Merge branch 'master' into alert_sqs_support

mozilla · May 14, 2019 · 4d554b2 · 4d554b2
2 parents 35b80db + 4e9b448
commit 4d554b2
Show file tree

Hide file tree

Showing 17 changed files with 252 additions and 49 deletions.
diff --git a/CODEOWNERS b/CODEOWNERS
@@ -4,10 +4,9 @@
 *                @pwnbus @mpurzynski @Phrozyn @tristanweir
 
 # Allow review by Gene or Andrew for cloudy MozDef code
-/cloudy_mozdef/  @gene1wood @andrewkrug
+/cloudy_mozdef/  @pwnbus @mpurzynski @Phrozyn @tristanweir @gene1wood @andrewkrug
 
-# Anyone in EIS can review documentation
-# https://github.com/orgs/mozilla/teams/enterprise-information-security/members
-/README.md       @mozilla/enterprise-information-security
-/CHANGELOG       @mozilla/enterprise-information-security
-/docs/           @mozilla/enterprise-information-security
+# Entire set can review certain documentation files
+/README.md       @pwnbus @mpurzynski @Phrozyn @tristanweir @gene1wood @andrewkrug
+/CHANGELOG       @pwnbus @mpurzynski @Phrozyn @tristanweir @gene1wood @andrewkrug
+/docs/           @pwnbus @mpurzynski @Phrozyn @tristanweir @gene1wood @andrewkrug
diff --git a/README.md b/README.md
@@ -3,6 +3,20 @@
 
 # MozDef: Mozilla Enterprise Defense Platform
 
+## Documentation:
+
+http://mozdef.readthedocs.org/en/latest/
+
+
+## Give MozDef a Try in AWS:
+
+The following button will launch the Mozilla Enterprise Defense Platform in your AWS account.
+
+**Warning:** Pressing the "Launch Stack" button and following through with the deployment will incur charges to your AWS account. 
+
+[![Launch MozDef](docs/source/images/cloudformation-launch-stack.png)][1]
+
+
 ## Why?
 
 The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.
@@ -22,12 +36,4 @@ The Mozilla Enterprise Defense Platform (MozDef) seeks to automate the security
 
 MozDef is in production at Mozilla where we are using it to process over 300 million events per day.
 
-## Give MozDef a Try in AWS:
-
-[![Launch MozDef](docs/source/images/cloudformation-launch-stack.png)][1]
-
-## Documentation:
-
-http://mozdef.readthedocs.org/en/latest/
-
-[1]: https://console.aws.amazon.com/cloudformation/home?region=us-west-2#/stacks/new?stackName=mozdef-for-aws&templateURL=https://s3-us-west-2.amazonaws.com/public.us-west-2.infosec.mozilla.org/mozdef/cf/v1.38.5/mozdef-parent.yml
+[1]: https://console.aws.amazon.com/cloudformation/home?region=us-west-2#/stacks/new?stackName=mozdef-for-aws&templateURL=https://s3-us-west-2.amazonaws.com/public.us-west-2.infosec.mozilla.org/mozdef/cf/v1.38.5/mozdef-parent.yml
diff --git a/alerts/cloudtrail_public_bucket.py b/alerts/cloudtrail_public_bucket.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2014 Mozilla Corporation
+
+
+from lib.alerttask import AlertTask
+from mozdef_util.query_models import SearchQuery, TermMatch, ExistsMatch
+
+
+class AlertCloudtrailPublicBucket(AlertTask):
+    def main(self):
+        search_query = SearchQuery(minutes=20)
+
+        search_query.add_must([
+            TermMatch('source', 'cloudtrail'),
+            TermMatch('details.eventname', 'PutBucketPolicy'),
+            ExistsMatch('details.requestparameters.bucketpolicy.statement.principal')
+        ])
+
+        self.filtersManual(search_query)
+        self.searchEventsSimple()
+        self.walkEvents()
+
+    # Set alert properties
+    def onEvent(self, event):
+        request_parameters = event['_source']['details']['requestparameters']
+        for statement in request_parameters['bucketpolicy']['statement']:
+            if statement['principal'] != '*':
+                return
+        category = 'access'
+        tags = ['cloudtrail']
+        severity = 'INFO'
+
+        bucket_name = 'Unknown'
+        if 'bucketname' in request_parameters:
+            bucket_name = request_parameters['bucketname']
+
+        summary = "The s3 bucket {0} is listed as public".format(bucket_name)
+        return self.createAlertDict(summary, category, tags, [event], severity)
diff --git a/alerts/get_watchlist.conf b/alerts/get_watchlist.conf
@@ -2,3 +2,4 @@
 # set the following to your protected endpoint api_url
 api_url = http://localhost:8081/getwatchlist
 jwt_secret = secret
+use_auth = false
diff --git a/alerts/get_watchlist.py b/alerts/get_watchlist.py
@@ -17,27 +17,23 @@
 
 class AlertWatchList(AlertTask):
     def main(self):
-        self.parse_config('get_watchlist.conf', ['api_url', 'jwt_secret'])
+        self.parse_config('get_watchlist.conf', ['api_url', 'jwt_secret', 'use_auth'])
 
-        jwt_token = JWTAuth(self.config.jwt_secret)
-        jwt_token.set_header_format('Bearer %s')
+        jwt_token = None
+        if self.config.use_auth.lower() != 'false':
+            jwt_token = JWTAuth(self.config.jwt_secret)
+            jwt_token.set_header_format('Bearer %s')
 
-        # Connect to rest api and grab response
         r = requests.get(self.config.api_url, auth=jwt_token)
-        status = r.status_code
-        index = 0
-        if status == 200:
-            status = r.status_code
+        # Connect to rest api and grab response
+        if r.ok:
             response = r.text
             terms_list = json.loads(response)
-            while index < len(terms_list):
-                term = terms_list[index]
-                term = '"{}"'.format(term)
+            for term in terms_list:
                 self.watchterm = term
-                index += 1
-                self.process_alert(term)
+                self.process_alert()
         else:
-            logger.error('The watchlist request failed. Status {0}.\n'.format(status))
+            logger.error('The watchlist request failed. Status {0}.\n'.format(r))
 
     def process_alert(self, term):
         search_query = SearchQuery(minutes=20)

diff --git a/cloudy_mozdef/cloudformation/mozdef-instance.yml b/cloudy_mozdef/cloudformation/mozdef-instance.yml
@@ -159,6 +159,14 @@ Resources:
                 OPTIONS_METEOR_ROOTURL=https://${DomainName}
                 METEOR_BACKEND=meteor:3000
                 ESBACKEND=${KibanaDomainOnlyURL}
+                # Disable certain web ui features
+                OPTIONS_REMOVE_FEATURES=ipblocklist,fqdnblocklist,logincounts,globe
+                # See https://github.com/mozilla-iam/mozilla.oidc.accessproxy/blob/master/README.md#setup
+                # Future support will be added for cognito backed authentication.
+                client_id=${OIDCClientId}
+                client_secret=${OIDCClientSecret}
+                discovery_url=${OIDCDiscoveryURL}
+                backend=http://meteor:3000
                 redirect_uri_path=/redirect_uri
                 httpsredir=no
                 # Meteor settings
@@ -202,9 +210,11 @@ Resources:
                 ALERTS = {
                     'bruteforce_ssh.AlertBruteforceSsh': {'schedule': crontab(minute='*/1')},
                     'unauth_ssh.AlertUnauthSSH': {'schedule': crontab(minute='*/1')},
+                    'get_watchlist.AlertWatchList': {'schedule': timedelta(minutes=1)},
                     'guard_duty_probe.AlertGuardDutyProbe': {'schedule': crontab(minute='*/1')},
                     'cloudtrail_logging_disabled.AlertCloudtrailLoggingDisabled': {'schedule': timedelta(minutes=1)},
-                    'cloudtrail_deadman.AlertCloudtrailDeadman': {'schedule': timedelta(minutes=15)}
+                    'cloudtrail_deadman.AlertCloudtrailDeadman': {'schedule': timedelta(minutes=15)},
+                    'cloudtrail_public_bucket.AlertCloudtrailPublicBucket': {'schedule': timedelta(minutes=1)},
                 }
 
                 ALERT_PLUGINS = [
@@ -291,6 +301,12 @@ Resources:
                 [Install]
                 WantedBy=multi-user.target
               path: /etc/systemd/system/docker-compose.service
+            - content: |
+                [options]
+                api_url = http://rest:8081/getwatchlist
+                jwt_secret = secret
+                use_auth = false
+              path: /opt/mozdef/docker/compose/mozdef_alerts/files/get_watchlist.conf
           runcmd:
             - echo RABBITMQ_PASSWORD=`python3 -c 'import secrets; s = secrets.token_hex(); print(s)'` > /opt/mozdef/docker/compose/rabbitmq.env
             - chmod --verbose 600 /opt/mozdef/docker/compose/rabbitmq.env

diff --git a/docker/compose/mozdef_alerts/Dockerfile b/docker/compose/mozdef_alerts/Dockerfile
@@ -4,6 +4,7 @@ LABEL maintainer="mozdef@mozilla.com"
 
 COPY alerts /opt/mozdef/envs/mozdef/alerts
 COPY docker/compose/mozdef_alerts/files/config.py /opt/mozdef/envs/mozdef/alerts/lib/
+COPY docker/compose/mozdef_alerts/files/get_watchlist.conf /opt/mozdef/envs/mozdef/alerts/get_watchlist.conf
 
 RUN chown -R mozdef:mozdef /opt/mozdef/envs/mozdef/alerts
 

diff --git a/docker/compose/mozdef_alerts/files/config.py b/docker/compose/mozdef_alerts/files/config.py
@@ -12,6 +12,7 @@
 ALERTS = {
     'bruteforce_ssh.AlertBruteforceSsh': {'schedule': crontab(minute='*/1')},
     'unauth_ssh.AlertUnauthSSH': {'schedule': crontab(minute='*/1')},
+    'get_watchlist.AlertWatchList': {'schedule': crontab(minute='*/1')},
 }
 
 ALERT_PLUGINS = [

diff --git a/docker/compose/mozdef_alerts/files/get_watchlist.conf b/docker/compose/mozdef_alerts/files/get_watchlist.conf
@@ -0,0 +1,5 @@
+[options]
+# set the following to your protected endpoint api_url
+api_url = http://rest:8081/getwatchlist
+jwt_secret = secret
+use_auth = false
diff --git a/meteor/client/menu.html b/meteor/client/menu.html
@@ -11,8 +11,7 @@
         <div id="header" class="row center">
             <span id="nav-main">
                 <ul>
-                    <li><img class="mozillalogo" src="/images/mozilla.svg"></li>
-                    <li><a class="mozdef" href="/" title="MOZDEF">MOZDEF</a></li>
+                    <li><a href="/">Home</a></li>
                     {{#if isFeature "kibana"}}
                         <li> <a target="_blank" href={{ resolveKibanaURL mozdef.kibanaURL }}>Kibana</a>
                             <ul>

diff --git a/meteor/client/mozdef.html b/meteor/client/mozdef.html
@@ -8,7 +8,7 @@
 <head>
     <meta name="viewport" content="width=1024">
     <link rel="shortcut icon" type="image/svg" href="/images/favicon.ico" />
-    <title>mozdef::mozilla defense platform</title>
+    <title>mozdef::mozilla enterprise defense platform</title>
 </head>
 
 <body>
@@ -58,7 +58,8 @@
 <template name="hello">
     <div class="container">
         <div class="row center">
-            <p class="welcome">{{greeting}}<br>Hand made by Mozilla</p>
+            <!--a nice greeting-->
+                <p class="welcome"><img class="mozdeflogo" src="/images/moz_defense-platform_01.png"><br/>{{greeting}}</p>
         </div>
     </div>
 </template>

diff --git a/meteor/client/mozdef.js b/meteor/client/mozdef.js
@@ -174,14 +174,14 @@ if ( Meteor.isClient ) {
         greeting: function() {
             if ( typeof console !== 'undefined' )
                 console.log( "mozdef starting" );
-            return "MozDef: The Mozilla Defense Platform";
+            return "Hand Made by Mozilla";
         }
     } );
 
     Template.hello.events( {
         'click': function() {
             // template data, if any, is available in 'this'
-            Session.set( 'displayMessage', 'Welcome &amp; to mozdef.' )
+            Session.set( 'displayMessage', 'Welcome to mozdef.' )
         }
     } );
 

diff --git a/meteor/imports/themes/classic/mozdef.css b/meteor/imports/themes/classic/mozdef.css
@@ -81,6 +81,21 @@ caption, legend {
     overflow: visible;
 }
 
+/* Home Page Styling */
+.welcome {
+    height: 180px;
+    width: 600px;
+    margin-left: 25%;
+    text-align: center;
+    color: var(--txt-primary-color);
+    vertical-align: middle;
+}
+
+.mozdeflogo{
+  width: 500px;
+  vertical-align: middle;
+}
+
 #bottom-toolbar {
   background: var(--bg-secondary-color);
   width: 100%;
@@ -285,10 +300,6 @@ td{
   color: var(--txt-primary-color);
 }
 
-.welcome {
-    text-align: center;
-}
-
 .tabcontent{
     margin-top: 20px;
 }

diff --git a/meteor/imports/themes/dark/mozdef.css b/meteor/imports/themes/dark/mozdef.css
@@ -61,6 +61,21 @@ caption, legend {
     overflow: visible;
 }
 
+/* Home Page Styling */
+.welcome {
+    height: 180px;
+    width: 600px;
+    margin-left: 25%;
+    text-align: center;
+    color: var(--txt-primary-color);
+    vertical-align: middle;
+}
+
+.mozdeflogo{
+  width: 500px;
+  vertical-align: middle;
+}
+
 #bottom-toolbar {
   background: #444444;
   width: 100%;
@@ -233,11 +248,6 @@ td{
   color:white;
 }
 
-
-.welcome {
-    text-align: center;
-}
-
 .tabcontent{
     margin-top: 20px;
 }

diff --git a/meteor/imports/themes/light/mozdef.css b/meteor/imports/themes/light/mozdef.css
@@ -72,6 +72,27 @@ caption, legend {
     overflow: visible;
 }
 
+/* Home Page Styling */
+.welcome {
+    height: 180px;
+    width: 600px;
+    margin-left: 25%;
+    text-align: center;
+    color: var(--txt-primary-color);
+    vertical-align: middle;
+}
+
+.mozdeflogo{
+  width: 500px;
+  vertical-align: middle;
+}
+
+/* dc-chart empty color */
+.dc-chart .empty-chart .pie-slice path {
+    fill: #bcb8b8;
+    cursor: default;
+}
+
 #bottom-toolbar {
   background: var(--bg-secondary-color);
   width: 100%;
@@ -282,10 +303,6 @@ td{
   color: var(--txt-primary-color);
 }
 
-.welcome {
-    text-align: center;
-}
-
 .tabcontent{
     margin-top: 20px;
 }

diff --git a/meteor/public/images/moz_defense-platform_01.png b/meteor/public/images/moz_defense-platform_01.png