{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"},"minLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"993462ea-ff3d-401e-ba77-545a23e668bf"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"44d447f4-cdf0-4c74-96dc-327d51b76c7d"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Understanding the Datalake","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"The Armor data lake is a centralized repository","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":" for storing Armor collected data. With regards to vulnerabilities, the data lake contains all the data for every report created for an environment and all the historical data from when the reports are run. This can be a lot of data so narrowing down the scope of information is critical to making sense of it all.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Accessing the Datalake","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Users can access the datalake in two ways:","type":"text"}]},{"type":"expand","attrs":{"title":"Option 1: Compliance in AMP"},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select a Report from the Report List and click on it's name to access the details page.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Then expand down to the control level of a section to view links for Remediation and Advanced Query.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Advanced Query.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This opens ChaosSearch in a new window.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on the Single Sign On button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click Next again on the next page to sign in to ChaosSearch.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Once the page loads the following will show:","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Note that there are two filters already being applied based on which control was open when Advanced Query was selected. The ruleId and ReportId.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To see the complete report, click on the X next to the ","type":"text"},{"text":"rule.Id","type":"text","marks":[{"type":"link","attrs":{"href":"http://rule.Id"}}]},{"text":" and now the filter is only using the ReportId to get data.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Keeping the ","type":"text"},{"text":"rule.Id","type":"text","marks":[{"type":"link","attrs":{"href":"http://rule.Id"}}]},{"text":" can also be useful for comparing changes over time (using a wider date range) for that rule.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changing the date range allows for viewing a single or multiple runs of the report depending on the goal.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Option 2: Log Search in AMP"},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select a Report from the Report List and click the report name to access the details. ","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":661,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":730,"id":"46021119-6f03-40c5-923a-d64a486c78ac","collection":"contentId-3519579576","type":"file","height":191}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Copy its unique report Id by navigating into the report's detail page.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":661,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":730,"id":"474ec308-ce33-4450-9ee6-e36dd631ead1","collection":"contentId-3519579576","type":"file","height":312}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Navigate to Security -> Log Search and SSO into Chaos Search.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":661,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":730,"id":"a981f2fd-388d-4d76-b82d-90040ff19477","collection":"contentId-3519579576","type":"file","height":361}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a filter by doing the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In Field select event.ReportId","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select is for Operator.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Paste the report Id from the report details page into the Value field.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click Save.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":651,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":505,"id":"08875182-b308-48d2-827f-321d987ac241","collection":"contentId-3519579576","type":"file","height":548}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Now set the date range to encompass the report date or dates to show and click Refresh.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":661,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":730,"id":"5478a1e2-e429-4403-b0e8-e1228928a393","collection":"contentId-3519579576","type":"file","height":168}}]}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Data Presentation","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Data consists of documents stored in the datalake. Each document contains all the data related to that particular rule and resource. Below are examples of the table and JSON views:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"expand","attrs":{"title":"Table Example"},"content":[{"type":"table","attrs":{"layout":"default","localId":"94e8fd89-cd83-439c-a9a3-d57598694da5"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"Field","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Values","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"@timestamp","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Nov 25, 2020 @ 07:32:27.480","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"#","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}},{"type":"strong"}]},{"text":"@version","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"1","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"_id","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"47741608","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"_index","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"1_1024_customer","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"#","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}},{"type":"strong"}]},{"text":"_score","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"1","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"_type","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"doc","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"armor_metrics.input_port","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"5445","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"armor_metrics.latency.processing","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"0.857","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"armor_metrics.processing_chain","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"[\"KVN_V4_collector_i-0908b8b2b53868dc0|2020-11-25T13:32:27Z\",\"KVN_V4_processor_i-0aa172c88f440b715|2020-11-25T13:32:28Z\"]","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"document_size","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"3,926","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"event_uuid","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"6d820110-73e5-45c9-945e-10c281fd4cb4","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"external_id","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"4f5b9ab7-8e57-4993-b0fb-440cd44d11e5","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"host.hostname","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"ip-10-0-0-8.us","type":"text","marks":[{"type":"link","attrs":{"href":"http://ip-10-0-0-8.us"}}]},{"text":"-west-2.compute.internal","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"host.ip","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"10.0.0.8","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"host.os.full","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Amazon Linux 2","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"host.os.name","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Linux","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"host_asset_id","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"75424166","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"index_type","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"ecs-1.5.0-vulnerability","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"labels.parent_id","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"1","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"logsource.origin","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"unknown","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"message_size","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"0","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"original_timestamp","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Nov 25, 2020 @ 07:32:27.233","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"received_timestamp","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Nov 25, 2020 @ 07:32:27.480","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"tags","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"[\"customer\",\"flow_source_data_miss\",\"default_parent_id\",\"cached_parent_metadata\"]","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"tenant_id","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"1024","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.category","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"[\"AMAZON LINUX\",\"PCI\"]","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.consequence","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.cve","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188","type":"text","marks":[{"type":"link","attrs":{"href":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.description","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Amazon Linux Security Advisory for e2fsprogs: ALAS2-2020-1509","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.diagnosis","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"<DIV> Issue Overview:

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. (CVE-2019-5094 )

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. (CVE-2019-5188 )

</DIV>","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.discovery","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"0","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.enumeration","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"135","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.id","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"352127","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.last_modification","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Oct 29, 2020 @ 07:29:25.000","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.patchable","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"1","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.pci_flag","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"1","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.published","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Oct 29, 2020 @ 07:29:25.000","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.reference","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"https://alas.aws.amazon.com/AL2/ALAS-2020-1509.html","type":"text","marks":[{"type":"link","attrs":{"href":"https://alas.aws.amazon.com/AL2/ALAS-2020-1509.html"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.report_id","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"20201125.133227","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.results","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Package Installed Version Required Version e2fsprogs 1.42.9-12.amzn2.0.2.x86_64 1.42.9-19.amzn2 e2fsprogs-libs 1.42.9-12.amzn2.0.2.x86_64 1.42.9-19.amzn2 libcom_err 1.42.9-12.amzn2.0.2.x86_64 1.42.9-19.amzn2 libss 1.42.9-12.amzn2.0.2.x86_64 1.42.9-19.amzn2 e2fsprogs 1.42.9-12.amzn2.0.2.x86_64 1.42.9-19.amzn2","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.scanner.vendor","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Powered by Qualys","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.score.base","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"6.7","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.score.environmental","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"0.0","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.score.temporal","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"5.4","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.score.version","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"3.0","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.severity","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"3","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.solution","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Please refer to Amazon advisory ALAS-2020-1509 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2020-1509: Amazon Linux 2 (e2fsprogs (1.42.9-19.amzn2) on x86_64)

ALAS-2020-1509: Amazon Linux 2 (e2fsprogs (1.42.9-19.amzn2) on aarch64)

ALAS-2020-1509: Amazon Linux 2 (e2fsprogs (1.42.9-19.amzn2) on src)

ALAS-2020-1509: Amazon Linux 2 (e2fsprogs (1.42.9-19.amzn2) on i686)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.status","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"Active","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[261.0]},"content":[{"type":"paragraph","content":[{"text":"vulnerability.vulnerability_type","type":"text","marks":[{"type":"textColor","attrs":{"color":"#69707d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1081.0]},"content":[{"type":"paragraph","content":[{"text":"VULNERABILITY","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"JSON Example"},"content":[{"type":"codeBlock","content":[{"text":"{\n \"_score\": 1,\n \"_type\": \"doc\",\n \"_source\": {\n \"vulnerability.enumeration\": \"135\",\n \"document_size\": 3926,\n \"@timestamp\": \"2020-11-25T13:32:27.480Z\",\n \"vulnerability.published\": \"2020-10-29T12:29:25.000Z\",\n \"vulnerability.results\": \"Package\\tInstalled Version\\tRequired Version\\ne2fsprogs\\t1.42.9-12.amzn2.0.2.x86_64\\t1.42.9-19.amzn2\\ne2fsprogs-libs\\t1.42.9-12.amzn2.0.2.x86_64\\t1.42.9-19.amzn2\\nlibcom_err\\t1.42.9-12.amzn2.0.2.x86_64\\t1.42.9-19.amzn2\\nlibss\\t1.42.9-12.amzn2.0.2.x86_64\\t1.42.9-19.amzn2\\ne2fsprogs\\t1.42.9-12.amzn2.0.2.x86_64\\t1.42.9-19.amzn2\",\n \"tenant_id\": \"1024\",\n \"vulnerability.cve\": \"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188\",\n \"host.os.name\": \"Linux\",\n \"message_size\": 0,\n \"vulnerability.description\": \"Amazon Linux Security Advisory for e2fsprogs: ALAS2-2020-1509\",\n \"vulnerability.scanner.vendor\": \"Powered by Qualys\",\n \"_id\": 47741608,\n \"tags\": \"[\\\"customer\\\",\\\"flow_source_data_miss\\\",\\\"default_parent_id\\\",\\\"cached_parent_metadata\\\"]\",\n \"armor_metrics.processing_chain\": \"[\\\"KVN_V4_collector_i-0908b8b2b53868dc0|2020-11-25T13:32:27Z\\\",\\\"KVN_V4_processor_i-0aa172c88f440b715|2020-11-25T13:32:28Z\\\"]\",\n \"vulnerability.score.temporal\": \"5.4\",\n \"vulnerability.solution\": \"Please refer to Amazon advisory ALAS-2020-1509 for affected packages and patching details, or update with your package manager.\\n

Patch:
\\nFollowing are links for downloading patches to fix the vulnerabilities:\\n

ALAS-2020-1509: Amazon Linux 2 (e2fsprogs (1.42.9-19.amzn2) on x86_64)

ALAS-2020-1509: Amazon Linux 2 (e2fsprogs (1.42.9-19.amzn2) on aarch64)

ALAS-2020-1509: Amazon Linux 2 (e2fsprogs (1.42.9-19.amzn2) on src)

ALAS-2020-1509: Amazon Linux 2 (e2fsprogs (1.42.9-19.amzn2) on i686)\",\n \"armor_metrics.input_port\": \"5445\",\n \"original_timestamp\": \"2020-11-25T13:32:27.233Z\",\n \"logsource.origin\": \"unknown\",\n \"vulnerability.score.environmental\": \"0.0\",\n \"vulnerability.status\": \"Active\",\n \"vulnerability.category\": \"[\\\"AMAZON LINUX\\\",\\\"PCI\\\"]\",\n \"host.ip\": \"10.0.0.8\",\n \"vulnerability.discovery\": \"0\",\n \"vulnerability.reference\": \"https://alas.aws.amazon.com/AL2/ALAS-2020-1509.html\",\n \"vulnerability.report_id\": \"20201125.133227\",\n \"received_timestamp\": \"2020-11-25T13:32:27.480Z\",\n \"host.os.full\": \"Amazon Linux 2\",\n \"vulnerability.pci_flag\": \"1\",\n \"vulnerability.patchable\": \"1\",\n \"vulnerability.score.version\": \"3.0\",\n \"event_uuid\": \"6d820110-73e5-45c9-945e-10c281fd4cb4\",\n \"vulnerability.last_modification\": \"2020-10-29T12:29:25.000Z\",\n \"vulnerability.diagnosis\": \"

\\n Issue Overview:\\n

\\n

\\n\\n \",\n \"labels.parent_id\": \"1\",\n \"host_asset_id\": \"75424166\",\n \"vulnerability.vulnerability_type\": \"VULNERABILITY\",\n \"external_id\": \"4f5b9ab7-8e57-4993-b0fb-440cd44d11e5\",\n \"vulnerability.score.base\": \"6.7\",\n \"armor_metrics.latency.processing\": 0.8566529750823975,\n \"vulnerability.severity\": \"3\",\n \"vulnerability.consequence\": \"Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.\",\n \"@version\": 1,\n \"host.hostname\": \"ip-10-0-0-8.us-west-2.compute.internal\",\n \"index_type\": \"ecs-1.5.0-vulnerability\",\n \"vulnerability.id\": \"352127\"\n },\n \"_id\": \"47741608\",\n \"_index\": \"1_1024_customer\"\n}","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The schema for these documents is based on Elastic Common Schema, please refer to the below links for the details and explanation of the fields:","type":"text"}]},{"type":"paragraph","content":[{"text":"Vulnerability Schema","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"https://www.elastic.co/guide/en/ecs/1.5/ecs-vulnerability.html","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.elastic.co/guide/en/ecs/1.5/ecs-vulnerability.html"}}]}]},{"type":"paragraph","content":[{"text":"Custom Fields:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"parsed.trendmicro.severity - the severity of the event","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"parsed.trendmicro.name - the name of the Integrity Monitoring rule","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"parsed.trendmicro.file_path - for processes, the protocol, interface, and port from which the FIM event was detected; for files, the path(s) of the file(s) that were renamed or whose contents were changed","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"parsed.trendmicro.action - the type of change detected for the process, file, or directory, such as deleted, created, renamed, or updated","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"parsed.trendmicro.message - a description of the changes detected on the relevant process, file, or directory","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Helpful Fields for Searching the Datalake","type":"text"}]},{"type":"rule"},{"type":"table","attrs":{"layout":"default","width":546.0,"localId":"7b9315e8-9ec7-448c-ab5f-098edc3c13fa"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"Field","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[452.0]},"content":[{"type":"paragraph","content":[{"text":"Filter By","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"hostname","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[452.0]},"content":[{"type":"paragraph","content":[{"text":"the hostname of the machine on which the event was sent","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"data_type","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[452.0]},"content":[{"type":"paragraph","content":[{"text":"the type of the data being searched for, trend-hids in this instance","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Adding a Filter","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"To add additional filters, click on the Add Filter Button.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":686,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1280,"id":"98a964ec-eab2-4879-ad0f-adafa540c68b","collection":"contentId-3519579576","type":"file","height":359}}]},{"type":"paragraph","content":[{"text":"Then set the field to one of the helpful fields above, select the operator, put in the value and hit save. The data is now filtered on a specific reportId, Policy or other field selected.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Viewing Datalake Aggregations","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Please refer to ","type":"text"},{"text":"Reports","type":"text","marks":[{"type":"link","attrs":{"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519579559"}}]},{"text":" for custom aggregations, visualizations and custom reports.","type":"text"},{"type":"hardBreak"}]}],"version":1}

Browser not supported