diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 6f15b22..131c639 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -1,7 +1,7 @@ name: Linting on: [push, pull_request] jobs: - lint: + lint: # Run per push for internal contributers. This isn't possible for forked pull requests, # so we'll need to run on PR events for external contributers. # String comparison below is case insensitive. diff --git a/LICENSE b/LICENSE index f9b71ef..64cc283 100644 --- a/LICENSE +++ b/LICENSE @@ -186,7 +186,7 @@ same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright (c) 2019-2022 Splunk Inc. + Copyright (c) 2019-2023 Splunk Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -198,4 +198,4 @@ distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and - limitations under the License. \ No newline at end of file + limitations under the License. diff --git a/NOTICE b/NOTICE index 9f24a26..6f4d80e 100644 --- a/NOTICE +++ b/NOTICE @@ -1,5 +1,5 @@ Splunk SOAR AWS Inspector -Copyright (c) 2019-2022 Splunk Inc. +Copyright (c) 2019-2023 Splunk Inc. Third-party Software Attributions: @@ -16,11 +16,6 @@ Copyright 2012 Kenneth Reitz Copyright 2012-2017 Amazon.com, Inc Copyright 2013 Kenneth Reitz -Library: docutils -Version: 0.16 -License: Public Domain -Copyright 2011 Günter Milde, - Library: python-dateutil Version: 2.8.1 License: Apache 2.0 @@ -32,8 +27,3 @@ Copyright 2015 - Paul Ganssle Copyright 2015 - dateutil contributors (see AUTHORS file) Copyright 2017 Paul Ganssle Copyright 2017 dateutil contributors (see AUTHORS file) - -Library: requests -Version: 2.25.0 -License: Apache 2.0 -Kenneth Reitz diff --git a/README.md b/README.md index 51e2b82..2074bac 100644 --- a/README.md +++ b/README.md @@ -2,11 +2,11 @@ # AWS Inspector Publisher: Splunk -Connector Version: 2\.2\.10 +Connector Version: 2.2.11 Product Vendor: AWS Product Name: Inspector -Product Version Supported (regex): "\.\*" -Minimum Product Version: 5\.2\.0 +Product Version Supported (regex): ".\*" +Minimum Product Version: 5.2.0 This app integrates with AWS Inspector to perform security assessment actions @@ -51,10 +51,10 @@ The below configuration variables are required for this Connector to operate. T VARIABLE | REQUIRED | TYPE | DESCRIPTION -------- | -------- | ---- | ----------- -**access\_key** | optional | password | Access Key -**secret\_key** | optional | password | Secret Key +**access_key** | optional | password | Access Key +**secret_key** | optional | password | Secret Key **region** | required | string | Default Region -**use\_role** | optional | boolean | Use attached role when running Phantom in EC2 +**use_role** | optional | boolean | Use attached role when running Phantom in EC2 ### Supported Actions [test connectivity](#action-test-connectivity) - Validate the asset configuration for connectivity using supplied configuration @@ -86,22 +86,22 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**target\_name** | required | Name of the target | string | `aws inspector target name` -**resource\_group\_arn** | optional | Resource Group ARN used for creating the assessment target | string | `aws inspector resource group arn` `aws arn` +**target_name** | required | Name of the target | string | `aws inspector target name` +**resource_group_arn** | optional | Resource Group ARN used for creating the assessment target | string | `aws inspector resource group arn` `aws arn` **credentials** | optional | Assumed role credentials | string | `aws credentials` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.resource\_group\_arn | string | `aws inspector resource group arn` `aws arn` -action\_result\.parameter\.target\_name | string | `aws inspector target name` -action\_result\.data\.\*\.assessmentTargetArn | string | `aws inspector target arn` `aws arn` -action\_result\.summary\.total\_target\_arn | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | -action\_result\.parameter\.credentials | string | `aws credentials` +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.resource_group_arn | string | `aws inspector resource group arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:resourcegroup/0-He7VMMwP +action_result.parameter.target_name | string | `aws inspector target name` | test_target +action_result.data.\*.assessmentTargetArn | string | `aws inspector target arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K +action_result.summary.total_target_arn | numeric | | 1 +action_result.message | string | | Target successfully added +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 +action_result.parameter.credentials | string | `aws credentials` | {'AccessKeyId': 'AKIAIOSFODNN7EXAMPLE', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', 'SessionToken': 'EXAMPLEKEYTEST///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SWEXAMPLEEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTSEXAMPLEKEYTESTJ8jjnxGQIikPRToL2ZEXAMPLE=='} ## action: 'delete target' Delete the assessment target @@ -109,25 +109,25 @@ Delete the assessment target Type: **generic** Read only: **False** -Deleting an assessment target will also delete corresponding templates, runs, and findings\. +Deleting an assessment target will also delete corresponding templates, runs, and findings. #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**target\_arn** | required | ARN of the assessment target | string | `aws inspector target arn` `aws arn` +**target_arn** | required | ARN of the assessment target | string | `aws inspector target arn` `aws arn` **credentials** | optional | Assumed role credentials | string | `aws credentials` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.target\_arn | string | `aws inspector target arn` `aws arn` -action\_result\.data | string | -action\_result\.summary | string | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | -action\_result\.parameter\.credentials | string | `aws credentials` +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.target_arn | string | `aws inspector target arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-KstwgEAp +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | Target is deleted successfully +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 +action_result.parameter.credentials | string | `aws credentials` | {'AccessKeyId': 'AKIAIOSFODNN7EXAMPLE', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', 'SessionToken': 'EXAMPLEKEYTEST///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SWEXAMPLEEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTSEXAMPLEKEYTESTJ8jjnxGQIikPRToL2ZEXAMPLE=='} ## action: 'list templates' List the assessment templates of assessment targets @@ -135,35 +135,35 @@ List the assessment templates of assessment targets Type: **investigate** Read only: **True** -In the parameter template\_name, the user can specify an explicit value or a string that contains a wildcard to match the value of the assessment template name\. +In the parameter template_name, the user can specify an explicit value or a string that contains a wildcard to match the value of the assessment template name. #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**target\_arns** | optional | List of target ARNs | string | `aws inspector target arn` `aws arn` -**template\_name** | optional | Assessment template name pattern | string | +**target_arns** | optional | List of target ARNs | string | `aws inspector target arn` `aws arn` +**template_name** | optional | Assessment template name pattern | string | **limit** | optional | Maximum number of templates to be fetched | numeric | **credentials** | optional | Assumed role credentials | string | `aws credentials` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.limit | numeric | -action\_result\.parameter\.target\_arns | string | `aws inspector target arn` `aws arn` -action\_result\.parameter\.template\_name | string | -action\_result\.data\.\*\.arn | string | -action\_result\.data\.\*\.assessmentRunCount | numeric | -action\_result\.data\.\*\.assessmentTargetArn | string | `aws inspector target arn` `aws arn` -action\_result\.data\.\*\.createdAt | string | -action\_result\.data\.\*\.durationInSeconds | numeric | -action\_result\.data\.\*\.name | string | -action\_result\.data\.\*\.rulesPackageArns | string | -action\_result\.summary\.total\_templates | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | -action\_result\.parameter\.credentials | string | `aws credentials` +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.limit | numeric | | 10 +action_result.parameter.target_arns | string | `aws inspector target arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-6oqI2Cov +action_result.parameter.template_name | string | | Assessment-Template-Default +action_result.data.\*.arn | string | | arn:aws:inspector:us-east-1:849257271967:target/0-6oqI2Cov/template/0-26yzApF2 +action_result.data.\*.assessmentRunCount | numeric | | 0 +action_result.data.\*.assessmentTargetArn | string | `aws inspector target arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-6oqI2Cov +action_result.data.\*.createdAt | string | | 2019-05-16 17:50:28.198000+00:00 +action_result.data.\*.durationInSeconds | numeric | | 3600 +action_result.data.\*.name | string | | Assessment-Template-Default +action_result.data.\*.rulesPackageArns | string | | arn:aws:inspector:us-east-1:316112463485:rulespackage/0-R01qwB5Q +action_result.summary.total_templates | numeric | | 2 +action_result.message | string | | Total templates: 2 +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 +action_result.parameter.credentials | string | `aws credentials` | {'AccessKeyId': 'AKIAIOSFODNN7EXAMPLE', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', 'SessionToken': 'EXAMPLEKEYTEST///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SWEXAMPLEEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTSEXAMPLEKEYTESTJ8jjnxGQIikPRToL2ZEXAMPLE=='} ## action: 'list targets' List the assessment target ARNs within the AWS account @@ -171,30 +171,30 @@ List the assessment target ARNs within the AWS account Type: **investigate** Read only: **True** -In the parameter target\_name, the user can specify an explicit value or a string that contains a wildcard to match the value of the assessment target name\. +In the parameter target_name, the user can specify an explicit value or a string that contains a wildcard to match the value of the assessment target name. #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**target\_name** | optional | Assessment target name pattern | string | `aws inspector target name` +**target_name** | optional | Assessment target name pattern | string | `aws inspector target name` **limit** | optional | Maximum number of targets to be fetched | numeric | **credentials** | optional | Assumed role credentials | string | `aws credentials` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.limit | numeric | -action\_result\.parameter\.target\_name | string | `aws inspector target name` -action\_result\.data\.\*\.createdAt | string | -action\_result\.data\.\*\.name | string | `aws inspector target name` -action\_result\.data\.\*\.arn | string | `aws inspector target arn` `aws arn` -action\_result\.data\.\*\.updatedAt | string | -action\_result\.summary\.total\_targets | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | -action\_result\.parameter\.credentials | string | `aws credentials` +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.limit | numeric | | 10 +action_result.parameter.target_name | string | `aws inspector target name` | test_target +action_result.data.\*.createdAt | string | | 2019-05-16 17:50:28.005000+00:00 +action_result.data.\*.name | string | `aws inspector target name` | Assessment-Target-All-Instances +action_result.data.\*.arn | string | `aws inspector target arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-6oqI2Cov +action_result.data.\*.updatedAt | string | | 2019-05-16 17:50:28.005000+00:00 +action_result.summary.total_targets | numeric | | 2 +action_result.message | string | | Total targets: 1 Total targets: 2 +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 +action_result.parameter.credentials | string | `aws credentials` | {'AccessKeyId': 'AKIAIOSFODNN7EXAMPLE', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', 'SessionToken': 'EXAMPLEKEYTEST///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SWEXAMPLEEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTSEXAMPLEKEYTESTJ8jjnxGQIikPRToL2ZEXAMPLE=='} ## action: 'run assessment' Start the assessment run specified by the assessment template ARN @@ -202,38 +202,38 @@ Start the assessment run specified by the assessment template ARN Type: **generic** Read only: **False** -While an assessment run is in the COLLECTING\_DATA state then, all other assessment runs will fail\. +While an assessment run is in the COLLECTING_DATA state then, all other assessment runs will fail. #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**template\_arn** | required | Assessment template ARN to start the assessment run of | string | `aws inspector template arn` `aws arn` -**assessment\_run\_name** | optional | Name of the assessment run | string | +**template_arn** | required | Assessment template ARN to start the assessment run of | string | `aws inspector template arn` `aws arn` +**assessment_run_name** | optional | Name of the assessment run | string | **credentials** | optional | Assumed role credentials | string | `aws credentials` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.assessment\_run\_name | string | -action\_result\.parameter\.template\_arn | string | `aws inspector template arn` `aws arn` -action\_result\.data\.\*\.arn | string | `aws inspector assessment run arn` `aws arn` -action\_result\.data\.\*\.assessmentTemplateArn | string | `aws inspector template arn` `aws arn` -action\_result\.data\.\*\.createdAt | string | -action\_result\.data\.\*\.dataCollected | boolean | -action\_result\.data\.\*\.durationInSeconds | numeric | -action\_result\.data\.\*\.name | string | -action\_result\.data\.\*\.rulesPackageArns | string | -action\_result\.data\.\*\.startedAt | string | -action\_result\.data\.\*\.state | string | -action\_result\.data\.\*\.stateChangedAt | string | -action\_result\.data\.\*\.stateChanges\.\*\.state | string | -action\_result\.data\.\*\.stateChanges\.\*\.stateChangedAt | string | -action\_result\.summary\.assessment\_run\_arn | numeric | `aws inspector assessment run arn` `aws arn` -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | -action\_result\.parameter\.credentials | string | `aws credentials` +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.assessment_run_name | string | | test-template/2019-05-29T06:35/Uom2 +action_result.parameter.template_arn | string | `aws inspector template arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K/template/0-QRxUrrdI +action_result.data.\*.arn | string | `aws inspector assessment run arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K/template/0-QRxUrrdI/run/0-D2egFbHs +action_result.data.\*.assessmentTemplateArn | string | `aws inspector template arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K/template/0-QRxUrrdI +action_result.data.\*.createdAt | string | | 2019-05-29 09:47:05.864000+00:00 +action_result.data.\*.dataCollected | boolean | | True False +action_result.data.\*.durationInSeconds | numeric | | 3600 +action_result.data.\*.name | string | | test-template/2019-05-29T09:47/RmfI +action_result.data.\*.rulesPackageArns | string | | arn:aws:inspector:us-east-1:316112463485:rulespackage/0-R01qwB5Q +action_result.data.\*.startedAt | string | | 2019-05-29 09:47:06.687000+00:00 +action_result.data.\*.state | string | | COLLECTING_DATA +action_result.data.\*.stateChangedAt | string | | 2019-05-29 09:47:06.687000+00:00 +action_result.data.\*.stateChanges.\*.state | string | | CREATED +action_result.data.\*.stateChanges.\*.stateChangedAt | string | | 2019-05-29 09:47:05.863000+00:00 +action_result.summary.assessment_run_arn | numeric | `aws inspector assessment run arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K/template/0-QRxUrrdI/run/0-D2egFbHs +action_result.message | string | | Assessment run arn: arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K/template/0-QRxUrrdI/run/0-D2egFbHs +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 +action_result.parameter.credentials | string | `aws credentials` | {'AccessKeyId': 'AKIAIOSFODNN7EXAMPLE', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', 'SessionToken': 'EXAMPLEKEYTEST///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SWEXAMPLEEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTSEXAMPLEKEYTESTJ8jjnxGQIikPRToL2ZEXAMPLE=='} ## action: 'get findings' List and describe the findings generated by the assessment runs @@ -244,57 +244,57 @@ Read only: **True** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**assessment\_run\_arns** | optional | List of the assessment runs ARNs \(Max Limit\: 50\) | string | `aws inspector assessment run arn` `aws arn` -**severities** | optional | List of severity values \(case\-sensitive\) \(Max Limit\: 50\) | string | +**assessment_run_arns** | optional | List of the assessment runs ARNs (Max Limit: 50) | string | `aws inspector assessment run arn` `aws arn` +**severities** | optional | List of severity values (case-sensitive) (Max Limit: 50) | string | **limit** | optional | Maximum number of findings to be fetched | numeric | **credentials** | optional | Assumed role credentials | string | `aws credentials` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.assessment\_run\_arns | string | `aws inspector assessment run arn` `aws arn` -action\_result\.parameter\.limit | numeric | -action\_result\.parameter\.severities | string | -action\_result\.data\.\*\.arn | string | -action\_result\.data\.\*\.assetAttributes\.agentId | string | `aws ec2 instance id` -action\_result\.data\.\*\.assetAttributes\.amiId | string | -action\_result\.data\.\*\.assetAttributes\.hostname | string | `host name` -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.networkInterfaceId | string | -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.privateDnsName | string | -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.privateIpAddress | string | `ip` -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.privateIpAddresses\.\*\.privateDnsName | string | -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.privateIpAddresses\.\*\.privateIpAddress | string | `ip` -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.publicDnsName | string | -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.publicIp | string | `ip` -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.securityGroups\.\*\.groupId | string | -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.securityGroups\.\*\.groupName | string | -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.subnetId | string | -action\_result\.data\.\*\.assetAttributes\.networkInterfaces\.\*\.vpcId | string | `aws ec2 vpc id` -action\_result\.data\.\*\.assetAttributes\.schemaVersion | numeric | -action\_result\.data\.\*\.assetAttributes\.tags\.\*\.key | string | -action\_result\.data\.\*\.assetAttributes\.tags\.\*\.value | string | `email` -action\_result\.data\.\*\.assetType | string | -action\_result\.data\.\*\.attributes\.\*\.key | string | -action\_result\.data\.\*\.attributes\.\*\.value | string | -action\_result\.data\.\*\.confidence | numeric | -action\_result\.data\.\*\.createdAt | string | -action\_result\.data\.\*\.description | string | -action\_result\.data\.\*\.id | string | -action\_result\.data\.\*\.indicatorOfCompromise | boolean | -action\_result\.data\.\*\.numericSeverity | numeric | -action\_result\.data\.\*\.recommendation | string | -action\_result\.data\.\*\.schemaVersion | numeric | -action\_result\.data\.\*\.service | string | -action\_result\.data\.\*\.serviceAttributes\.assessmentRunArn | string | -action\_result\.data\.\*\.serviceAttributes\.rulesPackageArn | string | -action\_result\.data\.\*\.serviceAttributes\.schemaVersion | numeric | -action\_result\.data\.\*\.severity | string | -action\_result\.data\.\*\.title | string | -action\_result\.data\.\*\.updatedAt | string | -action\_result\.summary\.total\_findings | numeric | -action\_result\.summary\.total\_templates | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | -action\_result\.parameter\.credentials | string | `aws credentials` \ No newline at end of file +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.assessment_run_arns | string | `aws inspector assessment run arn` `aws arn` | arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K/template/0-weJjg0hC/run/0-ZjmO3RKu +action_result.parameter.limit | numeric | | 5 +action_result.parameter.severities | string | | High Low Medium Undefined Informational +action_result.data.\*.arn | string | | arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K/template/0-weJjg0hC/run/0-ZjmO3RKu/finding/0-cOjmYFiJ +action_result.data.\*.assetAttributes.agentId | string | `aws ec2 instance id` | i-0edb2f67d116434a5 +action_result.data.\*.assetAttributes.amiId | string | | ami-07b8352fea5b7a594 +action_result.data.\*.assetAttributes.hostname | string | `host name` | ec2-23-20-100-84.compute-1.amazonaws.com +action_result.data.\*.assetAttributes.networkInterfaces.\*.networkInterfaceId | string | | eni-03bfd52b58267d6e4 +action_result.data.\*.assetAttributes.networkInterfaces.\*.privateDnsName | string | | ip-172-31-45-141.ec2.internal +action_result.data.\*.assetAttributes.networkInterfaces.\*.privateIpAddress | string | `ip` | 172.31.45.141 +action_result.data.\*.assetAttributes.networkInterfaces.\*.privateIpAddresses.\*.privateDnsName | string | | ip-172-31-45-141.ec2.internal +action_result.data.\*.assetAttributes.networkInterfaces.\*.privateIpAddresses.\*.privateIpAddress | string | `ip` | 172.31.45.141 +action_result.data.\*.assetAttributes.networkInterfaces.\*.publicDnsName | string | | ec2-23-20-100-84.compute-1.amazonaws.com +action_result.data.\*.assetAttributes.networkInterfaces.\*.publicIp | string | `ip` | 23.20.100.84 +action_result.data.\*.assetAttributes.networkInterfaces.\*.securityGroups.\*.groupId | string | | sg-00c60fd41aea33c09 +action_result.data.\*.assetAttributes.networkInterfaces.\*.securityGroups.\*.groupName | string | | nginx-default-sg +action_result.data.\*.assetAttributes.networkInterfaces.\*.subnetId | string | | subnet-97f8b0ca +action_result.data.\*.assetAttributes.networkInterfaces.\*.vpcId | string | `aws ec2 vpc id` | vpc-5113dc2a +action_result.data.\*.assetAttributes.schemaVersion | numeric | | 1 +action_result.data.\*.assetAttributes.tags.\*.key | string | | InstanceOwnerEmail Name +action_result.data.\*.assetAttributes.tags.\*.value | string | `email` | test +action_result.data.\*.assetType | string | | ec2-instance +action_result.data.\*.attributes.\*.key | string | | ENI +action_result.data.\*.attributes.\*.value | string | | eni-084422612470a9c63 +action_result.data.\*.confidence | numeric | | 10 +action_result.data.\*.createdAt | string | | 2019-05-29 14:09:34.077000+00:00 +action_result.data.\*.description | string | | On this instance, TCP port 23, which is associated with Telnet, is reachable from the internet. You can install the Inspector agent on this instance and re-run the assessment to check for any process listening on this port. The instance i-0edb2f67d116434a5 is located in VPC vpc-5113dc2a and has an attached ENI eni-03bfd52b58267d6e4 which uses network ACL acl-018ed07a. The port is reachable from the internet through Security Group sg-00c60fd41aea33c09 and IGW igw-0b758073 +action_result.data.\*.id | string | | Recognized port reachable from internet +action_result.data.\*.indicatorOfCompromise | boolean | | True False +action_result.data.\*.numericSeverity | numeric | | 9 +action_result.data.\*.recommendation | string | | You can edit the Security Group sg-00c60fd41aea33c09 to remove access from the internet on port 23 +action_result.data.\*.schemaVersion | numeric | | 1 +action_result.data.\*.service | string | | Inspector +action_result.data.\*.serviceAttributes.assessmentRunArn | string | | arn:aws:inspector:us-east-1:849257271967:target/0-evshZX5K/template/0-weJjg0hC/run/0-ZjmO3RKu +action_result.data.\*.serviceAttributes.rulesPackageArn | string | | arn:aws:inspector:us-east-1:316112463485:rulespackage/0-PmNV0Tcd +action_result.data.\*.serviceAttributes.schemaVersion | numeric | | 1 +action_result.data.\*.severity | string | | High Low Medium Undefined Informational +action_result.data.\*.title | string | | On instance i-0edb2f67d116434a5, TCP port 23 which is associated with 'Telnet' is reachable from the internet +action_result.data.\*.updatedAt | string | | 2019-05-29 14:09:34.077000+00:00 +action_result.summary.total_findings | numeric | | 5 +action_result.summary.total_templates | numeric | | 233 +action_result.message | string | | Total findings: 5 +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 +action_result.parameter.credentials | string | `aws credentials` | {'AccessKeyId': 'AKIAIOSFODNN7EXAMPLE', 'Expiration': '2021-06-07 22:28:04', 'SecretAccessKey': 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', 'SessionToken': 'EXAMPLEKEYTEST///////////wEaDFRU0s4AVrw0k0oYICK4ATAzOqzAkg9bHY29lYmP59UvVOHjLufOy4s7SnAzOxGqGIXnukLis4TWNhrJl5R5nYyimrm6K/9d0Cw2SWEXAMPLEEJHWJ+yY5Qk2QpWctS2BGn4n+G8cD6zEweCCMj+ScI5p8n7YI4wOdvXvOsVMmjV6F09Ujqr1w+NwoKXlglznXGs/7Q1kNZOMiioEhGUyoiHbQb37GCKslDK+oqe0KNaUKQ96YCepaLgMbMquDgdAM8I0TTxUO0o5ILF/gUyLT04R7QlOfktkdh6Qt0atTSEXAMPLEKEYTESTJ8jjnxGQIikPRToL2ZEXAMPLE=='} \ No newline at end of file diff --git a/__init__.py b/__init__.py index f7ee2da..44bae34 100644 --- a/__init__.py +++ b/__init__.py @@ -1,6 +1,6 @@ # File: __init__.py # -# Copyright (c) 2019-2022 Splunk Inc. +# Copyright (c) 2019-2023 Splunk Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/awsinspector.json b/awsinspector.json index b47aba4..49996cd 100644 --- a/awsinspector.json +++ b/awsinspector.json @@ -9,8 +9,8 @@ "product_name": "Inspector", "product_version_regex": ".*", "publisher": "Splunk", - "license": "Copyright (c) 2019-2022 Splunk Inc.", - "app_version": "2.2.10", + "license": "Copyright (c) 2019-2023 Splunk Inc.", + "app_version": "2.2.11", "utctime_updated": "2022-01-07T21:56:46.000000Z", "package_name": "phantom_awsinspector", "main_module": "awsinspector_connector.py", @@ -25,51 +25,31 @@ "wheel": [ { "module": "boto3", - "input_file": "wheels/boto3-1.17.30-py2.py3-none-any.whl" + "input_file": "wheels/shared/boto3-1.17.30-py2.py3-none-any.whl" }, { "module": "botocore", - "input_file": "wheels/botocore-1.20.30-py2.py3-none-any.whl" - }, - { - "module": "certifi", - "input_file": "wheels/certifi-2021.10.8-py2.py3-none-any.whl" - }, - { - "module": "chardet", - "input_file": "wheels/chardet-3.0.4-py2.py3-none-any.whl" - }, - { - "module": "docutils", - "input_file": "wheels/docutils-0.16-py2.py3-none-any.whl" - }, - { - "module": "idna", - "input_file": "wheels/idna-2.10-py2.py3-none-any.whl" + "input_file": "wheels/shared/botocore-1.20.30-py2.py3-none-any.whl" }, { "module": "jmespath", - "input_file": "wheels/jmespath-0.10.0-py2.py3-none-any.whl" + "input_file": "wheels/shared/jmespath-0.10.0-py2.py3-none-any.whl" }, { "module": "python_dateutil", - "input_file": "wheels/python_dateutil-2.8.1-py2.py3-none-any.whl" - }, - { - "module": "requests", - "input_file": "wheels/requests-2.25.0-py2.py3-none-any.whl" + "input_file": "wheels/shared/python_dateutil-2.8.1-py2.py3-none-any.whl" }, { "module": "s3transfer", - "input_file": "wheels/s3transfer-0.3.7-py2.py3-none-any.whl" + "input_file": "wheels/shared/s3transfer-0.3.7-py2.py3-none-any.whl" }, { "module": "six", - "input_file": "wheels/six-1.16.0-py2.py3-none-any.whl" + "input_file": "wheels/shared/six-1.16.0-py2.py3-none-any.whl" }, { "module": "urllib3", - "input_file": "wheels/urllib3-1.26.7-py2.py3-none-any.whl" + "input_file": "wheels/shared/urllib3-1.26.18-py2.py3-none-any.whl" } ] }, diff --git a/awsinspector_connector.py b/awsinspector_connector.py index 76f8e11..8e119fc 100644 --- a/awsinspector_connector.py +++ b/awsinspector_connector.py @@ -1,6 +1,6 @@ # File: awsinspector_connector.py # -# Copyright (c) 2019-2022 Splunk Inc. +# Copyright (c) 2019-2023 Splunk Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/awsinspector_consts.py b/awsinspector_consts.py index 6325a9a..6dc0022 100644 --- a/awsinspector_consts.py +++ b/awsinspector_consts.py @@ -1,6 +1,6 @@ # File: awsinspector_consts.py # -# Copyright (c) 2019-2022 Splunk Inc. +# Copyright (c) 2019-2023 Splunk Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/awsinspector_get_findings.html b/awsinspector_get_findings.html index 326eb7b..f92bc8f 100644 --- a/awsinspector_get_findings.html +++ b/awsinspector_get_findings.html @@ -10,7 +10,7 @@ {% block widget_content %}