Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add PCI and DMZ network configuration to panther_config #1018

Merged
merged 2 commits into from
Dec 12, 2023
Merged

Add PCI and DMZ network configuration to panther_config #1018

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f238ab3
Add PCI and DMZ network configuration to panther_config
jof Dec 11, 2023
aaf9ec6
Merge branch 'main' into jof/public/network-env-config
Dec 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 3 additions & 11 deletions global_helpers/panther_base_helpers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
from functools import reduce
from ipaddress import ip_address, ip_network
from typing import Any, List, Optional, Sequence, Union
from panther_config import config

# # # # # # # # # # # # # #
# Exceptions #
Expand Down Expand Up @@ -35,25 +36,16 @@ def in_pci_scope_tags(resource):
return resource["Tags"].get(CDE_TAG_KEY) == CDE_TAG_VALUE


PCI_NETWORKS = config.PCI_NETWORKS
# Expects a string in cidr notation (e.g. '10.0.0.0/24') indicating the ip range being checked
# Returns True if any ip in the range is marked as in scope
PCI_NETWORKS = [
ip_network("10.0.0.0/24"),
]


def is_pci_scope_cidr(ip_range):
return any(ip_network(ip_range).overlaps(pci_network) for pci_network in PCI_NETWORKS)


DMZ_NETWORKS = config.DMZ_NETWORKS
# Expects a string in cidr notation (e.g. '10.0.0.0/24') indicating the ip range being checked
# Returns True if any ip in the range is marked as DMZ space.
DMZ_NETWORKS = [
ip_network("10.1.0.0/24"),
ip_network("100.1.0.0/24"),
]


def is_dmz_cidr(ip_range):
"""This function determines whether a given IP range is within the defined DMZ IP range."""
return any(ip_network(ip_range).overlaps(dmz_network) for dmz_network in DMZ_NETWORKS)
Expand Down
8 changes: 8 additions & 0 deletions global_helpers/panther_config_defaults.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,11 @@
MS_EXCHANGE_ALLOWED_FORWARDING_DESTINATION_DOMAINS = ORGANIZATION_DOMAINS
MS_EXCHANGE_ALLOWED_FORWARDING_DESTINATION_EMAILS = ["postmaster@" + ORGANIZATION_DOMAINS[0]]
TELEPORT_ORGANIZATION_DOMAINS = ORGANIZATION_DOMAINS

PCI_NETWORKS = [
# ip_network("10.0.0.0/24"),
]

DMZ_NETWORKS = [
# ip_network("10.1.0.0/24"),
]