turbinia
trailscraper
Our great sponsors
| turbinia | trailscraper | |
|---|---|---|
| 1 | 6 | |
| 711 | 762 | |
| 0.8% | - | |
| 9.0 | 8.9 | |
| 5 days ago | 6 days ago | |
| Python | Python | |
| Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
turbinia
-
Log2Timeline -> Timesketch
You want Turbinia and DFTimewolf. Literally the tools built by the DF team at Google (the same team that makes L2T) purpose-built to do exactly what you're asking.
trailscraper
- TrailScraper
-
How to get the exact IAM services/roles needed to run a command
I like using https://github.com/flosell/trailscraper for this
- flosell/trailscraper - a command-line tool to get valuable information out of AWS CloudTrail
- TrailScraper: A command-line tool to get valuable information out of AWS CloudTrail and a general purpose toolbox for working with IAM policies
- Trailscraper can scrape your Cloudtrail logs and generate IAM Policies from the resources and verbs used by your users or roles
-
Is there a tool that tells you which IAM actions to allow if you give it an API operation?
I’ve used this project in the past to pull out policy information https://github.com/flosell/trailscraper (it’s a CLI, FYI)
What are some alternatives?
timesketch - Collaborative forensic timeline analysis
aws-secure-environment-accelerator - The AWS Secure Environment Accelerator is a tool designed to help deploy and operate secure multi-account, multi-region AWS environments on an ongoing basis. The power of the solution is the configuration file which enables the completely automated deployment of customizable architectures within AWS without changing a single line of code.
varc - Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.
cloudtracker - CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies.
dftimewolf - A framework for orchestrating forensic collection, processing and data export
parliament - AWS IAM linting library
Astra - Automated Security Testing For REST API's
aws-leastprivilege - Generates an IAM policy for the CloudFormation service role that adheres to least privilege.
faraday - Open Source Vulnerability Management Platform
cloudsplaining - Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.
aws-cloudformation-templates - A collection of useful CloudFormation templates
iamlive - Generate an IAM policy from AWS, Azure, or Google Cloud (GCP) calls using client-side monitoring (CSM) or embedded proxy