Azure security center enable ddos protection #27

kshrutik · 2020-11-02T15:16:59Z

Remediation job for enabling DDoS protection for the virtual network.

* PLA-17940 updating constraints and fixing s3_enable_access_logging to… (#3) * PLA-17940 updating constraints and fixing s3_enable_access_logging to not remediate the logging target bucket * PLA-17940 fixing copyright info * Updated readme to have link for reporting issues (#4) Co-authored-by: svikramjeet <[email protected]> * S3 access logs permissions (#6) * Update minimum permissions for the job * Add more logs when permission is missing Co-authored-by: Mohammad Zuber Khan <[email protected]> * change the way cloudAccountId is parsed from Job Paramaters (#9) Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-16779: Add remediation job for azure security group port 22 (#10) * PLA-16779: Add remediation job for azure security group port 22 * add test dependencies * update README.md * add deployment info to the README * add rule information Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation job for closing port 22 for VM (#11) * PLA-18743: Add remediation job for closing port 22 for VM * add tests for azure_vm_close_port_22 to tox * add deployment details Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation jobs for storage and RDP violations (#12) * add remediation job for closing RDP access * Add remediation job for remove public access for blob * Add remediation job to allow only https traffic to storage account * update READMEs to fix broken links Co-authored-by: Mohammad Zuber Khan <[email protected]> * fix the parameters passed for remediation (#13) Co-authored-by: Mohammad Zuber Khan <[email protected]> * add check for existing permissions before adding new (#15) Co-authored-by: Mohammad Zuber Khan <[email protected]> * Fix ports range for network security groups (#19) * handle the case when the security rule port is a range * Add minimum permissions for each remediation jobs * add link to built in roles Co-authored-by: Mohammad Zuber Khan <[email protected]> * update the remediation job payload (#21) Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-20459: Add rule information for the remediation job (#22) * update the remediation job payload (#21) Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-20459: Add rule information for the remediation job * add another rule remediated by the job Co-authored-by: Mohammad Zuber Khan <[email protected]> * Master -> Dev Merge (#23) * Release/v1.0.0 (#7) * PLA-17940 updating constraints and fixing s3_enable_access_logging to… (#3) * PLA-17940 updating constraints and fixing s3_enable_access_logging to not remediate the logging target bucket * PLA-17940 fixing copyright info * Updated readme to have link for reporting issues (#4) Co-authored-by: svikramjeet <[email protected]> * S3 access logs permissions (#6) * Update minimum permissions for the job * Add more logs when permission is missing Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Paul Allen <[email protected]> Co-authored-by: svikramjeet <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> * Release/v1.1.0 (#17) * PLA-17940 updating constraints and fixing s3_enable_access_logging to… (#3) * PLA-17940 updating constraints and fixing s3_enable_access_logging to not remediate the logging target bucket * PLA-17940 fixing copyright info * Updated readme to have link for reporting issues (#4) Co-authored-by: svikramjeet <[email protected]> * S3 access logs permissions (#6) * Update minimum permissions for the job * Add more logs when permission is missing Co-authored-by: Mohammad Zuber Khan <[email protected]> * change the way cloudAccountId is parsed from Job Paramaters (#9) Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-16779: Add remediation job for azure security group port 22 (#10) * PLA-16779: Add remediation job for azure security group port 22 * add test dependencies * update README.md * add deployment info to the README * add rule information Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation job for closing port 22 for VM (#11) * PLA-18743: Add remediation job for closing port 22 for VM * add tests for azure_vm_close_port_22 to tox * add deployment details Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation jobs for storage and RDP violations (#12) * add remediation job for closing RDP access * Add remediation job for remove public access for blob * Add remediation job to allow only https traffic to storage account * update READMEs to fix broken links Co-authored-by: Mohammad Zuber Khan <[email protected]> * fix the parameters passed for remediation (#13) Co-authored-by: Mohammad Zuber Khan <[email protected]> * add check for existing permissions before adding new (#15) Co-authored-by: Mohammad Zuber Khan <[email protected]> * Fix ports range for network security groups (#19) (#20) * handle the case when the security rule port is a range * Add minimum permissions for each remediation jobs * add link to built in roles Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Paul Allen <[email protected]> Co-authored-by: svikramjeet <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Paul Allen <[email protected]> Co-authored-by: svikramjeet <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> * Revert "Master -> Dev Merge (#23)" (#24) This reverts commit a875459. Co-authored-by: Paul Allen <[email protected]> Co-authored-by: svikramjeet <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]>

vmwclabot · 2020-11-02T15:17:05Z

@kshrutik, you must sign our contributor license agreement before your changes are merged. Click here to sign the agreement. If you are a VMware employee, read this for further instruction.

vmwclabot · 2020-11-04T17:36:41Z

@kshrutik, VMware has approved your signed contributor license agreement.

…enable_ddos_protection

mzkhan · 2020-11-06T03:27:27Z

remediation_worker/jobs/azure_security_center_enable_ddos_protection/README.md

@@ -0,0 +1,63 @@
+# Enable DDos protection for Virtual Network


Change DDos to DDoS

mzkhan · 2020-11-06T03:28:52Z

remediation_worker/jobs/azure_security_center_enable_ddos_protection/README.md

+### Applicable Rule
+
+##### Rule ID:
+5c8c26997a550e1fb6560cd9


Check the Rule ID.
This RuleID is for Blob container has public read access enabled
Secure state Link

I think you wanted to use this one

mzkhan · 2020-11-06T03:32:54Z

remediation_worker/jobs/azure_security_center_enable_ddos_protection/constraints.txt

@@ -0,0 +1,25 @@
+adal==1.2.5


We are pinning the package version by specifying the hash for the packages.

You can make use of the a hash generating took like pip-tool or hashin to generate them.

mzkhan · 2020-11-06T03:33:41Z

remediation_worker/jobs/azure_security_center_enable_ddos_protection/requirements-dev.txt

+-r requirements.txt
+-c constraints.txt
+
+importlib-metadata==2.0.0


Pin the version with the hash

mzkhan · 2020-11-06T03:35:38Z

remediation_worker/jobs/azure_security_center_enable_ddos_protection/requirements.txt

@@ -0,0 +1,2 @@
+azure-identity==1.4.1


Add the hashes for the package versions.

mzkhan · 2020-11-06T03:37:31Z

...azure_security_center_enable_ddos_protection/azure_security_center_enable_ddos_protection.py

@@ -0,0 +1,135 @@
+import json


Add the vmware copyright statement on top of the file

mzkhan · 2020-11-06T03:41:23Z

...azure_security_center_enable_ddos_protection/azure_security_center_enable_ddos_protection.py

+
+logging.basicConfig(level=logging.INFO)
+
+def logcall(f, *args, **kwargs):


Remove this function as this is not being used in the file.
Or, you can make use of this, as in rds_backup_retention_30_days

mzkhan

Please run pre-commit for the files being added

mzkhan

You should run tox as a final test to see if all the requirements are specified.

* PLA-17940 updating constraints and fixing s3_enable_access_logging to… (#3) * PLA-17940 updating constraints and fixing s3_enable_access_logging to not remediate the logging target bucket * PLA-17940 fixing copyright info * Updated readme to have link for reporting issues (#4) Co-authored-by: svikramjeet <[email protected]> * S3 access logs permissions (#6) * Update minimum permissions for the job * Add more logs when permission is missing Co-authored-by: Mohammad Zuber Khan <[email protected]> * change the way cloudAccountId is parsed from Job Paramaters (#9) Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-16779: Add remediation job for azure security group port 22 (#10) * PLA-16779: Add remediation job for azure security group port 22 * add test dependencies * update README.md * add deployment info to the README * add rule information Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation job for closing port 22 for VM (#11) * PLA-18743: Add remediation job for closing port 22 for VM * add tests for azure_vm_close_port_22 to tox * add deployment details Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation jobs for storage and RDP violations (#12) * add remediation job for closing RDP access * Add remediation job for remove public access for blob * Add remediation job to allow only https traffic to storage account * update READMEs to fix broken links Co-authored-by: Mohammad Zuber Khan <[email protected]> * fix the parameters passed for remediation (#13) Co-authored-by: Mohammad Zuber Khan <[email protected]> * add check for existing permissions before adding new (#15) Co-authored-by: Mohammad Zuber Khan <[email protected]> * Fix ports range for network security groups (#19) * handle the case when the security rule port is a range * Add minimum permissions for each remediation jobs * add link to built in roles Co-authored-by: Mohammad Zuber Khan <[email protected]> * update the remediation job payload (#21) Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-20459: Add rule information for the remediation job (#22) * update the remediation job payload (#21) Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-20459: Add rule information for the remediation job * add another rule remediated by the job Co-authored-by: Mohammad Zuber Khan <[email protected]> * Master -> Dev Merge (#23) * Release/v1.0.0 (#7) * PLA-17940 updating constraints and fixing s3_enable_access_logging to… (#3) * PLA-17940 updating constraints and fixing s3_enable_access_logging to not remediate the logging target bucket * PLA-17940 fixing copyright info * Updated readme to have link for reporting issues (#4) Co-authored-by: svikramjeet <[email protected]> * S3 access logs permissions (#6) * Update minimum permissions for the job * Add more logs when permission is missing Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Paul Allen <[email protected]> Co-authored-by: svikramjeet <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> * Release/v1.1.0 (#17) * PLA-17940 updating constraints and fixing s3_enable_access_logging to… (#3) * PLA-17940 updating constraints and fixing s3_enable_access_logging to not remediate the logging target bucket * PLA-17940 fixing copyright info * Updated readme to have link for reporting issues (#4) Co-authored-by: svikramjeet <[email protected]> * S3 access logs permissions (#6) * Update minimum permissions for the job * Add more logs when permission is missing Co-authored-by: Mohammad Zuber Khan <[email protected]> * change the way cloudAccountId is parsed from Job Paramaters (#9) Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-16779: Add remediation job for azure security group port 22 (#10) * PLA-16779: Add remediation job for azure security group port 22 * add test dependencies * update README.md * add deployment info to the README * add rule information Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation job for closing port 22 for VM (#11) * PLA-18743: Add remediation job for closing port 22 for VM * add tests for azure_vm_close_port_22 to tox * add deployment details Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation jobs for storage and RDP violations (#12) * add remediation job for closing RDP access * Add remediation job for remove public access for blob * Add remediation job to allow only https traffic to storage account * update READMEs to fix broken links Co-authored-by: Mohammad Zuber Khan <[email protected]> * fix the parameters passed for remediation (#13) Co-authored-by: Mohammad Zuber Khan <[email protected]> * add check for existing permissions before adding new (#15) Co-authored-by: Mohammad Zuber Khan <[email protected]> * Fix ports range for network security groups (#19) (#20) * handle the case when the security rule port is a range * Add minimum permissions for each remediation jobs * add link to built in roles Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Paul Allen <[email protected]> Co-authored-by: svikramjeet <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Paul Allen <[email protected]> Co-authored-by: svikramjeet <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> * Revert "Master -> Dev Merge (#23)" (#24) This reverts commit a875459. * Azure security center enable ddos protection (#27) * Azure security center enable ddos protection remediation script * Removed .DS_Store file * Made changes in README.md * Addressed the review comments * Pre-commit changes added * Made changes in README.md * Added the unit test in tox.ini * fix requirements-dev.txt for tox run Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: Shrutika Kulkarni <[email protected]> * Azure Storage default network access deny remediation script (#30) * Azure Storage default network access deny remediation script * .DS_Store file removed * Fixed some logging messages * Added unit test in tox.ini * Changed requirements.txt * Fixed requirements-dev.txt * Pla 19713: remove unused logcall (#31) * remove unused logcall function Co-authored-by: Mohammad Zuber Khan <[email protected]> * Add remediation job to enable ELB access logs (#29) * Add remediation job to enable ELB access logs Co-authored-by: Mohammad Zuber Khan <[email protected]> * PLA-21409: Azure SQL Server Threat Detection enable (#36) * PLA-21822 fixing whitespace (#37) * Pla 21822 fixing requirements whitespace (#38) * PLA-21822 fixing whitespace Co-authored-by: Paul Allen <[email protected]> Co-authored-by: svikramjeet <[email protected]> Co-authored-by: Zuber <[email protected]> Co-authored-by: Mohammad Zuber Khan <[email protected]> Co-authored-by: kshrutik <[email protected]> Co-authored-by: Shrutika Kulkarni <[email protected]>

vikramsinghvirdi and others added 3 commits October 26, 2020 12:57

Azure security center enable ddos protection remediation script

46b489e

Removed .DS_Store file

c5e1f32

vikramsinghvirdi requested review from bhanu13, mzkhan, pauldallen and regaw-leinad November 2, 2020 17:25

kshrutik closed this Nov 3, 2020

kshrutik reopened this Nov 3, 2020

Shrutika Kulkarni added 2 commits November 5, 2020 18:09

Merge remote-tracking branch 'origin/dev' into azure_security_center_…

665aa6b

…enable_ddos_protection

Made changes in README.md

99a2fe3

mzkhan reviewed Nov 6, 2020

View reviewed changes

mzkhan suggested changes Nov 6, 2020

View reviewed changes

Shrutika Kulkarni and others added 5 commits November 6, 2020 19:23

Addressed the review comments

0dcfd93

Pre-commit changes added

2e546d4

Made changes in README.md

a320a19

Added the unit test in tox.ini

b8837aa

fix requirements-dev.txt for tox run

e4e5ea5

mzkhan approved these changes Nov 17, 2020

View reviewed changes

mzkhan merged commit 4eebd8f into vmware-samples:dev Nov 17, 2020

vikramsinghvirdi mentioned this pull request Dec 21, 2020

Release/v1.3.0 (#39) #40

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Azure security center enable ddos protection #27

Azure security center enable ddos protection #27

kshrutik commented Nov 2, 2020

vmwclabot commented Nov 2, 2020

vmwclabot commented Nov 4, 2020

mzkhan Nov 6, 2020

mzkhan Nov 6, 2020

mzkhan Nov 6, 2020 •

edited

Loading

mzkhan Nov 6, 2020

mzkhan Nov 6, 2020

mzkhan Nov 6, 2020

mzkhan Nov 6, 2020

mzkhan left a comment

mzkhan left a comment

		@@ -0,0 +1,63 @@
		# Enable DDos protection for Virtual Network


		logging.basicConfig(level=logging.INFO)

		def logcall(f, args, *kwargs):

Azure security center enable ddos protection #27

Azure security center enable ddos protection #27

Conversation

kshrutik commented Nov 2, 2020

vmwclabot commented Nov 2, 2020

vmwclabot commented Nov 4, 2020

mzkhan Nov 6, 2020

Choose a reason for hiding this comment

mzkhan Nov 6, 2020

Choose a reason for hiding this comment

mzkhan Nov 6, 2020 • edited Loading

Choose a reason for hiding this comment

mzkhan Nov 6, 2020

Choose a reason for hiding this comment

mzkhan Nov 6, 2020

Choose a reason for hiding this comment

mzkhan Nov 6, 2020

Choose a reason for hiding this comment

mzkhan Nov 6, 2020

Choose a reason for hiding this comment

mzkhan left a comment

Choose a reason for hiding this comment

mzkhan left a comment

Choose a reason for hiding this comment

mzkhan Nov 6, 2020 •

edited

Loading