Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modify check_bucket method from AWSServerAccess #16116

Merged
merged 2 commits into from Mar 1, 2023

Conversation

EduLeon12
Copy link
Contributor

Related issue
Closes #15016

Description

AWSServerAccess integration was not processing logs found in the root folder of the bucket unless it had folders inside of it.
Bug and Fix is described here:

Fix consist in evaluating existence of "Contents" list after getting Bucket Objects.

Logs/Alerts example

Until now, when trying to get server access S3 bucket objects without a folder existing in the root folder, this error would appear:

/var/ossec/wodles/aws/aws-s3 -b wazuh-aws-wodle-access -t server_access -s 2021-NOV-12 -p dev -d2
DEBUG: +++ Debug mode on - Level: 2
ERROR: No files were found in 'wazuh-aws-wodle-access/'. No logs will be processed.

Now logs are found when there are no folders in root of Bucket as seen on image,

root@wazuh-master:/var/ossec/wodles/aws# /var/ossec/wodles/aws/aws-s3 -b wazuh-aws-wodle-access-test -t server_access -s 2021-APR-29 -p dev -d2
DEBUG: +++ Debug mode on - Level: 2
DEBUG: +++ Marker: 2021-04-29
DEBUG: ++ Found new log: 2021-04-29-09-13-06-338835093EADA3C1
DEBUG: ++ Found new log: 2021-04-29-09-14-05-B61AAAC9147C7F9F
DEBUG: ++ Skipping previously processed file: 2021-04-29-09-14-48-5273CCCAE2158DCE
DEBUG: +++ DB Maintenance

S3 Bucket Image:

Screenshot from 2023-01-27 16-36-30

Tests

=============================================== test session starts ===============================================
platform linux -- Python 3.10.6, pytest-7.2.1, pluggy-1.0.0
rootdir: /home/halothus/git/wazuh/wodles/aws
collected 39 items                                                                                                

tests/test_aws.py .......................................                                                   [100%]

=============================================== 39 passed in 0.16s ================================================

@EduLeon12 EduLeon12 self-assigned this Feb 8, 2023
- Check for "Contents" list after getting bucket objects.
- Fix spacing on line 639.
@EduLeon12 EduLeon12 force-pushed the fix/15016-aws-server-access-check-bucket-bug branch from 42b15f0 to 841516f Compare February 8, 2023 15:24
@EduLeon12 EduLeon12 linked an issue Feb 8, 2023 that may be closed by this pull request
6 tasks
@nico-stefani nico-stefani self-requested a review February 10, 2023 13:36
wodles/aws/aws_s3.py Outdated Show resolved Hide resolved
- Fixed conditional to avoid an empty 'Contents' list.

Co-authored-by: Nico Stefani <nicolas.stefi@wazuh.com>
Copy link
Member

@nico-stefani nico-stefani left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@davidjiglesias davidjiglesias merged commit 077c21c into 4.5 Mar 1, 2023
@davidjiglesias davidjiglesias deleted the fix/15016-aws-server-access-check-bucket-bug branch March 1, 2023 09:40
GGP1 pushed a commit that referenced this pull request Mar 16, 2023
* Modify check_bucket method from AWSServerAccess

- Check for "Contents" list after getting bucket objects.
- Fix spacing on line 639.

* Modify conditional in check_bucket method

- Fixed conditional to avoid an empty 'Contents' list.

Co-authored-by: Nico Stefani <nicolas.stefi@wazuh.com>

---------

Co-authored-by: Nico Stefani <nicolas.stefi@wazuh.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

AWS Server Access check_bucket bug
3 participants