AWS Inspector Plugin for Risk Exchange

This document explains how to configure the AWS Inspector v1.0.0 plugin in the Netskope Cloud Exchange platform.This plugin is used to fetch Workloads from the AWS Inspector > Inventory > Findings for EC2 instance resources. This plugin also supports Create Suppression Rule action on AWS Inspector.

Prerequisites

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Connectivity to the AWS Inspector.

AWS Inspector Plugin Support

This plugin is used to fetch Workloads from the AWS Inspector > Inventory > Findings for EC2 instance resources. This plugin also supports Create Suppression Rule action on AWS Inspector.

Mappings

Mappings are used to view the pulled Workloads along with their respective details. Fields mapped during plugin configuration will be visible on the Records page after the data is pulled. Here are the suggested mappings to use while configuring the plugin.

Pull Mapping for Devices(Workloads)

Permissions

AWS Inspector permissions to the IAM user to pull Workload information.

• inspector2:ListFindings
• inspector2:ListCoverage
• inspector2:BatchGetFindingDetails
• inspector2:CreateFilter
• inspector2:ListFilters

inspector_client = boto3.client(
         "inspector2",
         aws_access_key_id=self.aws_public_key,
         aws_secret_access_key=self.aws_private_key,
         aws_session_token=self.aws_session_token,
         region_name=self.configuration["region_name"].strip(),
         config=Config(
                proxies=self.proxy,
                user_agent=self.useragent,
                retries={
                         "total_max_attempts": 3,
                          "mode": standard,
                 },
         ),
)

{
    "filterCriteria": {
        "resourceType": [
            {"comparison": "EQUALS", "value": "AWS_EC2_INSTANCE"}
        ],
        "updatedAt": [
            {
                "startInclusive": start_time,
                "endInclusive": end_time,
            }
        ],
        "findingStatus": [
            {"comparison": "EQUALS", "value": "ACTIVE"}
        ],
    },
    "sortCriteria": {
        "field": "LAST_OBSERVED_AT",
        "sortOrder": "ASC",
    },
    "maxResults": BATCH_SIZE,
    # "nextToken": next_token  # included on subsequent pages
}

response = inspector_client.list_findings(**params)

{
    "findingArns": chunk   # list of up to 10 Inspector finding ARNs
}

response = inspector_client.batch_get_finding_details(findingArns=chunk)

{
    "action": "SUPPRESS",
    "maxResults": LIST_FILTERS_MAX_RESULTS,
    # "nextToken": next_token  # included on subsequent pages
}

response = inspector_client.list_filters(**kwargs)

{
    "name": rule_name,  
    "action": "SUPPRESS",
    "filterCriteria": criteria,              # built from suppression params, e.g.:
    # {
    #   "findingArn":    [{"comparison": "EQUALS",  "value": "..."}],
    #   "resourceTags":  [{"comparison": "EQUALS",  "key": "k", "value": "v"}],
    # }
    "description": "Created by Netskope Cloud Exchange on <ISO-date>.",
    # "reason": reason  # optional, user-provided
}

response = inspector_client.create_filter(**kwargs)
arn = response.get("arn", "")

Performance Matrix

Below is the performance matrix conducted on a Large CE Stack with below-mentioned specifications by pulling 500k workloads.

User Agent

APN/1.1 (ahq9d89xj9gspapczzdb59goq)

Workflow

1. Generate credentials for AWS Inspector authentication methods.
2. Configure the AWS Inspector plugin.
3. Configure a Business Rule.
4. Configure an Action.
5. Validate the plugin.

Watch a Video

Click play to watch a video.

Obtaining configuration parameter

Create an AWS Inspector Policy

1. Search for “IAM” in the search box and from the left panel Click on “Policies”.

   

2. Click on Create Policy.

   

3. Click on the JSON tab, and enter the below-mentioned policy. Click on Next:  Tags, Click on Next: Review.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "Statement1",
         "Effect": "Allow",
         "Action": [
                   "inspector2:ListFindings",
                   "inspector2:ListCoverage",
                   "inspector2:BatchGetFindingDetails",
                   "inspector2:CreateFilter",
                   "inspector2:ListFilters"
         ],
         "Resource": "*"
       }
     ]
   }

4. Enter Name and Click on Create Policy.

   

   • Attach this policy to the user, using the following steps:

     • Navigate to IAM > Users. Select the user on which you want to attach a policy, and click on Add permissions and click on Add permissions options.

       

     • Select “Attach policies directly” option under Permissions options and search and select the policy created in the previous step for the source queue.

       

     • Click on Next and then click on Add permissions. Policy will be attached to the user.

IAM Role Anywhere Authentication

Prerequisites

The AWS Certificate Manager service is required to be enabled to authenticate the plugin using the AWS IAM Roles Anywhere Authentication Method.

Create a Policy

This Policy contains the required permissions for creating Private CA Certificate (including Permissions for creating a Trust Anchor and Profile) and using the IAM Roles Anywhere.

1. Go to Policy Generator and select IAM Policy as policy type, enter Add Statement details, and generate a policy.
   • Select Type of Policy: IAM Policy
   • Effect: Allow
   • AWS Service: AWS Private Certificate Authority
   • Actions:
     • CreateCertificateAuthority
     • DescribeCertificateAuthority
     • GetCertificate
     • GetCertificateAuthorityCertificate
     • GetCertificateAuthorityCsr
     • ImportCertificateAuthorityCertificate
     • IssueCertificate
     • ListCertificateAuthorities
   • ARN: *
2. Click Add Statement.
   

   

3. Scroll back up to add another statement.
   • Select Type of Policy: IAM Policy
   • Effect: Allow
   • AWS Service: AWS Identity and Access Management (IAM)
   • Actions:
     • AttachRolePolicy
     • CreateAccessKey
     • CreateRole
     • DeleteRole
     • PassRole
   • ARN: *
4. Click Add Statement.
   

   

5. Scroll back up to add another statement.
   • Select Type of Policy: IAM Policy
   • Effect: Allow
   • AWS Service: AWS Certificate Manager
   • Actions:
     • DescribeCertificate
     • ExportCertificate
     • GetCertificate
     • ListCertificates
     • ListTagsForCertificate
     • RequestCertificate
   • ARN: *
6. Click Add Statement.
   

   

7. Scroll back up to add another statement.
   • Select Type of Policy: IAM Policy
   • Effect: Allow
   • AWS Service: AWS Identity and Access Management Roles Anywhere
   • Actions:
     • CreateProfile
     • CreateTrustAnchor
     • GetProfile
     • GetTrustAnchor
     • ListProfiles
     • ListTrustAnchors
   • ARN: *
8. Click Add Statement.
   

   

9. Click Generate Policy.
   

   

10. Copy the Policy as it will be used in the next step for creating the policy required for creating the Private CA certificates.
11. Go to AWS Console and select IAM from All Services. Click Policies in the left panel, and then click Create Policy.
    

    

12. Copy the policy to the JSON tab, click Next:Tags, and then click Next:Review
    .
    

    

13. Enter a name (like netskope-ce-rolesAnywhere-policy) and click Save Changes.
    

    

Create a Private Certificate Authority

1. Log in to AWS Console.
2. Search for Certificate Manager.
   

   

3. Click AWS Private CA.
4. Click Create a private CA.
   

   

5. For Mode Options, select General-purpose.
6. For CA type options, select Root.
   

   

7. Enter the Organization (O).
   

   

8. For Key algorithm options, select RSA 2048.
   

   

   

9. Add tags if any (optional).
10. Check the checkbox in the CA permissions options section.
11. Check the checkbox in the Pricing section.
12. Click Create to create the CA certificate.
    

    

    

13. From Actions, select Install CA Certificate.
    

    

14. Click Confirm and Install.
    

    

    

Create a Trust Anchor

1. Search for the IAM service, go to Roles under Access management scroll down to Roles Anywhere and select Manage.
   

   

2. Click Create a Trust anchor.
   

   

3. Enter a Trust anchor name.
   
4. Select AWS Certificate Manager Private CA (created in the previous steps) as a Certificate authority (CA) source. Select the Certificate that was created in the previous step in AWS Private Certificate Authority.
5. Add tags if required.
6. Click Create a trust anchor.
   

   
   

7. Click on the created Trust Anchor and copy the Trust Anchor ARN. This will be required in the Plugin configuration Trust Anchor ARN parameter for the authentication method AWS IAM Roles Anywhere.
   

   

Create an IAM Role

1. Go to IAM services in the AWS Console.
2. Click Role in the Access Management submenu.
3. Click Create Role.
   

   

4. In the Trusted entity type, select Custom Trust Policy.
   

   

5. Replace the Custom trust Policy with this Trust Policy. This policy contains the permissions for using the roles anywhere service:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": [
                       "rolesanywhere.amazonaws.com"
                   ]
               },
               "Action": [
                   "sts:AssumeRole",
                   "sts:TagSession",
                   "sts:SetSourceIdentity"
               ]
           }
       ]
   }

   

6. Click Next.
7. In the Permissions policies, select the policy created in Create an AWS Security Hub Policy.
   
8. Click Next.
9. Provide a Role name (like netskope-ce-aws-verified-access-role) and Description for the role.
   
10. Click Create role. Search for the created role and click on the Role Name. 
    
11. Make a note of the Role ARN. This will be required in the Plugin configuration Role ARN parameter for the authentication method AWS IAM Roles Anywhere.
    

Create a Profile

1. Select Roles under Access management.
2. Scroll down to Roles Anywhere and click Manage.
   

   

3. Expand the Setup steps.
4. Click Step 2: Configure roles.
5. Click Configure a profile.
   

   

6. Enter a Profile Name.
7. Select the role created in the Create IAM Role section.
   
8. Remove the Inline Policy.
   
9. Click Create a profile.
   

   

   

10. Select the created Profile and copy the Profile ARN.
    

Request a Private Certificate

1. Go to AWS Certificate Manager > Request certificate.
2. Select Request a private certificate.
   

   

3. Click Next.
4. Select the Certificate authority created in the previous step.
   

   

5. Provide a domain name in the Fully qualified domain name field, like netskope-ce-verified-access.com.
6. Select RSA 2048 as the Key algorithm.
   
7. Add tags if required.
8. Acknowledge the Certificate renewal permissions.
9. Click Request.
   

   

10. Go to List certificates from the navigation pane of AWS Certificate Manager.
11. Select the certificate created previously.
    
12. Click Export.
    
13. Enter a passphrase. Make a note of the passphrase as it will be required for the Configuration of the AWS Security Lake Plugin using the AWS IAM Roles Anywhere Authentication method.
14. Click Generate PEM Encoding.
    
15. Download all the Certificates as it won’t be visible again. For new certificates, you will need to Export them again.
    

The Certificate body, Certificate Private Key will be required for the Configuration of the AWS Verified Access Plugin using the AWS IAM Roles Anywhere authentication method. For more info, go to AWS IAM Role Anywhere.

AWS Authentication

Create a Role

1. Go to IAM services in the AWS Console.
2. Click Create role.
   

   

3. Select the AWS Service.
4. Under Use case, select EC2.
5. Click Next.
   

   

6. Select the permission policy created in Create an AWS Security Hub policy.
   
7. Click Next.
   
8. Enter a Role Name and Description.
   
9. Click Create Role.
   

Assign a Role to an EC2 Instance

1. Log in to your EC2 instance console.
2. Click Instances under Instances.
   

   

   

3. Go to Action > Security > Modify IAM Role.
   

   

4. Select the Role that you created above in Create a Role. (netskope-ce-instance-role).
5. Click Add IAM Role or Modify IAM Role. Note that both EC2 instance and Queue should be on the same region.
   

Configure the AWS Inspector Plugin

1. In Cloud Exchange, go to Settings > Plugin Store. Search for and select the AWS Inspector v1.0.0 (CRE) plugin.

   

2. Add plugin configuration name and change sync interval if needed.

   

3. Click Next and the Configuration Parameters: 

   • Authentication Method: Select the method to be used for authentication (Deployed on AWS/AWS IAM Roles Anywhere)

   • Private Key: Private Key for decrypting the AWS Private CA Certificate. Required for the AWS IAM Roles Anywhere authentication type.

   • Certificate Body: Certificate Body for AWS Public/Private CA Certificate. Required for the AWS IAM Roles Anywhere authentication type.

   • Password Phrase: Password Phrase for decrypting the CA Certificate. Required for the AWS IAM Roles Anywhere authentication type authentication type.

   • Profile ARN: AWS Profile ARN for AWS client authentication. Required for the AWS IAM Roles Anywhere authentication type.

   • Role ARN: AWS Role ARN for AWS client authentication. Required for the AWS IAM Roles Anywhere authentication type.

   • Trust Anchor ARN: AWS Trust Anchor ARN for AWS client authentication. Required for the AWS IAM Roles Anywhere authentication type.

   • AWS Region Name: AWS Region Name. Make sure that the region name matches the region in the Profile ARN and Trust Anchor ARN.

   • Initial Range: Number of days to pull the data for the initial run.

     

     

     

4. Click Next and select the required Entity from the Entity dropdown. Provide the field mappings per your requirements. You can create a new one by clicking Add.

   

   To create a new field, click Add field.

   

   Provide the Field Label, Data Type, Normalization and Aggregate Strategy per your requirements, and then click Save. 

   

   Map the created fields:

   

   

   Note

   • Refer to the Mappings section while configuring the plugin.
   • Finding ID and Private IP fields will be required to pull the Workloads.

5. Click Save.

   

Configure a Risk Exchange Business Rule for the AWS Inspector Plugin

1. In Risk Exchange, click Business Rules and Create New Rule.

2. Enter a Rule Name. Select the Entity for which Fields have been configured for the AWS Inspector plugin, and configure the query based on your requirements. This example filters the data fetched from the plugin.

   

3. Click Save.

Configure Risk Exchange Actions for the AWS Inspector Plugin

The AWS Inspector plugin supports the following action types:

• Create Suppression Rule: Create Suppression Rule action can be used to create a suppression rule on AWS Inspector.
• No Action: No action will be performed for this action. Users can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

Create a Suppression Rule

1. In Risk Exchange, go to Actions and click Add Action Configuration.

2. Select the required Business Rule, Target Plugin Configuration, and Action from their respective dropdowns.

3. Enable the Require Approval toggle if Approval is needed before performing action on the pulled records. If the Require Approval toggle is enabled, then users need to manually approve the execution of each action from Risk Exchange on the Action Logs page.

4. Enter the Action Parameters:

   • Rule Name: Name of the Suppression rule to create in AWS Inspector. Provide rule name in Static field. A maximum of 128 characters are allowed.
   • Rule Description: Description for Suppression rule. Provide a description in the Static field.
   • Filter Key: The AWS Inspector field is used as the suppression filter criteria. Select from Static field dropdown.
   • Filter Value: Value to match for the selected filter field. Map to a source field or provide a static value.

   

5. Click Save.

No Action

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Configuration, and Action from their respective dropdowns.
3. Enable the Require Approval toggle if Approval is needed before performing action on the pulled records.
4. Click Save.

Validate the AWS Inspector Plugin

Validate in Cloud Exchange

To validate the pulling:.

In Risk Exchange, and click on Records. Select the Entity that was selected while configuring the field mapping to view the pulled records.

To verify the logs related to pulled records, navigate to the Home > Settings > Logging page and apply the filter with plugin name or plugin configuration name.

Logs for performed Create Suppression Rule action:

When a pulled record matches one of the configured business rules, the configured action will be performed on the record. This can be seen at Risk Exchange > Action Logs.

Validate in AWS Inspector

To validate the workloads available on AWS Inspector:

Log in to AWS instance, and go to the Inspector service.

Move to the Findings page under Inventory.

Here are all the findings listed. To check the details of a particular finding, click on that finding.

Validate the Create Suppression Rule Action

To validate the Create Suppression Rule Action, navigate to the Inspector service of AWS.

Go to the Suppression Rules page under the Management section.

Click on the created Suppression rule to verify the description and filter for the rule.

Troubleshooting AWS Inspector Plugin

Unable to pull Workloads or the field values from the plugin

If you are not able to pull Workloads from the AWS Security Hub Findings, it could be due to there being no data available to pull due to:

• No data available for pulling.
• No fields are mapped.

What to do:

1. Go to AWS Inspector > Findings. Check if the findings are available to pull for the same time range and same region name as provided in the plugin configuration.
2. If the findings are available and still not pulled, check the Resource value for those findings. Only findings with the EC2 Instance or Amazon EC2 Instance Resource type are pulled.
3. If the Findings are available, make sure the fields are mapped in the plugin.

Facing issues while configuring the new plugin

If you’re creating a new plugin with AWS IAM Roles Anywhere and see this error while configuring the plugin:

What to do:

This error could possibly mean that one of the Trust Anchor ARN, Role ARN, or Profile ARN has a different account ID, so you need to check that the provided parameters are generated from the same account, and have the same region.