forked from p15670423/monkey
Docs: Remove references to ScoutSuite
This commit is contained in:
parent
2f397ad37e
commit
c68adf4849
|
@ -1,67 +0,0 @@
|
|||
---
|
||||
title: "Scoutsuite"
|
||||
date: 2021-03-02T16:23:06+02:00
|
||||
draft: false
|
||||
description: "Scout Suite is an open-source cloud security-auditing tool."
|
||||
weight: 10
|
||||
---
|
||||
|
||||
### About ScoutSuite
|
||||
|
||||
<a href="https://github.com/nccgroup/ScoutSuite" target="_blank" >Scout Suite</a> is an open-source cloud security-auditing tool.
|
||||
It queries the cloud API to gather configuration data. Based on configuration
|
||||
data gathered, ScoutSuite shows security issues and risks present in your infrastructure.
|
||||
|
||||
### Supported cloud providers
|
||||
|
||||
Currently, ScoutSuite integration only supports AWS environments.
|
||||
|
||||
### Enabling ScoutSuite
|
||||
|
||||
First, Infection Monkey needs access to your cloud API. You can provide access
|
||||
in the following ways:
|
||||
|
||||
- Provide access keys:
|
||||
- Create a new user with ReadOnlyAccess and SecurityAudit policies and generate keys
|
||||
- Generate keys for your current user (faster but less secure)
|
||||
- Configure AWS CLI:
|
||||
- If the command-line interface is available on the Island, it will be used to access
|
||||
the cloud API
|
||||
|
||||
More details about configuring ScoutSuite can be found in the tool itself, by choosing
|
||||
"Cloud Security Scan" in the "Run Monkey" options.
|
||||
|
||||
![Cloud scan option in run page](/images/usage/integrations/scoutsuite_run_page.png
|
||||
"Successful setup indicator")
|
||||
|
||||
After you're done with the setup, make sure that a checkmark appears next to the AWS option. This
|
||||
verifies that ScoutSuite can access the API.
|
||||
|
||||
![Successfull setup indicator](/images/usage/integrations/scoutsuite_aws_configured.png
|
||||
"Successful setup indicator")
|
||||
|
||||
### Running a cloud security scan
|
||||
|
||||
If you have successfully configured the cloud scan, Infection Monkey will scan
|
||||
your cloud infrastructure when the Monkey Agent is run **on the Island**. You
|
||||
can simply click on "From Island" in the run options to start the scan. The
|
||||
scope of the network scan and other activities you may have configured the Agent
|
||||
to perform are ignored by the ScoutSuite integration, except **Monkey
|
||||
Configuration -> System info collectors -> AWS collector**, which needs to
|
||||
remain **enabled**.
|
||||
|
||||
|
||||
### Assessing scan results
|
||||
|
||||
After the scan is done, ScoutSuite results will be categorized according to the
|
||||
ZeroTrust Extended framework and displayed as a part of the ZeroTrust report.
|
||||
The main difference between Infection Monkey findings and ScoutSuite findings
|
||||
is that ScoutSuite findings contain security rules. To see which rules were
|
||||
checked, click on the "Rules" button next to the relevant test. You'll see a
|
||||
list of rule dropdowns that are color coded according to their status. Expand a
|
||||
rule to see its description, remediation and more details about resources
|
||||
flagged. Each flagged resource has a path so you can easily locate it in the
|
||||
cloud and remediate the issue.
|
||||
|
||||
![Open ScoutSuite rule](/images/usage/integrations/scoutsuite_report_rule.png
|
||||
"Successful setup indicator")
|
|
@ -11,8 +11,6 @@ weight: 1
|
|||
Want to assess your progress in achieving a Zero Trust network? The Infection Monkey can automatically evaluate your readiness across the different
|
||||
[Zero Trust Extended Framework](https://www.forrester.com/report/The+Zero+Trust+eXtended+ZTX+Ecosystem/-/E-RES137210) principles.
|
||||
|
||||
You can additionally scan your cloud infrastructure's compliance to ZeroTrust principles using [ScoutSuite integration.]({{< ref "/usage/integrations/scoutsuite" >}})
|
||||
|
||||
## Configuration
|
||||
|
||||
- **Exploits -> Credentials** This configuration value will be used for brute-forcing. The Infection Monkey uses the most popular default passwords and usernames, but feel free to adjust it according to the default passwords common in your network. Keep in mind a longer list means longer scanning times.
|
||||
|
|
Loading…
Reference in New Issue