Categories: Kali Linux

Siras : Security Incident Response Automated Simulations

Security Incident Response Automated Simulations (SIRAS) are internal/controlled actions that provide a structured opportunity to practice the incident response plan and procedures during a realistic scenarios. the main idea of SIRAS is create an detection-as-a-code testing scenarios to facilitate the blueteam/tabletops scenarios. All smokers of siras make real actions into your AWS and then delete those actions in the same execution.

SIRAS is the incident response friend when you need to test your controls/alerts ;

How Works?

Why SIRAS?

Currently, the incident detection and response team are developing differents mechanisms to prevent/detect several types of incidents, leaving aside the test stage. Although each alert/automation is tested before implementing it, and it is not constantly monitored. For this, SIRAS proposes an automated test model where it is expected to trigger alerts in a controlled manner to make security incidents simulation.

How to run?

ACTIVATE VIRTUALENV
virtualenv siras && source ./siras/bin/activate
GET HELP
python3 siras.py -s test

OPTIONS TO RUN (needed)

-s for the “smoker”

-sDescription
allrun all smokers.
testtest siras if works.
sgCreate an open sg into AWS and nuke it.
paMultiple auth failed into vpn paloalto portal (please config “pano_url” into smoker/PanAuthSmoker.py)
auCreate an adminsitrator user into AWS.
acaMultiple auth failed into AWS console portal (please config “account_id” into smoker/awsConsoleAuthSmoker.py)
ctrCreate and delete a cloudtrail trail loggin.
s3pCreate an s3 bucket public.
esbCreate an esb public snapshot (please config your snapshot ID into smoker/EBSPublicSmoker line27)

OPTIONS TO RUN (optional)

-b (to run)Description
Truesave results into s3-bucket.
FalseThis is the default, just print the output into the console

Requirements

  • Python
  • VirtualEnv
  • AWS Credentials
  • ENV name ‘BUCKETS3’ to save the logs into that bucket if “true”.
  • (If you dont want to use virtualenv) pip to install requeriments.txt

Future Integrations

  • Kubernetes smokers
  • VPC changes
  • EC2 Infected Smoker.
  • GuardDuty Changes.

Request New Modules/Publish

Please feel free to publish or request new modules or use cases, open a ISSUE into the repo or make a PR.

R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

7 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

7 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago