Exported telem categories into dict, moved scoutsuite submodule to a different dir

This commit is contained in:
VakarisZ 2020-09-03 12:06:20 +03:00
parent b14193f848
commit a365d2eb3c
76 changed files with 104 additions and 122 deletions

2
.gitmodules vendored
View File

@ -5,5 +5,5 @@
path = docs/themes/learn path = docs/themes/learn
url = https://github.com/guardicode/hugo-theme-learn.git url = https://github.com/guardicode/hugo-theme-learn.git
[submodule "monkey/infection_monkey/system_info/collectors/scoutsuite"] [submodule "monkey/infection_monkey/system_info/collectors/scoutsuite"]
path = monkey/infection_monkey/system_info/collectors/scoutsuite path = monkey/infection_monkey/system_info/collectors/scoutsuite_collector/scoutsuite
url = https://github.com/ShayNehmad/ScoutSuite.git url = https://github.com/ShayNehmad/ScoutSuite.git

View File

@ -0,0 +1,9 @@
class TelemCategoryEnum:
EXPLOIT = 'exploit'
POST_BREACH = 'post_breach'
SCAN = 'scan'
SCOUTSUITE = 'scoutsuite'
STATE = 'state'
SYSTEM_INFO = 'system_info'
TRACE = 'trace'
TUNNEL = 'tunnel'

View File

@ -9,7 +9,7 @@ from requests.exceptions import ConnectionError
import infection_monkey.monkeyfs as monkeyfs import infection_monkey.monkeyfs as monkeyfs
import infection_monkey.tunnel as tunnel import infection_monkey.tunnel as tunnel
from common.data.api_url_consts import T1216_PBA_FILE_DOWNLOAD_PATH from common.common_consts.api_url_consts import T1216_PBA_FILE_DOWNLOAD_PATH
from infection_monkey.config import GUID, WormConfiguration from infection_monkey.config import GUID, WormConfiguration
from infection_monkey.network.info import check_internet_access, local_ips from infection_monkey.network.info import check_internet_access, local_ips
from infection_monkey.transport.http import HTTPConnectProxy from infection_monkey.transport.http import HTTPConnectProxy

View File

@ -10,7 +10,7 @@ import re
import requests import requests
from common.data.network_consts import ES_SERVICE from common.common_consts.network_consts import ES_SERVICE
from common.utils.attack_utils import BITS_UPLOAD_STRING, ScanStatus from common.utils.attack_utils import BITS_UPLOAD_STRING, ScanStatus
from infection_monkey.exploit.web_rce import WebRCE from infection_monkey.exploit.web_rce import WebRCE
from infection_monkey.model import (BITSADMIN_CMDLINE_HTTP, CHECK_COMMAND, from infection_monkey.model import (BITSADMIN_CMDLINE_HTTP, CHECK_COMMAND,

View File

@ -6,7 +6,7 @@ import requests
from requests.exceptions import ConnectionError, Timeout from requests.exceptions import ConnectionError, Timeout
import infection_monkey.config import infection_monkey.config
from common.data.network_consts import ES_SERVICE from common.common_consts.network_consts import ES_SERVICE
from infection_monkey.network.HostFinger import HostFinger from infection_monkey.network.HostFinger import HostFinger
ES_PORT = 9200 ES_PORT = 9200

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_BACKDOOR_USER from common.common_consts.post_breach_consts import POST_BREACH_BACKDOOR_USER
from infection_monkey.config import WormConfiguration from infection_monkey.config import WormConfiguration
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.utils.users import get_commands_to_add_user from infection_monkey.utils.users import get_commands_to_add_user

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_SETUID_SETGID from common.common_consts.post_breach_consts import POST_BREACH_SETUID_SETGID
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.post_breach.setuid_setgid.setuid_setgid import \ from infection_monkey.post_breach.setuid_setgid.setuid_setgid import \
get_commands_to_change_setuid_setgid get_commands_to_change_setuid_setgid

View File

@ -1,6 +1,6 @@
import subprocess import subprocess
from common.data.post_breach_consts import POST_BREACH_CLEAR_CMD_HISTORY from common.common_consts.post_breach_consts import POST_BREACH_CLEAR_CMD_HISTORY
from infection_monkey.post_breach.clear_command_history.clear_command_history import \ from infection_monkey.post_breach.clear_command_history.clear_command_history import \
get_commands_to_clear_command_history get_commands_to_clear_command_history
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA

View File

@ -3,7 +3,7 @@ import random
import string import string
import subprocess import subprocess
from common.data.post_breach_consts import POST_BREACH_COMMUNICATE_AS_NEW_USER from common.common_consts.post_breach_consts import POST_BREACH_COMMUNICATE_AS_NEW_USER
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.telemetry.post_breach_telem import PostBreachTelem from infection_monkey.telemetry.post_breach_telem import PostBreachTelem
from infection_monkey.utils.auto_new_user_factory import create_auto_new_user from infection_monkey.utils.auto_new_user_factory import create_auto_new_user

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_ACCOUNT_DISCOVERY from common.common_consts.post_breach_consts import POST_BREACH_ACCOUNT_DISCOVERY
from infection_monkey.post_breach.account_discovery.account_discovery import \ from infection_monkey.post_breach.account_discovery.account_discovery import \
get_commands_to_discover_accounts get_commands_to_discover_accounts
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_HIDDEN_FILES from common.common_consts.post_breach_consts import POST_BREACH_HIDDEN_FILES
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.telemetry.post_breach_telem import PostBreachTelem from infection_monkey.telemetry.post_breach_telem import PostBreachTelem
from infection_monkey.utils.environment import is_windows_os from infection_monkey.utils.environment import is_windows_os

View File

@ -1,6 +1,6 @@
import subprocess import subprocess
from common.data.post_breach_consts import \ from common.common_consts.post_breach_consts import \
POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.post_breach.shell_startup_files.shell_startup_files_modification import \ from infection_monkey.post_breach.shell_startup_files.shell_startup_files_modification import \

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING from common.common_consts.post_breach_consts import POST_BREACH_JOB_SCHEDULING
from infection_monkey.post_breach.job_scheduling.job_scheduling import ( from infection_monkey.post_breach.job_scheduling.job_scheduling import (
get_commands_to_schedule_jobs, remove_scheduled_jobs) get_commands_to_schedule_jobs, remove_scheduled_jobs)
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA

View File

@ -1,7 +1,7 @@
import logging import logging
import subprocess import subprocess
from common.data.post_breach_consts import POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC from common.common_consts.post_breach_consts import POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.post_breach.signed_script_proxy.signed_script_proxy import ( from infection_monkey.post_breach.signed_script_proxy.signed_script_proxy import (
cleanup_changes, get_commands_to_proxy_execution_using_signed_script) cleanup_changes, get_commands_to_proxy_execution_using_signed_script)

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_TRAP_COMMAND from common.common_consts.post_breach_consts import POST_BREACH_TRAP_COMMAND
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.post_breach.trap_command.trap_command import \ from infection_monkey.post_breach.trap_command.trap_command import \
get_trap_commands get_trap_commands

View File

@ -1,7 +1,7 @@
import logging import logging
import os import os
from common.data.post_breach_consts import POST_BREACH_FILE_EXECUTION from common.common_consts.post_breach_consts import POST_BREACH_FILE_EXECUTION
from common.utils.attack_utils import ScanStatus from common.utils.attack_utils import ScanStatus
from infection_monkey.config import WormConfiguration from infection_monkey.config import WormConfiguration
from infection_monkey.control import ControlClient from infection_monkey.control import ControlClient

View File

@ -4,7 +4,7 @@ from enum import IntEnum
import psutil import psutil
from common.data.system_info_collectors_names import AZURE_CRED_COLLECTOR from common.common_consts.system_info_collectors_names import AZURE_CRED_COLLECTOR
from infection_monkey.network.info import get_host_subnets from infection_monkey.network.info import get_host_subnets
from infection_monkey.system_info.azure_cred_collector import AzureCollector from infection_monkey.system_info.azure_cred_collector import AzureCollector
from infection_monkey.system_info.netstat_collector import NetstatCollector from infection_monkey.system_info.netstat_collector import NetstatCollector

View File

@ -1,7 +1,7 @@
import logging import logging
from common.cloud.aws.aws_instance import AwsInstance from common.cloud.aws.aws_instance import AwsInstance
from common.data.system_info_collectors_names import AWS_COLLECTOR from common.common_consts.system_info_collectors_names import AWS_COLLECTOR
from infection_monkey.system_info.system_info_collector import \ from infection_monkey.system_info.system_info_collector import \
SystemInfoCollector SystemInfoCollector

View File

@ -1,6 +1,6 @@
from common.cloud.all_instances import get_all_cloud_instances from common.cloud.all_instances import get_all_cloud_instances
from common.cloud.environment_names import Environment from common.cloud.environment_names import Environment
from common.data.system_info_collectors_names import ENVIRONMENT_COLLECTOR from common.common_consts.system_info_collectors_names import ENVIRONMENT_COLLECTOR
from infection_monkey.system_info.system_info_collector import \ from infection_monkey.system_info.system_info_collector import \
SystemInfoCollector SystemInfoCollector

View File

@ -1,7 +1,7 @@
import logging import logging
import socket import socket
from common.data.system_info_collectors_names import HOSTNAME_COLLECTOR from common.common_consts.system_info_collectors_names import HOSTNAME_COLLECTOR
from infection_monkey.system_info.system_info_collector import \ from infection_monkey.system_info.system_info_collector import \
SystemInfoCollector SystemInfoCollector

View File

@ -2,7 +2,7 @@ import logging
import psutil import psutil
from common.data.system_info_collectors_names import PROCESS_LIST_COLLECTOR from common.common_consts.system_info_collectors_names import PROCESS_LIST_COLLECTOR
from infection_monkey.system_info.system_info_collector import \ from infection_monkey.system_info.system_info_collector import \
SystemInfoCollector SystemInfoCollector

View File

@ -1,36 +0,0 @@
import logging
import tempfile
from common.cloud.environment_names import Environment
from common.data.system_info_collectors_names import SCOUTSUITE_COLLECTOR
from infection_monkey.system_info.system_info_collector import SystemInfoCollector
from infection_monkey.system_info.collectors.scoutsuite.ScoutSuite.__main__ import run
from system_info.collectors.environment_collector import get_monkey_environment
logger = logging.getLogger(__name__)
class ScoutSuiteCollector(SystemInfoCollector):
def __init__(self):
super().__init__(name=SCOUTSUITE_COLLECTOR)
def collect(self) -> dict:
env = get_monkey_environment()
env = "AWS"
if env == Environment.ON_PREMISE.value:
logger.info("Monkey is not on cloud; not running ScoutSuite")
return {}
else:
tmp_dir_path = tempfile.mkdtemp()
logger.info(f"Attempting to execute ScoutSuite with {env.lower()}, saving results in {tmp_dir_path}")
scout_suite_results = run(
env.lower(),
debug=True,
quiet=False,
no_browser=True,
report_dir=tmp_dir_path)
return {
"Environment": env,
"Results": scout_suite_results
}

@ -1 +0,0 @@
Subproject commit e784fc27ae8311c3c610bccd556d2bef3cd54d63

@ -0,0 +1 @@
Subproject commit 6707e052b8573a4f9eaee7f77f6c5de404f3e8fd

View File

@ -2,7 +2,7 @@ import logging
import os import os
import sys import sys
from common.data.system_info_collectors_names import MIMIKATZ_COLLECTOR from common.common_consts.system_info_collectors_names import MIMIKATZ_COLLECTOR
from infection_monkey.system_info.windows_cred_collector.mimikatz_cred_collector import \ from infection_monkey.system_info.windows_cred_collector.mimikatz_cred_collector import \
MimikatzCredentialCollector MimikatzCredentialCollector

View File

@ -1,3 +1,4 @@
from common.common_consts.telem_categories import TelemCategoryEnum
from infection_monkey.telemetry.base_telem import BaseTelem from infection_monkey.telemetry.base_telem import BaseTelem
__author__ = "itay.mizeretz" __author__ = "itay.mizeretz"
@ -15,7 +16,7 @@ class ExploitTelem(BaseTelem):
self.exploiter = exploiter self.exploiter = exploiter
self.result = result self.result = result
telem_category = 'exploit' telem_category = TelemCategoryEnum.EXPLOIT
def get_data(self): def get_data(self):
return { return {

View File

@ -1,5 +1,6 @@
import socket import socket
from common.common_consts.telem_categories import TelemCategoryEnum
from infection_monkey.telemetry.base_telem import BaseTelem from infection_monkey.telemetry.base_telem import BaseTelem
__author__ = "itay.mizeretz" __author__ = "itay.mizeretz"
@ -18,7 +19,7 @@ class PostBreachTelem(BaseTelem):
self.result = result self.result = result
self.hostname, self.ip = PostBreachTelem._get_hostname_and_ip() self.hostname, self.ip = PostBreachTelem._get_hostname_and_ip()
telem_category = 'post_breach' telem_category = TelemCategoryEnum.POST_BREACH
def get_data(self): def get_data(self):
return { return {

View File

@ -1,3 +1,4 @@
from common.common_consts.telem_categories import TelemCategoryEnum
from infection_monkey.telemetry.base_telem import BaseTelem from infection_monkey.telemetry.base_telem import BaseTelem
__author__ = "itay.mizeretz" __author__ = "itay.mizeretz"
@ -13,7 +14,7 @@ class ScanTelem(BaseTelem):
super(ScanTelem, self).__init__() super(ScanTelem, self).__init__()
self.machine = machine self.machine = machine
telem_category = 'scan' telem_category = TelemCategoryEnum.SCAN
def get_data(self): def get_data(self):
return { return {

View File

@ -1,3 +1,4 @@
from common.common_consts.telem_categories import TelemCategoryEnum
from infection_monkey.telemetry.base_telem import BaseTelem from infection_monkey.telemetry.base_telem import BaseTelem
__author__ = "itay.mizeretz" __author__ = "itay.mizeretz"
@ -14,7 +15,7 @@ class StateTelem(BaseTelem):
self.is_done = is_done self.is_done = is_done
self.version = version self.version = version
telem_category = 'state' telem_category = TelemCategoryEnum.STATE
def get_data(self): def get_data(self):
return { return {

View File

@ -1,3 +1,4 @@
from common.common_consts.telem_categories import TelemCategoryEnum
from infection_monkey.telemetry.base_telem import BaseTelem from infection_monkey.telemetry.base_telem import BaseTelem
__author__ = "itay.mizeretz" __author__ = "itay.mizeretz"
@ -13,7 +14,7 @@ class SystemInfoTelem(BaseTelem):
super(SystemInfoTelem, self).__init__() super(SystemInfoTelem, self).__init__()
self.system_info = system_info self.system_info = system_info
telem_category = 'system_info' telem_category = TelemCategoryEnum.SYSTEM_INFO
def get_data(self): def get_data(self):
return self.system_info return self.system_info

View File

@ -1,5 +1,6 @@
import logging import logging
from common.common_consts.telem_categories import TelemCategoryEnum
from infection_monkey.telemetry.base_telem import BaseTelem from infection_monkey.telemetry.base_telem import BaseTelem
__author__ = "itay.mizeretz" __author__ = "itay.mizeretz"
@ -18,7 +19,7 @@ class TraceTelem(BaseTelem):
self.msg = msg self.msg = msg
LOG.debug("Trace: %s" % msg) LOG.debug("Trace: %s" % msg)
telem_category = 'trace' telem_category = TelemCategoryEnum.TRACE
def get_data(self): def get_data(self):
return { return {

View File

@ -1,3 +1,4 @@
from common.common_consts.telem_categories import TelemCategoryEnum
from infection_monkey.control import ControlClient from infection_monkey.control import ControlClient
from infection_monkey.telemetry.base_telem import BaseTelem from infection_monkey.telemetry.base_telem import BaseTelem
@ -13,7 +14,7 @@ class TunnelTelem(BaseTelem):
super(TunnelTelem, self).__init__() super(TunnelTelem, self).__init__()
self.proxy = ControlClient.proxies.get('https') self.proxy = ControlClient.proxies.get('https')
telem_category = 'tunnel' telem_category = TelemCategoryEnum.TUNNEL
def get_data(self): def get_data(self):
return {'proxy': self.proxy} return {'proxy': self.proxy}

View File

@ -6,7 +6,7 @@ from flask import Flask, Response, send_from_directory
from werkzeug.exceptions import NotFound from werkzeug.exceptions import NotFound
import monkey_island.cc.environment.environment_singleton as env_singleton import monkey_island.cc.environment.environment_singleton as env_singleton
from common.data.api_url_consts import T1216_PBA_FILE_DOWNLOAD_PATH from common.common_consts.api_url_consts import T1216_PBA_FILE_DOWNLOAD_PATH
from monkey_island.cc.consts import MONKEY_ISLAND_ABS_PATH from monkey_island.cc.consts import MONKEY_ISLAND_ABS_PATH
from monkey_island.cc.database import database, mongo from monkey_island.cc.database import database, mongo
from monkey_island.cc.resources.attack.attack_config import AttackConfiguration from monkey_island.cc.resources.attack.attack_config import AttackConfiguration

View File

@ -1,4 +1,4 @@
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.finding import Finding from monkey_island.cc.models.zero_trust.finding import Finding

View File

@ -2,7 +2,7 @@ from datetime import datetime
from mongoengine import DateTimeField, EmbeddedDocument, StringField from mongoengine import DateTimeField, EmbeddedDocument, StringField
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
class Event(EmbeddedDocument): class Event(EmbeddedDocument):

View File

@ -6,7 +6,7 @@ from typing import List
from mongoengine import Document, EmbeddedDocumentListField, StringField from mongoengine import Document, EmbeddedDocumentListField, StringField
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
# Dummy import for mongoengine. # Dummy import for mongoengine.
# noinspection PyUnresolvedReferences # noinspection PyUnresolvedReferences
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event

View File

@ -1,6 +1,6 @@
from mongoengine import StringField from mongoengine import StringField
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.finding import Finding from monkey_island.cc.models.zero_trust.finding import Finding

View File

@ -3,7 +3,7 @@ import unittest
import mongomock import mongomock
from packaging import version from packaging import version
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.aggregate_finding import \ from monkey_island.cc.models.zero_trust.aggregate_finding import \
AggregateFinding AggregateFinding
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event

View File

@ -1,6 +1,6 @@
from mongoengine import ValidationError from mongoengine import ValidationError
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event
from monkey_island.cc.testing.IslandTestCase import IslandTestCase from monkey_island.cc.testing.IslandTestCase import IslandTestCase

View File

@ -1,6 +1,6 @@
from mongoengine import ValidationError from mongoengine import ValidationError
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event
from monkey_island.cc.models.zero_trust.finding import Finding from monkey_island.cc.models.zero_trust.finding import Finding
from monkey_island.cc.testing.IslandTestCase import IslandTestCase from monkey_island.cc.testing.IslandTestCase import IslandTestCase

View File

@ -1,4 +1,4 @@
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event
from monkey_island.cc.models.zero_trust.segmentation_finding import \ from monkey_island.cc.models.zero_trust.segmentation_finding import \
SegmentationFinding SegmentationFinding

View File

@ -6,6 +6,7 @@ import dateutil
import flask_restful import flask_restful
from flask import request from flask import request
from common.common_consts.telem_categories import TelemCategoryEnum
from monkey_island.cc.database import mongo from monkey_island.cc.database import mongo
from monkey_island.cc.models.monkey import Monkey from monkey_island.cc.models.monkey import Monkey
from monkey_island.cc.resources.auth.auth import jwt_required from monkey_island.cc.resources.auth.auth import jwt_required
@ -74,7 +75,7 @@ class Telemetry(flask_restful.Resource):
monkey_label = telem_monkey_guid monkey_label = telem_monkey_guid
x["monkey"] = monkey_label x["monkey"] = monkey_label
objects.append(x) objects.append(x)
if x['telem_category'] == 'system_info' and 'credentials' in x['data']: if x['telem_category'] == TelemCategoryEnum.SYSTEM_INFO and 'credentials' in x['data']:
for user in x['data']['credentials']: for user in x['data']['credentials']:
if -1 != user.find(','): if -1 != user.find(','):
new_user = user.replace(',', '.') new_user = user.replace(',', '.')

View File

@ -6,6 +6,7 @@ import flask_pymongo
import flask_restful import flask_restful
from flask import request from flask import request
from common.common_consts.telem_categories import TelemCategoryEnum
from monkey_island.cc.database import mongo from monkey_island.cc.database import mongo
from monkey_island.cc.resources.auth.auth import jwt_required from monkey_island.cc.resources.auth.auth import jwt_required
from monkey_island.cc.services.node import NodeService from monkey_island.cc.services.node import NodeService
@ -109,11 +110,11 @@ class TelemetryFeed(flask_restful.Resource):
TELEM_PROCESS_DICT = \ TELEM_PROCESS_DICT = \
{ {
'tunnel': TelemetryFeed.get_tunnel_telem_brief, TelemCategoryEnum.TUNNEL: TelemetryFeed.get_tunnel_telem_brief,
'state': TelemetryFeed.get_state_telem_brief, TelemCategoryEnum.STATE: TelemetryFeed.get_state_telem_brief,
'exploit': TelemetryFeed.get_exploit_telem_brief, TelemCategoryEnum.EXPLOIT: TelemetryFeed.get_exploit_telem_brief,
'scan': TelemetryFeed.get_scan_telem_brief, TelemCategoryEnum.SCAN: TelemetryFeed.get_scan_telem_brief,
'system_info': TelemetryFeed.get_systeminfo_telem_brief, TelemCategoryEnum.SYSTEM_INFO: TelemetryFeed.get_systeminfo_telem_brief,
'trace': TelemetryFeed.get_trace_telem_brief, TelemCategoryEnum.TRACE: TelemetryFeed.get_trace_telem_brief,
'post_breach': TelemetryFeed.get_post_breach_telem_brief TelemCategoryEnum.POST_BREACH: TelemetryFeed.get_post_breach_telem_brief
} }

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING from common.common_consts.post_breach_consts import POST_BREACH_JOB_SCHEDULING
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_ACCOUNT_DISCOVERY from common.common_consts.post_breach_consts import POST_BREACH_ACCOUNT_DISCOVERY
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import ( from common.common_consts.post_breach_consts import (
POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER) POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER)
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_CLEAR_CMD_HISTORY from common.common_consts.post_breach_consts import POST_BREACH_CLEAR_CMD_HISTORY
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_TRAP_COMMAND from common.common_consts.post_breach_consts import POST_BREACH_TRAP_COMMAND
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import \ from common.common_consts.post_breach_consts import \
POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_HIDDEN_FILES from common.common_consts.post_breach_consts import POST_BREACH_HIDDEN_FILES
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_SETUID_SETGID from common.common_consts.post_breach_consts import POST_BREACH_SETUID_SETGID
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING from common.common_consts.post_breach_consts import POST_BREACH_JOB_SCHEDULING
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC from common.common_consts.post_breach_consts import POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.post_breach_consts import \ from common.common_consts.post_breach_consts import \
POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
from monkey_island.cc.services.attack.technique_reports.pba_technique import \ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
PostBreachTechnique PostBreachTechnique

View File

@ -1,4 +1,4 @@
from common.data.validation_formats import IP, IP_RANGE from common.common_consts.validation_formats import IP, IP_RANGE
from monkey_island.cc.services.utils.typographic_symbols import WARNING_SIGN from monkey_island.cc.services.utils.typographic_symbols import WARNING_SIGN
BASIC_NETWORK = { BASIC_NETWORK = {

View File

@ -1,9 +1,9 @@
from common.data.system_info_collectors_names import (AWS_COLLECTOR, from common.common_consts.system_info_collectors_names import (AWS_COLLECTOR,
AZURE_CRED_COLLECTOR, AZURE_CRED_COLLECTOR,
ENVIRONMENT_COLLECTOR, ENVIRONMENT_COLLECTOR,
HOSTNAME_COLLECTOR, HOSTNAME_COLLECTOR,
MIMIKATZ_COLLECTOR, MIMIKATZ_COLLECTOR,
PROCESS_LIST_COLLECTOR) PROCESS_LIST_COLLECTOR)
SYSTEM_INFO_COLLECTOR_CLASSES = { SYSTEM_INFO_COLLECTOR_CLASSES = {
"title": "System Information Collectors", "title": "System Information Collectors",

View File

@ -1,9 +1,9 @@
from common.data.system_info_collectors_names import (AWS_COLLECTOR, from common.common_consts.system_info_collectors_names import (AWS_COLLECTOR,
AZURE_CRED_COLLECTOR, AZURE_CRED_COLLECTOR,
ENVIRONMENT_COLLECTOR, ENVIRONMENT_COLLECTOR,
HOSTNAME_COLLECTOR, HOSTNAME_COLLECTOR,
MIMIKATZ_COLLECTOR, MIMIKATZ_COLLECTOR,
PROCESS_LIST_COLLECTOR) PROCESS_LIST_COLLECTOR)
MONKEY = { MONKEY = {
"title": "Monkey", "title": "Monkey",

View File

@ -1,4 +1,4 @@
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
import monkey_island.cc.services.reporting.zero_trust_service import monkey_island.cc.services.reporting.zero_trust_service
from monkey_island.cc.models.zero_trust.finding import Finding from monkey_island.cc.models.zero_trust.finding import Finding
from monkey_island.cc.services.reporting.zero_trust_service import \ from monkey_island.cc.services.reporting.zero_trust_service import \

View File

@ -2,7 +2,7 @@ from typing import List
from bson.objectid import ObjectId from bson.objectid import ObjectId
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.finding import Finding from monkey_island.cc.models.zero_trust.finding import Finding
# How many events of a single finding to return to UI. # How many events of a single finding to return to UI.

View File

@ -1,6 +1,6 @@
import copy import copy
from common.data.post_breach_consts import POST_BREACH_COMMUNICATE_AS_NEW_USER from common.common_consts.post_breach_consts import POST_BREACH_COMMUNICATE_AS_NEW_USER
from monkey_island.cc.database import mongo from monkey_island.cc.database import mongo
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
from monkey_island.cc.services.telemetry.zero_trust_tests.communicate_as_new_user import \ from monkey_island.cc.services.telemetry.zero_trust_tests.communicate_as_new_user import \

View File

@ -1,11 +1,11 @@
import logging import logging
import typing import typing
from common.data.system_info_collectors_names import (AWS_COLLECTOR, from common.common_consts.system_info_collectors_names import (AWS_COLLECTOR,
ENVIRONMENT_COLLECTOR, ENVIRONMENT_COLLECTOR,
HOSTNAME_COLLECTOR, HOSTNAME_COLLECTOR,
PROCESS_LIST_COLLECTOR, PROCESS_LIST_COLLECTOR,
SCOUTSUITE_COLLECTOR) SCOUTSUITE_COLLECTOR)
from monkey_island.cc.services.telemetry.processing.system_info_collectors.aws import \ from monkey_island.cc.services.telemetry.processing.system_info_collectors.aws import \
process_aws_telemetry process_aws_telemetry
from monkey_island.cc.services.telemetry.processing.system_info_collectors.environment import \ from monkey_island.cc.services.telemetry.processing.system_info_collectors.environment import \

View File

@ -1,6 +1,6 @@
import json import json
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
from monkey_island.cc.models.zero_trust.aggregate_finding import \ from monkey_island.cc.models.zero_trust.aggregate_finding import \
AggregateFinding AggregateFinding

View File

@ -1,4 +1,4 @@
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.aggregate_finding import \ from monkey_island.cc.models.zero_trust.aggregate_finding import \
AggregateFinding AggregateFinding
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event

View File

@ -1,7 +1,7 @@
import json import json
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from common.data.network_consts import ES_SERVICE from common.common_consts.network_consts import ES_SERVICE
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
from monkey_island.cc.models.zero_trust.aggregate_finding import ( from monkey_island.cc.models.zero_trust.aggregate_finding import (
AggregateFinding, add_malicious_activity_to_timeline) AggregateFinding, add_malicious_activity_to_timeline)

View File

@ -1,4 +1,4 @@
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models.zero_trust.aggregate_finding import ( from monkey_island.cc.models.zero_trust.aggregate_finding import (
AggregateFinding, add_malicious_activity_to_timeline) AggregateFinding, add_malicious_activity_to_timeline)
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event

View File

@ -1,6 +1,6 @@
import itertools import itertools
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from common.network.network_range import NetworkRange from common.network.network_range import NetworkRange
from common.network.segmentation_utils import (get_ip_if_in_subnet, from common.network.segmentation_utils import (get_ip_if_in_subnet,
get_ip_in_src_and_not_in_dst) get_ip_in_src_and_not_in_dst)

View File

@ -1,6 +1,6 @@
import uuid import uuid
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event
from monkey_island.cc.models.zero_trust.finding import Finding from monkey_island.cc.models.zero_trust.finding import Finding

View File

@ -1,4 +1,4 @@
import common.data.zero_trust_consts as zero_trust_consts import common.common_consts.zero_trust_consts as zero_trust_consts
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
from monkey_island.cc.models.zero_trust.aggregate_finding import ( from monkey_island.cc.models.zero_trust.aggregate_finding import (
AggregateFinding, add_malicious_activity_to_timeline) AggregateFinding, add_malicious_activity_to_timeline)