Skip to content

Commit

Permalink
Feature: CloudEploit 2.0.1
Browse files Browse the repository at this point in the history
  • Loading branch information
khulnasoft-bot committed Dec 10, 2024
1 parent df19f51 commit ace1370
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 9 deletions.
16 changes: 8 additions & 8 deletions docs/writing-plugins.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ CloudFront: {
},
```

The second section in `collect.js` is `postcalls`, which is an array of objects defining API calls that rely on other calls first returned. For example, if you need to query for all `CloudFront distributions`, and then loop through each one and run a more detailed call, you would add the `CloudFront:listDistributions` call in the [`calls`](https://github.com/cloudexploit/scans/blob/master/collectors/aws/collector.js#L58-L64) section and then the more detailed call in [`postcalls`](https://github.com/cloudexploit/scans/blob/master/collectors/aws/collector.js#L467-L473), setting it to rely on the output of `listDistributions` call.
The second section in `collect.js` is `postcalls`, which is an array of objects defining API calls that rely on other calls first returned. For example, if you need to query for all `CloudFront distributions`, and then loop through each one and run a more detailed call, you would add the `CloudFront:listDistributions` call in the [`calls`](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/aws/collector.js#L58-L64) section and then the more detailed call in [`postcalls`](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/aws/collector.js#L467-L473), setting it to rely on the output of `listDistributions` call.

An example:

Expand All @@ -37,7 +37,7 @@ getGroup: {

This section tells CloudExploit to wait until the `IAM:listGroups` call has been made, and then loop through the data that is returned. The `filterKey` tells CloudExploit the name of the key from the original response, while `filterValue` tells it which property to set in the `getGroup` call filter. For example: `iam.getGroup({GroupName:abc})` where `abc` is the `GroupName` from the returned list. CloudExploit will loop through each response, re-invoking `getGroup` for each element.

You can find the [AWS Collector here.](https://github.com/cloudexploit/scans/blob/master/collectors/aws/collector.js)
You can find the [AWS Collector here.](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/aws/collector.js)

#### Azure Collection

Expand All @@ -52,7 +52,7 @@ virtualMachines: {
},
```

The second section in `collect.js` is `postcalls`, which is an array of objects defining API calls that rely on other calls first returned. For example, if you need to query for all `Virtual Machine instances`, and then loop through each one and run a more detailed call, you would add the `virtualMachines:listAll` call in the [`calls`](https://github.com/cloudexploit/scans/blob/master/collectors/azure/collector.js#L50-L55) section and then the more detailed call in [`postcalls`](https://github.com/cloudexploit/scans/blob/master/collectors/azure/collector.js#L293-L302), setting it to rely on the output of `listDistributions` call.
The second section in `collect.js` is `postcalls`, which is an array of objects defining API calls that rely on other calls first returned. For example, if you need to query for all `Virtual Machine instances`, and then loop through each one and run a more detailed call, you would add the `virtualMachines:listAll` call in the [`calls`](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/azure/collector.js#L50-L55) section and then the more detailed call in [`postcalls`](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/azure/collector.js#L293-L302), setting it to rely on the output of `listDistributions` call.

```
virtualMachineExtensions: {
Expand All @@ -67,7 +67,7 @@ virtualMachineExtensions: {
},
```

You can find the [Azure Collector here.](https://github.com/cloudexploit/scans/blob/master/collectors/azure/collector.js)
You can find the [Azure Collector here.](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/azure/collector.js)

#### GCP Collection

Expand All @@ -83,7 +83,7 @@ buckets: {
},
```

The second section in `collect.js` is `postcalls`, which is an array of objects defining API calls that rely on other calls first returned. For example, if you need to query for all `Storage Buckets`, and then loop through each one and run a more detailed call, you would add the `buckets:list` call in the [`calls`](https://github.com/cloudexploit/scans/blob/master/collectors/google/collector.js#L103-L109) section and then the more detailed call in [`postcalls`](https://github.com/cloudexploit/scans/blob/master/collectors/google/collector.js#L213-L223), setting it to rely on the output of `getIamPolicy` call.
The second section in `collect.js` is `postcalls`, which is an array of objects defining API calls that rely on other calls first returned. For example, if you need to query for all `Storage Buckets`, and then loop through each one and run a more detailed call, you would add the `buckets:list` call in the [`calls`](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/google/collector.js#L103-L109) section and then the more detailed call in [`postcalls`](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/google/collector.js#L213-L223), setting it to rely on the output of `getIamPolicy` call.

```
buckets: {
Expand All @@ -99,7 +99,7 @@ buckets: {
},
```

You can find the [GCP Collector here.](https://github.com/cloudexploit/scans/blob/master/collectors/google/collector.js)
You can find the [GCP Collector here.](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/google/collector.js)

#### Oracle Collection

Expand All @@ -115,7 +115,7 @@ vcn: {
},
```

The second section in `collect.js` is `postcalls`, which is an array of objects defining API calls that rely on other calls first returned. For example, if you need to query for all `VCNs`, and then loop through each one and run a more detailed call, you would add the `vcn:list` call in the [`calls`](https://github.com/cloudexploit/scans/blob/master/collectors/oracle/collector.js#L41-L47) section and then the more detailed call in [`postcalls`](https://github.com/cloudexploit/scans/blob/master/collectors/oracle/collector.js#L243-L251), setting it to rely on the output of `get` call.
The second section in `collect.js` is `postcalls`, which is an array of objects defining API calls that rely on other calls first returned. For example, if you need to query for all `VCNs`, and then loop through each one and run a more detailed call, you would add the `vcn:list` call in the [`calls`](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/oracle/collector.js#L41-L47) section and then the more detailed call in [`postcalls`](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/oracle/collector.js#L243-L251), setting it to rely on the output of `get` call.

```
vcn: {
Expand All @@ -129,7 +129,7 @@ vcn: {
},
```

You can find the [Oracle Collector here.](https://github.com/cloudexploit/scans/blob/master/collectors/oracle/collector.js)
You can find the [Oracle Collector here.](https://github.com/khulnasoft/cloudexploit/blob/master/collectors/oracle/collector.js)

## Scanning Phase

Expand Down
2 changes: 1 addition & 1 deletion plugins/aws/cloudwatchlogs/monitoringMetrics.js
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ module.exports = {
domain: 'Compliance',
severity: 'Medium',
description: 'Ensures metric filters are setup for CloudWatch logs to detect security risks from CloudTrail.',
more_info: 'Sending CloudTrail logs to CloudWatch is only useful if metrics are setup to detect risky activity from those logs. There are numerous metrics that should be used. For the exact filter patterns, please see this plugin on GitHub: https://github.com/cloudexploit/scans/blob/master/plugins/aws/cloudwatchlogs/monitoringMetrics.js',
more_info: 'Sending CloudTrail logs to CloudWatch is only useful if metrics are setup to detect risky activity from those logs. There are numerous metrics that should be used. For the exact filter patterns, please see this plugin on GitHub: https://github.com/khulnasoft/cloudexploit/blob/master/plugins/aws/cloudwatchlogs/monitoringMetrics.js',
recommended_action: 'Enable metric filters to detect malicious activity in CloudTrail logs sent to CloudWatch.',
link: 'http://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html',
apis: ['CloudTrail:describeTrails', 'CloudWatchLogs:describeMetricFilters'],
Expand Down

0 comments on commit ace1370

Please sign in to comment.