Security Monitoring Service

Checker configuration

Config file is a single yaml file. Configuration may be specified via the --config-file option or the $SECURITY_CHECKER_CONF environment variable.

regions:
- type: openstack
name: region1
cacert: /etc/cacert.pem
insecure: false
credentials:
auth_url: http://example.net:5000/
username: admin
password: admin
tenant_name: admin
elastic:
hosts:
- host: e1.example.com
port: 9200
- host: e2.example.com
port: 9200
use_ssl: true
verify_certs: false
plugins:
- module: security.plugins.secgroup
checkEveryMinutes: 1
regions: ["region1"]

SSL configuration for CCP

In case your region requires ssl, CCP config should have additional fields

configs:
elasticsearch:
hosts:
- host: e1.example.com
port: 9200
- host: e2.example.com
port: 9200
- host: e3.example.com
port: 9200
security:
checker:
regions:
- type: openstack
name: region1
credentials:
auth_url: http://example.net:5000/
username: admin
password: admin
tenant_name: admin
use_ssl: true
plugins:
- name: secgroup
checkEveryMinutes: 1
regions: ["region1"]
files:
region1-key.pem: /opt/key.pem

where section under files has mappings: *<region_name>-key.pem: <key_path>

Service configuration example

elastic:
hosts:
- host: e1.example.com
port: 9200
- host: e2.example.com
port: 9200
use_ssl: true
verify_certs: false

Running service

With flask server

security-api --config-file /etc/config.yaml

Use security-api --help for more information.

With gunicorn

export SECURITY_CONF=/etc/config.yaml
gunicorn security.wsgi:application

See flask documentation for more information.

Running checker

security-checker --config-file /etc/config.yaml

Use security-checker --help for more information.

Plugin API

Plugin should define class Plugin in own module. This class should be subclass of security.base.Plugin.

This class must define method discover(region). This method should return list of security.base.Issue instances.

Also attribute supported_region_types should be defined by plugin class.

Example:

fromsecurityimportbaseclassPlugin(base.Plugin):
supported_region_types= {"dummy"}
defdiscover(self, region):
return [
base.Issue("id-1", "Type1", "region1", "Sample issue"),
base.Issue("id-2", "Type1", "region1", "Sample issue"),
]

HTTP API

Types

Requests

List Issues For Region

GET /api/v1/region/{region}/issues/{period}

Return list of Issue objects

Example:

GET /api/v1/region/west/issues/day
[
{
"id": "d8b0be7c-2ad7-4083-8d5a-a7a9a56fdd14",
"type": "SecurityGroupTooOpen",
"description": "Security group too open",
"region_id": "Region1",
"discovered_at": "2016-02-28T16:41:41.090Z",
"confirmed_at": "2016-03-28T16:41:41.090Z",
}
]