Giters

jonrau1 / ElectricEye

ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[PFR] More auditor changes and Check additions & MITRE ATT&CK time

jonrau1 opened this issue · comments

commented

Story
As the maintainer of ElectricEye I want to continue to improve Auditors, add Checks, have more "Pythonic" code so that ElectricEye continues to kickass and is prepared to go "Pro"...Also I'll forget if I don't write this down.

Definition of Done

  • Revise the following Auditors, since their cache implementation/usage sucks
    • Backup DONE
    • Shodan
    • Shield (also us-east-1 override)
    • WAF (also us-east-1 override)
    • DocumentDB DONE
    • Neptune DONE
  • Add new Auditors/Checks to existing Auditors
    • (NEW) Elastic Beanstalk: Enhanced health, managed platform updates, IMDSv2, more??
    • Backup: FSx, Aurora, DocDB, Neptune, SGW, Audit reports
    • DynamoDB: DAX Encryption
    • RDS: Auto-updates, auto-snapshotting, Cluster checks, SSL enforcement for certain engines...
  • MITRE ATT&CK Compliance mappings added where it makes sense
    • Shodan checks
    • Public accessible checks
    • SG checks?
    • Default user checks
    • Cross-account/shared checks?

Nice to Have
New Auditor R&D / "Is this shit even possible?"

  • Storage Gateway
  • Athena THIS IS POSSIBLE
    • Metrics
    • Encryption for query results (vary levels on CSE/KMS/SSE)
  • EMR-on-EKS
  • Well-Architected Tool

Additional Information