sanjogpandasp / dollhouse

GCP audit and Incident response framework

Dollhouse

Dollhouse does Incident response and audit on Google Cloud Platform (GCP). As there are many components in GCP, dollhouse aims to be the one tool that can audit the whole platform and give almost real-time alerts to you. It can be used by Security Engineers and DevOps engineers to monitor the whole organization infrastucture. Dollhouse can also send alerts based on pre-configured events.

High Level Architecture

Currently supports:

---

• Firewall Rules
• IAM Roles
• Service Accounts
• Google Cloud Storage

Requirements

---

• An IAM account with Org level permissions :
  • roles/iam.securityReviewer
  • Viewer
• pip install requirements-audit.txt

Usage

---

usage: dollhouse-audit.py [-h] [--account ACCOUNT] [--es ELASTICSEARCH]
                          [--firewall] [--iam] [--project PROJECT]
                          [--firewall_name FIREWALL_NAME]

GCP Audit Tool

optional arguments:
  -h, --help                            show this help message and exit
  --account ACCOUNT                     account to run this tool with -> ex: [email protected]
  --es ELASTICSEARCH                    formats to json and pushes to elastic search
  --firewall                            run firewall rules check
  --iam                                 run IAM Users & Service Accounts check
  --project PROJECT                     query specific project
  --firewall_name FIREWALL_NAME         query specific firewall name

python dollhouse-audit.py --account [email protected] --firewall --iam

You can also query specific firewall name on a specific project

python dollhouse-audit.py --account [email protected] --project myProject --firewall_name myfirewallName

ElasticSearch Support

Results can be pushed to ElasticSearch for data storing

python dollhouse-audit.py --account [email protected] --firewall --iam --ES 127.0.0.1

---

Dollhouse-Bot

Dollhouse-bot is a slack bot which gives instant alerts on slack to custom events that you have set. This bot leverages Google Stackdriver Logging & Monitoring to check for events in a GCP Project.

Screenshot:

Requirements

---

• pip install requirements-bot.txt
• Gcloud account with the following permissions:
  • Logs Configuration Writer
  • Monitoring Editor
  • Service Usage Consumer

Setup

---

SlackBot

You can refer to the following page to get you started with building your slack bot application.

Config file

On utils/config.property, input the values for the following variables:

• elasticsearch_host
• elasticsearch_port
• dollhouse_bot_token (Bot User OAuth Access Token)
• EXAMPLE_COMMAND, IAM_ROLE_DESCRIBE_COMMAND, SERVICEACCONT_IDENTIFY_COMMAND, HELP_COMMAND (change it with the ID of your bot)
• running_account
• SLACK_CHANNEL (channel ID which dollhouse-bot will send alerts to)

Creating Stackdriver Account

Each project will have their account. This has to be done from the console or you can enable it while using terraform. Enable Stackdriver API by clicking the hamburger button on the top left, and go to stackdriver monitoring, follow the steps there. You can organize your stackdriver accounts by adding all projects into one stackdriver workspace, so that logs from all the projects goes into one workspace.

Enabling stackdriver API (This needs to be done by the project owner)

The below service apis need to be enabled

logging.googleapis.com                  Stackdriver Logging API
monitoring.googleapis.com               Stackdriver Monitoring API
stackdriver.googleapis.com              Stackdriver API
stackdriverprovisioning.googleapis.com  Stackdriver Provisioning Service

enable it running the following command

gcloud services enable [service_name]

Automated Deployment

You can deploy this automatically using dollhouse-deploy script. First, you must write custom logging metrics to that project.

python dollhouse-deploy.py -p projectName -d ./ --logserviceAccount --logfirewall --logiam

At this point, your project should have filtered out custom logs.

Note: Stackdriver and GCP needs to sync for a minute or two.

Once stackdriver monitoring has been set up, we can deploy stackdriver policies and create a slack notification Make sure you have a slack token and a slack channel. Example can be seen at slack_notification.json file. The alerts sent from stackdriver will not be look at by us because it does not give enough information. Only the bot looks at the alerts from here. You can name your channel to stackdriver-ignore. Invite dollhouse-bot to that channel. It will listen and parse the alerts and send it to the actual channel you specified on utils/config.property.

To deploy policies and slack channel:

python dollhouse-bot.py --createslack --stackdriverfirewall --stackdriverserviceAccount --stackdriveriam

Running Dollhouse-bot

To run dollhouse-bot, you can simply do python dollhouse-bot.py

Authors

---

• Fahri Shihab
• Sanjog Panda

Credits

---

• GO-JEK Security Team

Future Plans for Dollhouse:

---

• We continuously trying to improve on the code quality of the tool to make it more modular and maintainable.
• Incident Response on GCS bucket
• Whitelisting/Blacklisting alert rules from slack