Skip to content

Commit 1c4d596

Browse files
arielkr256arielkr256
authored
Merge branch 'develop' into bp/eks-anonymous
2 parents 4461ab7 + eeaaaf0 commit 1c4d596

18 files changed

+150
-22
lines changed

‎.github/workflows/check-deprecated.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,14 @@ jobs:
2121
github.com:443
2222
pypi.org:443
2323
- name: Checkout panther-analysis
24-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
24+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2525

2626
- name: Fetch Release
2727
run: |
2828
git fetch --depth=1 origin develop
2929
3030
- name: Set python version
31-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
31+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
3232
with:
3333
python-version: "3.11"
3434

‎.github/workflows/check-mitre.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
github.com:443
2020
pypi.org:443
2121
- name: Checkout panther-analysis
22-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2323

2424
- name: Set python version
25-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
25+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
2626
with:
2727
python-version: "3.11"
2828

‎.github/workflows/check-packs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ jobs:
2525
pypi.org:443
2626
2727
- name: Checkout panther-analysis
28-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2929

3030
- name: Set python version
31-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
31+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
3232
with:
3333
python-version: "3.11"
3434

‎.github/workflows/docker.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
registry-1.docker.io:443
2828
www.python.org:443
2929
- name: Checkout panther-analysis
30-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
30+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
3131
- uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf #v3.2.0
3232
- name: Set up Docker Buildx
3333
id: buildx

‎.github/workflows/lint.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
github.com:443
2020
pypi.org:443
2121
- name: Checkout panther-analysis
22-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2323

2424
- name: Set python version
25-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
25+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
2626
with:
2727
python-version: "3.11"
2828

‎.github/workflows/pre-release-upload.yml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
on:
2+
pull_request_review:
3+
types: [submitted]
4+
5+
permissions:
6+
contents: read
7+
8+
jobs:
9+
upload:
10+
if: github.head_ref == 'main'
11+
name: Pre-Release Upload to GA
12+
runs-on: ubuntu-latest
13+
env:
14+
API_HOST: ${{ secrets.GA_API_HOST }}
15+
API_TOKEN: ${{ secrets.GA_API_TOKEN }}
16+
steps:
17+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
18+
with:
19+
egress-policy: audit
20+
21+
- name: Validate Secrets
22+
if: ${{ env.GA_API_HOST == '' || env.GA_API_TOKEN == '' }}
23+
run: |
24+
echo "API_HOST or API_TOKEN not set"
25+
exit 0
26+
27+
- name: Checkout panther-analysis
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
29+
30+
- name: Set python version
31+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
32+
with:
33+
python-version: "3.11"
34+
35+
- name: Install pipenv
36+
run: pip install pipenv
37+
38+
- name: Setup venv
39+
run: make venv
40+
41+
- name: upload
42+
run: |
43+
pipenv run panther_analysis_tool upload --api-host ${{ env.GA_API_HOST }} --api-token ${{ env.GA_API_TOKEN }}

‎.github/workflows/release.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
1919
with:
2020
egress-policy: audit
21-
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
21+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2222
with:
2323
fetch-depth: 0
2424
token: ${{ env.GITHUB_TOKEN }}
@@ -29,7 +29,7 @@ jobs:
2929
aws-region: ${{ secrets.AWS_REGION }}
3030
role-session-name: panther-analysis-release
3131
- name: Install Python
32-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
32+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
3333
with:
3434
python-version: "3.11"
3535
- name: Create new panther-analysis release

‎.github/workflows/sync-from-upstream.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
branch: "sync_upstream_${{steps.set_upstream.outputs.latest-release}}"
3838
# Checkout this repo into the branch
3939
- name: Checkout your local repo in PR branch
40-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
4141
with:
4242
ref: "sync_upstream_${{steps.set_upstream.outputs.latest-release}}"
4343
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/test.yml

+31-2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,35 @@ permissions:
66

77
jobs:
88
test:
9+
if: github.event.pull_request.head.repo.fork == true
10+
name: Test
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
14+
with:
15+
disable-sudo: true
16+
egress-policy: audit
17+
18+
- name: Checkout panther-analysis
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
20+
21+
- name: Set python version
22+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
23+
with:
24+
python-version: "3.11"
25+
26+
- name: Install pipenv
27+
run: pip install pipenv
28+
29+
- name: Setup venv
30+
run: make venv
31+
32+
- name: test
33+
run: |
34+
pipenv run panther_analysis_tool test --show-failures-only
35+
36+
test-authenticated:
37+
if: github.event.pull_request.head.repo.fork == false
938
name: Test
1039
runs-on: ubuntu-latest
1140
env:
@@ -24,10 +53,10 @@ jobs:
2453
exit 0
2554
2655
- name: Checkout panther-analysis
27-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
56+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2857

2958
- name: Set python version
30-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
59+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
3160
with:
3261
python-version: "3.11"
3362

‎.github/workflows/upload.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ jobs:
2525
exit 0
2626
2727
- name: Checkout panther-analysis
28-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2929

3030
- name: Set python version
31-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
31+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
3232
with:
3333
python-version: "3.11"
3434

‎.github/workflows/validate.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ permissions:
77

88
jobs:
99
validate:
10-
if: github.event.review.state == 'approved'
10+
if: github.event.review.state == 'approved' && github.event.pull_request.head.repo.fork == false
1111
name: Validate
1212
runs-on: ubuntu-latest
1313
env:
@@ -24,10 +24,10 @@ jobs:
2424
exit 0
2525
2626
- name: Checkout panther-analysis
27-
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
2828

2929
- name: Set python version
30-
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
30+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
3131
with:
3232
python-version: "3.11"
3333

‎CONTRIBUTING.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Please familiarize yourself with these helpful resources on writing high-quality
88

99
- The blog post Panther's founder, Jack Naglieri, wrote on [The Anatomy of a High Quality SIEM Rule](https://jacknaglieri.substack.com/p/hq-siem-rules)
1010
- Panther's [Detection Documentation](https://docs.panther.com/detections)
11-
- The `panther-analysis` [Style Guide](https://github.com/panther-labs/panther-analysis/blob/main/STYLE_GUIDE.md)
11+
- The `panther-analysis` [Style Guide](https://github.com/panther-labs/panther-analysis/blob/main/style_guides/STYLE_GUIDE.md)
1212

1313
Especially excellent contributions will be considered for a quarterly prize! We will announce a winner in the **Panther-Analysis Seasonal Newsletter**, where we share updates and celebrate contributions to Panther’s open-source ruleset.
1414

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
dirs := $(shell ls | egrep 'policies|rules|helpers|models|templates|queries' | xargs)
1+
dirs := $(shell ls | egrep 'policies|rules|global_helpers|models|templates|queries' | xargs)
22
UNAME := $(shell uname)
33
TEST_ARGS :=
44

‎global_helpers/panther_aws_helpers.py

+1
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ def aws_guardduty_context(event: dict):
4949
"type": event.get("type", "<MISSING TYPE>"),
5050
"resource": event.get("resource", {}),
5151
"service": event.get("service", {}),
52+
"accountId": event.get("accountId", "<MISSING ACCOUNT ID>"),
5253
}
5354

5455

‎packs/aws.yml

+1
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,7 @@ PackDefinition:
133133
- AWS.WAF.Disassociation
134134
- AWS.WAF.HasXSSPredicate
135135
- AWS.WAF.LoggingConfigured
136+
- AWS.WAF.WebACLHasAssociatedResources
136137
# Other rules
137138
- AWS.CloudTrail.Account.Discovery
138139
- AWS.CloudTrail.CloudWatchLogs

‎policies/aws_waf_policies/aws_waf_webacl_has_associated_resources.py

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
def policy(resource):
2+
# Check if the WebACL has any associated resources
3+
associations = resource.get("AssociatedResources", [])
4+
return len(associations) > 0

‎policies/aws_waf_policies/aws_waf_webacl_has_associated_resources.yml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
AnalysisType: policy
2+
Filename: aws_waf_webacl_has_associated_resources.py
3+
PolicyID: "AWS.WAF.WebACLHasAssociatedResources"
4+
DisplayName: "AWS WAF WebACL Has Associated Resources"
5+
Enabled: true
6+
ResourceTypes:
7+
- AWS.WAF.Regional.WebACL
8+
- AWS.WAF.WebACL
9+
Tags:
10+
- AWS
11+
- Security Control
12+
- Optimization
13+
Severity: Medium
14+
Description: >
15+
This policy ensures that AWS WAF WebACLs are associated with at least one resource (ALB, CloudFront Distribution, or API Gateway). If a WebACL is not associated with any resources, it is inactive and not providing any protection.
16+
Runbook: >
17+
Associate the WAF WebACL with at least one resource, such as an Application Load Balancer (ALB), CloudFront Distribution, or API Gateway. WebACLs that are not associated with resources do not protect any traffic.
18+
Reference: https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associate.html
19+
Tests:
20+
- Name: WebACL Associated with Resources
21+
ExpectedResult: true
22+
Resource:
23+
{
24+
"ResourceType": "AWS.WAF.WebACL",
25+
"AssociatedResources":
26+
[
27+
"arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-app",
28+
"arn:aws:cloudfront::123456789012:distribution/EXAMPLE"
29+
]
30+
}
31+
32+
- Name: WebACL Not Associated with Resources
33+
ExpectedResult: false
34+
Resource:
35+
{
36+
"ResourceType": "AWS.WAF.WebACL",
37+
"AssociatedResources": []
38+
}
39+
40+
- Name: WebACL Associated with Single Resource
41+
ExpectedResult: true
42+
Resource:
43+
{
44+
"ResourceType": "AWS.WAF.WebACL",
45+
"AssociatedResources":
46+
[
47+
"arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-app"
48+
]
49+
}
50+

‎rules/gsuite_activityevent_rules/gsuite_workspace_calendar_external_sharing.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,5 @@ def title(event):
1818
f"GSuite workspace setting for default calendar sharing was changed by "
1919
f"[{event.deep_get('actor', 'email', default='<UNKNOWN_EMAIL>')}] "
2020
+ f"from [{event.deep_get('parameters', 'OLD_VALUE', default='<NO_OLD_SETTING_FOUND>')}] "
21-
+ "to [{event.deep_get('parameters', 'NEW_VALUE', default='<NO_NEW_SETTING_FOUND>')}]"
21+
+ f"to [{event.deep_get('parameters', 'NEW_VALUE', default='<NO_NEW_SETTING_FOUND>')}]"
2222
)

0 commit comments

Comments
 (0)