dep-scan
prowler
dep-scan | prowler | |
---|---|---|
3 | 25 | |
714 | 9,611 | |
5.3% | 1.9% | |
8.7 | 9.8 | |
11 days ago | 4 days ago | |
Python | Python | |
MIT License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
dep-scan
-
Show devsecops: OWASP dep-scan v5 - a next-generation security and risk audit tool for everyone
Depscan v5 is the first opensource SCA tool that can perform precision reachability analysis for Java, JavaScript/TypeScript, and Python applications to triage and prioritize the results. We invented an automatic symbols tagger, a lightweight data-flow analyzer, and a static slicer to compute all reachable flows with or without vulnerabilities. We open-sourced all our work, including the specification.
- Dep-scan: Fully open-source security audit for project dependencies
-
what was the name of the tool that does risk analysis on imported libraries?
wow found it with your keyword! it's https://github.com/AppThreat/dep-scan
prowler
-
Cloud Security and Resilience: DevSecOps Tools and Practices
1. Prowler: https://github.com/prowler-cloud/prowler Prowler provides security best practices assessments, audits, incident response readiness, and continuous monitoring for AWS environments.
-
Ask HN: Cloud security auditing for indie-grade projects?
Which cloud provider?
https://github.com/prowler-cloud/prowler is easy to get going with, and gives decent results. It's much stronger at AWS than GCP or Azure.
Steampipe can be a little harder to wrap your head around, but scales really well and has broader support: https://hub.steampipe.io/mods?objectives=security
-
Automating AWS Prowler Scans
Task Role: Select or create a new role that has the necessary permissions. Ensure this role has the three required Prowler policies and an additional custom policy to put objects into the desired S3 bucket.
-
Azure and M365 Secure Config Review
Prowler and ScoutSuite are a good start for cloud stuff.
- AWS Account - Analysis
-
Open source alternative cloud security tool that works like Wiz/Lacework/Aqua
Yes! There are open source cloud security tools! Here are some open source tools out there: steampipe, prowler, cloudquery, and ZeusCloud.
-
CSPM opensource suggestions
If AWS is in use then i would add prowler to the list - https://github.com/prowler-cloud/prowler This is the best open source cspm for aws.
-
Practical way for security assestment in AWS with Prowler
More info you can find it at Prowler Github and Prowler Docs
- AWS Security Scanner
-
Opensource equivalent of Sailpoint
You’re not going to find a shiny enterprise web ui for free but there are tools out there. If you just want to review AWS accounts, you can use prowler https://github.com/prowler-cloud/prowler
What are some alternatives?
VexEmulator - A V5 brain emulator that can run most .v5python programs
ScoutSuite - Multi-Cloud Security Auditing Tool
ElectricEye - ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks
cloudmapper - CloudMapper helps you analyze your Amazon Web Services (AWS) environments.
repometascore - repometascore (aka repository metadata scoring) analyzes metadata of the given repository, collects info about its contributors, and outputs the risk level.
steampipe-mod-aws-compliance - Run individual controls or full compliance benchmarks for CIS, PCI, NIST, HIPAA and more across all of your AWS accounts using Powerpipe and Steampipe.
ochrona-cli - A command line tool for detecting vulnerabilities in Python dependencies and doing safe package installs
terraform-aws-secure-baseline - Terraform module to set up your AWS account with the secure baseline configuration based on CIS Amazon Web Services Foundations and AWS Foundational Security Best Practices.
cdxgen - Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server. Slack: https://cyclonedx.slack.com/archives/C04NFFE1962
opencspm - Open Cloud Security Posture Management Engine
kubestriker - A Blazing fast Security Auditing tool for Kubernetes
CIS-Ubuntu-20.04-Ansible - Ansible Role to Automate CIS v1.1.0 Ubuntu Linux 18.04 LTS, 20.04 LTS Remediation