for mapping in int_sg_mapping.values():

for sg in mapping:

This change is optional, but this way the code is easier to read :)

I made this change and unit tests were breaking. Will keep as-is

…-1852

johnnywilkes · 2023-03-20T15:25:37Z

@ShirleyDenkberg , can you look this over as well, please?

Packs/AWS-Enrichment-Remediation/Playbooks/AWS_-_Security_Group_Remediation_v2.yml

Packs/AWS-Enrichment-Remediation/Playbooks/AWS_-_Security_Group_Remediation_v2_README.md

Packs/AWS-Enrichment-Remediation/README.md

Packs/AWS-Enrichment-Remediation/ReleaseNotes/1_1_1.md

Packs/AWS-Enrichment-Remediation/Scripts/AWSRecreateSG/AWSRecreateSG.yml

ShirleyDenkberg · 2023-03-20T15:49:50Z

Packs/AWS-Enrichment-Remediation/Scripts/AWSRecreateSG/README.md

+| **Argument Name** | **Description** |
+| --- | --- |
+| instance_id | EC2 Instance ID. |
+| port | TCP/UDP Port to be restricted. |


ShirleyDenkberg · 2023-03-20T15:51:14Z

@yucohen @efelmandar Doc review completed.

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

…-1852

efelmandar · 2023-03-21T16:08:02Z

@yucohen the recorded demo is enough here, finished the review, and is ready for merge.
@johnnywilkes nice work!

* add automation * init Unittest, docstrings, README, fix yml * more format, validate and lint * unit tests, lint and base playbook * playbook, README, RN * fix build issues * update tests * COVERAGE!!!!! * Yuval's feedback * simple mistake * Apply suggestions from code review * Update README.md --------- Co-authored-by: johnnywilkes <32227961+johnnywilkes@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: yucohen <86777474+yucohen@users.noreply.github.com>

johnnywilkes added 5 commits March 13, 2023 17:54

add automation

89df594

init Unittest, docstrings, README, fix yml

6dc74eb

more format, validate and lint

e4025f0

unit tests, lint and base playbook

ac8e3b4

playbook, README, RN

c6a9ce9

content-bot added Community Contribution Form Filled Whether contribution form filled or not. Contribution Thank you! Contributions are always welcome! labels Mar 16, 2023

content-bot changed the base branch from master to contrib/johnnywilkes_AWS-EXPANDR-1852 March 16, 2023 23:15

content-bot assigned daryakoval Mar 16, 2023

content-bot requested a review from daryakoval March 16, 2023 23:15

johnnywilkes and others added 2 commits March 16, 2023 19:38

fix build issues

fc8b57d

Merge branch 'contrib/johnnywilkes_AWS-EXPANDR-1852' into AWS-EXPANDR…

ee267d4

…-1852

gal-forer assigned yucohen and unassigned daryakoval Mar 17, 2023

gal-forer requested review from yucohen and removed request for daryakoval March 17, 2023 00:17

update tests

41e2394

johnnywilkes and others added 2 commits March 18, 2023 18:28

COVERAGE!!!!!

e056d1f

Merge branch 'contrib/johnnywilkes_AWS-EXPANDR-1852' into AWS-EXPANDR…

575733d

…-1852

yucohen requested a review from efelmandar March 19, 2023 12:00

yucohen assigned efelmandar Mar 19, 2023

yucohen requested changes Mar 20, 2023

View reviewed changes

johnnywilkes and others added 3 commits March 20, 2023 10:51

Yuval's feedback

585c5a6

simple mistake

b71cb3d

Merge branch 'contrib/johnnywilkes_AWS-EXPANDR-1852' into AWS-EXPANDR…

415826e

…-1852

ShirleyDenkberg self-assigned this Mar 20, 2023

ShirleyDenkberg added the docs-approved label Mar 20, 2023

ShirleyDenkberg reviewed Mar 20, 2023

View reviewed changes

johnnywilkes and others added 3 commits March 20, 2023 13:07

Apply suggestions from code review

2791557

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update README.md

9b728cf

Merge branch 'contrib/johnnywilkes_AWS-EXPANDR-1852' into AWS-EXPANDR…

27b858b

…-1852

yucohen approved these changes Mar 21, 2023

View reviewed changes

yucohen merged commit 8e95583 into demisto:contrib/johnnywilkes_AWS-EXPANDR-1852 Mar 21, 2023
17 checks passed

content-bot mentioned this pull request Mar 21, 2023

AWS - xpander 1852 #25434

Merged

11 tasks

johnnywilkes mentioned this pull request Mar 22, 2023

[ASM] - Expandr - 1852 #25454

Merged

11 tasks

content-bot mentioned this pull request Mar 23, 2023

[ASM] - Expandr - 1852 #25482

Merged

11 tasks

johnnywilkes deleted the AWS-EXPANDR-1852 branch July 10, 2023 15:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AWS - xpander 1852 #25339

AWS - xpander 1852 #25339

johnnywilkes commented Mar 16, 2023

content-bot commented Mar 16, 2023

johnnywilkes commented Mar 18, 2023

yucohen left a comment

yucohen Mar 20, 2023

johnnywilkes Mar 20, 2023

yucohen Mar 20, 2023

johnnywilkes Mar 20, 2023

johnnywilkes Mar 20, 2023

yucohen Mar 20, 2023

johnnywilkes Mar 20, 2023

johnnywilkes Mar 20, 2023

yucohen Mar 20, 2023

johnnywilkes Mar 20, 2023

johnnywilkes Mar 20, 2023

yucohen Mar 20, 2023

johnnywilkes Mar 20, 2023

johnnywilkes commented Mar 20, 2023

ShirleyDenkberg Mar 20, 2023

ShirleyDenkberg commented Mar 20, 2023

efelmandar commented Mar 21, 2023

		Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules, and replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.

		TODO ADD LINK AFTER PR

		raise ValueError('failed to pull information on EC2 instance')


		''' COMMAND FUNCTION '''

		''' COMMAND FUNCTION '''


		def aws_recreate_sg_command(args: Dict[str, Any]) -> str:

		for mapping in int_sg_mapping.keys():
		for sg in int_sg_mapping[mapping]:

	\| port \| TCP/UDP Port to be restricted. \|
	\| port \| TCP/UDP port to be restricted. \|

AWS - xpander 1852 #25339

AWS - xpander 1852 #25339

Conversation

johnnywilkes commented Mar 16, 2023

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Screenshots

Minimum version of Cortex XSOAR

Does it break backward compatibility?

Must have

content-bot commented Mar 16, 2023

johnnywilkes commented Mar 18, 2023

yucohen left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

johnnywilkes commented Mar 20, 2023

Choose a reason for hiding this comment

ShirleyDenkberg commented Mar 20, 2023

efelmandar commented Mar 21, 2023