foxsec-pipeline

foxsec-pipeline copied to clipboard

Creating as a draft for now, This removes the thread sleep from the `UnboundedSource` `advance` interface. This seems to not be required, however the behavior of the advance method is...

ameihm0912

Currently when bmo audit logs are consumed we just have the type as either auth (login) or auth session. If it's an existing session, we don't have any additional context...

kkleemola

The output path of the pipelines is currently limited to ingestion of `Alert` objects. This makes it difficult to persist other types of data from the pipeline that are not...

ameihm0912

Include link to AWS Guardduty Finding Type docs in Bugzilla alert text

1

As an example, have a link to https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_stealth.html within the alert body (https://bugzilla.mozilla.org/show_bug.cgi?id=1626813#c35) since the finding type is `Stealth:IAMUser/CloudTrailLoggingDisabled`

ajvb

Create parser for EventHub audit messages

1

A new parser should be created to handle messages from Azure EventHub

ameihm0912

Create cloud function for consuming events from Azure EventHub

1

The function should read events from EventHub and write them to GCP logging, similar to our other ingestion functions. An example we can start from: https://github.com/hwine/azure-notes/blob/master/log_scripts/log-relay

ameihm0912

Include query link with AlertSummary notification

3

Provide a link with notification that results in a query to pull up applicable alerts.

ameihm0912

Prefer `NEWVERSION` over `FILEUPLOADMNT`, and make use of new fields in alerts if possible

ameihm0912

Filter out amo_cloud_submissions alerts from PostProcessing's alert summary analysis

2

Add support for filtering out certain alerts within the alert summary analysis in post processing. Then, filter out `amo_cloud_submission` alerts specifically.

ajvb

Integrate code coverage tooling

1

It would be nice to be able to view metrics on how our code coverage is doing across our unit tests. If we have a tool that can support multiple...

ajvb