ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(threat detection): rename to threshold (#3665)

Browse Source
This commit is contained in:
Sergio Garcia
2024-04-04 13:29:35 +02:00
committed by GitHub
parent e1e95d8879
commit eaa8900758
3 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/config/config.yaml
+2 -2
View File
@@ -89,7 +89,7 @@ aws:
# AWS CloudTrail Configuration
# aws.cloudtrail_threat_detection_privilege_escalation
threat_detection_privilege_escalation_entropy: 0.7 # Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.7 (70%)
threat_detection_privilege_escalation_threshold: 0.1 # Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.1 (10%)
threat_detection_privilege_escalation_minutes: 1440 # Past minutes to search from now for privilege_escalation attacks, by default is 1440 minutes (24 hours)
threat_detection_privilege_escalation_actions: [
"AddPermission",
@@ -145,7 +145,7 @@ aws:
"UpdateLoginProfile",
]
# aws.cloudtrail_threat_detection_enumeration
threat_detection_enumeration_entropy: 0.7 # Percentage of actions found to decide if it is an enumeration attack event, by default is 0.7 (70%)
threat_detection_enumeration_threshold: 0.1 # Percentage of actions found to decide if it is an enumeration attack event, by default is 0.1 (10%)
threat_detection_enumeration_minutes: 1440 # Past minutes to search from now for enumeration attacks, by default is 1440 minutes (24 hours)
threat_detection_enumeration_actions: [
"DescribeAccessEntry",
prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.py
+5 -4
View File
@@ -5,8 +5,8 @@ from prowler.providers.aws.services.cloudtrail.cloudtrail_client import (
cloudtrail_client,
)
ENTROPY_THRESHOLD = cloudtrail_client.audit_config.get(
"threat_detection_enumeration_entropy", 0.7
THRESHOLD = cloudtrail_client.audit_config.get(
"threat_detection_enumeration_threshold", 0.1
)
THREAT_DETECTION_MINUTES = cloudtrail_client.audit_config.get(
"threat_detection_enumeration_minutes", 1440
@@ -47,7 +47,8 @@ class cloudtrail_threat_detection_enumeration(Check):
event_name
)
for source_ip, actions in potential_enumeration.items():
if len(actions) / len(ENUMERATION_ACTIONS) > ENTROPY_THRESHOLD:
ip_threshold = round(len(actions) / len(ENUMERATION_ACTIONS), 2)
if len(actions) / len(ENUMERATION_ACTIONS) > THRESHOLD:
found_potential_enumeration = True
report = Check_Report_AWS(self.metadata())
report.region = trail.region
@@ -55,7 +56,7 @@ class cloudtrail_threat_detection_enumeration(Check):
report.resource_arn = trail.arn
report.resource_tags = trail.tags
report.status = "FAIL"
report.status_extended = f"Potential enumeration attack detected from source IP {source_ip} with an entropy of {ENTROPY_THRESHOLD}."
report.status_extended = f"Potential enumeration attack detected from source IP {source_ip} with an threshold of {ip_threshold}."
findings.append(report)
if not found_potential_enumeration:
report = Check_Report_AWS(self.metadata())
prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.py
+5 -4
View File
@@ -5,8 +5,8 @@ from prowler.providers.aws.services.cloudtrail.cloudtrail_client import (
cloudtrail_client,
)
ENTROPY_THRESHOLD = cloudtrail_client.audit_config.get(
"threat_detection_privilege_escalation_entropy", 0.7
THRESHOLD = cloudtrail_client.audit_config.get(
"threat_detection_privilege_escalation_threshold", 0.1
)
THREAT_DETECTION_MINUTES = cloudtrail_client.audit_config.get(
"threat_detection_privilege_escalation_minutes", 1440
@@ -52,7 +52,8 @@ class cloudtrail_threat_detection_privilege_escalation(Check):
event_log["sourceIPAddress"]
].add(event_name)
for source_ip, actions in potential_privilege_escalation.items():
if len(actions) / len(PRIVILEGE_ESCALATION_ACTIONS) > ENTROPY_THRESHOLD:
ip_threshold = round(len(actions) / len(PRIVILEGE_ESCALATION_ACTIONS), 2)
if len(actions) / len(PRIVILEGE_ESCALATION_ACTIONS) > THRESHOLD:
found_potential_privilege_escalation = True
report = Check_Report_AWS(self.metadata())
report.region = trail.region
@@ -60,7 +61,7 @@ class cloudtrail_threat_detection_privilege_escalation(Check):
report.resource_arn = trail.arn
report.resource_tags = trail.tags
report.status = "FAIL"
report.status_extended = f"Potential privilege escalation attack detected from source IP {source_ip} with an entropy of {ENTROPY_THRESHOLD}."
report.status_extended = f"Potential privilege escalation attack detected from source IP {source_ip} with an threshold of {ip_threshold}."
findings.append(report)
if not found_potential_privilege_escalation:
report = Check_Report_AWS(self.metadata())