-
Notifications
You must be signed in to change notification settings - Fork 126
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Snowflake support, update OCSF, bug fixes & experiments #293
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jonrau1
added
bug
Something isn't working
documentation
Improvements or additions to documentation
enhancement
New feature or request
python
Pull requests that update Python code
aws
Related to AWS
snowflake
For Snowflake
labels
Sep 3, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
aws
Related to AWS
bug
Something isn't working
documentation
Improvements or additions to documentation
enhancement
New feature or request
python
Pull requests that update Python code
snowflake
For Snowflake
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Primarily, this PR is to address #292 to add Snowflake to the list of SaaS Security Posture Management checks in ElectricEye, which I did. Albeit, only somewhat, I don't have access to an Enterprise Account and cannot evaluate any of the encryption-related checks and will not do so blindly in good faith (and to save myself asspain in the future).
Additionally, as is the tradition, whenever I am dicking around with the code I want to eek out some small performance improvements, bugfixes, and mess around with Outputs and some experimental features -- much like how I added same-account session creation and even came up with the idea of using a TOML file.
Breaking Changes
ocsf_stdout
andocsf_kdf
to 1.4.0 from 1.1.0--create-insights
option from the Controller, removed the old code that it called to create AWS Security Hub InsightsBugfixes
base_event
as well asresources.cloud_partition
,resources.region
,cloud.account.uid
, andcloud.region
for non-AWS checks that have placeholder ASFF values for Account, Region, and Partition--list-controls
arg to display finding titles in a JSON listprint
andlogger.*
were usedEEAuditor
andCloudUtils
for easier debugging - mostly for meboto3.Session()
objects were created due to improper nestingelectric_eye_role_name
in the TOML or experimental--args
feature-t
-- notably ServiceNow was called when evaluating AWSFeatures & Improvements
ocsf_v1_4_0
EEAuditor
notably for AWS checksINFO
- this can make it a bit chatty so in the future I will have to change it I am sure - that will be a larger project I don't want to dick with right nowCloudUtils
-tp
for--toml-path
or-of
for--output-file
Experimental
-ut
/--use-toml
to decide when to read from the TOML configuration file or use externally provided details--args
which allows you to provide escaped JSON when-ut
is set toFalse
, this will call a new function inCloudUtils
to process the configuration details from a JSON object instead of the TOML. This is a WIP and only AWS and Snowflake are ported with minimal documentation. The concept is to make it easier to run ElectricEye within Docker or another orchestrator, especially for providing several Accounts/Regions/Compartments to execute in parallel instead of in series.