mkdir araalinetworks
cd araalinetworks
git clone https://github.com/araalinetworks/api.git
cd api/python
# get rid of lfs (if you had it previously)
git lfs uninstall
# install/upgrade
python araalictl.py
# to authorize your copy (signup link below)
./araalictl config Fog=fog.<your-customer-name-here>.aws.araalinetworks.com
./araalictl config InternalCfgBackend=prod.aws.araalinetworks.com
sudo ./araalictl authorize -local
- https://www.araalinetworks.com/signup
- https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent
- https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/testing-your-ssh-connection
- https://docs.github.com/en/github/using-git/changing-a-remotes-url
# if you have python3
pip3 install --upgrade --force-reinstall --no-cache-dir jupyter
# on kali linux
sudo apt-get install jupyter-notebook
jupyter notebook
app = App("zone", "app")
for link in app.iterlinks():
if something or link.lstate != "DEFINED_POLICY":
link.accept() # based on some side information
if something: # based on some side information
link.snooze()
app.review() # review what will get committed
app.commit()
app2 = app.relocate("new_zone", "new_app")
for link in app2.iterlinks():
# accept is the default thing on relocation for all accepted policies in ap, rest is snoozed by default
link.snooze() # snooze the ones you dont like
link.accept() # if you want to accept a snoozed on in original
# edit/generalize using regex: client or server for the link's that need change
link.client.change("binary_name", "/snap/amazon-ssm-agent/[0-9]+/ssm-agent-worker")
link.server.change("binary_name", "/snap/amazon-ssm-agent/[0-9]+/ssm-agent-worker")
app2.review() # reivew what we will be committing
app2.commit()
run = Runtime()
run.stats() # dump summary stats
run.to_data() # dump all relevant data
for zone in run.iterzones(): # all the zones
for app in zone.iterapps(): # all the apps
for link in app.iterlinks(): # all the links
print(link)
break
break
break
# stats for all apps in a zone
run.iterzones("zone").stats()
# stats for all links in an app
run.iterzones("zone").iterapps("app").stats()
# edit policies for an app
for link in run.iterzones("zone").iterapps("app").iterlinks():
if something or link.lstate != "DEFINED_POLICY":
link.accept() # based on some side information
if something: # based on some side information
link.snooze()
run.iterzones("zone").iterapps("app").review() # review what will get committed
run.iterzones("zone").iterapps("app").commit()
# accept all open alerts for zone/app
for link in run.iterzones("zone").iterapps("app").iterlinks(afilter=True):
print(link)
link.accept()
# review changes before commit
run.iterzones("zone").iterapps("app").review()
run.iterzones("zone").iterapps("app").commit()
run = Runtime()
stats = Table(run.stats(all=False))
total_alerts = sum([a["Num Links"] for a in stats.to_data()])
# library of commonly used filters
f = LinkTable.Filter
# all the links in your runtime, arbitrarly chain lambdas as filters)
linkTable = LinkTable(run.iterlinks(),
#f.endpoint("zone", "prod"),
#f.endpoint("app", "^bendvm.bend.web"),
#f.endpoint("dns_pattern", "169"),
#f.endpoint("dns_pattern", "api.snapcraft.io"),
#f.neg(f.endpoint("dns_pattern", None, who="server")),
#f.endpoint("network", None, who="server"),
#f.endpoint("network", None, who="client"),
#f.endpoint("network", "169.254.169.254", who="server")
#f.neg(f.endpoint("process", ansible", re.IGNORECASE)),
#f.endpoint("binary_name", "/snap/amazon-ssm-agent"), #/2996/ssm-agent-worker")
#f.neg(f.endpoint("process", "cassandra", re.IGNORECASE)),
#f.endpoint("process", ["sshd", "haproxy"], who="server"),
#f.endpoint("network", None, who="server"), # perimeter
#f.neg(f.endpoint("dns_pattern", None, who="server")),
#f.neg(f.endpoint("network", None, who="server")), # perimeter
#f.ltype("NAE"),
f.lstate("BASELINE_ALERT"),
#f.speculative(False),
#f.lstate("DEFINED_POLICY"),
#f.neg(f.server_non_ip),
#f.server_non_ip,
#f.perimeter,
#f.neg(f.same_zone),
#f.same_zone
)
linkTable.snooze() # EITHER, snooze all links that pass the filter
linkTable.accept() # OR, accept all links that pass the filter
# multi-link editing: assuming all links are homogeneous
linkTable.change("client", "binary_name", "/snap/amazon-ssm-agent/[0-9]+/ssm-agent-worker")
# done with all filtering and editing
run.review()
run.commit()
You could try conda to install jupyter. Its sometimes nasty to get hold of it. We are trying to create a virtualenv for it.
./araalictl authorize -clean # to start over.