Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create AWS Security Hub Rules #23206

Closed
wants to merge 224 commits into from
Closed

Create AWS Security Hub Rules #23206

wants to merge 224 commits into from

Conversation

IsExec
Copy link
Member

@IsExec IsExec commented May 1, 2024 •
edited

Related issue
#22505
  • Added decoder to JSON decoders specific for AWS security hub
  • Added base ruleset for AWS security hub:
    • Security hub controls base rules
    • Base rules for AWS service integrations (GuardDuty, Inspector and Health)
    • Rules for critical security control checks
  • Create .ini check file
  • Decoder/Rule tests
    • Added unit testing files ".ini"
    • runtests.py executed without errors

sebasfalcone and others added 30 commits March 21, 2024 18:54
@sebasfalcone
CL:
c04d53b 
- Improved indexer connector logging
- Factorized out callbacks used on indexer connector
@AlexRuiz7
Rename legacy-template.json
0cf51ec
@Dwordcito
Changes to limit the memory usage in write/read operations with rocksdb.
84b510a
@Dwordcito
Add cna mapping feature.
00b1d75
@sebasfalcone
CL:
91e7364 
- Fixed coverity defects
  - Use of auto causes copy
  - Copy instead of move
  - Use of & to prevent copy
@sebasfalcone
CL:
1081744 
- Reverted style changes
@Dwordcito
Merge pull request #22523 from wazuh/dev-20772-auto-causes-copy-defec…
bbc26ed 
…t-at-shared-modules-1

Fix coverity defects for 4.8.0
@Dwordcito
Fix unit tests.
7321fb4
@Selutario
Add USER_ENABLE_UPDATE_CHECK preloaded var
99e7ca8
@Selutario
Update preloaded-vars template
48cd8c2
@Dwordcito
Merge pull request #22684 from wazuh/22681/rename-vd-index-template
f5b4cce 
Rename legacy-template.json
@pereyra-m
Improving indexerConnector logging
ce833f3
@Dwordcito
Merge pull request #22682 from wazuh/dev-22532-worker-fails-to-initia…
9d37705 
…lize-indexerconnector-for-index-wazuh-states-vulnerabilities

Improving indexer connector log messages
@Dwordcito
- Add unit tests
5b09573 
- Fix behavior if the feed have less or invalid data.
@Dwordcito
Add requested changes.
528196b
@Dwordcito
- Fix invalid call during reload json maps.
e59e2a0
@Selutario
Merge pull request #22719 from wazuh/enhancement/22706-update-check-p…
8853bfb 
…reloaded-var

Add new preloaded var to disable `update_check`
@GGP1
Update error remediation message
b1a79a2
@Damian-Mangold
Update log level
94cacab
@Dwordcito
Merge pull request #22693 from wazuh/fix/22581-fix-memory-management-…
68435a5 
…of-rocksdb

Changes to limit the memory usage in write/read operations with rocksdb.
@Dwordcito
Merge pull request #22737 from wazuh/dev-22721-reduce-verbosity-loggi…
780d1de 
…ng-on-content-updater

Update the log level in the vulnerability scanner content-updater
@GabrielEValenzuela @sebasfalcone
CL:
06936d6 
- Implement L1 logic

- Partial implement L2 logic
@GabrielEValenzuela @sebasfalcone
CL:
ff62168 
- Implement translation logic
- Restore deleted file
- Add TC-008 for windows scenario
@GabrielEValenzuela @sebasfalcone
CL:
e20431f 
- Fix new line
@GabrielEValenzuela @sebasfalcone
CL:
67b65fc 
- Fix errors related with string_view
- Add filter logic
@GabrielEValenzuela @sebasfalcone
CL:
5df1bd0 
- Fix segfault.
- Add documentation.
@GabrielEValenzuela @sebasfalcone
CL:
a366f29 
- Fix segfault.

- Add documentation.
@GabrielEValenzuela @sebasfalcone
CL:
454ee64 
- Refactoring, move L2 to databaseFeedManager.
- Delete filter.
- Split translation package scanner in a new function.
- Add cases for QA python testing.
- Restor cacheLRU.
@GabrielEValenzuela @sebasfalcone
CL:
0a3edce 
- Fix style.
@sebasfalcone
CL:
d3bf835 
- Fixed typo on column name
GabrielEValenzuela and others added 21 commits April 26, 2024 10:11
@GabrielEValenzuela
CL:
b985989 
- Fix error.
@TomasTurina
Merge pull request #22974 from wazuh/fix/21565-migrate-deprecated-sha…
6d378c9 
…1-functions

Migrate deprecated sha1 functions.
@Dwordcito
Merge pull request #23075 from wazuh/bug/23064-improve-loggin-socketd…
755ddbd 
…bwrapper

Improve error logging in `socketDbWrapper`
@sebasfalcone
CL:
543896a 
- Fixed typo
- Updated logging
   - Moved to debug
   - Aligned logging message
@Dwordcito
Merge pull request #23151 from wazuh/enhancement/23150-align-vulnerab…
7f0ad45 
…ility-scanner-facade-logging-with-current-changes

Align vulnerability scanner logging with current changes
@vikman90
fix: downgrade macOS image version for scan-build test
68ce597
@vikman90
Merge pull request #23178 from wazuh/fix/23176-scan-build-macos
7acd80a 
Downgrade macOS image version for scan-build test
@cborla @vikman90
fix: improve xml parser
f7c8a11
@cborla @vikman90
fix: add extra unit tests for xml parser
cfd1cab
@GabrielEValenzuela
CL:
68b8f73 
- Rename title to Wazuh Agent
@GabrielEValenzuela
CL:
737fe1b 
- Move callbacks
@Dwordcito
Merge pull request #23183 from wazuh/bug/17025-fix_coverity_syscollec…
0086780 
…torImp

Address Coverity issues in `syscollectorImp.cpp`
@Dwordcito
Merge pull request #23182 from wazuh/enhancement/19464_improve_window…
0f9cea9 
…s_ui

Improve Windows agent UI
@vikman90
Merge branch '4.7.4' into merge-4.7.4-into-4.8.0
bd4982f
@vikman90
Merge pull request #20448 from wazuh/16386-additional-xml-validation
1d8ed30 
Add additional check on XML parsing
@MarcelKemp
Merge pull request #23190 from wazuh/merge-4.7.4-into-4.8.0
fe72bb5 
Merge 4.7.4 into 4.8.0
@MarcelKemp
Merge branch '4.8.0' into merge-4.8.0-into-4.9.0
56e8a3d
@MarcelKemp
fix: downgrade macOS image version for ITs
f527538
@vikman90
test: expect synchronous=NORMAL at global database
c5d4eac
@vikman90
Merge pull request #23191 from wazuh/merge-4.8.0-into-4.9.0
f4de366 
Merge 4.8.0 into 4.9.0
@IsExec
AWS security hub default ruleset
f5d70dc
@IsExec IsExec self-assigned this May 1, 2024
@IsExec IsExec requested a review from ooniagbi May 2, 2024 06:28
@ooniagbi ooniagbi changed the base branch from 4.9.0 to epic-21209-aws-security-hub-integration May 2, 2024 11:46
@IsExec IsExec linked an issue May 3, 2024 that may be closed by this pull request
Create AWS Security Hub rules #22505
Closed
@IsExec IsExec removed a link to an issue May 3, 2024
Create AWS Security Hub rules #22505
Closed
@IsExec IsExec closed this May 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ooniagbi ooniagbi Awaiting requested review from ooniagbi

Assignees

@IsExec IsExec

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet