Skip to content

Commit 0ea4d2e

Browse files
cbruno10misravedPriyanka-Chatterjee-2000khushboo9024MichaelBurgess
authored
Add initial benchmarks and dashboards (#8)
Co-authored-by: misraved <ved@turbot.com> Co-authored-by: Priyanka Chatterjee <priyanka.chatterjee@turbot.com> Co-authored-by: Khushboo <46913995+khushboo9024@users.noreply.github.com> Co-authored-by: Mike Burgess <mike@turbot.com> Co-authored-by: Ved misra <47312748+misraved@users.noreply.github.com> Co-authored-by: khushboosharma <khushboo@turbot.com> Co-authored-by: Graza <code@graza.io> Co-authored-by: ParthaI <partha@turbot.com> Co-authored-by: Nathan Wallace <nathan@turbot.com>
1 parent ba5b883 commit 0ea4d2e

File tree

261 files changed

+6288
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

261 files changed

+6288
-2
lines changed

‎.gitattributes

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
**/*.pp linguist-language=HCL

‎.github/ISSUE_TEMPLATE/bug_report.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: ''
5+
labels: bug
6+
assignees: ''
7+
8+
---
9+
10+
**Describe the bug**
11+
A clear and concise description of what the bug is.
12+
13+
**Powerpipe version (`powerpipe -v`)**
14+
Example: v0.3.0
15+
16+
**Tailpipe version (`tailpipe -v`)**
17+
Example: v0.3.0
18+
19+
**Plugin version (`tailpipe plugin list`)**
20+
Example: v0.5.0
21+
22+
**To reproduce**
23+
Steps to reproduce the behavior (please include relevant code and/or commands).
24+
25+
**Expected behavior**
26+
A clear and concise description of what you expected to happen.
27+
28+
**Additional context**
29+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/config.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Questions
4+
url: https://turbot.com/community/join
5+
about: GitHub issues in this repository are only intended for bug reports and feature requests. Other issues will be closed. Please ask and answer questions through the Turbot Slack community.
6+
- name: Powerpipe CLI Bug Reports and Feature Requests
7+
url: https://github.com/turbot/powerpipe/issues/new/choose
8+
about: Powerpipe CLI has its own codebase. Bug reports and feature requests for those pieces of functionality should be directed to that repository.
9+
- name: Tailpipe CLI Bug Reports and Feature Requests
10+
url: https://github.com/turbot/tailpipe/issues/new/choose
11+
about: Tailpipe CLI has its own codebase. Bug reports and feature requests for those pieces of functionality should be directed to that repository.

‎.github/ISSUE_TEMPLATE/feature_request.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea for this project
4+
title: ''
5+
labels: enhancement
6+
assignees: ''
7+
8+
---
9+
10+
**Is your feature request related to a problem? Please describe.**
11+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
12+
13+
**Describe the solution you'd like**
14+
A clear and concise description of what you want to happen.
15+
16+
**Describe alternatives you've considered**
17+
A clear and concise description of any alternative solutions or features you've considered.
18+
19+
**Additional context**
20+
Add any other context or screenshots about the feature request here.

‎.github/PULL_REQUEST_TEMPLATE.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
### Checklist
2+
- [ ] Issue(s) linked

‎.github/workflows/stale.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Stale Issues and PRs
2+
on:
3+
schedule:
4+
- cron: "30 23 * * *"
5+
workflow_dispatch:
6+
inputs:
7+
dryRun:
8+
description: Set to true for a dry run
9+
required: false
10+
default: "false"
11+
type: string
12+
13+
jobs:
14+
stale_workflow:
15+
uses: turbot/steampipe-workflows/.github/workflows/stale.yml@main
16+
with:
17+
dryRun: ${{ github.event.inputs.dryRun }}

‎.github/workflows/sync-labels.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
name: Sync Labels
2+
on:
3+
schedule:
4+
- cron: "30 22 * * 1"
5+
workflow_dispatch:
6+
7+
jobs:
8+
sync_labels_workflow:
9+
uses: turbot/steampipe-workflows/.github/workflows/sync-labels.yml@main

‎.gitignore

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Binaries for programs and plugins
2+
*.exe
3+
*.exe~
4+
*.dll
5+
*.so
6+
*.dylib
7+
8+
# Swap files
9+
*.swp
10+
11+
# Ignore Apple custom attributes file
12+
.DS_Store
13+
14+
# Powerpipe variable files
15+
*.ppvars
16+
*.auto.ppvars
17+
18+
# Ignore DuckDB files
19+
*.db

‎CHANGELOG.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
## v0.1.0 [2025-01-30]
2+
3+
_What's new?_
4+
5+
- New benchmarks added:
6+
- CloudTrail Log Detections benchmark (`powerpipe benchmark run aws_cloudtrail_log_detections.benchmark.cloudtrail_log_detections`).
7+
- MITRE ATT&CK v16.1 benchmark (`powerpipe benchmark run aws_cloudtrail_log_detections.benchmark.mitre_attack_v161`).
8+
9+
- New dashboards added:
10+
- [CloudTrail Log Activity Dashboard](https://hub.powerpipe.io/mods/turbot/aws_cloudtrail_log_detections/dashboards/dashboard.activity_dashboard)
11+
- [CloudTrail Log Root User Activity Report](https://hub.powerpipe.io/mods/turbot/aws_cloudtrail_log_detections/dashboards/dashboard.root_user_activity_report)

‎README.md

Lines changed: 89 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,89 @@
1-
# tailpipe-mod-aws
2-
Scan AWS logs for high risk activity
1+
# AWS CloudTrail Log Detections Mod for Powerpipe
2+
3+
[Tailpipe](https://tailpipe.io) is an open-source CLI tool that allows you to collect logs and query them with SQL.
4+
5+
[AWS](https://aws.amazon.com/) provides on-demand cloud computing platforms and APIs to authenticated customers on a metered pay-as-you-go basis.
6+
7+
The [AWS CloudTrail Log Detections Mod](https://hub.powerpipe.mods/turbot/tailpipe-mod-aws-cloudtrail-log-detections) contains pre-built dashboards and detections, which can be used to monitor and analyze activity across your AWS accounts.
8+
9+
Run detection benchmarks:
10+
![image](docs/images/aws_cloudtrail_log_mitre_dashboard.png)
11+
12+
View insights in dashboards:
13+
![image](docs/images/aws_cloudtrail_log_activity_dashboard.png)
14+
15+
## Documentation
16+
17+
- **[Dashboards →](https://hub.powerpipe.io/mods/turbot/tailpipe-mod-aws-cloudtrail-log-detections/dashboards)**
18+
- **[Benchmarks and detections →](https://hub.powerpipe.io/mods/turbot/tailpipe-mod-aws-cloudtrail-log-detections/benchmarks)**
19+
20+
## Getting Started
21+
22+
Install Powerpipe from the [downloads](https://powerpipe.io/downloads) page:
23+
24+
```sh
25+
# MacOS
26+
brew install turbot/tap/powerpipe
27+
```
28+
29+
```sh
30+
# Linux or Windows (WSL)
31+
sudo /bin/sh -c "$(curl -fsSL https://powerpipe.io/install/powerpipe.sh)"
32+
```
33+
34+
This mod also requires AWS CloudTrail logs to be collected using [Tailpipe](https://tailpipe.io) with the [AWS plugin](https://hub.tailpipe.io/plugins/turbot/aws):
35+
- [Get started with the AWS plugin for Tailpipe →](https://hub.tailpipe.io/plugins/turbot/aws#getting-started)
36+
37+
Install the mod:
38+
39+
```sh
40+
mkdir dashboards
41+
cd dashboards
42+
powerpipe mod install github.com/turbot/tailpipe-mod-aws-cloudtrail-log-detections
43+
```
44+
45+
### Browsing Dashboards
46+
47+
Start the dashboard server:
48+
49+
```sh
50+
powerpipe server
51+
```
52+
53+
Browse and view your dashboards at **http://localhost:9033**.
54+
55+
### Running Benchmarks in Your Terminal
56+
57+
Instead of running benchmarks in a dashboard, you can also run them within your
58+
terminal with the `powerpipe benchmark` command:
59+
60+
List available benchmarks:
61+
62+
```sh
63+
powerpipe benchmark list
64+
```
65+
66+
Run a benchmark:
67+
68+
```sh
69+
powerpipe benchmark run aws_cloudtrail_log_detections.benchmark.mitre_attack_v161
70+
```
71+
72+
Different output formats are also available, for more information please see
73+
[Output Formats](https://powerpipe.io/docs/reference/cli/benchmark#output-formats).
74+
75+
## Open Source & Contributing
76+
77+
This repository is published under the [Apache 2.0 license](https://www.apache.org/licenses/LICENSE-2.0). Please see our [code of conduct](https://github.com/turbot/.github/blob/main/CODE_OF_CONDUCT.md). We look forward to collaborating with you!
78+
79+
[Tailpipe](https://tailpipe.io) and [Powerpipe](https://powerpipe.io) are products produced from this open source software, exclusively by [Turbot HQ, Inc](https://turbot.com). They are distributed under our commercial terms. Others are allowed to make their own distribution of the software, but cannot use any of the Turbot trademarks, cloud services, etc. You can learn more in our [Open Source FAQ](https://turbot.com/open-source).
80+
81+
## Get Involved
82+
83+
**[Join #tailpipe and #powerpipe on Slack →](https://turbot.com/community/join)**
84+
85+
Want to help but don't know where to start? Pick up one of the `help wanted` issues:
86+
87+
- [Powerpipe](https://github.com/turbot/powerpipe/labels/help%20wanted)
88+
- [Tailpipe](https://github.com/turbot/tailpipe/labels/help%20wanted)
89+
- [AWS CloudTrail Log Detections Mod](https://github.com/turbot/tailpipe-mod-aws-cloudtrail-log-detections/labels/help%20wanted)

0 commit comments

Comments
 (0)