forked from gane5hvarma/panther
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Feature/s3 simplify onboarding (#2299)
* Updated S3 Log Source onboard fields (#2183) * export goToStep from wizard context * Added condition for skipping step in S3SourceConfigurationPanel * Transform prefix & logTypes to S3PrefixLogTypes * Changed order of KMS field * Fixes based on feedback * Quick wording fix * Fix creating s3 log source tests * Fixes tests for EditLogSource * Added additonal logType for combobox * Added type to validation * Renamed var for skipping cfn step * Optimizing changes * Fix breaking tes * Added a test case for removing an existing prefix * Added React.memo for flatten logTypes * Fixed issue where button was active before query execution * Updated snapshots * Fixed dependicies for memo * Feedback fixes * Updated LinkButton * Updated broken tests * Removed s3PrefixLogTypes from GetCfnTemplate * Backend: Allow users to specify multiple s3 prefix->logtypes mappings per s3 log source (#2232) * Allow multiple s3 prefixes per s3 source * Cleanup prefix parameter from log-onboarding CFN template Now that users can define multiple s3 prefixes per onboarded bucket (log source), this commit removes the prefix filter from the `s3:GetObject` permission for the log processing role so that users can eventually update prefixes in an s3 source without having to update the CFN template. "Eventually" is the key word here though. Due to backwards compatibility, users that already have deployed a stack that includes a prefix restriction, need to update their stack to remove it. For now, we have to prompt all users to update their stack. In order to allow some users to not update their CFN stack, we have to change the current FE<>BE flow so that the backend can check whether the installed stack needs update (by querying AWS) and return a flag to the frontend accordingly. * Add unit test for backwards compatibility * Fix json fields to match graphql schema * Get unique logtypes for s3 source * Add validation for unique prefixes per source and prefix/bucket pairs * Narrow down prefixes in the self registered sources for Cloudtrail, GuardDuty, ALB, s3 access logs * For s3 sources in the log processor, use the log types of the longest prefix that matches the input object key Co-authored-by: Alex Mylonas <[email protected]>
- Loading branch information
1 parent
5b74652
commit c8e5667
Showing
46 changed files
with
1,044 additions
and
362 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| package models | ||
|
|
||
| /** | ||
| * Panther is a Cloud-Native SIEM for the Modern Security Team. | ||
| * Copyright (C) 2020 Panther Labs Inc | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the GNU Affero General Public License as | ||
| * published by the Free Software Foundation, either version 3 of the | ||
| * License, or (at your option) any later version. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU Affero General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU Affero General Public License | ||
| * along with this program. If not, see <https://www.gnu.org/licenses/>. | ||
| */ | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestS3PrefixLogtypes_LongestPrefixMatch(t *testing.T) { | ||
| pl := S3PrefixLogtypes{ | ||
| {"prefixA/", []string{"Log.A"}}, | ||
| {"prefixA/prefixB", []string{"Log.B"}}, | ||
| {"", []string{"Log.C"}}, | ||
| } | ||
|
|
||
| testcases := []struct { | ||
| objectKey string | ||
| expected S3PrefixLogtypesMapping | ||
| }{ | ||
| {"prefixA/log.json", pl[0]}, | ||
| {"prefixA/pref/log.json", pl[0]}, | ||
| {"prefixA/prefixB/log.json", pl[1]}, | ||
| {"log.json", pl[2]}, | ||
| {"logs/log.json", pl[2]}, | ||
| {"prefixB/log.json", pl[2]}, | ||
| } | ||
| for _, tc := range testcases { | ||
| actual, _ := pl.LongestPrefixMatch(tc.objectKey) | ||
| require.Equal(t, tc.expected, actual, "Fail for input object key '%s'", tc.objectKey) | ||
| } | ||
| } | ||
|
|
||
| func TestS3PrefixLogtypes_LongestPrefixMatch_ReturnNil(t *testing.T) { | ||
| pl := S3PrefixLogtypes{ | ||
| {"prefixA/", []string{"Log.A"}}, | ||
| {"prefixA/prefixB", []string{"Log.B"}}, | ||
| } | ||
|
|
||
| _, matched := pl.LongestPrefixMatch("logs/log.json") | ||
|
|
||
| // No prefix matched | ||
| require.False(t, matched) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.