diff --git a/404.html b/404.html index e11756d3d..6b2ff73b5 100644 --- a/404.html +++ b/404.html @@ -7,8 +7,8 @@ - - + +
Skip to main content

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

diff --git a/assets/images/environments-create-441942bdd5871532daf772ba48b11583.png b/assets/images/environments-create-441942bdd5871532daf772ba48b11583.png deleted file mode 100644 index 11fb32fbd..000000000 Binary files a/assets/images/environments-create-441942bdd5871532daf772ba48b11583.png and /dev/null differ diff --git a/assets/js/00e2a099.c4c03b25.js b/assets/js/00e2a099.a5842230.js similarity index 98% rename from assets/js/00e2a099.c4c03b25.js rename to assets/js/00e2a099.a5842230.js index fdde5c3dd..d3005a66e 100644 --- a/assets/js/00e2a099.c4c03b25.js +++ b/assets/js/00e2a099.a5842230.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9259],{59248:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>r,metadata:()=>i,toc:()=>l});var n=o(74848),a=o(28453);const r={title:"Manage data",hide_title:!0,sidebar_position:8},s="How to Manage Data in the Cado Platform",i={id:"cado/manage/data",title:"Manage data",description:"There are several important considerations when managing data in the Cado platform.",source:"@site/docs/cado/manage/data.md",sourceDirName:"cado/manage",slug:"/cado/manage/data",permalink:"/cado/manage/data",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/data.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"Manage data",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Worker management",permalink:"/cado/manage/workers"},next:{title:"Expand disk in AWS",permalink:"/cado/manage/expand-disk"}},c={},l=[{value:"Controlling the Lifecycle of Data Stored by the Cado Platform",id:"controlling-the-lifecycle-of-data-stored-by-the-cado-platform",level:2},{value:"Storing Sensitive Customer Data",id:"storing-sensitive-customer-data",level:2}];function d(e){const t={a:"a",h1:"h1",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...(0,a.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-manage-data-in-the-cado-platform",children:"How to Manage Data in the Cado Platform"}),"\n",(0,n.jsx)(t.p,{children:"There are several important considerations when managing data in the Cado platform."}),"\n",(0,n.jsx)(t.h2,{id:"controlling-the-lifecycle-of-data-stored-by-the-cado-platform",children:"Controlling the Lifecycle of Data Stored by the Cado Platform"}),"\n",(0,n.jsx)(t.p,{children:"Each cloud provider offers tools to help manage the lifecycle of data stored in their environments. The Cado platform supports these tools based on the cloud provider you use:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"AWS"}),": You can use ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",children:"Object Locks"})})," and ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/console/s3/lifecyclerules",children:"Lifecycle Rules"})})," in your S3 bucket to control data retention and deletion. For more details, refer to the AWS documentation."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Azure"}),": Manage data lifecycle through ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview",children:"Life Cycle Management Policies"})})," for Azure Blob Storage. For more information, refer to the Azure documentation."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Google Cloud"}),": Use ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/storage/docs/lifecycle",children:"Object Lifecycle Management"})})," for Google Cloud Storage buckets to control data lifecycle. See the Google Cloud documentation for further details."]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"storing-sensitive-customer-data",children:"Storing Sensitive Customer Data"}),"\n",(0,n.jsx)(t.p,{children:"The storage of sensitive customer data in the Cado platform depends on the types of data sources and evidence imported into the software. Data can be stored in several locations, including:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"The database on the main Cado instance."}),"\n",(0,n.jsx)(t.li,{children:"EFS (Elastic File System)."}),"\n",(0,n.jsx)(t.li,{children:"The customer's S3 bucket (AWS) or Azure storage."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Because the Cado platform is deployed within the customer's cloud environment, the customer has full control over data lifecycle management (e.g., using Lifecycle Management policies) and access controls, such as VPC and subnet rules, to secure sensitive data."})]})}function h(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>s,x:()=>i});var n=o(96540);const a={},r=n.createContext(a);function s(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:s(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9259],{59248:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>r,metadata:()=>i,toc:()=>l});var n=o(74848),a=o(28453);const r={title:"Manage data",hide_title:!0,sidebar_position:8},s="How to Manage Data in the Cado Platform",i={id:"cado/manage/data",title:"Manage data",description:"There are several important considerations when managing data in the Cado platform.",source:"@site/docs/cado/manage/data.md",sourceDirName:"cado/manage",slug:"/cado/manage/data",permalink:"/cado/manage/data",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/data.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"Manage data",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Worker management",permalink:"/cado/manage/workers"},next:{title:"Expand disk in AWS",permalink:"/cado/manage/expand-disk"}},c={},l=[{value:"Controlling the Lifecycle of Data Stored by the Cado Platform",id:"controlling-the-lifecycle-of-data-stored-by-the-cado-platform",level:2},{value:"Storing Sensitive Customer Data",id:"storing-sensitive-customer-data",level:2}];function d(e){const t={a:"a",h1:"h1",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...(0,a.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-manage-data-in-the-cado-platform",children:"How to Manage Data in the Cado Platform"}),"\n",(0,n.jsx)(t.p,{children:"There are several important considerations when managing data in the Cado platform."}),"\n",(0,n.jsx)(t.h2,{id:"controlling-the-lifecycle-of-data-stored-by-the-cado-platform",children:"Controlling the Lifecycle of Data Stored by the Cado Platform"}),"\n",(0,n.jsx)(t.p,{children:"Each cloud provider offers tools to help manage the lifecycle of data stored in their environments. The Cado platform supports these tools based on the cloud provider you use:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"AWS"}),": You can use ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",children:"Object Locks"})})," and ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/console/s3/lifecyclerules",children:"Lifecycle Rules"})})," in your S3 bucket to control data retention and deletion. For more details, refer to the AWS documentation."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Azure"}),": Manage data lifecycle through ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview",children:"Life Cycle Management Policies"})})," for Azure Blob Storage. For more information, refer to the Azure documentation."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Google Cloud"}),": Use ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/storage/docs/lifecycle",children:"Object Lifecycle Management"})})," for Google Cloud Storage buckets to control data lifecycle. See the Google Cloud documentation for further details."]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"storing-sensitive-customer-data",children:"Storing Sensitive Customer Data"}),"\n",(0,n.jsx)(t.p,{children:"The storage of sensitive customer data in the Cado platform depends on the types of data sources and evidence imported into the software. Data can be stored in several locations, including:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"The database on the main Cado instance."}),"\n",(0,n.jsx)(t.li,{children:"EFS (Elastic File System)."}),"\n",(0,n.jsx)(t.li,{children:"The customer's S3 bucket (AWS) or Azure storage."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Because the Cado platform is deployed within the customer's cloud environment, the customer has full control over data lifecycle management (e.g., using Lifecycle Management policies) and access controls, such as VPC and subnet rules, to secure sensitive data."})]})}function h(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>s,x:()=>i});var n=o(96540);const a={},r=n.createContext(a);function s(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:s(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0331c271.098de1e3.js b/assets/js/0331c271.dd627e2f.js similarity index 98% rename from assets/js/0331c271.098de1e3.js rename to assets/js/0331c271.dd627e2f.js index 21db76532..a96dfcdf7 100644 --- a/assets/js/0331c271.098de1e3.js +++ b/assets/js/0331c271.dd627e2f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3815],{48229:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>i,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>r,toc:()=>l});var t=n(74848),c=n(28453);const s={title:"Manually deploy a cross-account role in AWS",hide_title:!0,sidebar_position:2},a="How to manually deploy a cross-account IAM role in AWS",r={id:"cado/deploy/cross/cross-account-creation",title:"Manually deploy a cross-account role in AWS",description:"The Cado platform can be configured to access resources across multiple AWS accounts. For example, if you manage multiple AWS accounts, you can deploy Cado in a single AWS account and grant access to the other accounts, enabling the platform to acquire, process, and analyze evidence seamlessly.",source:"@site/docs/cado/deploy/cross/cross-account-creation.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/cross-account-creation",permalink:"/cado/deploy/cross/cross-account-creation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/cross-account-creation.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Manually deploy a cross-account role in AWS",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Cross cloud",permalink:"/cado/deploy/cross/intro"},next:{title:"Automatically deploy a cross-account role with StackSets in AWS",permalink:"/cado/deploy/cross/cross-account-creation-auto"}},i={},l=[{value:"Overview",id:"overview",level:2},{value:"Step 1: Create an IAM Policy and Role in the Target AWS Account",id:"step-1-create-an-iam-policy-and-role-in-the-target-aws-account",level:2}];function d(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,c.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-manually-deploy-a-cross-account-iam-role-in-aws",children:"How to manually deploy a cross-account IAM role in AWS"}),"\n",(0,t.jsx)(o.p,{children:"The Cado platform can be configured to access resources across multiple AWS accounts. For example, if you manage multiple AWS accounts, you can deploy Cado in a single AWS account and grant access to the other accounts, enabling the platform to acquire, process, and analyze evidence seamlessly."}),"\n",(0,t.jsxs)(o.p,{children:["Alternatively, you can automatically deploy the IAM role via ",(0,t.jsx)(o.a,{href:"/cado/deploy/cross/cross-account-creation-auto",children:"Stacksets"}),", then add the roles to the Cado platform using ",(0,t.jsx)(o.a,{href:"/cado/deploy/cross/aws-organizations",children:"AWS Organizations"}),"."]}),"\n",(0,t.jsx)(o.h2,{id:"overview",children:"Overview"}),"\n",(0,t.jsx)(o.p,{children:"The process below outlines how to grant the Cado platform access to a target AWS account (other than the one where Cado is deployed). This process can be repeated for every AWS account you want to provide access to."}),"\n",(0,t.jsx)(o.p,{children:"There are two main steps to set up cross-account acquisitions:"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Create a Cross-Account IAM Policy and Role"})," in the target AWS account from which the Cado platform will acquire data. This allows Cado to assume the cross-account role for data acquisition."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Add the Cross-Account IAM Role ARN"})," to the Cado platform to enable access to that AWS account."]}),"\n"]}),"\n",(0,t.jsxs)(o.p,{children:["This page describes step 1. For step 2, see ",(0,t.jsx)(o.a,{href:"/cado/deploy/cross/add-cross-account-manual",children:"Manually add a cross-account role to Cado"}),"."]}),"\n",(0,t.jsxs)(o.admonition,{type:"info",children:[(0,t.jsx)(o.p,{children:"Throughout this guide:"}),(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["The ",(0,t.jsx)(o.strong,{children:"primary AWS account"})," is where Cado is deployed (referred to as account ",(0,t.jsx)(o.code,{children:"111111111111"}),")."]}),"\n",(0,t.jsxs)(o.li,{children:["The ",(0,t.jsx)(o.strong,{children:"target AWS account"})," is where cross-account access is being set up (referred to as account ",(0,t.jsx)(o.code,{children:"222222222222"}),")."]}),"\n"]})]}),"\n",(0,t.jsx)(o.h2,{id:"step-1-create-an-iam-policy-and-role-in-the-target-aws-account",children:"Step 1: Create an IAM Policy and Role in the Target AWS Account"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.strong,{children:"Create the IAM Policy:"})}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["In the target AWS account (",(0,t.jsx)(o.code,{children:"222222222222"}),"), go to ",(0,t.jsx)(o.strong,{children:"IAM > Policies"})," and click ",(0,t.jsx)(o.strong,{children:"Create Policy"}),"."]}),"\n",(0,t.jsxs)(o.li,{children:["Use the Cado Cross-Account Policy ",(0,t.jsx)(o.a,{href:"https://raw.githubusercontent.com/cado-security/Deployment-Templates/main/cross-account/CrossAccountPolicy.yaml",children:"found here"}),"."]}),"\n",(0,t.jsxs)(o.li,{children:["Give the policy a name, such as ",(0,t.jsx)(o.code,{children:"CadoResponseCrossAccountPolicy"}),", and create the policy."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.strong,{children:"Create the IAM Role:"})}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["Navigate to ",(0,t.jsx)(o.strong,{children:"IAM > Roles"})," and click ",(0,t.jsx)(o.strong,{children:"Create Role"}),"."]}),"\n",(0,t.jsxs)(o.li,{children:["Select ",(0,t.jsx)(o.strong,{children:"Another AWS Account"})," and enter the account ID of your primary AWS account (",(0,t.jsx)(o.code,{children:"111111111111"}),")."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Create Role",src:n(34268).A+"",width:"761",height:"323"})}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:"Attach the policy created in the previous step and proceed to name the role."}),"\n",(0,t.jsxs)(o.li,{children:["The role name ",(0,t.jsx)(o.strong,{children:"must include"})," the text ",(0,t.jsx)(o.code,{children:"CadoResponse"})," (e.g., ",(0,t.jsx)(o.code,{children:"CadoResponseCrossAccountRole"}),"). This is required for cross-account acquisition to function properly."]}),"\n",(0,t.jsxs)(o.li,{children:["The role needs a ",(0,t.jsx)(o.a,{href:"/cado/deploy/aws/iam/iam-description#using-an-existing-iam-role",children:"trust relationship"})," with the Cado role in 111111111111"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(o.p,{children:["Deploying the Cross-Account IAM Policy and Role can be automated using AWS StackSets or other methods. See ",(0,t.jsx)(o.a,{href:"#automating-aws-iam-role-and-policy-deployment",children:"Automating AWS IAM Role and Policy Deployment"}),"."]})]})}function h(e={}){const{wrapper:o}={...(0,c.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},34268:(e,o,n)=>{n.d(o,{A:()=>t});const t=n.p+"assets/images/create-role-fa83b0fb86d9d71fcea59dc0f7103a94.png"},28453:(e,o,n)=>{n.d(o,{R:()=>a,x:()=>r});var t=n(96540);const c={},s=t.createContext(c);function a(e){const o=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:a(e.components),t.createElement(s.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3815],{48229:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>i,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>r,toc:()=>l});var t=n(74848),c=n(28453);const s={title:"Manually deploy a cross-account role in AWS",hide_title:!0,sidebar_position:2},a="How to manually deploy a cross-account IAM role in AWS",r={id:"cado/deploy/cross/cross-account-creation",title:"Manually deploy a cross-account role in AWS",description:"The Cado platform can be configured to access resources across multiple AWS accounts. For example, if you manage multiple AWS accounts, you can deploy Cado in a single AWS account and grant access to the other accounts, enabling the platform to acquire, process, and analyze evidence seamlessly.",source:"@site/docs/cado/deploy/cross/cross-account-creation.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/cross-account-creation",permalink:"/cado/deploy/cross/cross-account-creation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/cross-account-creation.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Manually deploy a cross-account role in AWS",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Cross cloud",permalink:"/cado/deploy/cross/intro"},next:{title:"Automatically deploy a cross-account role with StackSets in AWS",permalink:"/cado/deploy/cross/cross-account-creation-auto"}},i={},l=[{value:"Overview",id:"overview",level:2},{value:"Step 1: Create an IAM Policy and Role in the Target AWS Account",id:"step-1-create-an-iam-policy-and-role-in-the-target-aws-account",level:2}];function d(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,c.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-manually-deploy-a-cross-account-iam-role-in-aws",children:"How to manually deploy a cross-account IAM role in AWS"}),"\n",(0,t.jsx)(o.p,{children:"The Cado platform can be configured to access resources across multiple AWS accounts. For example, if you manage multiple AWS accounts, you can deploy Cado in a single AWS account and grant access to the other accounts, enabling the platform to acquire, process, and analyze evidence seamlessly."}),"\n",(0,t.jsxs)(o.p,{children:["Alternatively, you can automatically deploy the IAM role via ",(0,t.jsx)(o.a,{href:"/cado/deploy/cross/cross-account-creation-auto",children:"Stacksets"}),", then add the roles to the Cado platform using ",(0,t.jsx)(o.a,{href:"/cado/deploy/cross/aws-organizations",children:"AWS Organizations"}),"."]}),"\n",(0,t.jsx)(o.h2,{id:"overview",children:"Overview"}),"\n",(0,t.jsx)(o.p,{children:"The process below outlines how to grant the Cado platform access to a target AWS account (other than the one where Cado is deployed). This process can be repeated for every AWS account you want to provide access to."}),"\n",(0,t.jsx)(o.p,{children:"There are two main steps to set up cross-account acquisitions:"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Create a Cross-Account IAM Policy and Role"})," in the target AWS account from which the Cado platform will acquire data. This allows Cado to assume the cross-account role for data acquisition."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Add the Cross-Account IAM Role ARN"})," to the Cado platform to enable access to that AWS account."]}),"\n"]}),"\n",(0,t.jsxs)(o.p,{children:["This page describes step 1. For step 2, see ",(0,t.jsx)(o.a,{href:"/cado/deploy/cross/add-cross-account-manual",children:"Manually add a cross-account role to Cado"}),"."]}),"\n",(0,t.jsxs)(o.admonition,{type:"info",children:[(0,t.jsx)(o.p,{children:"Throughout this guide:"}),(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["The ",(0,t.jsx)(o.strong,{children:"primary AWS account"})," is where Cado is deployed (referred to as account ",(0,t.jsx)(o.code,{children:"111111111111"}),")."]}),"\n",(0,t.jsxs)(o.li,{children:["The ",(0,t.jsx)(o.strong,{children:"target AWS account"})," is where cross-account access is being set up (referred to as account ",(0,t.jsx)(o.code,{children:"222222222222"}),")."]}),"\n"]})]}),"\n",(0,t.jsx)(o.h2,{id:"step-1-create-an-iam-policy-and-role-in-the-target-aws-account",children:"Step 1: Create an IAM Policy and Role in the Target AWS Account"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.strong,{children:"Create the IAM Policy:"})}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["In the target AWS account (",(0,t.jsx)(o.code,{children:"222222222222"}),"), go to ",(0,t.jsx)(o.strong,{children:"IAM > Policies"})," and click ",(0,t.jsx)(o.strong,{children:"Create Policy"}),"."]}),"\n",(0,t.jsxs)(o.li,{children:["Use the Cado Cross-Account Policy ",(0,t.jsx)(o.a,{href:"https://raw.githubusercontent.com/cado-security/Deployment-Templates/main/cross-account/CrossAccountPolicy.yaml",children:"found here"}),"."]}),"\n",(0,t.jsxs)(o.li,{children:["Give the policy a name, such as ",(0,t.jsx)(o.code,{children:"CadoResponseCrossAccountPolicy"}),", and create the policy."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.strong,{children:"Create the IAM Role:"})}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["Navigate to ",(0,t.jsx)(o.strong,{children:"IAM > Roles"})," and click ",(0,t.jsx)(o.strong,{children:"Create Role"}),"."]}),"\n",(0,t.jsxs)(o.li,{children:["Select ",(0,t.jsx)(o.strong,{children:"Another AWS Account"})," and enter the account ID of your primary AWS account (",(0,t.jsx)(o.code,{children:"111111111111"}),")."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Create Role",src:n(34268).A+"",width:"761",height:"323"})}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:"Attach the policy created in the previous step and proceed to name the role."}),"\n",(0,t.jsxs)(o.li,{children:["The role name ",(0,t.jsx)(o.strong,{children:"must include"})," the text ",(0,t.jsx)(o.code,{children:"CadoResponse"})," (e.g., ",(0,t.jsx)(o.code,{children:"CadoResponseCrossAccountRole"}),"). This is required for cross-account acquisition to function properly."]}),"\n",(0,t.jsxs)(o.li,{children:["The role needs a ",(0,t.jsx)(o.a,{href:"/cado/deploy/aws/iam/iam-description#using-an-existing-iam-role",children:"trust relationship"})," with the Cado role in 111111111111"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(o.p,{children:["Deploying the Cross-Account IAM Policy and Role can be automated using AWS StackSets or other methods. See ",(0,t.jsx)(o.a,{href:"#automating-aws-iam-role-and-policy-deployment",children:"Automating AWS IAM Role and Policy Deployment"}),"."]})]})}function h(e={}){const{wrapper:o}={...(0,c.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},34268:(e,o,n)=>{n.d(o,{A:()=>t});const t=n.p+"assets/images/create-role-fa83b0fb86d9d71fcea59dc0f7103a94.png"},28453:(e,o,n)=>{n.d(o,{R:()=>a,x:()=>r});var t=n(96540);const c={},s=t.createContext(c);function a(e){const o=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:a(e.components),t.createElement(s.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/08de61b6.ba6f9db0.js b/assets/js/08de61b6.d1b9a842.js similarity index 98% rename from assets/js/08de61b6.ba6f9db0.js rename to assets/js/08de61b6.d1b9a842.js index a9ec9f570..18ddf6245 100644 --- a/assets/js/08de61b6.ba6f9db0.js +++ b/assets/js/08de61b6.d1b9a842.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4561],{64691:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>d,contentTitle:()=>c,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>a});var s=i(74848),t=i(28453);const o={title:"Collected artifacts",hide_title:!0,sidebar_position:3},c="What Artifacts Are Collected by Cado Host",r={id:"cado/discovery-import/cado-host/artifacts",title:"Collected artifacts",description:"Cado Host collects a variety of artifacts by default, depending on the operating system. You can configure additional files and folders to be collected by using the --additional_files parameter when running Cado Host. For more details, see the Command Line Parameters documentation.",source:"@site/docs/cado/discovery-import/cado-host/artifacts.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/artifacts",permalink:"/cado/discovery-import/cado-host/artifacts",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/artifacts.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Collected artifacts",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Deploy via API",permalink:"/cado/discovery-import/cado-host/api-deploy"},next:{title:"AWS credentials",permalink:"/cado/discovery-import/cado-host/aws-credentials"}},d={},a=[{value:"Volatile Data",id:"volatile-data",level:3},{value:"Linux and macOS",id:"linux-and-macos",level:3},{value:"Windows",id:"windows",level:3}];function l(e){const n={a:"a",code:"code",em:"em",h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"what-artifacts-are-collected-by-cado-host",children:"What Artifacts Are Collected by Cado Host"}),"\n",(0,s.jsxs)(n.p,{children:["Cado Host collects a variety of artifacts by default, depending on the operating system. You can configure additional files and folders to be collected by using the ",(0,s.jsx)(n.code,{children:"--additional_files"})," parameter when running Cado Host. For more details, see the ",(0,s.jsx)(n.strong,{children:(0,s.jsx)(n.a,{href:"cli",children:"Command Line Parameters"})})," documentation."]}),"\n",(0,s.jsx)(n.h3,{id:"volatile-data",children:"Volatile Data"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following volatile data available at the time of execution:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Information about running processes."}),"\n",(0,s.jsxs)(n.li,{children:["Memory of running processes on a per-process basis ",(0,s.jsxs)(n.em,{children:["(Note: Memory collection on Windows is disabled by default. ",(0,s.jsx)(n.a,{href:"cli",children:"See Command Line Parameters"})," for more details.)"]})]}),"\n",(0,s.jsx)(n.li,{children:"Netstat data of active network connections."}),"\n",(0,s.jsx)(n.li,{children:"Contents of open files, such as running binaries."}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"linux-and-macos",children:"Linux and macOS"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following artifacts on Linux and macOS, when available:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:".bash_history"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:".ssh/known_hosts"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/var/adm/wtmp"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/var/db/application_usage.sqlite"})}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/var/log"}),", ",(0,s.jsx)(n.code,{children:"/private/var/log/"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/etc/passwd"}),", ",(0,s.jsx)(n.code,{children:"/etc/group"}),", ",(0,s.jsx)(n.code,{children:"/etc/hosts"}),", ",(0,s.jsx)(n.code,{children:"/etc/hosts.allow"}),", ",(0,s.jsx)(n.code,{children:"/etc/hosts.deny"}),", ",(0,s.jsx)(n.code,{children:"/etc/httpd/logs/"})]}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/root/.bash_history"})}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/System/Library/LaunchAgents"}),", ",(0,s.jsx)(n.code,{children:"/System/Library/LaunchDaemons"}),", ",(0,s.jsx)(n.code,{children:"/System/Library/StartupItems"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/Library/LaunchAgents"}),", ",(0,s.jsx)(n.code,{children:"/Library/LaunchDaemons"}),", ",(0,s.jsx)(n.code,{children:"/Library/Preferences/SystemConfiguration"}),", ",(0,s.jsx)(n.code,{children:"/Library/Receipts/InstallHistory.plist"}),", ",(0,s.jsx)(n.code,{children:"/Library/StartupItems"})]}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/etc/rc.d"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/etc/utmp"})}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/var/run/utmp"}),", ",(0,s.jsx)(n.code,{children:"/var/run/wtmp"})]}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"windows",children:"Windows"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following artifacts on Windows, when available:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Information about running processes and active network connections."}),"\n",(0,s.jsxs)(n.li,{children:["File system artifacts including ",(0,s.jsx)(n.code,{children:"$MFT"}),", ",(0,s.jsx)(n.code,{children:"NTUSER.DAT"}),", and their associated log files."]}),"\n",(0,s.jsx)(n.li,{children:"McAfee and security logs."}),"\n",(0,s.jsx)(n.li,{children:"Web browser history, cache, and cookies from Google Chrome, Mozilla Firefox, Opera, and Microsoft Edge."}),"\n",(0,s.jsxs)(n.li,{children:["PowerShell history (",(0,s.jsx)(n.code,{children:"PSReadline\\ConsoleHost_history.txt"}),")."]}),"\n",(0,s.jsxs)(n.li,{children:["Application cache, prefetch data, event logs (",(0,s.jsx)(n.code,{children:"AppEvent.evt"}),", ",(0,s.jsx)(n.code,{children:"SecEvent.evt"}),", ",(0,s.jsx)(n.code,{children:"SysEvent.evt"}),")."]}),"\n",(0,s.jsxs)(n.li,{children:["Task scheduler information (",(0,s.jsx)(n.code,{children:"SYSTEMROOT\\Tasks"}),")."]}),"\n",(0,s.jsxs)(n.li,{children:["Internet Information Services (IIS) logs (",(0,s.jsx)(n.code,{children:"inetpub\\logs\\LogFiles"}),")."]}),"\n",(0,s.jsxs)(n.li,{children:["Windows system configuration files (",(0,s.jsx)(n.code,{children:"hosts"}),", ",(0,s.jsx)(n.code,{children:"SAM"}),", ",(0,s.jsx)(n.code,{children:"SECURITY"}),", ",(0,s.jsx)(n.code,{children:"SOFTWARE"}),", ",(0,s.jsx)(n.code,{children:"SYSTEM"})," logs)."]}),"\n",(0,s.jsx)(n.li,{children:"Windows startup programs and file history."}),"\n",(0,s.jsx)(n.li,{children:"System activity logs and setup logs."}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"These artifacts provide valuable forensic data for incident response and investigations."}),"\n",(0,s.jsxs)(n.p,{children:["For more details on the configuration and collection options, refer to the ",(0,s.jsx)(n.strong,{children:(0,s.jsx)(n.a,{href:"cli",children:"Command Line Parameters"})})," documentation."]})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},28453:(e,n,i)=>{i.d(n,{R:()=>c,x:()=>r});var s=i(96540);const t={},o=s.createContext(t);function c(e){const n=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:c(e.components),s.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4561],{64691:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>d,contentTitle:()=>c,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>a});var s=i(74848),t=i(28453);const o={title:"Collected artifacts",hide_title:!0,sidebar_position:3},c="What Artifacts Are Collected by Cado Host",r={id:"cado/discovery-import/cado-host/artifacts",title:"Collected artifacts",description:"Cado Host collects a variety of artifacts by default, depending on the operating system. You can configure additional files and folders to be collected by using the --additional_files parameter when running Cado Host. For more details, see the Command Line Parameters documentation.",source:"@site/docs/cado/discovery-import/cado-host/artifacts.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/artifacts",permalink:"/cado/discovery-import/cado-host/artifacts",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/artifacts.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Collected artifacts",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Deploy via API",permalink:"/cado/discovery-import/cado-host/api-deploy"},next:{title:"AWS credentials",permalink:"/cado/discovery-import/cado-host/aws-credentials"}},d={},a=[{value:"Volatile Data",id:"volatile-data",level:3},{value:"Linux and macOS",id:"linux-and-macos",level:3},{value:"Windows",id:"windows",level:3}];function l(e){const n={a:"a",code:"code",em:"em",h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"what-artifacts-are-collected-by-cado-host",children:"What Artifacts Are Collected by Cado Host"}),"\n",(0,s.jsxs)(n.p,{children:["Cado Host collects a variety of artifacts by default, depending on the operating system. You can configure additional files and folders to be collected by using the ",(0,s.jsx)(n.code,{children:"--additional_files"})," parameter when running Cado Host. For more details, see the ",(0,s.jsx)(n.strong,{children:(0,s.jsx)(n.a,{href:"cli",children:"Command Line Parameters"})})," documentation."]}),"\n",(0,s.jsx)(n.h3,{id:"volatile-data",children:"Volatile Data"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following volatile data available at the time of execution:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Information about running processes."}),"\n",(0,s.jsxs)(n.li,{children:["Memory of running processes on a per-process basis ",(0,s.jsxs)(n.em,{children:["(Note: Memory collection on Windows is disabled by default. ",(0,s.jsx)(n.a,{href:"cli",children:"See Command Line Parameters"})," for more details.)"]})]}),"\n",(0,s.jsx)(n.li,{children:"Netstat data of active network connections."}),"\n",(0,s.jsx)(n.li,{children:"Contents of open files, such as running binaries."}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"linux-and-macos",children:"Linux and macOS"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following artifacts on Linux and macOS, when available:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:".bash_history"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:".ssh/known_hosts"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/var/adm/wtmp"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/var/db/application_usage.sqlite"})}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/var/log"}),", ",(0,s.jsx)(n.code,{children:"/private/var/log/"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/etc/passwd"}),", ",(0,s.jsx)(n.code,{children:"/etc/group"}),", ",(0,s.jsx)(n.code,{children:"/etc/hosts"}),", ",(0,s.jsx)(n.code,{children:"/etc/hosts.allow"}),", ",(0,s.jsx)(n.code,{children:"/etc/hosts.deny"}),", ",(0,s.jsx)(n.code,{children:"/etc/httpd/logs/"})]}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/root/.bash_history"})}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/System/Library/LaunchAgents"}),", ",(0,s.jsx)(n.code,{children:"/System/Library/LaunchDaemons"}),", ",(0,s.jsx)(n.code,{children:"/System/Library/StartupItems"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/Library/LaunchAgents"}),", ",(0,s.jsx)(n.code,{children:"/Library/LaunchDaemons"}),", ",(0,s.jsx)(n.code,{children:"/Library/Preferences/SystemConfiguration"}),", ",(0,s.jsx)(n.code,{children:"/Library/Receipts/InstallHistory.plist"}),", ",(0,s.jsx)(n.code,{children:"/Library/StartupItems"})]}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/etc/rc.d"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/etc/utmp"})}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"/var/run/utmp"}),", ",(0,s.jsx)(n.code,{children:"/var/run/wtmp"})]}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"windows",children:"Windows"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following artifacts on Windows, when available:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Information about running processes and active network connections."}),"\n",(0,s.jsxs)(n.li,{children:["File system artifacts including ",(0,s.jsx)(n.code,{children:"$MFT"}),", ",(0,s.jsx)(n.code,{children:"NTUSER.DAT"}),", and their associated log files."]}),"\n",(0,s.jsx)(n.li,{children:"McAfee and security logs."}),"\n",(0,s.jsx)(n.li,{children:"Web browser history, cache, and cookies from Google Chrome, Mozilla Firefox, Opera, and Microsoft Edge."}),"\n",(0,s.jsxs)(n.li,{children:["PowerShell history (",(0,s.jsx)(n.code,{children:"PSReadline\\ConsoleHost_history.txt"}),")."]}),"\n",(0,s.jsxs)(n.li,{children:["Application cache, prefetch data, event logs (",(0,s.jsx)(n.code,{children:"AppEvent.evt"}),", ",(0,s.jsx)(n.code,{children:"SecEvent.evt"}),", ",(0,s.jsx)(n.code,{children:"SysEvent.evt"}),")."]}),"\n",(0,s.jsxs)(n.li,{children:["Task scheduler information (",(0,s.jsx)(n.code,{children:"SYSTEMROOT\\Tasks"}),")."]}),"\n",(0,s.jsxs)(n.li,{children:["Internet Information Services (IIS) logs (",(0,s.jsx)(n.code,{children:"inetpub\\logs\\LogFiles"}),")."]}),"\n",(0,s.jsxs)(n.li,{children:["Windows system configuration files (",(0,s.jsx)(n.code,{children:"hosts"}),", ",(0,s.jsx)(n.code,{children:"SAM"}),", ",(0,s.jsx)(n.code,{children:"SECURITY"}),", ",(0,s.jsx)(n.code,{children:"SOFTWARE"}),", ",(0,s.jsx)(n.code,{children:"SYSTEM"})," logs)."]}),"\n",(0,s.jsx)(n.li,{children:"Windows startup programs and file history."}),"\n",(0,s.jsx)(n.li,{children:"System activity logs and setup logs."}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"These artifacts provide valuable forensic data for incident response and investigations."}),"\n",(0,s.jsxs)(n.p,{children:["For more details on the configuration and collection options, refer to the ",(0,s.jsx)(n.strong,{children:(0,s.jsx)(n.a,{href:"cli",children:"Command Line Parameters"})})," documentation."]})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},28453:(e,n,i)=>{i.d(n,{R:()=>c,x:()=>r});var s=i(96540);const t={},o=s.createContext(t);function c(e){const n=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:c(e.components),s.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0be23a04.b3c46266.js b/assets/js/0be23a04.0e40d961.js similarity index 97% rename from assets/js/0be23a04.b3c46266.js rename to assets/js/0be23a04.0e40d961.js index eb5d1bf9c..d77580e1f 100644 --- a/assets/js/0be23a04.b3c46266.js +++ b/assets/js/0be23a04.0e40d961.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1880],{78197:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>r,contentTitle:()=>d,default:()=>h,frontMatter:()=>a,metadata:()=>i,toc:()=>c});var n=s(74848),o=s(28453);const a={title:"Endpoint access",hide_title:!0,sidebar_position:3},d="What AWS endpoints does the Cado platform require access to?",i={id:"cado/deploy/aws/networking/endpoints",title:"Endpoint access",description:"The Cado platform requires access to the following AWS API endpoints, including regional addresses for regions that are accessed (e.g. us-east-2.ec2.amazonaws.com). If the VPC, in which Cado is deployed, will not be able to access these endpoints over the public internet, then a VPC Endpoint may be required.",source:"@site/docs/cado/deploy/aws/networking/endpoints.md",sourceDirName:"cado/deploy/aws/networking",slug:"/cado/deploy/aws/networking/endpoints",permalink:"/cado/deploy/aws/networking/endpoints",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/networking/endpoints.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Endpoint access",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Remove internet routable addresses",permalink:"/cado/deploy/aws/networking/internet-routable-addresses"},next:{title:"Logging best practices",permalink:"/cado/deploy/aws/security/logging"}},r={},c=[{value:"Cado Update Definitions",id:"cado-update-definitions",level:2}];function l(e){const t={a:"a",em:"em",h1:"h1",h2:"h2",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,o.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-aws-endpoints-does-the-cado-platform-require-access-to",children:"What AWS endpoints does the Cado platform require access to?"}),"\n",(0,n.jsxs)(t.p,{children:["The Cado platform requires access to the following AWS API endpoints, including regional addresses for regions that are accessed (e.g. us-east-2.ec2.amazonaws.com). If the VPC, in which Cado is deployed, will not be able to access these endpoints over the public internet, then a ",(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint-aws",children:"VPC Endpoint"})," may be required."]}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Core Platform"}),(0,n.jsx)(t.th,{children:"KMS encrypted EC2s"}),(0,n.jsx)(t.th,{children:"Memory Forensics"}),(0,n.jsx)(t.th,{children:"Lambda Functions"}),(0,n.jsx)(t.th,{children:"ECS/EKS Containers"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"ec2.amazonaws.com"}),(0,n.jsx)(t.td,{children:"kms.amazonaws.com"}),(0,n.jsx)(t.td,{children:"ssm.amazonaws.com"}),(0,n.jsx)(t.td,{children:"lambda.amazonaws.com"}),(0,n.jsx)(t.td,{children:"ecs.amazonaws.com"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"secretsmanager.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{children:"cloudwatch.amazonaws.com"}),(0,n.jsx)(t.td,{children:"ecs-tasks.amazonaws.com"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"s3.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{children:"eks.amazonaws.com"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"sts.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"iam.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"cloudtrail.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{})]})]})]}),"\n",(0,n.jsxs)(t.p,{children:["If you have opted to use regional endpoints, you will need to ensure there is access to the regional endpoints for any regions you use. For example ec2.",(0,n.jsx)(t.em,{children:"us-east-1"}),".amazonaws.com to access the EC2 service in us-east-1."]}),"\n",(0,n.jsx)(t.h2,{id:"cado-update-definitions",children:"Cado Update Definitions"}),"\n",(0,n.jsx)(t.p,{children:"Cado requires access to cado-public.s3.amazonaws.com in order to perform a GET (read only) request to confirm the latest version that is available."})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>d,x:()=>i});var n=s(96540);const o={},a=n.createContext(o);function d(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:d(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1880],{78197:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>r,contentTitle:()=>d,default:()=>h,frontMatter:()=>a,metadata:()=>i,toc:()=>c});var n=s(74848),o=s(28453);const a={title:"Endpoint access",hide_title:!0,sidebar_position:3},d="What AWS endpoints does the Cado platform require access to?",i={id:"cado/deploy/aws/networking/endpoints",title:"Endpoint access",description:"The Cado platform requires access to the following AWS API endpoints, including regional addresses for regions that are accessed (e.g. us-east-2.ec2.amazonaws.com). If the VPC, in which Cado is deployed, will not be able to access these endpoints over the public internet, then a VPC Endpoint may be required.",source:"@site/docs/cado/deploy/aws/networking/endpoints.md",sourceDirName:"cado/deploy/aws/networking",slug:"/cado/deploy/aws/networking/endpoints",permalink:"/cado/deploy/aws/networking/endpoints",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/networking/endpoints.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Endpoint access",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Remove internet routable addresses",permalink:"/cado/deploy/aws/networking/internet-routable-addresses"},next:{title:"Logging best practices",permalink:"/cado/deploy/aws/security/logging"}},r={},c=[{value:"Cado Update Definitions",id:"cado-update-definitions",level:2}];function l(e){const t={a:"a",em:"em",h1:"h1",h2:"h2",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,o.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-aws-endpoints-does-the-cado-platform-require-access-to",children:"What AWS endpoints does the Cado platform require access to?"}),"\n",(0,n.jsxs)(t.p,{children:["The Cado platform requires access to the following AWS API endpoints, including regional addresses for regions that are accessed (e.g. us-east-2.ec2.amazonaws.com). If the VPC, in which Cado is deployed, will not be able to access these endpoints over the public internet, then a ",(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint-aws",children:"VPC Endpoint"})," may be required."]}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Core Platform"}),(0,n.jsx)(t.th,{children:"KMS encrypted EC2s"}),(0,n.jsx)(t.th,{children:"Memory Forensics"}),(0,n.jsx)(t.th,{children:"Lambda Functions"}),(0,n.jsx)(t.th,{children:"ECS/EKS Containers"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"ec2.amazonaws.com"}),(0,n.jsx)(t.td,{children:"kms.amazonaws.com"}),(0,n.jsx)(t.td,{children:"ssm.amazonaws.com"}),(0,n.jsx)(t.td,{children:"lambda.amazonaws.com"}),(0,n.jsx)(t.td,{children:"ecs.amazonaws.com"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"secretsmanager.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{children:"cloudwatch.amazonaws.com"}),(0,n.jsx)(t.td,{children:"ecs-tasks.amazonaws.com"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"s3.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{children:"eks.amazonaws.com"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"sts.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"iam.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"cloudtrail.amazonaws.com"}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{}),(0,n.jsx)(t.td,{})]})]})]}),"\n",(0,n.jsxs)(t.p,{children:["If you have opted to use regional endpoints, you will need to ensure there is access to the regional endpoints for any regions you use. For example ec2.",(0,n.jsx)(t.em,{children:"us-east-1"}),".amazonaws.com to access the EC2 service in us-east-1."]}),"\n",(0,n.jsx)(t.h2,{id:"cado-update-definitions",children:"Cado Update Definitions"}),"\n",(0,n.jsx)(t.p,{children:"Cado requires access to cado-public.s3.amazonaws.com in order to perform a GET (read only) request to confirm the latest version that is available."})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>d,x:()=>i});var n=s(96540);const o={},a=n.createContext(o);function d(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:d(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0c10e8c1.df593164.js b/assets/js/0c10e8c1.252db136.js similarity index 98% rename from assets/js/0c10e8c1.df593164.js rename to assets/js/0c10e8c1.252db136.js index fe332051a..7286ba3f9 100644 --- a/assets/js/0c10e8c1.df593164.js +++ b/assets/js/0c10e8c1.252db136.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[280],{90620:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>u,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var s=n(74848),i=n(28453);const o={title:"Bucket",hide_title:!0,sidebar_position:4},r="Bucket",c={id:"cado/deploy/aws/aws-bucket",title:"Bucket",description:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions.",source:"@site/docs/cado/deploy/aws/aws-bucket.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/aws-bucket",permalink:"/cado/deploy/aws/aws-bucket",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/aws-bucket.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Bucket",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Supported regions and GovCloud",permalink:"/cado/deploy/aws/regions"},next:{title:"NFS",permalink:"/cado/deploy/aws/aws-nfs"}},a={},d=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function l(e){const t={code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"bucket",children:"Bucket"}),"\n",(0,s.jsx)(t.p,{children:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions."}),"\n",(0,s.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"The IAM role used in the initial deployment, and permission to edit it"}),"\n",(0,s.jsx)(t.li,{children:"Permission to create a S3 bucket in the AWS console"}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsx)(t.p,{children:"Create an S3 bucket in your AWS console"}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsx)(t.p,{children:"Add the necessary permissions by adding the following to your IAM role:"}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-json",children:'{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Sid": "RequiredForCadoHostAndPreservation",\n "Effect": "Allow",\n "Action": [\n "s3:PutObject",\n "s3:GetObject",\n "s3:RestoreObject",\n "s3:PutObjectTagging",\n "s3:GetObjectTagging"\n ],\n "Resource": "arn:aws:s3:::MY_CADO_BUCKET/*" // Replace MY_CADO_BUCKET with your bucket name and delete this comment\n },\n {\n "Sid": "RequiredForCadoHostAndPreservation2",\n "Effect": "Allow",\n "Action": [\n "s3:ListAllMyBuckets",\n "s3:ListBucket",\n "s3:GetBucketLocation"\n ],\n "Resource": "arn:aws:s3:::MY_CADO_BUCKET" // Replace MY_CADO_BUCKET with your bucket name and delete this comment\n }\n ]\n}\n\n'})}),"\n",(0,s.jsxs)(t.ol,{start:"3",children:["\n",(0,s.jsx)(t.li,{children:"Enter the bucket name in the Setup Wizard - if the configured permissions are insufficient you will be notified and asked to correct before logging into the platform."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"AWS Bucket",src:n(96127).A+"",width:"512",height:"265"})})]})}function u(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},96127:(e,t,n)=>{n.d(t,{A:()=>s});const s=n.p+"assets/images/aws-bucket-3728fdcefa1ecd5e841f497d8a44211f.png"},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>c});var s=n(96540);const i={},o=s.createContext(i);function r(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[280],{90620:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>u,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var s=n(74848),i=n(28453);const o={title:"Bucket",hide_title:!0,sidebar_position:4},r="Bucket",c={id:"cado/deploy/aws/aws-bucket",title:"Bucket",description:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions.",source:"@site/docs/cado/deploy/aws/aws-bucket.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/aws-bucket",permalink:"/cado/deploy/aws/aws-bucket",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/aws-bucket.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Bucket",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Supported regions and GovCloud",permalink:"/cado/deploy/aws/regions"},next:{title:"NFS",permalink:"/cado/deploy/aws/aws-nfs"}},a={},d=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function l(e){const t={code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"bucket",children:"Bucket"}),"\n",(0,s.jsx)(t.p,{children:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions."}),"\n",(0,s.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"The IAM role used in the initial deployment, and permission to edit it"}),"\n",(0,s.jsx)(t.li,{children:"Permission to create a S3 bucket in the AWS console"}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsx)(t.p,{children:"Create an S3 bucket in your AWS console"}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsx)(t.p,{children:"Add the necessary permissions by adding the following to your IAM role:"}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-json",children:'{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Sid": "RequiredForCadoHostAndPreservation",\n "Effect": "Allow",\n "Action": [\n "s3:PutObject",\n "s3:GetObject",\n "s3:RestoreObject",\n "s3:PutObjectTagging",\n "s3:GetObjectTagging"\n ],\n "Resource": "arn:aws:s3:::MY_CADO_BUCKET/*" // Replace MY_CADO_BUCKET with your bucket name and delete this comment\n },\n {\n "Sid": "RequiredForCadoHostAndPreservation2",\n "Effect": "Allow",\n "Action": [\n "s3:ListAllMyBuckets",\n "s3:ListBucket",\n "s3:GetBucketLocation"\n ],\n "Resource": "arn:aws:s3:::MY_CADO_BUCKET" // Replace MY_CADO_BUCKET with your bucket name and delete this comment\n }\n ]\n}\n\n'})}),"\n",(0,s.jsxs)(t.ol,{start:"3",children:["\n",(0,s.jsx)(t.li,{children:"Enter the bucket name in the Setup Wizard - if the configured permissions are insufficient you will be notified and asked to correct before logging into the platform."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"AWS Bucket",src:n(96127).A+"",width:"512",height:"265"})})]})}function u(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},96127:(e,t,n)=>{n.d(t,{A:()=>s});const s=n.p+"assets/images/aws-bucket-3728fdcefa1ecd5e841f497d8a44211f.png"},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>c});var s=n(96540);const i={},o=s.createContext(i);function r(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0c245acb.5488c4d6.js b/assets/js/0c245acb.03af70c0.js similarity index 96% rename from assets/js/0c245acb.5488c4d6.js rename to assets/js/0c245acb.03af70c0.js index b6391d265..5ef754a85 100644 --- a/assets/js/0c245acb.5488c4d6.js +++ b/assets/js/0c245acb.03af70c0.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9159],{72558:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>u});var r=o(74848),s=o(28453);const i={title:"Azure Compute",hide_title:!0,sidebar_position:1},n="How to Import Azure Compute Instances",a={id:"cado/discovery-import/azure/azure-compute",title:"Azure Compute",description:"The Cado platform allows you to acquire Azure Compute instances for investigation. Follow these steps:",source:"@site/docs/cado/discovery-import/azure/azure-compute.md",sourceDirName:"cado/discovery-import/azure",slug:"/cado/discovery-import/azure/azure-compute",permalink:"/cado/discovery-import/azure/azure-compute",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/azure/azure-compute.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Azure Compute",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"EBS Direct Acquisition",permalink:"/cado/discovery-import/aws/ebs-direct-acquisition"},next:{title:"Azure Storage",permalink:"/cado/discovery-import/azure/azure-storage"}},c={},u=[];function l(e){const t={br:"br",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"how-to-import-azure-compute-instances",children:"How to Import Azure Compute Instances"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform allows you to acquire Azure Compute instances for investigation. Follow these steps:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Select an Azure Subscription"}),(0,r.jsx)(t.br,{}),"\n","This will populate a list of available compute instances associated with that subscription."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Choose the Instance"}),(0,r.jsx)(t.br,{}),"\n","Select the instance you want to import, review the details, and confirm the selection."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Start the Import"}),(0,r.jsx)(t.br,{}),"\n","Click on ",(0,r.jsx)(t.strong,{children:"Start Import"})," to begin the acquisition process."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Azure Compute Import",src:o(9176).A+"",width:"1806",height:"736"})}),"\n",(0,r.jsx)(t.p,{children:"Once the import is initiated, the platform will automatically collect and process the necessary data for further analysis."})]})}function p(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},9176:(e,t,o)=>{o.d(t,{A:()=>r});const r=o.p+"assets/images/azure-compute-dbab6f7874ca8382faabce3b07327841.png"},28453:(e,t,o)=>{o.d(t,{R:()=>n,x:()=>a});var r=o(96540);const s={},i=r.createContext(s);function n(e){const t=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9159],{72558:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>u});var r=o(74848),s=o(28453);const i={title:"Azure Compute",hide_title:!0,sidebar_position:1},n="How to Import Azure Compute Instances",a={id:"cado/discovery-import/azure/azure-compute",title:"Azure Compute",description:"The Cado platform allows you to acquire Azure Compute instances for investigation. Follow these steps:",source:"@site/docs/cado/discovery-import/azure/azure-compute.md",sourceDirName:"cado/discovery-import/azure",slug:"/cado/discovery-import/azure/azure-compute",permalink:"/cado/discovery-import/azure/azure-compute",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/azure/azure-compute.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Azure Compute",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"EBS Direct Acquisition",permalink:"/cado/discovery-import/aws/ebs-direct-acquisition"},next:{title:"Azure Storage",permalink:"/cado/discovery-import/azure/azure-storage"}},c={},u=[];function l(e){const t={br:"br",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"how-to-import-azure-compute-instances",children:"How to Import Azure Compute Instances"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform allows you to acquire Azure Compute instances for investigation. Follow these steps:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Select an Azure Subscription"}),(0,r.jsx)(t.br,{}),"\n","This will populate a list of available compute instances associated with that subscription."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Choose the Instance"}),(0,r.jsx)(t.br,{}),"\n","Select the instance you want to import, review the details, and confirm the selection."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Start the Import"}),(0,r.jsx)(t.br,{}),"\n","Click on ",(0,r.jsx)(t.strong,{children:"Start Import"})," to begin the acquisition process."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Azure Compute Import",src:o(9176).A+"",width:"1806",height:"736"})}),"\n",(0,r.jsx)(t.p,{children:"Once the import is initiated, the platform will automatically collect and process the necessary data for further analysis."})]})}function p(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},9176:(e,t,o)=>{o.d(t,{A:()=>r});const r=o.p+"assets/images/azure-compute-dbab6f7874ca8382faabce3b07327841.png"},28453:(e,t,o)=>{o.d(t,{R:()=>n,x:()=>a});var r=o(96540);const s={},i=r.createContext(s);function n(e){const t=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0c833961.c010e3c0.js b/assets/js/0c833961.9b346322.js similarity index 99% rename from assets/js/0c833961.c010e3c0.js rename to assets/js/0c833961.9b346322.js index 6c2c69228..54f60ebe1 100644 --- a/assets/js/0c833961.c010e3c0.js +++ b/assets/js/0c833961.9b346322.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4228],{8145:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>p,frontMatter:()=>s,metadata:()=>c,toc:()=>l});var n=o(74848),i=o(28453);const s={title:"Automated Setup of GCP for data collection",hide_title:!0,sidebar_position:3},r="How to automatically set up GCP for data collection",c={id:"cado/deploy/gcp/gcp-auto-setup",title:"Automated Setup of GCP for data collection",description:"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts.",source:"@site/docs/cado/deploy/gcp/gcp-auto-setup.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-auto-setup",permalink:"/cado/deploy/gcp/gcp-auto-setup",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-auto-setup.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Automated Setup of GCP for data collection",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Endpoint access",permalink:"/cado/deploy/gcp/endpoints"},next:{title:"Platform Encryption in GCP",permalink:"/cado/deploy/gcp/data-encryption-overview"}},a={},l=[{value:"Uploading and Running the Scripts",id:"uploading-and-running-the-scripts",level:3},{value:"Scripts",id:"scripts",level:2},{value:"Role Creation",id:"role-creation",level:3},{value:"Service Account Creation",id:"service-account-creation",level:3},{value:"Workload Identity Federation",id:"workload-identity-federation",level:3},{value:"Cross-project Access",id:"cross-project-access",level:3}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",hr:"hr",p:"p",pre:"pre",strong:"strong",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-automatically-set-up-gcp-for-data-collection",children:"How to automatically set up GCP for data collection"}),"\n",(0,n.jsx)(t.p,{children:"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts."}),"\n",(0,n.jsx)(t.admonition,{type:"note",children:(0,n.jsx)(t.p,{children:"The actions in these scripts can take a few minutes to take effect, as such, it's best not to run them in quick succession."})}),"\n",(0,n.jsx)(t.h3,{id:"uploading-and-running-the-scripts",children:"Uploading and Running the Scripts"}),"\n",(0,n.jsx)(t.p,{children:"To make use of these scripts, it's best to upload them using the gcloud terminal. To do this, navigate to the GCP console and click the 'Activate Cloud Shell' button in the top-right corner."}),"\n",(0,n.jsxs)(t.p,{children:["The scripts can be found in our ",(0,n.jsx)(t.strong,{children:"Cado GCP Scripts github"}),":\n",(0,n.jsx)(t.a,{href:"https://github.com/cado-security/gcp-setup",children:"https://github.com/cado-security/gcp-setup"})]}),"\n",(0,n.jsx)("img",{src:"/img/gcp-shell.png",alt:"Cloud Shell",width:"350"}),"\n",(0,n.jsx)(t.p,{children:"Once they've been uploaded to your user area in the gcloud terminal, you can run them with bash."}),"\n",(0,n.jsx)("img",{src:"/img/gcp-scripts.png",alt:"Cloud Shell",width:"800"}),"\n",(0,n.jsx)(t.h2,{id:"scripts",children:"Scripts"}),"\n",(0,n.jsx)(t.h3,{id:"role-creation",children:"Role Creation"}),"\n",(0,n.jsxs)(t.p,{children:["The first script in the series '",(0,n.jsx)(t.strong,{children:"gcp_setup_1_role.sh"}),"' will create a 'CadoGCPRole' role within the active project with scoped permissions for Cado to operate. If you want to create the role at the organization level for use across multiple projects, add the organization ID as a parameter.\nWhen the script finishes you should see the role ID printed, we will use this role ID in other scripts so it's best to save it somewhere."]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_1_role.sh \nSave this role ID to be used in the next script: organizations/0123456789/roles/CadoGCPRole\n"})}),"\n",(0,n.jsx)(t.hr,{}),"\n",(0,n.jsx)(t.h3,{id:"service-account-creation",children:"Service Account Creation"}),"\n",(0,n.jsxs)(t.p,{children:["The second script '",(0,n.jsx)(t.strong,{children:"gcp_setup_2_service_account.sh"}),"' will create a 'CadoServiceAccount' service account within the active project, using the CadoGCPRole role's permissions. You need to specify the role ID from the previous script as a parameter when executing."]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_2_service_account.sh \n"})}),"\n",(0,n.jsx)(t.hr,{}),"\n",(0,n.jsx)(t.h3,{id:"workload-identity-federation",children:"Workload Identity Federation"}),"\n",(0,n.jsxs)(t.p,{children:["The third script '",(0,n.jsx)(t.strong,{children:"gcp_setup_3_WIF.sh"}),"' will create a 'cado-aws-pool' workload identity pool with a 'Cado-AWS-Provider' identity provider and will also connect the previously created 'CadoServiceAccount' service account. This script needs the AWS account ID you will be authenticating with passed as a parameter. Once executing finishes, you can navigate to the 'Connected Service Accounts' tab in the pool and download the credentials ready to use in the platform."]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_3_WIF.sh \n"})}),"\n",(0,n.jsx)(t.hr,{}),"\n",(0,n.jsx)(t.h3,{id:"cross-project-access",children:"Cross-project Access"}),"\n",(0,n.jsxs)(t.p,{children:["The last script '",(0,n.jsx)(t.strong,{children:"gcp_setup_4_cross_project.sh"}),"' is optional and will setup a target project ready for acquisition using the original 'CadoServiceAccount', meaning you won't need separate credentials to access assets in the target project. This script will only work if the original 'CadoGCPRole' was created at the organization level and will need that role ID along with the target project's ID passed as parameters."]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_4_cross_project.sh \n"})})]})}function p(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>c});var n=o(96540);const i={},s=n.createContext(i);function r(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4228],{8145:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>p,frontMatter:()=>s,metadata:()=>c,toc:()=>l});var n=o(74848),i=o(28453);const s={title:"Automated Setup of GCP for data collection",hide_title:!0,sidebar_position:3},r="How to automatically set up GCP for data collection",c={id:"cado/deploy/gcp/gcp-auto-setup",title:"Automated Setup of GCP for data collection",description:"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts.",source:"@site/docs/cado/deploy/gcp/gcp-auto-setup.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-auto-setup",permalink:"/cado/deploy/gcp/gcp-auto-setup",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-auto-setup.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Automated Setup of GCP for data collection",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Endpoint access",permalink:"/cado/deploy/gcp/endpoints"},next:{title:"Platform Encryption in GCP",permalink:"/cado/deploy/gcp/data-encryption-overview"}},a={},l=[{value:"Uploading and Running the Scripts",id:"uploading-and-running-the-scripts",level:3},{value:"Scripts",id:"scripts",level:2},{value:"Role Creation",id:"role-creation",level:3},{value:"Service Account Creation",id:"service-account-creation",level:3},{value:"Workload Identity Federation",id:"workload-identity-federation",level:3},{value:"Cross-project Access",id:"cross-project-access",level:3}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",hr:"hr",p:"p",pre:"pre",strong:"strong",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-automatically-set-up-gcp-for-data-collection",children:"How to automatically set up GCP for data collection"}),"\n",(0,n.jsx)(t.p,{children:"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts."}),"\n",(0,n.jsx)(t.admonition,{type:"note",children:(0,n.jsx)(t.p,{children:"The actions in these scripts can take a few minutes to take effect, as such, it's best not to run them in quick succession."})}),"\n",(0,n.jsx)(t.h3,{id:"uploading-and-running-the-scripts",children:"Uploading and Running the Scripts"}),"\n",(0,n.jsx)(t.p,{children:"To make use of these scripts, it's best to upload them using the gcloud terminal. To do this, navigate to the GCP console and click the 'Activate Cloud Shell' button in the top-right corner."}),"\n",(0,n.jsxs)(t.p,{children:["The scripts can be found in our ",(0,n.jsx)(t.strong,{children:"Cado GCP Scripts github"}),":\n",(0,n.jsx)(t.a,{href:"https://github.com/cado-security/gcp-setup",children:"https://github.com/cado-security/gcp-setup"})]}),"\n",(0,n.jsx)("img",{src:"/img/gcp-shell.png",alt:"Cloud Shell",width:"350"}),"\n",(0,n.jsx)(t.p,{children:"Once they've been uploaded to your user area in the gcloud terminal, you can run them with bash."}),"\n",(0,n.jsx)("img",{src:"/img/gcp-scripts.png",alt:"Cloud Shell",width:"800"}),"\n",(0,n.jsx)(t.h2,{id:"scripts",children:"Scripts"}),"\n",(0,n.jsx)(t.h3,{id:"role-creation",children:"Role Creation"}),"\n",(0,n.jsxs)(t.p,{children:["The first script in the series '",(0,n.jsx)(t.strong,{children:"gcp_setup_1_role.sh"}),"' will create a 'CadoGCPRole' role within the active project with scoped permissions for Cado to operate. If you want to create the role at the organization level for use across multiple projects, add the organization ID as a parameter.\nWhen the script finishes you should see the role ID printed, we will use this role ID in other scripts so it's best to save it somewhere."]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_1_role.sh \nSave this role ID to be used in the next script: organizations/0123456789/roles/CadoGCPRole\n"})}),"\n",(0,n.jsx)(t.hr,{}),"\n",(0,n.jsx)(t.h3,{id:"service-account-creation",children:"Service Account Creation"}),"\n",(0,n.jsxs)(t.p,{children:["The second script '",(0,n.jsx)(t.strong,{children:"gcp_setup_2_service_account.sh"}),"' will create a 'CadoServiceAccount' service account within the active project, using the CadoGCPRole role's permissions. You need to specify the role ID from the previous script as a parameter when executing."]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_2_service_account.sh \n"})}),"\n",(0,n.jsx)(t.hr,{}),"\n",(0,n.jsx)(t.h3,{id:"workload-identity-federation",children:"Workload Identity Federation"}),"\n",(0,n.jsxs)(t.p,{children:["The third script '",(0,n.jsx)(t.strong,{children:"gcp_setup_3_WIF.sh"}),"' will create a 'cado-aws-pool' workload identity pool with a 'Cado-AWS-Provider' identity provider and will also connect the previously created 'CadoServiceAccount' service account. This script needs the AWS account ID you will be authenticating with passed as a parameter. Once executing finishes, you can navigate to the 'Connected Service Accounts' tab in the pool and download the credentials ready to use in the platform."]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_3_WIF.sh \n"})}),"\n",(0,n.jsx)(t.hr,{}),"\n",(0,n.jsx)(t.h3,{id:"cross-project-access",children:"Cross-project Access"}),"\n",(0,n.jsxs)(t.p,{children:["The last script '",(0,n.jsx)(t.strong,{children:"gcp_setup_4_cross_project.sh"}),"' is optional and will setup a target project ready for acquisition using the original 'CadoServiceAccount', meaning you won't need separate credentials to access assets in the target project. This script will only work if the original 'CadoGCPRole' was created at the organization level and will need that role ID along with the target project's ID passed as parameters."]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_4_cross_project.sh \n"})})]})}function p(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>c});var n=o(96540);const i={},s=n.createContext(i);function r(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0e87acb0.01a562cb.js b/assets/js/0e87acb0.9d4d04f4.js similarity index 98% rename from assets/js/0e87acb0.01a562cb.js rename to assets/js/0e87acb0.9d4d04f4.js index 985375b43..1f629e570 100644 --- a/assets/js/0e87acb0.01a562cb.js +++ b/assets/js/0e87acb0.9d4d04f4.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8275],{62008:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>s,metadata:()=>d,toc:()=>l});var i=n(74848),r=n(28453);const s={title:"Microsoft Defender XDR",hide_title:!0,sidebar_position:4},o="How to Integrate with Microsoft Defender XDR",d={id:"cado/integrations/xdr/defender",title:"Microsoft Defender XDR",description:"Integrating with Microsoft Defender XDR allows you to initiate triage acquisition on hosts with the Defender agent installed using Live Response.",source:"@site/docs/cado/integrations/xdr/defender.md",sourceDirName:"cado/integrations/xdr",slug:"/cado/integrations/xdr/defender",permalink:"/cado/integrations/xdr/defender",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/xdr/defender.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Microsoft Defender XDR",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"CrowdStrike",permalink:"/cado/integrations/xdr/crowdstrike"},next:{title:"Tanium",permalink:"/cado/integrations/xdr/tanium"}},a={},l=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Enabling the Integration in the Cado Platform",id:"enabling-the-integration-in-the-cado-platform",level:2},{value:"Limitations",id:"limitations",level:2}];function c(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-integrate-with-microsoft-defender-xdr",children:"How to Integrate with Microsoft Defender XDR"}),"\n",(0,i.jsx)(t.p,{children:"Integrating with Microsoft Defender XDR allows you to initiate triage acquisition on hosts with the Defender agent installed using Live Response."}),"\n",(0,i.jsxs)(t.p,{children:["Once initiated, Live Response will locate the endpoint running the Defender agent and execute a ",(0,i.jsx)(t.a,{href:"/cado/discovery-import/cado-host/intro",children:"Cado Host"})," command to collect the triage package and upload it to Cado for processing."]}),"\n",(0,i.jsx)(t.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Ensure you have a ",(0,i.jsx)(t.strong,{children:"Microsoft Defender for Endpoint Plan 2"})," license."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["In the Defender Portal, enable the following settings by navigating to ",(0,i.jsx)(t.strong,{children:"Settings > Endpoints > Advanced Features"}),":"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Defender Live Response Settings",src:n(4958).A+"",width:"2132",height:"474"})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Create an ",(0,i.jsx)(t.strong,{children:"App Registration"})," with the required API permissions for Defender XDR. Refer to ",(0,i.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp",children:"Microsoft documentation"})," for guidance on creating the App Registration in your Azure portal."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"The following API permissions are required for Cado integration:"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Permission"}),(0,i.jsx)(t.th,{children:"Reason"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Admin Consent Required"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Library.Manage"}),(0,i.jsx)(t.td,{children:"Allows Cado to upload Cado Host scripts to the Live Response library for credential refresh"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Machine.LiveResponse"}),(0,i.jsx)(t.td,{children:"Allows Cado to run Cado Host against a machine"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Machine.Read.All"}),(0,i.jsx)(t.td,{children:"Allows Cado to inspect a single machine on Defender and obtain its UUID"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Machine.ReadWrite.All"}),(0,i.jsx)(t.td,{children:"Allows Cado to retrieve a list of all machines on Defender for display in the UI"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Alert.Read.All"}),(0,i.jsx)(t.td,{children:"Allows Cado to monitor alerts from Defender as part of the Detection integration"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Alert.ReadWrite.All"}),(0,i.jsx)(t.td,{children:"Allows Cado to manage alerts from Defender as part of the Detection integration"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"enabling-the-integration-in-the-cado-platform",children:"Enabling the Integration in the Cado Platform"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Settings > Accounts"})," and click ",(0,i.jsx)(t.strong,{children:"Create an account"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Select ",(0,i.jsx)(t.strong,{children:"Defender"})," from the set of providers."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Defender Integration",src:n(21213).A+"",width:"3784",height:"1506"})}),"\n",(0,i.jsxs)(t.ol,{start:"3",children:["\n",(0,i.jsxs)(t.li,{children:["Give the account a ",(0,i.jsx)(t.strong,{children:"Name"})," and enter the ",(0,i.jsx)(t.strong,{children:"Endpoint"}),", ",(0,i.jsx)(t.strong,{children:"Client ID"}),", ",(0,i.jsx)(t.strong,{children:"Client Secret"}),", and ",(0,i.jsx)(t.strong,{children:"Tenant"})," from the App Registration you created. Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'."]}),"\n",(0,i.jsx)(t.li,{children:"Navigate to the 'Accounts' table and the newly created Defender account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,i.jsxs)(t.li,{children:["An alternative way to check the account has been set up correctly is to browse to any investigation, and click ",(0,i.jsx)(t.strong,{children:"Import > XDR > Defender"}),". If configured correctly, a paginated list of hosts with the Defender agent installed will be displayed."]}),"\n"]}),"\n",(0,i.jsx)(t.h2,{id:"limitations",children:"Limitations"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Microsoft Defender limits to 25 concurrent Live Response sessions."}),"\n",(0,i.jsx)(t.li,{children:"Live Response scripts will time out after 10 minutes."}),"\n",(0,i.jsx)(t.li,{children:"Only one Live Response session can be active per endpoint."}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},21213:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/Accounts-Defender-4e7d9dec51b2c229a6d069651f7b6192.png"},4958:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/defender_settings-4cd95e7472c65fc3515fca60d575a228.png"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>d});var i=n(96540);const r={},s=i.createContext(r);function o(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8275],{62008:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>s,metadata:()=>d,toc:()=>l});var i=n(74848),r=n(28453);const s={title:"Microsoft Defender XDR",hide_title:!0,sidebar_position:4},o="How to Integrate with Microsoft Defender XDR",d={id:"cado/integrations/xdr/defender",title:"Microsoft Defender XDR",description:"Integrating with Microsoft Defender XDR allows you to initiate triage acquisition on hosts with the Defender agent installed using Live Response.",source:"@site/docs/cado/integrations/xdr/defender.md",sourceDirName:"cado/integrations/xdr",slug:"/cado/integrations/xdr/defender",permalink:"/cado/integrations/xdr/defender",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/xdr/defender.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Microsoft Defender XDR",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"CrowdStrike",permalink:"/cado/integrations/xdr/crowdstrike"},next:{title:"Tanium",permalink:"/cado/integrations/xdr/tanium"}},a={},l=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Enabling the Integration in the Cado Platform",id:"enabling-the-integration-in-the-cado-platform",level:2},{value:"Limitations",id:"limitations",level:2}];function c(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-integrate-with-microsoft-defender-xdr",children:"How to Integrate with Microsoft Defender XDR"}),"\n",(0,i.jsx)(t.p,{children:"Integrating with Microsoft Defender XDR allows you to initiate triage acquisition on hosts with the Defender agent installed using Live Response."}),"\n",(0,i.jsxs)(t.p,{children:["Once initiated, Live Response will locate the endpoint running the Defender agent and execute a ",(0,i.jsx)(t.a,{href:"/cado/discovery-import/cado-host/intro",children:"Cado Host"})," command to collect the triage package and upload it to Cado for processing."]}),"\n",(0,i.jsx)(t.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Ensure you have a ",(0,i.jsx)(t.strong,{children:"Microsoft Defender for Endpoint Plan 2"})," license."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["In the Defender Portal, enable the following settings by navigating to ",(0,i.jsx)(t.strong,{children:"Settings > Endpoints > Advanced Features"}),":"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Defender Live Response Settings",src:n(4958).A+"",width:"2132",height:"474"})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Create an ",(0,i.jsx)(t.strong,{children:"App Registration"})," with the required API permissions for Defender XDR. Refer to ",(0,i.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp",children:"Microsoft documentation"})," for guidance on creating the App Registration in your Azure portal."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"The following API permissions are required for Cado integration:"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Permission"}),(0,i.jsx)(t.th,{children:"Reason"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Admin Consent Required"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Library.Manage"}),(0,i.jsx)(t.td,{children:"Allows Cado to upload Cado Host scripts to the Live Response library for credential refresh"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Machine.LiveResponse"}),(0,i.jsx)(t.td,{children:"Allows Cado to run Cado Host against a machine"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Machine.Read.All"}),(0,i.jsx)(t.td,{children:"Allows Cado to inspect a single machine on Defender and obtain its UUID"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Machine.ReadWrite.All"}),(0,i.jsx)(t.td,{children:"Allows Cado to retrieve a list of all machines on Defender for display in the UI"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Alert.Read.All"}),(0,i.jsx)(t.td,{children:"Allows Cado to monitor alerts from Defender as part of the Detection integration"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Alert.ReadWrite.All"}),(0,i.jsx)(t.td,{children:"Allows Cado to manage alerts from Defender as part of the Detection integration"}),(0,i.jsx)(t.td,{children:"Application"}),(0,i.jsx)(t.td,{children:"Yes"})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"enabling-the-integration-in-the-cado-platform",children:"Enabling the Integration in the Cado Platform"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Settings > Accounts"})," and click ",(0,i.jsx)(t.strong,{children:"Create an account"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Select ",(0,i.jsx)(t.strong,{children:"Defender"})," from the set of providers."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Defender Integration",src:n(21213).A+"",width:"3784",height:"1506"})}),"\n",(0,i.jsxs)(t.ol,{start:"3",children:["\n",(0,i.jsxs)(t.li,{children:["Give the account a ",(0,i.jsx)(t.strong,{children:"Name"})," and enter the ",(0,i.jsx)(t.strong,{children:"Endpoint"}),", ",(0,i.jsx)(t.strong,{children:"Client ID"}),", ",(0,i.jsx)(t.strong,{children:"Client Secret"}),", and ",(0,i.jsx)(t.strong,{children:"Tenant"})," from the App Registration you created. Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'."]}),"\n",(0,i.jsx)(t.li,{children:"Navigate to the 'Accounts' table and the newly created Defender account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,i.jsxs)(t.li,{children:["An alternative way to check the account has been set up correctly is to browse to any investigation, and click ",(0,i.jsx)(t.strong,{children:"Import > XDR > Defender"}),". If configured correctly, a paginated list of hosts with the Defender agent installed will be displayed."]}),"\n"]}),"\n",(0,i.jsx)(t.h2,{id:"limitations",children:"Limitations"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Microsoft Defender limits to 25 concurrent Live Response sessions."}),"\n",(0,i.jsx)(t.li,{children:"Live Response scripts will time out after 10 minutes."}),"\n",(0,i.jsx)(t.li,{children:"Only one Live Response session can be active per endpoint."}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},21213:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/Accounts-Defender-4e7d9dec51b2c229a6d069651f7b6192.png"},4958:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/defender_settings-4cd95e7472c65fc3515fca60d575a228.png"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>d});var i=n(96540);const r={},s=i.createContext(r);function o(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/138702eb.b83f41cc.js b/assets/js/138702eb.426af6c9.js similarity index 98% rename from assets/js/138702eb.b83f41cc.js rename to assets/js/138702eb.426af6c9.js index a39b2c922..faf06d71f 100644 --- a/assets/js/138702eb.b83f41cc.js +++ b/assets/js/138702eb.426af6c9.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9387],{2857:(o,t,e)=>{e.r(t),e.d(t,{assets:()=>d,contentTitle:()=>n,default:()=>p,frontMatter:()=>s,metadata:()=>c,toc:()=>l});var r=e(74848),i=e(28453);const s={title:"Import from cloud",hide_title:!0,sidebar_position:2},n="How to import data from cloud providers (AWS, Azure, GCP)",c={id:"cado/discovery-import/import-from-cloud",title:"Import from cloud",description:"To import data from cloud providers, follow these steps:",source:"@site/docs/cado/discovery-import/import-from-cloud.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/import-from-cloud",permalink:"/cado/discovery-import/import-from-cloud",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/import-from-cloud.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Import from cloud",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Import data",permalink:"/cado/discovery-import/intro"},next:{title:"Automating collection from detections",permalink:"/cado/discovery-import/automation"}},d={},l=[];function a(o){const t={br:"br",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...o.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"how-to-import-data-from-cloud-providers-aws-azure-gcp",children:"How to import data from cloud providers (AWS, Azure, GCP)"}),"\n",(0,r.jsx)(t.p,{children:"To import data from cloud providers, follow these steps:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Select a Cloud Role"}),(0,r.jsx)(t.br,{}),"\n","Begin by choosing the ",(0,r.jsx)(t.strong,{children:"Cloud Role"})," that you will use for the data import. This role must have the necessary permissions for accessing the data."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Filter or Search"}),(0,r.jsx)(t.br,{}),"\n","You can filter the list of roles by provider (AWS, Azure, GCP) or search for a specific account, subscription, or investigation to narrow down the options."]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Importing from cloud",src:e(18010).A+"",width:"1832",height:"632"})}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Choose Cloud Service"}),(0,r.jsx)(t.br,{}),"\n","After selecting the appropriate role, choose the cloud service (AWS, Azure, or GCP) that contains the data you want to import."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Follow the on-screen prompts to complete the process."})]})}function p(o={}){const{wrapper:t}={...(0,i.R)(),...o.components};return t?(0,r.jsx)(t,{...o,children:(0,r.jsx)(a,{...o})}):a(o)}},18010:(o,t,e)=>{e.d(t,{A:()=>r});const r=e.p+"assets/images/import-cloud-6754420b4e7cc81d73642d1671355124.png"},28453:(o,t,e)=>{e.d(t,{R:()=>n,x:()=>c});var r=e(96540);const i={},s=r.createContext(i);function n(o){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof o?o(t):{...t,...o}}),[t,o])}function c(o){let t;return t=o.disableParentContext?"function"==typeof o.components?o.components(i):o.components||i:n(o.components),r.createElement(s.Provider,{value:t},o.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9387],{2857:(o,t,e)=>{e.r(t),e.d(t,{assets:()=>d,contentTitle:()=>n,default:()=>p,frontMatter:()=>s,metadata:()=>c,toc:()=>l});var r=e(74848),i=e(28453);const s={title:"Import from cloud",hide_title:!0,sidebar_position:2},n="How to import data from cloud providers (AWS, Azure, GCP)",c={id:"cado/discovery-import/import-from-cloud",title:"Import from cloud",description:"To import data from cloud providers, follow these steps:",source:"@site/docs/cado/discovery-import/import-from-cloud.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/import-from-cloud",permalink:"/cado/discovery-import/import-from-cloud",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/import-from-cloud.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Import from cloud",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Import data",permalink:"/cado/discovery-import/intro"},next:{title:"Automating collection from detections",permalink:"/cado/discovery-import/automation"}},d={},l=[];function a(o){const t={br:"br",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...o.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"how-to-import-data-from-cloud-providers-aws-azure-gcp",children:"How to import data from cloud providers (AWS, Azure, GCP)"}),"\n",(0,r.jsx)(t.p,{children:"To import data from cloud providers, follow these steps:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Select a Cloud Role"}),(0,r.jsx)(t.br,{}),"\n","Begin by choosing the ",(0,r.jsx)(t.strong,{children:"Cloud Role"})," that you will use for the data import. This role must have the necessary permissions for accessing the data."]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Filter or Search"}),(0,r.jsx)(t.br,{}),"\n","You can filter the list of roles by provider (AWS, Azure, GCP) or search for a specific account, subscription, or investigation to narrow down the options."]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Importing from cloud",src:e(18010).A+"",width:"1832",height:"632"})}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:[(0,r.jsx)(t.strong,{children:"Choose Cloud Service"}),(0,r.jsx)(t.br,{}),"\n","After selecting the appropriate role, choose the cloud service (AWS, Azure, or GCP) that contains the data you want to import."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Follow the on-screen prompts to complete the process."})]})}function p(o={}){const{wrapper:t}={...(0,i.R)(),...o.components};return t?(0,r.jsx)(t,{...o,children:(0,r.jsx)(a,{...o})}):a(o)}},18010:(o,t,e)=>{e.d(t,{A:()=>r});const r=e.p+"assets/images/import-cloud-6754420b4e7cc81d73642d1671355124.png"},28453:(o,t,e)=>{e.d(t,{R:()=>n,x:()=>c});var r=e(96540);const i={},s=r.createContext(i);function n(o){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof o?o(t):{...t,...o}}),[t,o])}function c(o){let t;return t=o.disableParentContext?"function"==typeof o.components?o.components(i):o.components||i:n(o.components),r.createElement(s.Provider,{value:t},o.children)}}}]); \ No newline at end of file diff --git a/assets/js/13eba36a.2331cdc9.js b/assets/js/13eba36a.805d6889.js similarity index 99% rename from assets/js/13eba36a.2331cdc9.js rename to assets/js/13eba36a.805d6889.js index 47a0e46eb..e3e432f40 100644 --- a/assets/js/13eba36a.2331cdc9.js +++ b/assets/js/13eba36a.805d6889.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6941],{69253:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>r,contentTitle:()=>c,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>l});var s=t(74848),n=t(28453);const i={title:"Automatically add cross-account roles to Cado with AWS Organizations",hide_title:!0,sidebar_position:5},c="How to automatically add cross-account roles to Cado with AWS Organizations",a={id:"cado/deploy/cross/aws-organizations",title:"Automatically add cross-account roles to Cado with AWS Organizations",description:"This guide will walk you through how to integrate AWS roles into the Cado platform using AWS Organizations.",source:"@site/docs/cado/deploy/cross/aws-organizations.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/aws-organizations",permalink:"/cado/deploy/cross/aws-organizations",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/aws-organizations.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"Automatically add cross-account roles to Cado with AWS Organizations",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Manually add a cross-account role to Cado in AWS",permalink:"/cado/deploy/cross/add-cross-account-manual"},next:{title:"Add cross-account roles in AWS to Cado with the API",permalink:"/cado/deploy/cross/cross-account-creation-api"}},r={},l=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"1. Setting Permissions for Account Discovery",id:"1-setting-permissions-for-account-discovery",level:3},{value:"2. Select List Accounts Role in Cado",id:"2-select-list-accounts-role-in-cado",level:3},{value:"3. Set Cross-Account IAM Role",id:"3-set-cross-account-iam-role",level:3},{value:"4. Pipeline execution",id:"4-pipeline-execution",level:3},{value:"Performing Account Checks",id:"performing-account-checks",level:2}];function d(e){const o={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(o.h1,{id:"how-to-automatically-add-cross-account-roles-to-cado-with-aws-organizations",children:"How to automatically add cross-account roles to Cado with AWS Organizations"}),"\n",(0,s.jsx)(o.p,{children:"This guide will walk you through how to integrate AWS roles into the Cado platform using AWS Organizations."}),"\n",(0,s.jsx)(o.p,{children:"This is the recommended way to add cross-account roles you have deployed to the Cado Platform, to enable the platform to import data from multiple AWS accounts."}),"\n",(0,s.jsx)(o.admonition,{type:"tip",children:(0,s.jsxs)(o.p,{children:["This feature is currently in beta. To enable it, go to ",(0,s.jsx)(o.em,{children:"Settings > Experiments"}),' and turn on "AWS Organizations Account Discovery."']})}),"\n",(0,s.jsxs)(o.p,{children:["Alternatively, you can use the ",(0,s.jsx)(o.a,{href:"/cado/deploy/cross/cross-account-creation-api",children:"Cado API"})," to add cross-account roles to the platform."]}),"\n",(0,s.jsx)(o.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsx)(o.p,{children:"Before starting, ensure that you have the following in place:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"AWS Organizations"})," configured with multiple AWS accounts under a single management account."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"IAM roles"})," with the necessary cross-account permissions applied to all AWS accounts using ",(0,s.jsx)(o.a,{href:"/cado/deploy/cross/cross-account-creation-auto",children:"AWS StackSets"})," or ",(0,s.jsx)(o.a,{href:"/cado/deploy/cross/cross-account-creation",children:"manual deployment"}),"."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Cado Platform Access"}),", specifically with admin rights to manage cloud accounts."]}),"\n"]}),"\n",(0,s.jsxs)(o.h3,{id:"1-setting-permissions-for-account-discovery",children:["1. ",(0,s.jsx)(o.strong,{children:"Setting Permissions for Account Discovery"})]}),"\n",(0,s.jsxs)(o.p,{children:["The ",(0,s.jsx)(o.a,{href:"https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html",children:"ListAccounts"})," operation is used by Cado to retrieve a list of all accounts within your organization. It can only be executed from the management account of the AWS Organization."]}),"\n",(0,s.jsx)(o.p,{children:"For the code to function correctly, the IAM role used for discovery must have the necessary permissions to list accounts in AWS Organizations. Here\u2019s a minimal example of an IAM policy:"}),"\n",(0,s.jsx)(o.pre,{children:(0,s.jsx)(o.code,{className:"language-json",children:'{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Sid": "ListAccounts",\n "Effect": "Allow",\n "Action": [\n "organizations:ListAccounts",\n "organizations:ListTagsForResource"\n ],\n "Resource": "*"\n }\n ]\n}\n'})}),"\n",(0,s.jsx)(o.p,{children:"This policy must be attached to the role that the Cado platform will assume."}),"\n",(0,s.jsx)(o.p,{children:"The ListAccounts permission should be set in the root account, and the Cado role (or a role that has trust with the Cado role) should be allowed to assume it."}),"\n",(0,s.jsxs)(o.h3,{id:"2-select-list-accounts-role-in-cado",children:["2. ",(0,s.jsx)(o.strong,{children:"Select List Accounts Role in Cado"})]}),"\n",(0,s.jsx)(o.p,{children:"To enable cross-account discovery on the Cado platform, follow these steps:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:["Go to ",(0,s.jsx)(o.strong,{children:"Settings > Accounts"})," and click ",(0,s.jsx)(o.strong,{children:"Create an account"}),"."]}),"\n",(0,s.jsxs)(o.li,{children:["Select ",(0,s.jsx)(o.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,s.jsxs)(o.li,{children:["Select the ",(0,s.jsx)(o.strong,{children:"AWS Organizations"})," option."]}),"\n",(0,s.jsx)(o.li,{children:'Under the "Role with ListAccounts Permission" dropdown, select the role with permissions to list accounts in your AWS Organization.'}),"\n"]}),"\n",(0,s.jsxs)(o.p,{children:["You will need to select the role containing the organizations",":ListAccounts"," permission to the platform via Settings > Accounts. This role should have a ",(0,s.jsx)(o.a,{href:"/cado/deploy/aws/iam/iam-description#using-an-existing-iam-role",children:"trust policy"})," allowing the CadoResponseRole to assume it, and added to the platform manually via Settings > Accounts."]}),"\n",(0,s.jsx)(o.p,{children:"The dropdown will only list roles that have been added to the platform. Since Cado validates the roles before adding them, all roles shown should be assumable by the CadoResponseRole."}),"\n",(0,s.jsx)(o.p,{children:"An example is below:"}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Select List Accounts Role 1",src:t(1153).A+"",width:"1316",height:"1254"})}),"\n",(0,s.jsxs)(o.h3,{id:"3-set-cross-account-iam-role",children:["3. ",(0,s.jsx)(o.strong,{children:"Set Cross-Account IAM Role"})]}),"\n",(0,s.jsx)(o.p,{children:"Next, configure the cross-account IAM role that the Cado platform will use to interact with other accounts:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:["Enter the role name (e.g., ",(0,s.jsx)(o.code,{children:"CadoResponseRole"}),") in the ",(0,s.jsx)(o.code,{children:"Cross Account IAM Role Name"})," field."]}),"\n",(0,s.jsxs)(o.li,{children:["Click ",(0,s.jsx)(o.code,{children:"Discover accounts"})," to trigger the discovery process using the provided role."]}),"\n"]}),"\n",(0,s.jsx)(o.p,{children:"Ensure that only the role name is used, not the entire ARN. The role name should be the name of the role that was applied to all AWS accounts using the StackSet."}),"\n",(0,s.jsx)(o.p,{children:"An example is below:"}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Select List Accounts Role 2",src:t(61600).A+"",width:"1368",height:"500"})}),"\n",(0,s.jsxs)(o.h3,{id:"4-pipeline-execution",children:["4. ",(0,s.jsx)(o.strong,{children:"Pipeline execution"})]}),"\n",(0,s.jsx)(o.p,{children:"The pipeline to add accounts will then execute, and can be monitored in the pipeline view."}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Pipeline View",src:t(42557).A+"",width:"1300",height:"296"})}),"\n",(0,s.jsx)(o.h2,{id:"performing-account-checks",children:"Performing Account Checks"}),"\n",(0,s.jsxs)(o.p,{children:["Once the accounts are added to the Cado platform, it's recommended to regularly run Account Checks to ensure the necessary permissions are still in place for acquisitions. For details on running these checks, refer to ",(0,s.jsx)(o.a,{href:"/cado/manage/monitoring#account-check",children:"Account Check"}),"."]})]})}function h(e={}){const{wrapper:o}={...(0,n.R)(),...e.components};return o?(0,s.jsx)(o,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},61600:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/aws-orgs-list-accounts-role-2-2fbc76e6c1d38cd57bae5f81efd7141d.png"},1153:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/aws-orgs-list-accounts-role-3f4052b4ac5476782e4a72c1e5ccb421.png"},42557:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/aws-orgs-pipeline-281f923cbaca6bc90af353ae6c88fd0d.png"},28453:(e,o,t)=>{t.d(o,{R:()=>c,x:()=>a});var s=t(96540);const n={},i=s.createContext(n);function c(e){const o=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function a(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:c(e.components),s.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6941],{69253:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>r,contentTitle:()=>c,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>l});var s=t(74848),n=t(28453);const i={title:"Automatically add cross-account roles to Cado with AWS Organizations",hide_title:!0,sidebar_position:5},c="How to automatically add cross-account roles to Cado with AWS Organizations",a={id:"cado/deploy/cross/aws-organizations",title:"Automatically add cross-account roles to Cado with AWS Organizations",description:"This guide will walk you through how to integrate AWS roles into the Cado platform using AWS Organizations.",source:"@site/docs/cado/deploy/cross/aws-organizations.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/aws-organizations",permalink:"/cado/deploy/cross/aws-organizations",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/aws-organizations.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"Automatically add cross-account roles to Cado with AWS Organizations",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Manually add a cross-account role to Cado in AWS",permalink:"/cado/deploy/cross/add-cross-account-manual"},next:{title:"Add cross-account roles in AWS to Cado with the API",permalink:"/cado/deploy/cross/cross-account-creation-api"}},r={},l=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"1. Setting Permissions for Account Discovery",id:"1-setting-permissions-for-account-discovery",level:3},{value:"2. Select List Accounts Role in Cado",id:"2-select-list-accounts-role-in-cado",level:3},{value:"3. Set Cross-Account IAM Role",id:"3-set-cross-account-iam-role",level:3},{value:"4. Pipeline execution",id:"4-pipeline-execution",level:3},{value:"Performing Account Checks",id:"performing-account-checks",level:2}];function d(e){const o={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(o.h1,{id:"how-to-automatically-add-cross-account-roles-to-cado-with-aws-organizations",children:"How to automatically add cross-account roles to Cado with AWS Organizations"}),"\n",(0,s.jsx)(o.p,{children:"This guide will walk you through how to integrate AWS roles into the Cado platform using AWS Organizations."}),"\n",(0,s.jsx)(o.p,{children:"This is the recommended way to add cross-account roles you have deployed to the Cado Platform, to enable the platform to import data from multiple AWS accounts."}),"\n",(0,s.jsx)(o.admonition,{type:"tip",children:(0,s.jsxs)(o.p,{children:["This feature is currently in beta. To enable it, go to ",(0,s.jsx)(o.em,{children:"Settings > Experiments"}),' and turn on "AWS Organizations Account Discovery."']})}),"\n",(0,s.jsxs)(o.p,{children:["Alternatively, you can use the ",(0,s.jsx)(o.a,{href:"/cado/deploy/cross/cross-account-creation-api",children:"Cado API"})," to add cross-account roles to the platform."]}),"\n",(0,s.jsx)(o.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsx)(o.p,{children:"Before starting, ensure that you have the following in place:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"AWS Organizations"})," configured with multiple AWS accounts under a single management account."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"IAM roles"})," with the necessary cross-account permissions applied to all AWS accounts using ",(0,s.jsx)(o.a,{href:"/cado/deploy/cross/cross-account-creation-auto",children:"AWS StackSets"})," or ",(0,s.jsx)(o.a,{href:"/cado/deploy/cross/cross-account-creation",children:"manual deployment"}),"."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Cado Platform Access"}),", specifically with admin rights to manage cloud accounts."]}),"\n"]}),"\n",(0,s.jsxs)(o.h3,{id:"1-setting-permissions-for-account-discovery",children:["1. ",(0,s.jsx)(o.strong,{children:"Setting Permissions for Account Discovery"})]}),"\n",(0,s.jsxs)(o.p,{children:["The ",(0,s.jsx)(o.a,{href:"https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html",children:"ListAccounts"})," operation is used by Cado to retrieve a list of all accounts within your organization. It can only be executed from the management account of the AWS Organization."]}),"\n",(0,s.jsx)(o.p,{children:"For the code to function correctly, the IAM role used for discovery must have the necessary permissions to list accounts in AWS Organizations. Here\u2019s a minimal example of an IAM policy:"}),"\n",(0,s.jsx)(o.pre,{children:(0,s.jsx)(o.code,{className:"language-json",children:'{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Sid": "ListAccounts",\n "Effect": "Allow",\n "Action": [\n "organizations:ListAccounts",\n "organizations:ListTagsForResource"\n ],\n "Resource": "*"\n }\n ]\n}\n'})}),"\n",(0,s.jsx)(o.p,{children:"This policy must be attached to the role that the Cado platform will assume."}),"\n",(0,s.jsx)(o.p,{children:"The ListAccounts permission should be set in the root account, and the Cado role (or a role that has trust with the Cado role) should be allowed to assume it."}),"\n",(0,s.jsxs)(o.h3,{id:"2-select-list-accounts-role-in-cado",children:["2. ",(0,s.jsx)(o.strong,{children:"Select List Accounts Role in Cado"})]}),"\n",(0,s.jsx)(o.p,{children:"To enable cross-account discovery on the Cado platform, follow these steps:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:["Go to ",(0,s.jsx)(o.strong,{children:"Settings > Accounts"})," and click ",(0,s.jsx)(o.strong,{children:"Create an account"}),"."]}),"\n",(0,s.jsxs)(o.li,{children:["Select ",(0,s.jsx)(o.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,s.jsxs)(o.li,{children:["Select the ",(0,s.jsx)(o.strong,{children:"AWS Organizations"})," option."]}),"\n",(0,s.jsx)(o.li,{children:'Under the "Role with ListAccounts Permission" dropdown, select the role with permissions to list accounts in your AWS Organization.'}),"\n"]}),"\n",(0,s.jsxs)(o.p,{children:["You will need to select the role containing the organizations",":ListAccounts"," permission to the platform via Settings > Accounts. This role should have a ",(0,s.jsx)(o.a,{href:"/cado/deploy/aws/iam/iam-description#using-an-existing-iam-role",children:"trust policy"})," allowing the CadoResponseRole to assume it, and added to the platform manually via Settings > Accounts."]}),"\n",(0,s.jsx)(o.p,{children:"The dropdown will only list roles that have been added to the platform. Since Cado validates the roles before adding them, all roles shown should be assumable by the CadoResponseRole."}),"\n",(0,s.jsx)(o.p,{children:"An example is below:"}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Select List Accounts Role 1",src:t(1153).A+"",width:"1316",height:"1254"})}),"\n",(0,s.jsxs)(o.h3,{id:"3-set-cross-account-iam-role",children:["3. ",(0,s.jsx)(o.strong,{children:"Set Cross-Account IAM Role"})]}),"\n",(0,s.jsx)(o.p,{children:"Next, configure the cross-account IAM role that the Cado platform will use to interact with other accounts:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:["Enter the role name (e.g., ",(0,s.jsx)(o.code,{children:"CadoResponseRole"}),") in the ",(0,s.jsx)(o.code,{children:"Cross Account IAM Role Name"})," field."]}),"\n",(0,s.jsxs)(o.li,{children:["Click ",(0,s.jsx)(o.code,{children:"Discover accounts"})," to trigger the discovery process using the provided role."]}),"\n"]}),"\n",(0,s.jsx)(o.p,{children:"Ensure that only the role name is used, not the entire ARN. The role name should be the name of the role that was applied to all AWS accounts using the StackSet."}),"\n",(0,s.jsx)(o.p,{children:"An example is below:"}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Select List Accounts Role 2",src:t(61600).A+"",width:"1368",height:"500"})}),"\n",(0,s.jsxs)(o.h3,{id:"4-pipeline-execution",children:["4. ",(0,s.jsx)(o.strong,{children:"Pipeline execution"})]}),"\n",(0,s.jsx)(o.p,{children:"The pipeline to add accounts will then execute, and can be monitored in the pipeline view."}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Pipeline View",src:t(42557).A+"",width:"1300",height:"296"})}),"\n",(0,s.jsx)(o.h2,{id:"performing-account-checks",children:"Performing Account Checks"}),"\n",(0,s.jsxs)(o.p,{children:["Once the accounts are added to the Cado platform, it's recommended to regularly run Account Checks to ensure the necessary permissions are still in place for acquisitions. For details on running these checks, refer to ",(0,s.jsx)(o.a,{href:"/cado/manage/monitoring#account-check",children:"Account Check"}),"."]})]})}function h(e={}){const{wrapper:o}={...(0,n.R)(),...e.components};return o?(0,s.jsx)(o,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},61600:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/aws-orgs-list-accounts-role-2-2fbc76e6c1d38cd57bae5f81efd7141d.png"},1153:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/aws-orgs-list-accounts-role-3f4052b4ac5476782e4a72c1e5ccb421.png"},42557:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/aws-orgs-pipeline-281f923cbaca6bc90af353ae6c88fd0d.png"},28453:(e,o,t)=>{t.d(o,{R:()=>c,x:()=>a});var s=t(96540);const n={},i=s.createContext(n);function c(e){const o=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function a(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:c(e.components),s.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/1487f5c9.6368e61c.js b/assets/js/1487f5c9.d213ebed.js similarity index 99% rename from assets/js/1487f5c9.6368e61c.js rename to assets/js/1487f5c9.d213ebed.js index b5836d2d0..72386d6df 100644 --- a/assets/js/1487f5c9.6368e61c.js +++ b/assets/js/1487f5c9.d213ebed.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2012],{36814:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var o=n(74848),r=n(28453);const i={title:"Community Edition EULA",hide_title:!0,sidebar_position:2},a="DOCUMENT B",s={id:"troubleshooting/eula/community-eula",title:"Community Edition EULA",description:"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.",source:"@site/docs/troubleshooting/eula/community-eula.md",sourceDirName:"troubleshooting/eula",slug:"/troubleshooting/eula/community-eula",permalink:"/troubleshooting/eula/community-eula",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/eula/community-eula.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Community Edition EULA",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Commercial EULA",permalink:"/troubleshooting/eula/commercial-eula"},next:{title:"Service level agreements",permalink:"/troubleshooting/faq"}},l={},c=[{value:"Community Edition License Agreement",id:"community-edition-license-agreement",level:2}];function h(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",hr:"hr",li:"li",ol:"ol",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"document-b",children:"DOCUMENT B"}),"\n",(0,o.jsxs)(t.admonition,{type:"info",children:[(0,o.jsxs)(t.p,{children:["FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, ",(0,o.jsx)(t.a,{href:"/troubleshooting/eula/commercial-eula#end-user-license-agreement",children:(0,o.jsx)(t.strong,{children:"DOCUMENT A - END USER LICENSE AGREEMENT"})})," SHALL APPLY."]}),(0,o.jsxs)(t.p,{children:["FOR ALL COMMUNITY EDITION USERS OF CADO SOFTWARE, ",(0,o.jsx)(t.a,{href:"/troubleshooting/eula/community-eula#community-edition-license-agreement",children:(0,o.jsx)(t.strong,{children:"DOCUMENT B - COMMUNITY EDITION LICENSE AGREEMENT"})})," SHALL APPLY."]})]}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsx)(t.h2,{id:"community-edition-license-agreement",children:"Community Edition License Agreement"}),"\n",(0,o.jsx)(t.p,{children:'IMPORTANT \u2013 READ THIS COMMUNITY EDITION LICENSE AGREEMENT (\u201cAGREEMENT\u201d) BEFORE AGREEING TO USE THE SOFTWARE. BY PROCEEDING, YOU ACKNOWLEDGE THAT YOU HAVE READ AND AGREE TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT WITH CADO SECURITY LIMITED. IF YOU DO NOT AGREE WITH THE TERMS AND CONDITIONS OF THIS AGREEMENT DO NOT PROCEED WITH ANY INSTALLATION AND/OR USE OF THE SOFTWARE. THE DATE THAT YOU AGREE TO BE BOUND BY THIS AGREEMENT BY INSTALLATION AND/OR USE IS THE "EFFECTIVE DATE."'}),"\n",(0,o.jsx)(t.p,{children:'This Community Edition License Agreement governs use of the Software (as defined below) provided by Cado Security Limited, or its subsidiaries or affiliates (collectively, the \u201cCompany\u201d). This Agreement sets out the terms on which Company makes the Software available to you ("You\u201d or \u201cYour\u201d).'}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Grant of Rights; Reservation of Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Subject to Your acceptance and compliance with the terms and conditions of this Agreement Company grants You a limited, non-sublicensable, non-exclusive, non-transferable revocable right to access, install, download and use the Software (as defined below) in object code form only, exclusively within Your cloud based environment, for internal and non-commercial purposes only."}),"\n",(0,o.jsxs)(t.ol,{start:"2",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Restrictions."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You may not:"}),"\n",(0,o.jsx)(t.p,{children:"copy the Software or any part of it, except as expressly permitted in this Agreement;\nrent, sell, lease, sublicense, distribute, pledge, assign or otherwise transfer, or commercially exploit, or encumber rights to, the Software or any part of it in any manner or for any purpose, or make the Software available for use by any third party in any manner including provide commercial hosting services, time-sharing, service bureau;\naccess the Software for the purpose of building a competitive product or service or copying its features or user interface;\nremove, delete, obscure, alter or add to any copyright or proprietary notices appearing within the Software;\ndisassemble, decrypt, extract, reverse engineer or reverse compile the Software, or otherwise attempt to discover the confidential algorithms and techniques incorporated in the Software, or disclose or use any confidential information of Company in any manner, other than to the extent such actions cannot be prohibited under applicable law;\nmodify, translate, adapt, or create derivative works from the Software; or\nobtain or have access to the source code or systems and programming documentation of the Software or any part thereof."}),"\n",(0,o.jsxs)(t.ol,{start:"3",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Proprietary Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"The Cado Security software including any (a) software that the Company uses to make the Software available; and (b) any published documentation that Company generally makes available to its customers (\u201cDocumentation\u201d) (collectively, the \u201cSoftware\u201d), is subject to the protection of copyright laws, which prohibit unauthorized copying and distribution of copyrighted works. The Software incorporates Company\u2019s proprietary and confidential algorithms and techniques that are subject to legal protection as know-how and trade secrets. All right, title and interest to any intellectual property rights included but not limited to patents, copyright works, know how, trade secrets and trademarks in the Software are owned by the Company."}),"\n",(0,o.jsxs)(t.ol,{start:"4",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Support; Compliance."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You are solely responsible for installing any updates and modifications that the Company may make available from time to time. Company will only support the most recent version of the Software. Company may, at any time, with or without notice, inspect Your use of the Software to verify compliance with this Agreement."}),"\n",(0,o.jsxs)(t.ol,{start:"5",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Data."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Company may collect, process, aggregate, and use certain information, analysis, statistics, and other data generated by Your use of the Software (a) to confirm that the Software is being used in accordance with the rights granted under this Agreement, and (b) to drive improvements in the Software, and Company will retain ownership of such Software use data. Company agrees not to publish any of this information in a form that identifies You or any User. In the event Company processes personal data as a processor, such personal data will be processed by Company in accordance with applicable data protection laws."}),"\n",(0,o.jsxs)(t.ol,{start:"6",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Community Edition Slack Channel."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In connection with Your use of the Software, the Company may automatically register you in a Cado Community Edition Slack collaboration space. Company reserves the right to refuse entry and/or remove Your access at any time. You remain responsible at all times for Your behavior and any content posted. You agree to accept and observe Slack's terms of use at all times. Company has a zero tolerance policy for any illegal, illicit, defamatory, derogatory behavior or content and reserves the right to report any such violation to Slack and/or to the appropriate authorities."}),"\n",(0,o.jsxs)(t.ol,{start:"7",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Term; Termination."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Company may terminate this Agreement and all rights granted herein at any time, with or without cause. The term of this Agreement and Your right to use the Software will automatically terminate without notice in the event of any failure by You to comply with any of the above restrictions or any term of this Agreement. Upon expiration or earlier termination of this Agreement, You will cease using the Software and expunge and destroy all copies of the Software in Your possession. All provisions of this Agreement intended by their nature will survive termination."}),"\n",(0,o.jsxs)(t.ol,{start:"8",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Warranty and Disclaimer."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Each party warrants to the other that it has the required authority to enter into this Agreement. YOU AGREE THAT COMPANY AND ITS LICENSORS PROVIDE THE SOFTWARE ON AN \u201cAS IS\u201d AND \u201cWHERE-AS\u201d BASIS. NEITHER COMPANY NOR ITS LICENSORS MAKE ANY WARRANTIES WITH RESPECT TO THE PERFORMANCE OF THE SOFTWARE, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND COMPANY AND ITS LICENSORS EXPRESSLY DISCLAIM ALL OTHER WARRANTIES, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF NON-INFRINGEMENT OF THIRD PARTY RIGHTS, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE."}),"\n",(0,o.jsxs)(t.ol,{start:"9",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Limitation of Liability."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In no event will Company be liable under or in connection with this Agreement for (a) any lost profits, loss of revenue, loss of business, loss of contract, loss of goodwill or loss of anticipated savings (whether direct or indirect); (b) error or interruption of use, loss or inaccuracy or corruption of data; or (c) any incidental, special, punitive, exemplary, indirect or consequential damages, arising out of or related to the Software, or the use thereof, even if Company has been advised, or is otherwise aware, of the possibility of such damages. The aggregate liability of Company under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, in respect of any and all claims, will not exceed $100 USD."}),"\n",(0,o.jsxs)(t.ol,{start:"10",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Intellectual Property Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"As between You and Company, all right, title and interest in and to the Software and Company\u2019s trademarks and service marks are owned exclusively by Company and its licensors. Other than as expressly set forth in this Agreement, no license or other rights in or to the Software thereto are granted to You, and all such licenses and rights are hereby expressly reserved."}),"\n",(0,o.jsxs)(t.ol,{start:"11",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Miscellaneous."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"This Agreement does not create any agency or partnership relationship between the parties\nhereto. This Agreement, and any dispute arising out of or in connection with it or its subject matter, whether of\na contractual or non-contractual nature, shall be governed by and construed in accordance with the laws of\nDelaware (if You are located in the United States), or England (if You are located outside of the United States).\nThe sole and exclusive jurisdiction and venue for any litigation arising out of this Agreement shall be the courts\nof Delaware (if You are located in the United States), or England (if You are located outside of the United\nStates). This Agreement constitutes the entire agreement between the parties with respect to the subject\nmatter hereof and supersedes all prior agreements and understandings whether written or oral, express or\nimplied. If any provision of this Agreement is held invalid, illegal or unenforceable by a court of competent\njurisdiction, such shall not affect any other provision of this Agreement, which shall remain in full force and\neffect. No amendment or alteration of the terms of this Agreement shall be effective unless made in writing and\nexecuted by Company. A failure or delay in exercising any right in respect to this Agreement will not be\npresumed to operate as a waiver, and a single or partial exercise of any right will not be presumed to preclude\nany subsequent or further exercise of that right or the exercise of any other right."})]})}function d(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(h,{...e})}):h(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>s});var o=n(96540);const r={},i=o.createContext(r);function a(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2012],{36814:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var o=n(74848),r=n(28453);const i={title:"Community Edition EULA",hide_title:!0,sidebar_position:2},a="DOCUMENT B",s={id:"troubleshooting/eula/community-eula",title:"Community Edition EULA",description:"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.",source:"@site/docs/troubleshooting/eula/community-eula.md",sourceDirName:"troubleshooting/eula",slug:"/troubleshooting/eula/community-eula",permalink:"/troubleshooting/eula/community-eula",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/eula/community-eula.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Community Edition EULA",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Commercial EULA",permalink:"/troubleshooting/eula/commercial-eula"},next:{title:"Service level agreements",permalink:"/troubleshooting/faq"}},l={},c=[{value:"Community Edition License Agreement",id:"community-edition-license-agreement",level:2}];function h(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",hr:"hr",li:"li",ol:"ol",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"document-b",children:"DOCUMENT B"}),"\n",(0,o.jsxs)(t.admonition,{type:"info",children:[(0,o.jsxs)(t.p,{children:["FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, ",(0,o.jsx)(t.a,{href:"/troubleshooting/eula/commercial-eula#end-user-license-agreement",children:(0,o.jsx)(t.strong,{children:"DOCUMENT A - END USER LICENSE AGREEMENT"})})," SHALL APPLY."]}),(0,o.jsxs)(t.p,{children:["FOR ALL COMMUNITY EDITION USERS OF CADO SOFTWARE, ",(0,o.jsx)(t.a,{href:"/troubleshooting/eula/community-eula#community-edition-license-agreement",children:(0,o.jsx)(t.strong,{children:"DOCUMENT B - COMMUNITY EDITION LICENSE AGREEMENT"})})," SHALL APPLY."]})]}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsx)(t.h2,{id:"community-edition-license-agreement",children:"Community Edition License Agreement"}),"\n",(0,o.jsx)(t.p,{children:'IMPORTANT \u2013 READ THIS COMMUNITY EDITION LICENSE AGREEMENT (\u201cAGREEMENT\u201d) BEFORE AGREEING TO USE THE SOFTWARE. BY PROCEEDING, YOU ACKNOWLEDGE THAT YOU HAVE READ AND AGREE TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT WITH CADO SECURITY LIMITED. IF YOU DO NOT AGREE WITH THE TERMS AND CONDITIONS OF THIS AGREEMENT DO NOT PROCEED WITH ANY INSTALLATION AND/OR USE OF THE SOFTWARE. THE DATE THAT YOU AGREE TO BE BOUND BY THIS AGREEMENT BY INSTALLATION AND/OR USE IS THE "EFFECTIVE DATE."'}),"\n",(0,o.jsx)(t.p,{children:'This Community Edition License Agreement governs use of the Software (as defined below) provided by Cado Security Limited, or its subsidiaries or affiliates (collectively, the \u201cCompany\u201d). This Agreement sets out the terms on which Company makes the Software available to you ("You\u201d or \u201cYour\u201d).'}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Grant of Rights; Reservation of Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Subject to Your acceptance and compliance with the terms and conditions of this Agreement Company grants You a limited, non-sublicensable, non-exclusive, non-transferable revocable right to access, install, download and use the Software (as defined below) in object code form only, exclusively within Your cloud based environment, for internal and non-commercial purposes only."}),"\n",(0,o.jsxs)(t.ol,{start:"2",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Restrictions."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You may not:"}),"\n",(0,o.jsx)(t.p,{children:"copy the Software or any part of it, except as expressly permitted in this Agreement;\nrent, sell, lease, sublicense, distribute, pledge, assign or otherwise transfer, or commercially exploit, or encumber rights to, the Software or any part of it in any manner or for any purpose, or make the Software available for use by any third party in any manner including provide commercial hosting services, time-sharing, service bureau;\naccess the Software for the purpose of building a competitive product or service or copying its features or user interface;\nremove, delete, obscure, alter or add to any copyright or proprietary notices appearing within the Software;\ndisassemble, decrypt, extract, reverse engineer or reverse compile the Software, or otherwise attempt to discover the confidential algorithms and techniques incorporated in the Software, or disclose or use any confidential information of Company in any manner, other than to the extent such actions cannot be prohibited under applicable law;\nmodify, translate, adapt, or create derivative works from the Software; or\nobtain or have access to the source code or systems and programming documentation of the Software or any part thereof."}),"\n",(0,o.jsxs)(t.ol,{start:"3",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Proprietary Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"The Cado Security software including any (a) software that the Company uses to make the Software available; and (b) any published documentation that Company generally makes available to its customers (\u201cDocumentation\u201d) (collectively, the \u201cSoftware\u201d), is subject to the protection of copyright laws, which prohibit unauthorized copying and distribution of copyrighted works. The Software incorporates Company\u2019s proprietary and confidential algorithms and techniques that are subject to legal protection as know-how and trade secrets. All right, title and interest to any intellectual property rights included but not limited to patents, copyright works, know how, trade secrets and trademarks in the Software are owned by the Company."}),"\n",(0,o.jsxs)(t.ol,{start:"4",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Support; Compliance."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You are solely responsible for installing any updates and modifications that the Company may make available from time to time. Company will only support the most recent version of the Software. Company may, at any time, with or without notice, inspect Your use of the Software to verify compliance with this Agreement."}),"\n",(0,o.jsxs)(t.ol,{start:"5",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Data."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Company may collect, process, aggregate, and use certain information, analysis, statistics, and other data generated by Your use of the Software (a) to confirm that the Software is being used in accordance with the rights granted under this Agreement, and (b) to drive improvements in the Software, and Company will retain ownership of such Software use data. Company agrees not to publish any of this information in a form that identifies You or any User. In the event Company processes personal data as a processor, such personal data will be processed by Company in accordance with applicable data protection laws."}),"\n",(0,o.jsxs)(t.ol,{start:"6",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Community Edition Slack Channel."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In connection with Your use of the Software, the Company may automatically register you in a Cado Community Edition Slack collaboration space. Company reserves the right to refuse entry and/or remove Your access at any time. You remain responsible at all times for Your behavior and any content posted. You agree to accept and observe Slack's terms of use at all times. Company has a zero tolerance policy for any illegal, illicit, defamatory, derogatory behavior or content and reserves the right to report any such violation to Slack and/or to the appropriate authorities."}),"\n",(0,o.jsxs)(t.ol,{start:"7",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Term; Termination."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Company may terminate this Agreement and all rights granted herein at any time, with or without cause. The term of this Agreement and Your right to use the Software will automatically terminate without notice in the event of any failure by You to comply with any of the above restrictions or any term of this Agreement. Upon expiration or earlier termination of this Agreement, You will cease using the Software and expunge and destroy all copies of the Software in Your possession. All provisions of this Agreement intended by their nature will survive termination."}),"\n",(0,o.jsxs)(t.ol,{start:"8",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Warranty and Disclaimer."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Each party warrants to the other that it has the required authority to enter into this Agreement. YOU AGREE THAT COMPANY AND ITS LICENSORS PROVIDE THE SOFTWARE ON AN \u201cAS IS\u201d AND \u201cWHERE-AS\u201d BASIS. NEITHER COMPANY NOR ITS LICENSORS MAKE ANY WARRANTIES WITH RESPECT TO THE PERFORMANCE OF THE SOFTWARE, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND COMPANY AND ITS LICENSORS EXPRESSLY DISCLAIM ALL OTHER WARRANTIES, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF NON-INFRINGEMENT OF THIRD PARTY RIGHTS, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE."}),"\n",(0,o.jsxs)(t.ol,{start:"9",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Limitation of Liability."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In no event will Company be liable under or in connection with this Agreement for (a) any lost profits, loss of revenue, loss of business, loss of contract, loss of goodwill or loss of anticipated savings (whether direct or indirect); (b) error or interruption of use, loss or inaccuracy or corruption of data; or (c) any incidental, special, punitive, exemplary, indirect or consequential damages, arising out of or related to the Software, or the use thereof, even if Company has been advised, or is otherwise aware, of the possibility of such damages. The aggregate liability of Company under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, in respect of any and all claims, will not exceed $100 USD."}),"\n",(0,o.jsxs)(t.ol,{start:"10",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Intellectual Property Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"As between You and Company, all right, title and interest in and to the Software and Company\u2019s trademarks and service marks are owned exclusively by Company and its licensors. Other than as expressly set forth in this Agreement, no license or other rights in or to the Software thereto are granted to You, and all such licenses and rights are hereby expressly reserved."}),"\n",(0,o.jsxs)(t.ol,{start:"11",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Miscellaneous."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"This Agreement does not create any agency or partnership relationship between the parties\nhereto. This Agreement, and any dispute arising out of or in connection with it or its subject matter, whether of\na contractual or non-contractual nature, shall be governed by and construed in accordance with the laws of\nDelaware (if You are located in the United States), or England (if You are located outside of the United States).\nThe sole and exclusive jurisdiction and venue for any litigation arising out of this Agreement shall be the courts\nof Delaware (if You are located in the United States), or England (if You are located outside of the United\nStates). This Agreement constitutes the entire agreement between the parties with respect to the subject\nmatter hereof and supersedes all prior agreements and understandings whether written or oral, express or\nimplied. If any provision of this Agreement is held invalid, illegal or unenforceable by a court of competent\njurisdiction, such shall not affect any other provision of this Agreement, which shall remain in full force and\neffect. No amendment or alteration of the terms of this Agreement shall be effective unless made in writing and\nexecuted by Company. A failure or delay in exercising any right in respect to this Agreement will not be\npresumed to operate as a waiver, and a single or partial exercise of any right will not be presumed to preclude\nany subsequent or further exercise of that right or the exercise of any other right."})]})}function d(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(h,{...e})}):h(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>s});var o=n(96540);const r={},i=o.createContext(r);function a(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/14d87e73.926dde42.js b/assets/js/14d87e73.f81372f5.js similarity index 98% rename from assets/js/14d87e73.926dde42.js rename to assets/js/14d87e73.f81372f5.js index 09c53e8de..fc82eab9f 100644 --- a/assets/js/14d87e73.926dde42.js +++ b/assets/js/14d87e73.f81372f5.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9866],{14575:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>p,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var n=o(74848),s=o(28453);const r={title:"Export to on-premise forensic tools",hide_title:!0,sidebar_position:1},i="How to Export to On-Premise Forensic Tools",a={id:"cado/integrations/forensic-tools",title:"Export to on-premise forensic tools",description:"Cado collects forensic data in the following formats based on the cloud provider:",source:"@site/docs/cado/integrations/forensic-tools.md",sourceDirName:"cado/integrations",slug:"/cado/integrations/forensic-tools",permalink:"/cado/integrations/forensic-tools",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/forensic-tools.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Export to on-premise forensic tools",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"API overview",permalink:"/cado/integrations/api-overview"},next:{title:"How to export to SIEM",permalink:"/cado/integrations/siem"}},c={},l=[{value:"Centrally Preserving Data",id:"centrally-preserving-data",level:2}];function d(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-export-to-on-premise-forensic-tools",children:"How to Export to On-Premise Forensic Tools"}),"\n",(0,n.jsx)(t.p,{children:"Cado collects forensic data in the following formats based on the cloud provider:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"AWS EC2"})," systems: DD format"]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Azure Virtual Machines"}),": VHD format"]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"GCP Instances"}),": VMDK format"]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Cado Host Triage captures"})," (including captures from Containers): ZIP format"]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"These files are stored in cloud storage (e.g., S3 in AWS or Storage in Azure) and can be downloaded from the respective cloud console. Once downloaded, the data can be imported into desktop forensic tools such as:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.a,{href:"https://www.magnetforensics.com/products/magnet-axiom/",children:"Magnet Axiom"})," (",(0,n.jsx)(t.a,{href:"https://www.magnetforensics.com/docs/axiom/html/Content/en-us/acquire-cloud/acquire-amazon-s3.htm",children:"How to import from S3"}),")"]}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://www.x-ways.net/forensics/",children:"X-Ways Forensics"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://www.opentext.com/products/encase-forensic",children:"EnCase Forensic"})}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"centrally-preserving-data",children:"Centrally Preserving Data"}),"\n",(0,n.jsxs)(t.p,{children:["If your deployment is in AWS, you can configure the system to automatically copy and preserve all processed evidence in a central S3 bucket. To enable this feature, go to ",(0,n.jsx)(t.strong,{children:"Settings"})," > ",(0,n.jsx)(t.strong,{children:"Preservation"}),"."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Preservation",src:o(2181).A+"",width:"1614",height:"600"})}),"\n",(0,n.jsx)(t.p,{children:'When data is collected in AWS (to the "default" bucket)/Azure/GCP - a second copy of the data will be copied to the S3 bucket set for evidence preservation.'})]})}function p(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},2181:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/preserve-77127c08dfd8fd7b4fd7ba1012390ff4.png"},28453:(e,t,o)=>{o.d(t,{R:()=>i,x:()=>a});var n=o(96540);const s={},r=n.createContext(s);function i(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9866],{14575:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>p,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var n=o(74848),s=o(28453);const r={title:"Export to on-premise forensic tools",hide_title:!0,sidebar_position:1},i="How to Export to On-Premise Forensic Tools",a={id:"cado/integrations/forensic-tools",title:"Export to on-premise forensic tools",description:"Cado collects forensic data in the following formats based on the cloud provider:",source:"@site/docs/cado/integrations/forensic-tools.md",sourceDirName:"cado/integrations",slug:"/cado/integrations/forensic-tools",permalink:"/cado/integrations/forensic-tools",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/forensic-tools.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Export to on-premise forensic tools",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"API overview",permalink:"/cado/integrations/api-overview"},next:{title:"How to export to SIEM",permalink:"/cado/integrations/siem"}},c={},l=[{value:"Centrally Preserving Data",id:"centrally-preserving-data",level:2}];function d(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-export-to-on-premise-forensic-tools",children:"How to Export to On-Premise Forensic Tools"}),"\n",(0,n.jsx)(t.p,{children:"Cado collects forensic data in the following formats based on the cloud provider:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"AWS EC2"})," systems: DD format"]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Azure Virtual Machines"}),": VHD format"]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"GCP Instances"}),": VMDK format"]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Cado Host Triage captures"})," (including captures from Containers): ZIP format"]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"These files are stored in cloud storage (e.g., S3 in AWS or Storage in Azure) and can be downloaded from the respective cloud console. Once downloaded, the data can be imported into desktop forensic tools such as:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.a,{href:"https://www.magnetforensics.com/products/magnet-axiom/",children:"Magnet Axiom"})," (",(0,n.jsx)(t.a,{href:"https://www.magnetforensics.com/docs/axiom/html/Content/en-us/acquire-cloud/acquire-amazon-s3.htm",children:"How to import from S3"}),")"]}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://www.x-ways.net/forensics/",children:"X-Ways Forensics"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://www.opentext.com/products/encase-forensic",children:"EnCase Forensic"})}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"centrally-preserving-data",children:"Centrally Preserving Data"}),"\n",(0,n.jsxs)(t.p,{children:["If your deployment is in AWS, you can configure the system to automatically copy and preserve all processed evidence in a central S3 bucket. To enable this feature, go to ",(0,n.jsx)(t.strong,{children:"Settings"})," > ",(0,n.jsx)(t.strong,{children:"Preservation"}),"."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Preservation",src:o(2181).A+"",width:"1614",height:"600"})}),"\n",(0,n.jsx)(t.p,{children:'When data is collected in AWS (to the "default" bucket)/Azure/GCP - a second copy of the data will be copied to the S3 bucket set for evidence preservation.'})]})}function p(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},2181:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/preserve-77127c08dfd8fd7b4fd7ba1012390ff4.png"},28453:(e,t,o)=>{o.d(t,{R:()=>i,x:()=>a});var n=o(96540);const s={},r=n.createContext(s);function i(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/19b12360.1ad36277.js b/assets/js/19b12360.1c0ca5ec.js similarity index 98% rename from assets/js/19b12360.1ad36277.js rename to assets/js/19b12360.1c0ca5ec.js index 1a35b6d0c..9609ab51e 100644 --- a/assets/js/19b12360.1ad36277.js +++ b/assets/js/19b12360.1c0ca5ec.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2309],{58676:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>c,default:()=>l,frontMatter:()=>s,metadata:()=>i,toc:()=>d});var n=t(74848),r=t(28453);const s={title:"Cross-Project setup",hide_title:!0,sidebar_position:5},c="How to set up Cross-Project Imports in GCP",i={id:"cado/deploy/gcp/gcp-cross-project",title:"Cross-Project setup",description:"After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the Overview, we can use these principals to import from other GCP projects under the same service account.",source:"@site/docs/cado/deploy/gcp/gcp-cross-project.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-cross-project",permalink:"/cado/deploy/gcp/gcp-cross-project",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-cross-project.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"Cross-Project setup",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Platform Encryption in GCP",permalink:"/cado/deploy/gcp/data-encryption-overview"},next:{title:"IAM permissions description",permalink:"/cado/deploy/gcp/iam-description"}},a={},d=[{value:"Secondary Project Permissions",id:"secondary-project-permissions",level:2}];function p(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(o.h1,{id:"how-to-set-up-cross-project-imports-in-gcp",children:"How to set up Cross-Project Imports in GCP"}),"\n",(0,n.jsxs)(o.p,{children:["After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the ",(0,n.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-settings",children:"Overview"}),", we can use these principals to import from other GCP projects under the same service account."]}),"\n",(0,n.jsx)(o.admonition,{type:"info",children:(0,n.jsxs)(o.p,{children:["This also allows cross-project importing, meaning images from an instance in ",(0,n.jsx)(o.code,{children:"Project-A"})," can be saved to a bucket in ",(0,n.jsx)(o.code,{children:"Project-B"})]})}),"\n",(0,n.jsxs)(o.p,{children:["In this example we'll be using ",(0,n.jsx)(o.code,{children:"cadoserviceaccount@my-project.iam.gserviceaccount.com"})," as the service account we've already set up, and ",(0,n.jsx)(o.code,{children:"0123456789-compute0@developer.gserviceaccount.com"})," as the default Compute Engine principal for our primary project."]}),"\n",(0,n.jsx)(o.admonition,{type:"info",children:(0,n.jsx)(o.p,{children:"Cloud Build API needs to be enabled in every GCP project from which you want to collect"})}),"\n",(0,n.jsx)(o.h2,{id:"secondary-project-permissions",children:"Secondary Project Permissions"}),"\n",(0,n.jsxs)(o.p,{children:["In the secondary project, navigate to the ",(0,n.jsx)(o.strong,{children:"IAM and Admin > IAM"})," section and select ",(0,n.jsx)(o.strong,{children:"Grant Access"}),". Add both the created service account and Compute Engine ",(0,n.jsx)(o.code,{children:"gserviceaccount.com"})," emails in the ",(0,n.jsx)(o.strong,{children:"Add Principal"})," section and assign them both the ",(0,n.jsx)(o.strong,{children:"Custom -> Cado Role"})," role. More info on the ",(0,n.jsx)(o.strong,{children:"Cado Role"})," can be found ",(0,n.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-settings###The-Cado-Role",children:"here"})]}),"\n",(0,n.jsx)("img",{src:"/img/gcp-crossproject-granting.png",height:"800",width:"600",alt:"GCP Cross Project"}),"\n",(0,n.jsxs)(o.p,{children:["Once added they should both appear as principals in the ",(0,n.jsx)(o.strong,{children:"IAM"})," section of that project."]}),"\n",(0,n.jsx)(o.admonition,{type:"tip",children:(0,n.jsxs)(o.p,{children:["This approach also works for adding permissions to Folders or Organizations. Simply select whichever resource you wish to grant access to in the ",(0,n.jsx)(o.a,{href:"https://console.cloud.google.com/cloud-resource-manager",children:"Manage Resources"})," section, and navigate to the ",(0,n.jsx)(o.strong,{children:"IAM and Admin > IAM"})," section for that resource."]})}),"\n",(0,n.jsx)(o.h1,{id:"project-selection",children:"Project Selection"}),"\n",(0,n.jsxs)(o.p,{children:["Now in Cado, if the credentials of the service account are already in the platform after following the ",(0,n.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-settings",children:"Overview"}),", when importing from GCP you will now have a selection of projects to choose from."]}),"\n",(0,n.jsx)(o.p,{children:(0,n.jsx)(o.img,{alt:"GCP-Cado-Cross-Project",src:t(34212).A+"",width:"789",height:"403"})}),"\n",(0,n.jsxs)(o.admonition,{type:"info",children:[(0,n.jsxs)(o.p,{children:["This configuration only allows us to import from our Secondary Project to our Primary Project. If we want to be able to import the other way as well, the Secondary Account's Cloud Build ",(0,n.jsx)(o.code,{children:"gserviceaccount.com"})," will need to be granted access to the Primary Account's IAM section and given the ",(0,n.jsx)(o.strong,{children:"Cado Role"})," role."]}),(0,n.jsxs)(o.p,{children:["Simply follow the same steps in the ",(0,n.jsx)(o.strong,{children:"Secondary Project Permissions"})," section, but using the Secondary Project's principal and adding it to the Primary Project."]})]})]})}function l(e={}){const{wrapper:o}={...(0,r.R)(),...e.components};return o?(0,n.jsx)(o,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},34212:(e,o,t)=>{t.d(o,{A:()=>n});const n=t.p+"assets/images/gcp-cado-project-selection-2762ea12f2f1cc7d5b52ca71dafb1590.png"},28453:(e,o,t)=>{t.d(o,{R:()=>c,x:()=>i});var n=t(96540);const r={},s=n.createContext(r);function c(e){const o=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),n.createElement(s.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2309],{58676:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>c,default:()=>l,frontMatter:()=>s,metadata:()=>i,toc:()=>d});var n=t(74848),r=t(28453);const s={title:"Cross-Project setup",hide_title:!0,sidebar_position:5},c="How to set up Cross-Project Imports in GCP",i={id:"cado/deploy/gcp/gcp-cross-project",title:"Cross-Project setup",description:"After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the Overview, we can use these principals to import from other GCP projects under the same service account.",source:"@site/docs/cado/deploy/gcp/gcp-cross-project.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-cross-project",permalink:"/cado/deploy/gcp/gcp-cross-project",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-cross-project.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"Cross-Project setup",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Platform Encryption in GCP",permalink:"/cado/deploy/gcp/data-encryption-overview"},next:{title:"IAM permissions description",permalink:"/cado/deploy/gcp/iam-description"}},a={},d=[{value:"Secondary Project Permissions",id:"secondary-project-permissions",level:2}];function p(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(o.h1,{id:"how-to-set-up-cross-project-imports-in-gcp",children:"How to set up Cross-Project Imports in GCP"}),"\n",(0,n.jsxs)(o.p,{children:["After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the ",(0,n.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-settings",children:"Overview"}),", we can use these principals to import from other GCP projects under the same service account."]}),"\n",(0,n.jsx)(o.admonition,{type:"info",children:(0,n.jsxs)(o.p,{children:["This also allows cross-project importing, meaning images from an instance in ",(0,n.jsx)(o.code,{children:"Project-A"})," can be saved to a bucket in ",(0,n.jsx)(o.code,{children:"Project-B"})]})}),"\n",(0,n.jsxs)(o.p,{children:["In this example we'll be using ",(0,n.jsx)(o.code,{children:"cadoserviceaccount@my-project.iam.gserviceaccount.com"})," as the service account we've already set up, and ",(0,n.jsx)(o.code,{children:"0123456789-compute0@developer.gserviceaccount.com"})," as the default Compute Engine principal for our primary project."]}),"\n",(0,n.jsx)(o.admonition,{type:"info",children:(0,n.jsx)(o.p,{children:"Cloud Build API needs to be enabled in every GCP project from which you want to collect"})}),"\n",(0,n.jsx)(o.h2,{id:"secondary-project-permissions",children:"Secondary Project Permissions"}),"\n",(0,n.jsxs)(o.p,{children:["In the secondary project, navigate to the ",(0,n.jsx)(o.strong,{children:"IAM and Admin > IAM"})," section and select ",(0,n.jsx)(o.strong,{children:"Grant Access"}),". Add both the created service account and Compute Engine ",(0,n.jsx)(o.code,{children:"gserviceaccount.com"})," emails in the ",(0,n.jsx)(o.strong,{children:"Add Principal"})," section and assign them both the ",(0,n.jsx)(o.strong,{children:"Custom -> Cado Role"})," role. More info on the ",(0,n.jsx)(o.strong,{children:"Cado Role"})," can be found ",(0,n.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-settings###The-Cado-Role",children:"here"})]}),"\n",(0,n.jsx)("img",{src:"/img/gcp-crossproject-granting.png",height:"800",width:"600",alt:"GCP Cross Project"}),"\n",(0,n.jsxs)(o.p,{children:["Once added they should both appear as principals in the ",(0,n.jsx)(o.strong,{children:"IAM"})," section of that project."]}),"\n",(0,n.jsx)(o.admonition,{type:"tip",children:(0,n.jsxs)(o.p,{children:["This approach also works for adding permissions to Folders or Organizations. Simply select whichever resource you wish to grant access to in the ",(0,n.jsx)(o.a,{href:"https://console.cloud.google.com/cloud-resource-manager",children:"Manage Resources"})," section, and navigate to the ",(0,n.jsx)(o.strong,{children:"IAM and Admin > IAM"})," section for that resource."]})}),"\n",(0,n.jsx)(o.h1,{id:"project-selection",children:"Project Selection"}),"\n",(0,n.jsxs)(o.p,{children:["Now in Cado, if the credentials of the service account are already in the platform after following the ",(0,n.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-settings",children:"Overview"}),", when importing from GCP you will now have a selection of projects to choose from."]}),"\n",(0,n.jsx)(o.p,{children:(0,n.jsx)(o.img,{alt:"GCP-Cado-Cross-Project",src:t(34212).A+"",width:"789",height:"403"})}),"\n",(0,n.jsxs)(o.admonition,{type:"info",children:[(0,n.jsxs)(o.p,{children:["This configuration only allows us to import from our Secondary Project to our Primary Project. If we want to be able to import the other way as well, the Secondary Account's Cloud Build ",(0,n.jsx)(o.code,{children:"gserviceaccount.com"})," will need to be granted access to the Primary Account's IAM section and given the ",(0,n.jsx)(o.strong,{children:"Cado Role"})," role."]}),(0,n.jsxs)(o.p,{children:["Simply follow the same steps in the ",(0,n.jsx)(o.strong,{children:"Secondary Project Permissions"})," section, but using the Secondary Project's principal and adding it to the Primary Project."]})]})]})}function l(e={}){const{wrapper:o}={...(0,r.R)(),...e.components};return o?(0,n.jsx)(o,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},34212:(e,o,t)=>{t.d(o,{A:()=>n});const n=t.p+"assets/images/gcp-cado-project-selection-2762ea12f2f1cc7d5b52ca71dafb1590.png"},28453:(e,o,t)=>{t.d(o,{R:()=>c,x:()=>i});var n=t(96540);const r={},s=n.createContext(r);function c(e){const o=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),n.createElement(s.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/1bdcb11a.99179d1f.js b/assets/js/1bdcb11a.d52301d1.js similarity index 96% rename from assets/js/1bdcb11a.99179d1f.js rename to assets/js/1bdcb11a.d52301d1.js index 85546cc2e..09d71f777 100644 --- a/assets/js/1bdcb11a.99179d1f.js +++ b/assets/js/1bdcb11a.d52301d1.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2284],{38189:(t,e,i)=>{i.r(e),i.d(e,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var n=i(74848),s=i(28453);const a={title:"Automated Investigation",hide_title:!0,sidebar_position:4},o="What is the Automated Investigation Tab?",r={id:"cado/investigate/automated-investigation",title:"Automated Investigation",description:"The Automated Investigation tab offers a summary of the findings from Cado\u2019s investigation. It provides key insights into what was discovered during the analysis.",source:"@site/docs/cado/investigate/automated-investigation.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/automated-investigation",permalink:"/cado/investigate/automated-investigation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/automated-investigation.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Automated Investigation",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Timeline Search",permalink:"/cado/investigate/timeline-search"},next:{title:"Browse Disk",permalink:"/cado/investigate/browse-disk"}},d={},c=[];function u(t){const e={h1:"h1",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...t.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{id:"what-is-the-automated-investigation-tab",children:"What is the Automated Investigation Tab?"}),"\n",(0,n.jsx)(e.p,{children:"The Automated Investigation tab offers a summary of the findings from Cado\u2019s investigation. It provides key insights into what was discovered during the analysis."}),"\n",(0,n.jsx)(e.p,{children:"The Automated Investigation includes:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Investigation Trigger"}),": A description of how the investigation was initiated."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Verdict"}),": A concise, one-line summary of Cado's assessment of what occurred."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Suspected Compromised Assets"}),": A list of assets that may have been compromised during the event."]}),"\n"]}),"\n",(0,n.jsx)(e.p,{children:"The timeline highlights up to 50 events, prioritizing those that are most significant. Events are more likely to be shown if they are flagged as malicious, tagged by a user, or occurred in rapid succession."}),"\n",(0,n.jsx)(e.p,{children:(0,n.jsx)(e.img,{alt:"Automated Investigation",src:i(89138).A+"",width:"3352",height:"1078"})})]})}function h(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(u,{...t})}):u(t)}},89138:(t,e,i)=>{i.d(e,{A:()=>n});const n=i.p+"assets/images/tutorial5-d8a6025a2c5bc622b0067f3997112536.png"},28453:(t,e,i)=>{i.d(e,{R:()=>o,x:()=>r});var n=i(96540);const s={},a=n.createContext(s);function o(t){const e=n.useContext(a);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function r(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:o(t.components),n.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2284],{38189:(t,e,i)=>{i.r(e),i.d(e,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var n=i(74848),s=i(28453);const a={title:"Automated Investigation",hide_title:!0,sidebar_position:4},o="What is the Automated Investigation Tab?",r={id:"cado/investigate/automated-investigation",title:"Automated Investigation",description:"The Automated Investigation tab offers a summary of the findings from Cado\u2019s investigation. It provides key insights into what was discovered during the analysis.",source:"@site/docs/cado/investigate/automated-investigation.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/automated-investigation",permalink:"/cado/investigate/automated-investigation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/automated-investigation.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Automated Investigation",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Timeline Search",permalink:"/cado/investigate/timeline-search"},next:{title:"Browse Disk",permalink:"/cado/investigate/browse-disk"}},d={},c=[];function u(t){const e={h1:"h1",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...t.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{id:"what-is-the-automated-investigation-tab",children:"What is the Automated Investigation Tab?"}),"\n",(0,n.jsx)(e.p,{children:"The Automated Investigation tab offers a summary of the findings from Cado\u2019s investigation. It provides key insights into what was discovered during the analysis."}),"\n",(0,n.jsx)(e.p,{children:"The Automated Investigation includes:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Investigation Trigger"}),": A description of how the investigation was initiated."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Verdict"}),": A concise, one-line summary of Cado's assessment of what occurred."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Suspected Compromised Assets"}),": A list of assets that may have been compromised during the event."]}),"\n"]}),"\n",(0,n.jsx)(e.p,{children:"The timeline highlights up to 50 events, prioritizing those that are most significant. Events are more likely to be shown if they are flagged as malicious, tagged by a user, or occurred in rapid succession."}),"\n",(0,n.jsx)(e.p,{children:(0,n.jsx)(e.img,{alt:"Automated Investigation",src:i(89138).A+"",width:"3352",height:"1078"})})]})}function h(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(u,{...t})}):u(t)}},89138:(t,e,i)=>{i.d(e,{A:()=>n});const n=i.p+"assets/images/tutorial5-d8a6025a2c5bc622b0067f3997112536.png"},28453:(t,e,i)=>{i.d(e,{R:()=>o,x:()=>r});var n=i(96540);const s={},a=n.createContext(s);function o(t){const e=n.useContext(a);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function r(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:o(t.components),n.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/1dc01342.bd3749cb.js b/assets/js/1dc01342.84e375ad.js similarity index 99% rename from assets/js/1dc01342.bd3749cb.js rename to assets/js/1dc01342.84e375ad.js index 8cbf688eb..bdd8022f1 100644 --- a/assets/js/1dc01342.bd3749cb.js +++ b/assets/js/1dc01342.84e375ad.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8987],{60841:(e,i,t)=>{t.r(i),t.d(i,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var n=t(74848),s=t(28453);const r={title:"Import from subscriptions and tenants in Azure",hide_title:!0,sidebar_position:7},o="How to import from other Azure subscriptions and tenants in Azure",a={id:"cado/deploy/cross/azure-cross-tenancy-subscriptions",title:"Import from subscriptions and tenants in Azure",description:"Setting up an app registration for cross tenancy/subscription acquisitions",source:"@site/docs/cado/deploy/cross/azure-cross-tenancy-subscriptions.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/azure-cross-tenancy-subscriptions",permalink:"/cado/deploy/cross/azure-cross-tenancy-subscriptions",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/azure-cross-tenancy-subscriptions.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"Import from subscriptions and tenants in Azure",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Adding Azure subscriptions to Azure/AWS/GCP",permalink:"/cado/deploy/cross/adding-azure"},next:{title:"Adding GCP Projects to Azure/AWS",permalink:"/cado/deploy/cross/adding-gcp"}},c={},d=[{value:"Setting up an app registration for cross tenancy/subscription acquisitions",id:"setting-up-an-app-registration-for-cross-tenancysubscription-acquisitions",level:3},{value:"Required role-assignments",id:"required-role-assignments",level:4},{value:"Registering credentials within Cado",id:"registering-credentials-within-cado",level:3}];function l(e){const i={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(i.h1,{id:"how-to-import-from-other-azure-subscriptions-and-tenants-in-azure",children:"How to import from other Azure subscriptions and tenants in Azure"}),"\n",(0,n.jsx)(i.h3,{id:"setting-up-an-app-registration-for-cross-tenancysubscription-acquisitions",children:"Setting up an app registration for cross tenancy/subscription acquisitions"}),"\n",(0,n.jsxs)(i.p,{children:["To leverage cross Azure acquisitions, you need to create an ",(0,n.jsx)(i.strong,{children:(0,n.jsx)(i.a,{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app",children:"Azure app registration"})})," in the Azure tenancy you want to acquire resources from. Follow the contents of this guide, and select the option for ",(0,n.jsx)(i.code,{children:"Accounts in any organizational directory (Any Azure AD directory - Multitenant)"}),". ",(0,n.jsx)(i.img,{alt:"Azure App Registration",src:t(23284).A+"",width:"1048",height:"516"})]}),"\n",(0,n.jsx)(i.admonition,{type:"tip",children:(0,n.jsxs)(i.p,{children:["If you are only importing from a separate subscription within the same tenancy as your Cado deployment, you can use ",(0,n.jsx)(i.code,{children:"Accounts in this organizational directory only"})," as your app registration account type."]})}),"\n",(0,n.jsxs)(i.p,{children:["You can then generate a client secret associated with this app registration using ",(0,n.jsx)(i.strong,{children:(0,n.jsx)(i.a,{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-credentials",children:"this guide"})}),", be sure to keep a note of it as you will need it to register the app with the Cado platform. ",(0,n.jsx)(i.img,{alt:"Creating a client secret",src:t(87).A+"",width:"1606",height:"595"}),"\nBy default, when you create an app registration, Azure will also create an enterprise application alongside it with the same name.\nNavigate to this in Microsoft Entra, and under the ",(0,n.jsx)(i.strong,{children:"properties"})," sidebar, allow the option for ",(0,n.jsx)(i.code,{children:"Enabled for users to sign-in"}),". Without enabling this option, cross tenancy/subscription acquisitions will not work.\n",(0,n.jsx)(i.img,{alt:"Azure Enterprise App Registration Permission",src:t(55638).A+"",width:"1273",height:"443"})]}),"\n",(0,n.jsx)(i.h4,{id:"required-role-assignments",children:"Required role-assignments"}),"\n",(0,n.jsx)(i.p,{children:"Once you have created your app registration, you will need to give it the required Azure role-assignments to allow it to access your Azure resources."}),"\n",(0,n.jsxs)(i.ol,{children:["\n",(0,n.jsx)(i.li,{children:"Go to the Azure management group you want to acquire from, this could be within the same, or a different Azure tenancy."}),"\n",(0,n.jsxs)(i.li,{children:["Select your management group and go to the Access control (IAM) permissions for it. ",(0,n.jsx)(i.img,{alt:"Adding IAM permissions",src:t(14227).A+"",width:"1357",height:"687"})]}),"\n",(0,n.jsxs)(i.li,{children:["Select ",(0,n.jsx)(i.code,{children:"Add role assignment"})," and add the following role-assignments for your app registration: ",(0,n.jsx)(i.img,{alt:"Adding IAM permissions to app registration",src:t(17517).A+"",width:"1900",height:"802"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Storage Account Contributor"})}),"\n",(0,n.jsx)(i.li,{children:"Required for forensic preservation, chain of custody, storing and accessing forensic data and acquisition methods using Cado Host."}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Disk Snapshot Contributor"})}),"\n",(0,n.jsx)(i.li,{children:"Required to acquire Compute instances."}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Virtual Machine Contributor"})}),"\n",(0,n.jsx)(i.li,{children:"Required for core platform functionality including worker management and upgrades as well acquiring Compute instances."}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Monitoring Contributor"})}),"\n",(0,n.jsx)(i.li,{children:"Required for cross-tenant visibility."}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Azure Kubernetes Service Cluster Admin Role"})}),"\n",(0,n.jsx)(i.li,{children:"Required for Kubernetes acquisition and listing cluster credentials."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(i.admonition,{type:"tip",children:(0,n.jsxs)(i.p,{children:["Search for your app registration name under the ",(0,n.jsx)(i.code,{children:"Select members"})," prompt."]})}),"\n",(0,n.jsx)(i.p,{children:"With these credentials in place, you are able to register the app with Cado."}),"\n",(0,n.jsx)(i.h3,{id:"registering-credentials-within-cado",children:"Registering credentials within Cado"}),"\n",(0,n.jsx)(i.p,{children:"Once you have created the app registration, you will be able to register the credentials within Cado using the following steps:"}),"\n",(0,n.jsxs)(i.ol,{children:["\n",(0,n.jsxs)(i.li,{children:["Navigate to the to the settings page and choose the ",(0,n.jsx)(i.code,{children:"Cloud"})," option."]}),"\n",(0,n.jsxs)(i.li,{children:["Select the ",(0,n.jsx)(i.strong,{children:"Azure"})," tab and click ",(0,n.jsx)(i.code,{children:"Add Azure Credentials"}),". ",(0,n.jsx)(i.img,{alt:"Azure Credentials Page",src:t(69550).A+"",width:"1908",height:"872"})]}),"\n",(0,n.jsxs)(i.li,{children:["Using the information generated during the the app registration setup, fill-in the required fields with the appropriate information and click ",(0,n.jsx)(i.code,{children:"Submit"}),". ",(0,n.jsx)(i.strong,{children:"Use the subscription ID you assigned app-registration permissions for"}),". ",(0,n.jsx)(i.img,{alt:"Azure Credentials Insertion Page",src:t(15650).A+"",width:"1332",height:"1072"})]}),"\n"]}),"\n",(0,n.jsx)(i.admonition,{type:"tip",children:(0,n.jsxs)(i.p,{children:[(0,n.jsx)(i.code,{children:"Cloud ID"})," is only used to assign a name to the added credentials, it can be any memorable name of your choosing."]})}),"\n",(0,n.jsxs)(i.p,{children:["Some of the information you will need is on the Azure app registration page, shown below: ",(0,n.jsx)(i.img,{alt:"Azure App Registration Page",src:t(35397).A+"",width:"1008",height:"552"})]}),"\n",(0,n.jsx)(i.p,{children:'Set the Cloud ID as a name you will recognize, e.g. "AzureCrossAccount".'}),"\n",(0,n.jsx)(i.p,{children:"You can find the Tenant ID under Azure Active Directory."}),"\n",(0,n.jsx)(i.p,{children:"The Application Client ID is the Application Client ID of the application, found on the Properties tab of the Enterprise Application you created earlier."}),"\n",(0,n.jsx)(i.p,{children:"The Client Secret is from the the first step above."}),"\n",(0,n.jsxs)(i.p,{children:["The credentials are now ready to use within Cado. Go to an Azure import and select the credential you wish to use from the table in the first step. ",(0,n.jsx)(i.img,{alt:"Using Custom Azure Credentials",src:t(18010).A+"",width:"1832",height:"632"})," You are now able to import resources managed by other tenants and or subscriptions as normal."]}),"\n",(0,n.jsx)(i.admonition,{type:"tip",children:(0,n.jsx)(i.p,{children:"If you encounter an error when attempting to acquire a resource across Azure accounts or subscriptions, verify that a typo has not been made during addition, or if the wrong information has been entered in the wrong field."})})]})}function p(e={}){const{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,n.jsx)(i,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},17517:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-adding-permissions-to-app-registration-91d7323c8ba189612ae5ea3fbabbd66d.png"},14227:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-adding-subscription-permissions-e2146bdc5ec4876758142af7a70bbe9f.png"},35397:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-app-registration-info-a5c7db188b8087a1e813976ae6484c0d.png"},87:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-creating-client-secret-03828e236f7cf994e5a59b1679a09140.png"},69550:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-creds-page-bdefcb9f68f08bf069307313b5a22e3b.png"},55638:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-enterprise-app-permission-6a7d1aeb3be81574d65c00d1a9ff6e49.png"},15650:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-insert-custom-creds-adad74697f96629de11ee9482cbd1833.png"},23284:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-registering-app-2dd0987baae6d76b0eb998ec283da27e.png"},18010:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/import-cloud-6754420b4e7cc81d73642d1671355124.png"},28453:(e,i,t)=>{t.d(i,{R:()=>o,x:()=>a});var n=t(96540);const s={},r=n.createContext(s);function o(e){const i=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function a(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(r.Provider,{value:i},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8987],{60841:(e,i,t)=>{t.r(i),t.d(i,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var n=t(74848),s=t(28453);const r={title:"Import from subscriptions and tenants in Azure",hide_title:!0,sidebar_position:7},o="How to import from other Azure subscriptions and tenants in Azure",a={id:"cado/deploy/cross/azure-cross-tenancy-subscriptions",title:"Import from subscriptions and tenants in Azure",description:"Setting up an app registration for cross tenancy/subscription acquisitions",source:"@site/docs/cado/deploy/cross/azure-cross-tenancy-subscriptions.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/azure-cross-tenancy-subscriptions",permalink:"/cado/deploy/cross/azure-cross-tenancy-subscriptions",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/azure-cross-tenancy-subscriptions.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"Import from subscriptions and tenants in Azure",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Adding Azure subscriptions to Azure/AWS/GCP",permalink:"/cado/deploy/cross/adding-azure"},next:{title:"Adding GCP Projects to Azure/AWS",permalink:"/cado/deploy/cross/adding-gcp"}},c={},d=[{value:"Setting up an app registration for cross tenancy/subscription acquisitions",id:"setting-up-an-app-registration-for-cross-tenancysubscription-acquisitions",level:3},{value:"Required role-assignments",id:"required-role-assignments",level:4},{value:"Registering credentials within Cado",id:"registering-credentials-within-cado",level:3}];function l(e){const i={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(i.h1,{id:"how-to-import-from-other-azure-subscriptions-and-tenants-in-azure",children:"How to import from other Azure subscriptions and tenants in Azure"}),"\n",(0,n.jsx)(i.h3,{id:"setting-up-an-app-registration-for-cross-tenancysubscription-acquisitions",children:"Setting up an app registration for cross tenancy/subscription acquisitions"}),"\n",(0,n.jsxs)(i.p,{children:["To leverage cross Azure acquisitions, you need to create an ",(0,n.jsx)(i.strong,{children:(0,n.jsx)(i.a,{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app",children:"Azure app registration"})})," in the Azure tenancy you want to acquire resources from. Follow the contents of this guide, and select the option for ",(0,n.jsx)(i.code,{children:"Accounts in any organizational directory (Any Azure AD directory - Multitenant)"}),". ",(0,n.jsx)(i.img,{alt:"Azure App Registration",src:t(23284).A+"",width:"1048",height:"516"})]}),"\n",(0,n.jsx)(i.admonition,{type:"tip",children:(0,n.jsxs)(i.p,{children:["If you are only importing from a separate subscription within the same tenancy as your Cado deployment, you can use ",(0,n.jsx)(i.code,{children:"Accounts in this organizational directory only"})," as your app registration account type."]})}),"\n",(0,n.jsxs)(i.p,{children:["You can then generate a client secret associated with this app registration using ",(0,n.jsx)(i.strong,{children:(0,n.jsx)(i.a,{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-credentials",children:"this guide"})}),", be sure to keep a note of it as you will need it to register the app with the Cado platform. ",(0,n.jsx)(i.img,{alt:"Creating a client secret",src:t(87).A+"",width:"1606",height:"595"}),"\nBy default, when you create an app registration, Azure will also create an enterprise application alongside it with the same name.\nNavigate to this in Microsoft Entra, and under the ",(0,n.jsx)(i.strong,{children:"properties"})," sidebar, allow the option for ",(0,n.jsx)(i.code,{children:"Enabled for users to sign-in"}),". Without enabling this option, cross tenancy/subscription acquisitions will not work.\n",(0,n.jsx)(i.img,{alt:"Azure Enterprise App Registration Permission",src:t(55638).A+"",width:"1273",height:"443"})]}),"\n",(0,n.jsx)(i.h4,{id:"required-role-assignments",children:"Required role-assignments"}),"\n",(0,n.jsx)(i.p,{children:"Once you have created your app registration, you will need to give it the required Azure role-assignments to allow it to access your Azure resources."}),"\n",(0,n.jsxs)(i.ol,{children:["\n",(0,n.jsx)(i.li,{children:"Go to the Azure management group you want to acquire from, this could be within the same, or a different Azure tenancy."}),"\n",(0,n.jsxs)(i.li,{children:["Select your management group and go to the Access control (IAM) permissions for it. ",(0,n.jsx)(i.img,{alt:"Adding IAM permissions",src:t(14227).A+"",width:"1357",height:"687"})]}),"\n",(0,n.jsxs)(i.li,{children:["Select ",(0,n.jsx)(i.code,{children:"Add role assignment"})," and add the following role-assignments for your app registration: ",(0,n.jsx)(i.img,{alt:"Adding IAM permissions to app registration",src:t(17517).A+"",width:"1900",height:"802"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Storage Account Contributor"})}),"\n",(0,n.jsx)(i.li,{children:"Required for forensic preservation, chain of custody, storing and accessing forensic data and acquisition methods using Cado Host."}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Disk Snapshot Contributor"})}),"\n",(0,n.jsx)(i.li,{children:"Required to acquire Compute instances."}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Virtual Machine Contributor"})}),"\n",(0,n.jsx)(i.li,{children:"Required for core platform functionality including worker management and upgrades as well acquiring Compute instances."}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Monitoring Contributor"})}),"\n",(0,n.jsx)(i.li,{children:"Required for cross-tenant visibility."}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"Azure Kubernetes Service Cluster Admin Role"})}),"\n",(0,n.jsx)(i.li,{children:"Required for Kubernetes acquisition and listing cluster credentials."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(i.admonition,{type:"tip",children:(0,n.jsxs)(i.p,{children:["Search for your app registration name under the ",(0,n.jsx)(i.code,{children:"Select members"})," prompt."]})}),"\n",(0,n.jsx)(i.p,{children:"With these credentials in place, you are able to register the app with Cado."}),"\n",(0,n.jsx)(i.h3,{id:"registering-credentials-within-cado",children:"Registering credentials within Cado"}),"\n",(0,n.jsx)(i.p,{children:"Once you have created the app registration, you will be able to register the credentials within Cado using the following steps:"}),"\n",(0,n.jsxs)(i.ol,{children:["\n",(0,n.jsxs)(i.li,{children:["Navigate to the to the settings page and choose the ",(0,n.jsx)(i.code,{children:"Cloud"})," option."]}),"\n",(0,n.jsxs)(i.li,{children:["Select the ",(0,n.jsx)(i.strong,{children:"Azure"})," tab and click ",(0,n.jsx)(i.code,{children:"Add Azure Credentials"}),". ",(0,n.jsx)(i.img,{alt:"Azure Credentials Page",src:t(69550).A+"",width:"1908",height:"872"})]}),"\n",(0,n.jsxs)(i.li,{children:["Using the information generated during the the app registration setup, fill-in the required fields with the appropriate information and click ",(0,n.jsx)(i.code,{children:"Submit"}),". ",(0,n.jsx)(i.strong,{children:"Use the subscription ID you assigned app-registration permissions for"}),". ",(0,n.jsx)(i.img,{alt:"Azure Credentials Insertion Page",src:t(15650).A+"",width:"1332",height:"1072"})]}),"\n"]}),"\n",(0,n.jsx)(i.admonition,{type:"tip",children:(0,n.jsxs)(i.p,{children:[(0,n.jsx)(i.code,{children:"Cloud ID"})," is only used to assign a name to the added credentials, it can be any memorable name of your choosing."]})}),"\n",(0,n.jsxs)(i.p,{children:["Some of the information you will need is on the Azure app registration page, shown below: ",(0,n.jsx)(i.img,{alt:"Azure App Registration Page",src:t(35397).A+"",width:"1008",height:"552"})]}),"\n",(0,n.jsx)(i.p,{children:'Set the Cloud ID as a name you will recognize, e.g. "AzureCrossAccount".'}),"\n",(0,n.jsx)(i.p,{children:"You can find the Tenant ID under Azure Active Directory."}),"\n",(0,n.jsx)(i.p,{children:"The Application Client ID is the Application Client ID of the application, found on the Properties tab of the Enterprise Application you created earlier."}),"\n",(0,n.jsx)(i.p,{children:"The Client Secret is from the the first step above."}),"\n",(0,n.jsxs)(i.p,{children:["The credentials are now ready to use within Cado. Go to an Azure import and select the credential you wish to use from the table in the first step. ",(0,n.jsx)(i.img,{alt:"Using Custom Azure Credentials",src:t(18010).A+"",width:"1832",height:"632"})," You are now able to import resources managed by other tenants and or subscriptions as normal."]}),"\n",(0,n.jsx)(i.admonition,{type:"tip",children:(0,n.jsx)(i.p,{children:"If you encounter an error when attempting to acquire a resource across Azure accounts or subscriptions, verify that a typo has not been made during addition, or if the wrong information has been entered in the wrong field."})})]})}function p(e={}){const{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,n.jsx)(i,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},17517:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-adding-permissions-to-app-registration-91d7323c8ba189612ae5ea3fbabbd66d.png"},14227:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-adding-subscription-permissions-e2146bdc5ec4876758142af7a70bbe9f.png"},35397:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-app-registration-info-a5c7db188b8087a1e813976ae6484c0d.png"},87:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-creating-client-secret-03828e236f7cf994e5a59b1679a09140.png"},69550:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-creds-page-bdefcb9f68f08bf069307313b5a22e3b.png"},55638:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-enterprise-app-permission-6a7d1aeb3be81574d65c00d1a9ff6e49.png"},15650:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-insert-custom-creds-adad74697f96629de11ee9482cbd1833.png"},23284:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/azure-registering-app-2dd0987baae6d76b0eb998ec283da27e.png"},18010:(e,i,t)=>{t.d(i,{A:()=>n});const n=t.p+"assets/images/import-cloud-6754420b4e7cc81d73642d1671355124.png"},28453:(e,i,t)=>{t.d(i,{R:()=>o,x:()=>a});var n=t(96540);const s={},r=n.createContext(s);function o(e){const i=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function a(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(r.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/212ec08f.dbddfe19.js b/assets/js/212ec08f.b12564b0.js similarity index 97% rename from assets/js/212ec08f.dbddfe19.js rename to assets/js/212ec08f.b12564b0.js index 8fcd5336e..ac8507552 100644 --- a/assets/js/212ec08f.dbddfe19.js +++ b/assets/js/212ec08f.b12564b0.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9316],{51780:(t,e,a)=>{a.r(e),a.d(e,{assets:()=>r,contentTitle:()=>n,default:()=>m,frontMatter:()=>i,metadata:()=>d,toc:()=>c});var o=a(74848),s=a(28453);const i={title:"Lambda",hide_title:!0,sidebar_position:6},n="How to Import Data from AWS Lambda",d={id:"cado/discovery-import/aws/aws-lambda",title:"Lambda",description:"The Cado platform allows you to acquire AWS Lambda functions, which are serverless computing services.",source:"@site/docs/cado/discovery-import/aws/aws-lambda.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-lambda",permalink:"/cado/discovery-import/aws/aws-lambda",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-lambda.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Lambda",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"EKS",permalink:"/cado/discovery-import/aws/aws-eks"},next:{title:"AWS Memory Analysis",permalink:"/cado/discovery-import/aws/memory"}},r={},c=[{value:"Steps to Import",id:"steps-to-import",level:3},{value:"Output",id:"output",level:2},{value:"CloudWatch Logs Integration",id:"cloudwatch-logs-integration",level:3},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function l(t){const e={em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.R)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{id:"how-to-import-data-from-aws-lambda",children:"How to Import Data from AWS Lambda"}),"\n",(0,o.jsx)(e.p,{children:"The Cado platform allows you to acquire AWS Lambda functions, which are serverless computing services."}),"\n",(0,o.jsx)(e.h3,{id:"steps-to-import",children:"Steps to Import"}),"\n",(0,o.jsxs)(e.ol,{children:["\n",(0,o.jsxs)(e.li,{children:[(0,o.jsx)(e.strong,{children:"Select the Region"})," where the Lambda function is located."]}),"\n",(0,o.jsx)(e.li,{children:"You will see a table of available functions. Select the function you wish to acquire."}),"\n",(0,o.jsxs)(e.li,{children:["Confirm the details and click ",(0,o.jsx)(e.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Import Lambda Function",src:a(42516).A+"",width:"1820",height:"626"})}),"\n",(0,o.jsx)(e.h2,{id:"output",children:"Output"}),"\n",(0,o.jsxs)(e.p,{children:["Once processing is complete, the Lambda function\u2019s events will be added to the timeline. You can view the Lambda function\u2019s code in the ",(0,o.jsx)(e.strong,{children:"Browse Disk"})," tab."]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Lambda Function Code",src:a(54344).A+"",width:"2150",height:"1291"})}),"\n",(0,o.jsx)(e.h3,{id:"cloudwatch-logs-integration",children:"CloudWatch Logs Integration"}),"\n",(0,o.jsx)(e.p,{children:"Lambda automatically sends logs from your code to a CloudWatch Logs group associated with the function. Cado captures these logs and adds them to your timeline, enabling you to view any logging statements made by the function."}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Cloudwatch Logs",src:a(24915).A+"",width:"2157",height:"1268"})}),"\n",(0,o.jsxs)(e.p,{children:[(0,o.jsx)(e.em,{children:"Note:"})," Cado imports the image of container-based Lambda functions from the Amazon Elastic Container Registry."]}),"\n",(0,o.jsx)(e.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,o.jsx)(e.p,{children:"The following diagram illustrates how Lambda acquisitions operate:"}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Lambda Data Flow",src:a(41667).A+"",width:"1912",height:"1062"})})]})}function m(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(l,{...t})}):l(t)}},24915:(t,e,a)=>{a.d(e,{A:()=>o});const o=a.p+"assets/images/aws-lambda-cloudwatch-626d30a04a944d662dd2f07e49a2e377.png"},54344:(t,e,a)=>{a.d(e,{A:()=>o});const o=a.p+"assets/images/aws-lambda-code-94ebd04039523e0161ddd9ae0b5364a8.png"},42516:(t,e,a)=>{a.d(e,{A:()=>o});const o=a.p+"assets/images/import-lambda-362ec6f3fd1bd776b42653b365f199d6.png"},41667:(t,e,a)=>{a.d(e,{A:()=>o});const o=a.p+"assets/images/lambda-collection-ea8401f8421f3431af85289755ee71f6.png"},28453:(t,e,a)=>{a.d(e,{R:()=>n,x:()=>d});var o=a(96540);const s={},i=o.createContext(s);function n(t){const e=o.useContext(i);return o.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function d(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:n(t.components),o.createElement(i.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9316],{51780:(t,e,a)=>{a.r(e),a.d(e,{assets:()=>r,contentTitle:()=>n,default:()=>m,frontMatter:()=>i,metadata:()=>d,toc:()=>c});var o=a(74848),s=a(28453);const i={title:"Lambda",hide_title:!0,sidebar_position:6},n="How to Import Data from AWS Lambda",d={id:"cado/discovery-import/aws/aws-lambda",title:"Lambda",description:"The Cado platform allows you to acquire AWS Lambda functions, which are serverless computing services.",source:"@site/docs/cado/discovery-import/aws/aws-lambda.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-lambda",permalink:"/cado/discovery-import/aws/aws-lambda",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-lambda.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Lambda",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"EKS",permalink:"/cado/discovery-import/aws/aws-eks"},next:{title:"AWS Memory Analysis",permalink:"/cado/discovery-import/aws/memory"}},r={},c=[{value:"Steps to Import",id:"steps-to-import",level:3},{value:"Output",id:"output",level:2},{value:"CloudWatch Logs Integration",id:"cloudwatch-logs-integration",level:3},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function l(t){const e={em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.R)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{id:"how-to-import-data-from-aws-lambda",children:"How to Import Data from AWS Lambda"}),"\n",(0,o.jsx)(e.p,{children:"The Cado platform allows you to acquire AWS Lambda functions, which are serverless computing services."}),"\n",(0,o.jsx)(e.h3,{id:"steps-to-import",children:"Steps to Import"}),"\n",(0,o.jsxs)(e.ol,{children:["\n",(0,o.jsxs)(e.li,{children:[(0,o.jsx)(e.strong,{children:"Select the Region"})," where the Lambda function is located."]}),"\n",(0,o.jsx)(e.li,{children:"You will see a table of available functions. Select the function you wish to acquire."}),"\n",(0,o.jsxs)(e.li,{children:["Confirm the details and click ",(0,o.jsx)(e.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Import Lambda Function",src:a(42516).A+"",width:"1820",height:"626"})}),"\n",(0,o.jsx)(e.h2,{id:"output",children:"Output"}),"\n",(0,o.jsxs)(e.p,{children:["Once processing is complete, the Lambda function\u2019s events will be added to the timeline. You can view the Lambda function\u2019s code in the ",(0,o.jsx)(e.strong,{children:"Browse Disk"})," tab."]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Lambda Function Code",src:a(54344).A+"",width:"2150",height:"1291"})}),"\n",(0,o.jsx)(e.h3,{id:"cloudwatch-logs-integration",children:"CloudWatch Logs Integration"}),"\n",(0,o.jsx)(e.p,{children:"Lambda automatically sends logs from your code to a CloudWatch Logs group associated with the function. Cado captures these logs and adds them to your timeline, enabling you to view any logging statements made by the function."}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Cloudwatch Logs",src:a(24915).A+"",width:"2157",height:"1268"})}),"\n",(0,o.jsxs)(e.p,{children:[(0,o.jsx)(e.em,{children:"Note:"})," Cado imports the image of container-based Lambda functions from the Amazon Elastic Container Registry."]}),"\n",(0,o.jsx)(e.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,o.jsx)(e.p,{children:"The following diagram illustrates how Lambda acquisitions operate:"}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Lambda Data Flow",src:a(41667).A+"",width:"1912",height:"1062"})})]})}function m(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(l,{...t})}):l(t)}},24915:(t,e,a)=>{a.d(e,{A:()=>o});const o=a.p+"assets/images/aws-lambda-cloudwatch-626d30a04a944d662dd2f07e49a2e377.png"},54344:(t,e,a)=>{a.d(e,{A:()=>o});const o=a.p+"assets/images/aws-lambda-code-94ebd04039523e0161ddd9ae0b5364a8.png"},42516:(t,e,a)=>{a.d(e,{A:()=>o});const o=a.p+"assets/images/import-lambda-362ec6f3fd1bd776b42653b365f199d6.png"},41667:(t,e,a)=>{a.d(e,{A:()=>o});const o=a.p+"assets/images/lambda-collection-ea8401f8421f3431af85289755ee71f6.png"},28453:(t,e,a)=>{a.d(e,{R:()=>n,x:()=>d});var o=a(96540);const s={},i=o.createContext(s);function n(t){const e=o.useContext(i);return o.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function d(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:n(t.components),o.createElement(i.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/25df0945.b7ea7379.js b/assets/js/25df0945.b565e748.js similarity index 98% rename from assets/js/25df0945.b7ea7379.js rename to assets/js/25df0945.b565e748.js index 59b3a775c..de301185c 100644 --- a/assets/js/25df0945.b7ea7379.js +++ b/assets/js/25df0945.b565e748.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7714],{38357:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>l,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>d,toc:()=>a});var t=o(74848),i=o(28453);const s={title:"Deploy",hide_title:!0,sidebar_position:2},r="How to Deploy Cado Host",d={id:"cado/discovery-import/cado-host/deploy",title:"Deploy",description:"Deploy Through Cado Platform",source:"@site/docs/cado/discovery-import/cado-host/deploy.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/deploy",permalink:"/cado/discovery-import/cado-host/deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/deploy.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Deploy",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"What is Cado Host",permalink:"/cado/discovery-import/cado-host/intro"},next:{title:"Deploy via API",permalink:"/cado/discovery-import/cado-host/api-deploy"}},l={},a=[{value:"Deploy Through Cado Platform",id:"deploy-through-cado-platform",level:2},{value:"Using Script Builder",id:"using-script-builder",level:3},{value:"Using Direct Download",id:"using-direct-download",level:3},{value:"Running as Non-Administrator",id:"running-as-non-administrator",level:2},{value:"Windows SmartScreen",id:"windows-smartscreen",level:2},{value:"Setting the Binary as Executable on Linux and macOS",id:"setting-the-binary-as-executable-on-linux-and-macos",level:2},{value:"Using Local Storage",id:"using-local-storage",level:2},{value:"Deploying Cado Host to Multiple Devices",id:"deploying-cado-host-to-multiple-devices",level:2},{value:"Deployment from XDR Integrations",id:"deployment-from-xdr-integrations",level:2},{value:"Proxy and Network Access",id:"proxy-and-network-access",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-deploy-cado-host",children:"How to Deploy Cado Host"}),"\n",(0,t.jsx)(n.h2,{id:"deploy-through-cado-platform",children:"Deploy Through Cado Platform"}),"\n",(0,t.jsx)(n.p,{children:"You have two main options to deploy Cado Host:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Script Builder"}),": Build a custom script in the Cado Platform that can be run on any supported device. The script will collect triage artifacts, upload them to cloud storage, and automatically process the data in Cado."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Direct Download"}),": Download and run Cado Host independently without interacting with the Cado Platform."]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"using-script-builder",children:"Using Script Builder"}),"\n",(0,t.jsx)(n.p,{children:"Follow these steps to deploy Cado Host via the Script Builder:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Note:"})," Pre-signed URLs and API keys generated in AWS expire 2 hours after creation, and AWS limits the total upload size to 5GB."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"caution",children:(0,t.jsxs)(n.p,{children:["Make sure that devices running the scripts have HTTPS access to the AWS S3 endpoint, for example: ",(0,t.jsx)(n.code,{children:"https://.s3.amazonaws.com/"}),"."]})}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In the Cado Platform, go to ",(0,t.jsx)(n.strong,{children:"Investigation > Import > Cado Host"}),"."]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Import Evidence",src:o(51822).A+"",width:"842",height:"242"})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Select either ",(0,t.jsx)(n.strong,{children:"Direct Download"})," or ",(0,t.jsx)(n.strong,{children:"Script Builder"}),"."]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Direct Download"})," is suitable for manually downloading the Cado Host binary to endpoints via Group Policy or an MDM tool."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Script Builder"})," generates a script that can be run directly on a device via terminal, command prompt, or a remote execution tool."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Select OS, storage, etc",src:o(6237).A+"",width:"3288",height:"916"})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Script Builder"})," tab, select:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Your ",(0,t.jsx)(n.strong,{children:"Operating System"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Your ",(0,t.jsx)(n.strong,{children:"Cloud Storage"})," (where Cado Host will upload the collected data)."]}),"\n",(0,t.jsxs)(n.li,{children:["The ",(0,t.jsx)(n.strong,{children:"Cado Host Binary Deployment Method"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["If you choose ",(0,t.jsx)(n.strong,{children:"Manual"})," under ",(0,t.jsx)(n.code,{children:"Select Cado Host Binary Deployment"}),", download the Cado Host binary separately and then copy/paste the generated command into your terminal."]})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Copy the pre-generated command and run it on the target device, or click ",(0,t.jsx)(n.strong,{children:"Download Script"})," and run the downloaded script."]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Download Script",src:o(72783).A+"",width:"1860",height:"144"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"using-direct-download",children:"Using Direct Download"}),"\n",(0,t.jsx)(n.p,{children:"To manually download and deploy the Cado Host binary:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Select your ",(0,t.jsx)(n.strong,{children:"Operating System"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Click ",(0,t.jsx)(n.strong,{children:"Download"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Follow the instructions to run Cado Host locally on the device."}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Direct Download",src:o(80069).A+"",width:"690",height:"180"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"running-as-non-administrator",children:"Running as Non-Administrator"}),"\n",(0,t.jsx)(n.p,{children:"Cado Host is designed to be run through the command line. Without administrative privileges, some artifacts (e.g., memory or locked files) cannot be acquired."}),"\n",(0,t.jsx)(n.h2,{id:"windows-smartscreen",children:"Windows SmartScreen"}),"\n",(0,t.jsxs)(n.p,{children:["On Windows, running Cado Host outside of the command line may trigger Windows SmartScreen. If you run ",(0,t.jsx)(n.code,{children:"cado-host.exe"})," by manually clicking it, you will need to adjust the security settings:"]}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Right-click the executable."}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Select ",(0,t.jsx)(n.strong,{children:"Properties"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:'Untick the "Blocked" box in the Security section.'}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Properties",src:o(64091).A+"",width:"388",height:"175"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"setting-the-binary-as-executable-on-linux-and-macos",children:"Setting the Binary as Executable on Linux and macOS"}),"\n",(0,t.jsx)(n.p,{children:"For Linux and macOS, you may need to make the binary executable before running it:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-console",children:"chmod +x ./cado-host\n./cado-host\n"})}),"\n",(0,t.jsx)(n.h2,{id:"using-local-storage",children:"Using Local Storage"}),"\n",(0,t.jsx)(n.p,{children:"If no cloud storage option is set, files will be saved to the same folder where Cado Host is run. Currently, changing the storage location is not supported."}),"\n",(0,t.jsx)(n.h2,{id:"deploying-cado-host-to-multiple-devices",children:"Deploying Cado Host to Multiple Devices"}),"\n",(0,t.jsxs)(n.p,{children:["Cado Host can be deployed to multiple devices at once, such as through ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"https://support.microsoft.com/en-gb/help/816102/how-to-use-group-policy-to-remotely-install-software-in-windows-server",children:"Group Policy"})})," or other systems management tools."]}),"\n",(0,t.jsx)(n.h2,{id:"deployment-from-xdr-integrations",children:"Deployment from XDR Integrations"}),"\n",(0,t.jsxs)(n.p,{children:["Cado Host can also be deployed to compromised machines via XDR systems such as CrowdStrike and SentinelOne. For more information, refer to the integrations with ",(0,t.jsx)(n.a,{href:"/cado/integrations/xdr/sentinelone",children:"SentinelOne"})," and ",(0,t.jsx)(n.a,{href:"/cado/integrations/xdr/crowdstrike",children:"CrowdStrike"}),"."]}),"\n",(0,t.jsx)(n.h2,{id:"proxy-and-network-access",children:"Proxy and Network Access"}),"\n",(0,t.jsx)(n.p,{children:"Cado Host will use the operating system defaults to connect to cloud storage.\nThis means you may need to configure a proxy or network access for Cado Host to connect to the internet and upload data."})]})}function h(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},80069:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/cado-direct-download-4fb508eb151e7d52584e2de053180172.png"},72783:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/cado-host-script-7823fe12dadde563d74559181f6d5fb5.png"},64091:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/import-security-856f56febba6db2d8b739dc366096cd4.png"},6237:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/import-step2-a9fec9f0067cbf56f65ad9b6cdc7abb6.png"},51822:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},28453:(e,n,o)=>{o.d(n,{R:()=>r,x:()=>d});var t=o(96540);const i={},s=t.createContext(i);function r(e){const n=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function d(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),t.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7714],{38357:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>l,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>d,toc:()=>a});var t=o(74848),i=o(28453);const s={title:"Deploy",hide_title:!0,sidebar_position:2},r="How to Deploy Cado Host",d={id:"cado/discovery-import/cado-host/deploy",title:"Deploy",description:"Deploy Through Cado Platform",source:"@site/docs/cado/discovery-import/cado-host/deploy.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/deploy",permalink:"/cado/discovery-import/cado-host/deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/deploy.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Deploy",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"What is Cado Host",permalink:"/cado/discovery-import/cado-host/intro"},next:{title:"Deploy via API",permalink:"/cado/discovery-import/cado-host/api-deploy"}},l={},a=[{value:"Deploy Through Cado Platform",id:"deploy-through-cado-platform",level:2},{value:"Using Script Builder",id:"using-script-builder",level:3},{value:"Using Direct Download",id:"using-direct-download",level:3},{value:"Running as Non-Administrator",id:"running-as-non-administrator",level:2},{value:"Windows SmartScreen",id:"windows-smartscreen",level:2},{value:"Setting the Binary as Executable on Linux and macOS",id:"setting-the-binary-as-executable-on-linux-and-macos",level:2},{value:"Using Local Storage",id:"using-local-storage",level:2},{value:"Deploying Cado Host to Multiple Devices",id:"deploying-cado-host-to-multiple-devices",level:2},{value:"Deployment from XDR Integrations",id:"deployment-from-xdr-integrations",level:2},{value:"Proxy and Network Access",id:"proxy-and-network-access",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-deploy-cado-host",children:"How to Deploy Cado Host"}),"\n",(0,t.jsx)(n.h2,{id:"deploy-through-cado-platform",children:"Deploy Through Cado Platform"}),"\n",(0,t.jsx)(n.p,{children:"You have two main options to deploy Cado Host:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Script Builder"}),": Build a custom script in the Cado Platform that can be run on any supported device. The script will collect triage artifacts, upload them to cloud storage, and automatically process the data in Cado."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Direct Download"}),": Download and run Cado Host independently without interacting with the Cado Platform."]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"using-script-builder",children:"Using Script Builder"}),"\n",(0,t.jsx)(n.p,{children:"Follow these steps to deploy Cado Host via the Script Builder:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Note:"})," Pre-signed URLs and API keys generated in AWS expire 2 hours after creation, and AWS limits the total upload size to 5GB."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"caution",children:(0,t.jsxs)(n.p,{children:["Make sure that devices running the scripts have HTTPS access to the AWS S3 endpoint, for example: ",(0,t.jsx)(n.code,{children:"https://.s3.amazonaws.com/"}),"."]})}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In the Cado Platform, go to ",(0,t.jsx)(n.strong,{children:"Investigation > Import > Cado Host"}),"."]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Import Evidence",src:o(51822).A+"",width:"842",height:"242"})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Select either ",(0,t.jsx)(n.strong,{children:"Direct Download"})," or ",(0,t.jsx)(n.strong,{children:"Script Builder"}),"."]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Direct Download"})," is suitable for manually downloading the Cado Host binary to endpoints via Group Policy or an MDM tool."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Script Builder"})," generates a script that can be run directly on a device via terminal, command prompt, or a remote execution tool."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Select OS, storage, etc",src:o(6237).A+"",width:"3288",height:"916"})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Script Builder"})," tab, select:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Your ",(0,t.jsx)(n.strong,{children:"Operating System"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Your ",(0,t.jsx)(n.strong,{children:"Cloud Storage"})," (where Cado Host will upload the collected data)."]}),"\n",(0,t.jsxs)(n.li,{children:["The ",(0,t.jsx)(n.strong,{children:"Cado Host Binary Deployment Method"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["If you choose ",(0,t.jsx)(n.strong,{children:"Manual"})," under ",(0,t.jsx)(n.code,{children:"Select Cado Host Binary Deployment"}),", download the Cado Host binary separately and then copy/paste the generated command into your terminal."]})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Copy the pre-generated command and run it on the target device, or click ",(0,t.jsx)(n.strong,{children:"Download Script"})," and run the downloaded script."]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Download Script",src:o(72783).A+"",width:"1860",height:"144"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"using-direct-download",children:"Using Direct Download"}),"\n",(0,t.jsx)(n.p,{children:"To manually download and deploy the Cado Host binary:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Select your ",(0,t.jsx)(n.strong,{children:"Operating System"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Click ",(0,t.jsx)(n.strong,{children:"Download"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Follow the instructions to run Cado Host locally on the device."}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Direct Download",src:o(80069).A+"",width:"690",height:"180"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"running-as-non-administrator",children:"Running as Non-Administrator"}),"\n",(0,t.jsx)(n.p,{children:"Cado Host is designed to be run through the command line. Without administrative privileges, some artifacts (e.g., memory or locked files) cannot be acquired."}),"\n",(0,t.jsx)(n.h2,{id:"windows-smartscreen",children:"Windows SmartScreen"}),"\n",(0,t.jsxs)(n.p,{children:["On Windows, running Cado Host outside of the command line may trigger Windows SmartScreen. If you run ",(0,t.jsx)(n.code,{children:"cado-host.exe"})," by manually clicking it, you will need to adjust the security settings:"]}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Right-click the executable."}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Select ",(0,t.jsx)(n.strong,{children:"Properties"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:'Untick the "Blocked" box in the Security section.'}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Properties",src:o(64091).A+"",width:"388",height:"175"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"setting-the-binary-as-executable-on-linux-and-macos",children:"Setting the Binary as Executable on Linux and macOS"}),"\n",(0,t.jsx)(n.p,{children:"For Linux and macOS, you may need to make the binary executable before running it:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-console",children:"chmod +x ./cado-host\n./cado-host\n"})}),"\n",(0,t.jsx)(n.h2,{id:"using-local-storage",children:"Using Local Storage"}),"\n",(0,t.jsx)(n.p,{children:"If no cloud storage option is set, files will be saved to the same folder where Cado Host is run. Currently, changing the storage location is not supported."}),"\n",(0,t.jsx)(n.h2,{id:"deploying-cado-host-to-multiple-devices",children:"Deploying Cado Host to Multiple Devices"}),"\n",(0,t.jsxs)(n.p,{children:["Cado Host can be deployed to multiple devices at once, such as through ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"https://support.microsoft.com/en-gb/help/816102/how-to-use-group-policy-to-remotely-install-software-in-windows-server",children:"Group Policy"})})," or other systems management tools."]}),"\n",(0,t.jsx)(n.h2,{id:"deployment-from-xdr-integrations",children:"Deployment from XDR Integrations"}),"\n",(0,t.jsxs)(n.p,{children:["Cado Host can also be deployed to compromised machines via XDR systems such as CrowdStrike and SentinelOne. For more information, refer to the integrations with ",(0,t.jsx)(n.a,{href:"/cado/integrations/xdr/sentinelone",children:"SentinelOne"})," and ",(0,t.jsx)(n.a,{href:"/cado/integrations/xdr/crowdstrike",children:"CrowdStrike"}),"."]}),"\n",(0,t.jsx)(n.h2,{id:"proxy-and-network-access",children:"Proxy and Network Access"}),"\n",(0,t.jsx)(n.p,{children:"Cado Host will use the operating system defaults to connect to cloud storage.\nThis means you may need to configure a proxy or network access for Cado Host to connect to the internet and upload data."})]})}function h(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},80069:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/cado-direct-download-4fb508eb151e7d52584e2de053180172.png"},72783:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/cado-host-script-7823fe12dadde563d74559181f6d5fb5.png"},64091:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/import-security-856f56febba6db2d8b739dc366096cd4.png"},6237:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/import-step2-a9fec9f0067cbf56f65ad9b6cdc7abb6.png"},51822:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},28453:(e,n,o)=>{o.d(n,{R:()=>r,x:()=>d});var t=o(96540);const i={},s=t.createContext(i);function r(e){const n=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function d(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),t.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/261a6458.70b97cd2.js b/assets/js/261a6458.08a2d1bf.js similarity index 99% rename from assets/js/261a6458.70b97cd2.js rename to assets/js/261a6458.08a2d1bf.js index 680db567e..d64a76fc0 100644 --- a/assets/js/261a6458.70b97cd2.js +++ b/assets/js/261a6458.08a2d1bf.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[348],{70166:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>d,frontMatter:()=>s,metadata:()=>o,toc:()=>r});var n=i(74848),A=i(28453);const s={title:"Getting started example",hide_title:!0,sidebar_position:1},a="Getting Started with the CTF Investigation",o={id:"cado/investigate/ctf-tutorial",title:"Getting started example",description:"Cado provides a Capture the Flag (CTF) data set to help you get familiar with the Cado platform.",source:"@site/docs/cado/investigate/ctf-tutorial.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/ctf-tutorial",permalink:"/cado/investigate/ctf-tutorial",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/ctf-tutorial.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Getting started example",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Tanium",permalink:"/cado/integrations/xdr/tanium"},next:{title:"Evidence",permalink:"/cado/investigate/evidence"}},c={},r=[{value:"Create an Investigation",id:"create-an-investigation",level:2},{value:"Scenario",id:"scenario",level:2},{value:"Investigate",id:"investigate",level:2},{value:"Conclusion",id:"conclusion",level:2}];function l(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,A.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"getting-started-with-the-ctf-investigation",children:"Getting Started with the CTF Investigation"}),"\n",(0,n.jsx)(t.p,{children:"Cado provides a Capture the Flag (CTF) data set to help you get familiar with the Cado platform."}),"\n",(0,n.jsx)(t.h2,{id:"create-an-investigation",children:"Create an Investigation"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Begin by creating a new ",(0,n.jsx)(t.a,{href:"/cado/discovery-import/investigations",children:"investigation"})," in the Cado platform."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Create investigation",src:i(80022).A+"",width:"2556",height:"1212"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Normally, you would import data from various sources by clicking the ",(0,n.jsx)(t.strong,{children:'"Import"'})," button within the project:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Import data",src:i(70701).A+"",width:"672",height:"102"})}),"\n",(0,n.jsxs)(t.p,{children:["For this CTF, the data has already been imported for you. Navigate to the ",(0,n.jsx)(t.strong,{children:"Help"})," page and click ",(0,n.jsx)(t.strong,{children:"\u201cImport CTF data\u201d"}),". The import process will take a few minutes."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Import CTF",src:i(23424).A+"",width:"1370",height:"186"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Click the ",(0,n.jsx)(t.strong,{children:"Platform"})," button on the left menu to monitor the processing status. Once processing is complete, you will see the data in your investigation."]}),"\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.img,{alt:"Platform button",src:i(91164).A+"",width:"364",height:"90"}),"\n",(0,n.jsx)(t.img,{alt:"Processing",src:i(18942).A+"",width:"2314",height:"855"})]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsx)(t.p,{children:"Open the investigation by returning to the main dashboard and selecting the investigation. You can now start exploring the data."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Investigation",src:i(44548).A+"",width:"1451",height:"682"})}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"scenario",children:"Scenario"}),"\n",(0,n.jsx)(t.p,{children:"AWS GuardDuty raised an alert about an instance in our AWS account accessing a known Bitcoin mining address. We imported AWS GuardDuty logs and a disk image of the instance in question. The original image file was over 8GB, but for this CTF, we reduced it to around 30MB."}),"\n",(0,n.jsx)(t.h2,{id:"investigate",children:"Investigate"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Insights"})," page will display key findings from the data:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Insights",src:i(38139).A+"",width:"1451",height:"707"})}),"\n",(0,n.jsx)(t.p,{children:"You can quickly assess what an attacker might have done by reviewing the timeline. There are two main ways to do this:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Select the ",(0,n.jsx)(t.strong,{children:"Automated Investigation"})," tab to view events ranked by a machine learning algorithm:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Timeline",src:i(89138).A+"",width:"3352",height:"1078"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Select ",(0,n.jsx)(t.strong,{children:"Search"})," and filter for ",(0,n.jsx)(t.strong,{children:"Malicious"})," and ",(0,n.jsx)(t.strong,{children:"Suspicious"})," events:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Search",src:i(54281).A+"",width:"3358",height:"880"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(t.p,{children:["In either view, click on the filename ",(0,n.jsx)(t.strong,{children:'"a.sh"'})," to examine the file contents. This is the script that installed a crypto miner on the instance:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"File",src:i(99456).A+"",width:"3246",height:"732"})}),"\n",(0,n.jsxs)(t.p,{children:["Next, click the ",(0,n.jsx)(t.strong,{children:"uploads"})," folder in the file tree to explore its contents. This is where the script was uploaded:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Folder",src:i(26727).A+"",width:"3252",height:"766"})}),"\n",(0,n.jsxs)(t.p,{children:["Returning to the ",(0,n.jsx)(t.strong,{children:"a.sh"})," file, you can see the script that was executed:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Script",src:i(55390).A+"",width:"3148",height:"622"})}),"\n",(0,n.jsxs)(t.p,{children:["Click the highlighted filepath ",(0,n.jsx)(t.strong,{children:'"/etc/crontab"'})," to investigate further using the search function:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Crontab",src:i(88644).A+"",width:"1670",height:"815"})}),"\n",(0,n.jsx)(t.h2,{id:"conclusion",children:"Conclusion"}),"\n",(0,n.jsx)(t.p,{children:"This is a simple example of how you can use the Cado platform to investigate an incident. The platform enables you to quickly identify key events and artifacts, while providing powerful tools to dive deeper into the data."})]})}function d(e={}){const{wrapper:t}={...(0,A.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},18942:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/ctf-processing-6a9412a63b01a6b7b43840bc5435b512.png"},23424:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/ctf-fd7540731400cc26e41720f98e135317.png"},91164:(e,t,i)=>{i.d(t,{A:()=>n});const n="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAWwAAABaCAYAAACcy2y9AAAMP2lDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnluSkJDQQpcSehOkE0BKCC2A9CLYCEmAUGIMBBV7WVRw7WIBG7oqotgBsaCInUWxYV8sKCjrYsGuvEkBXfeV7833zZ3//nPmP2fOnbn3DgDqJ7licR6qAUC+qFASHxbEGJ2axiB1AwogACrQBi5cXoGYFRsbBWAZbP9e3t0EiKy95ijT+mf/fy2afEEBDwAkFuIMfgEvH+JDAOCVPLGkEACijLeYXCiWYViBtgQGCPFCGc5S4EoZzlDgfXKbxHg2xC0AqFC5XEkWAGpXIM8o4mVBDbU+iJ1FfKEIAHUGxP75+RP5EKdDbAttxBDL9JkZP+hk/U0zY0iTy80awoq5yItKsLBAnMed+n+m43+X/DzpoA9rWKnZkvB42Zxh3m7lToyUYSrEvaKM6BiItSD+IOTL7SFGKdnS8CSFPWrEK2DDnAFdiJ353OBIiI0gDhXlRUcp+YxMYSgHYrhC0CnCQk4ixPoQLxQUhCQobTZLJsYrfaF1mRI2S8mf50rkfmW+Hkhzk1hK/dfZAo5SH1Mrzk5MgZgCsWWRMDkaYjWInQpyEyKVNiOLs9nRgzYSabwsfkuI4wWisCCFPlaUKQmNV9qX5hcMzhfbnC3kRCvxgcLsxHBFfrAWHlceP5wLdkUgYiUN6ggKRkcNzoUvCA5RzB3rFoiSEpQ6H8SFQfGKsThFnBertMfNBXlhMt4cYveCogTlWDy5EC5IhT6eKS6MTVTEiRfncCNiFfHgy0AUYINgwABSWDPARJADhG299b3wTtETCrhAArKAADgqmcERKfIeEbwmgGLwJ0QCUDA0LkjeKwBFkP86xCqujiBT3lskH5ELnkKcDyJBHryXykeJhrwlgyeQEf7DOxdWHow3D1ZZ/7/nB9nvDAsyUUpGOuiRoT5oSQwhBhPDiaFEO9wQ98d98Sh4DYTVFWfi3oPz+G5PeEpoJzwi3CB0Em5PEM6V/BTlKNAJ9UOVucj4MRe4NdT0wINwP6gOlXFd3BA44u7QDwsPgJ49IMtWxi3LCuMn7b/N4IenobQjO5NRsh45kGz780g1ezWPIRVZrn/MjyLWjKF8s4d6fvbP/iH7fNhG/myJLcQOYuewU9gF7BhWDxhYE9aAtWLHZXhodT2Rr65Bb/HyeHKhjvAf/gafrCyTBc41zj3OXxR9hYIpsnc0YE8UT5UIs7ILGSz4RRAwOCKe03CGq7OrOwCy74vi9fUmTv7dQHRbv3Pz/gDAr2lgYODody6iCYD9XnD7H/nO2TLhp0MVgPNHeFJJkYLDZRcCfEuow51mAEyABbCF83EFnsAXBIIQEAFiQCJIBeNh9NlwnUvAZDAdzAEloAwsA6vBerAJbAU7wR5wANSDY+AUOAsugSvgBrgLV08XeAH6wDvwGUEQEkJD6IgBYopYIQ6IK8JE/JEQJAqJR1KRdCQLESFSZDoyDylDViDrkS1INbIfOYKcQi4g7cht5CHSg7xGPqEYSkW1UWPUGh2BMlEWGokmouPQLHQSWozOR5ega9EqdDdah55CL6E30E70BdqPAUwV08XMMEeMibGxGCwNy8Qk2EysFCvHqrBarBE+52tYJ9aLfcSJOB1n4I5wBYfjSTgPn4TPxBfj6/GdeB3egl/DH+J9+DcCjWBEcCD4EDiE0YQswmRCCaGcsJ1wmHAG7qUuwjsikahLtCF6wb2YSswhTiMuJm4g7iWeJLYTHxP7SSSSAcmB5EeKIXFJhaQS0jrSblIT6Sqpi/RBRVXFVMVVJVQlTUWkMlelXGWXygmVqyrPVD6TNchWZB9yDJlPnkpeSt5GbiRfJneRP1M0KTYUP0oiJYcyh7KWUks5Q7lHeaOqqmqu6q0apypUna26VnWf6nnVh6ofqVpUeyqbOpYqpS6h7qCepN6mvqHRaNa0QFoarZC2hFZNO017QPugRldzUuOo8dVmqVWo1aldVXupTla3Umepj1cvVi9XP6h+Wb1Xg6xhrcHW4GrM1KjQOKLRodGvSdd00YzRzNdcrLlL84JmtxZJy1orRIuvNV9rq9Zprcd0jG5BZ9N59Hn0bfQz9C5toraNNkc7R7tMe492m3afjpaOu06yzhSdCp3jOp26mK61Lkc3T3ep7gHdm7qf9Iz1WHoCvUV6tXpX9d7rD9MP1Bfol+rv1b+h/8mAYRBikGuw3KDe4L4hbmhvGGc42XCj4RnD3mHaw3yH8YaVDjsw7I4RamRvFG80zWirUatRv7GJcZix2Hid8WnjXhNdk0CTHJNVJidMekzppv6mQtNVpk2mzxk6DBYjj7GW0cLoMzMyCzeTmm0xazP7bG5jnmQ+13yv+X0LigXTItNilUWzRZ+lqeUoy+mWNZZ3rMhWTKtsqzVW56zeW9tYp1gvsK637rbRt+HYFNvU2NyzpdkG2E6yrbK9bke0Y9rl2m2wu2KP2nvYZ9tX2F92QB08HYQOGxzahxOGew8XDa8a3uFIdWQ5FjnWOD500nWKcprrVO/0coTliLQRy0ecG/HN2cM5z3mb810XLZcIl7kujS6vXe1dea4VrtfdaG6hbrPcGtxeuTu4C9w3ut/yoHuM8ljg0ezx1dPLU+JZ69njZemV7lXp1cHUZsYyFzPPexO8g7xneR/z/ujj6VPoc8DnL19H31zfXb7dI21GCkZuG/nYz9yP67fFr9Of4Z/uv9m/M8AsgBtQFfAo0CKQH7g98BnLjpXD2s16GeQcJAk6HPSe7cOewT4ZjAWHBZcGt4VohSSFrA95EGoemhVaE9oX5hE2LexkOCE8Mnx5eAfHmMPjVHP6IrwiZkS0RFIjEyLXRz6Kso+SRDWOQkdFjFo56l60VbQouj4GxHBiVsbcj7WJnRR7NI4YFxtXEfc03iV+evy5BHrChIRdCe8SgxKXJt5Nsk2SJjUnqyePTa5Ofp8SnLIipXP0iNEzRl9KNUwVpjakkdKS07an9Y8JGbN6TNdYj7ElY2+Osxk3ZdyF8Ybj88Yfn6A+gTvhYDohPSV9V/oXbgy3itufwcmozOjjsXlreC/4gfxV/B6Bn2CF4FmmX+aKzO4sv6yVWT3ZAdnl2b1CtnC98FVOeM6mnPe5Mbk7cgfyUvL25qvkp+cfEWmJckUtE00mTpnYLnYQl4g7J/lMWj2pTxIp2V6AFIwraCjUhj/yrVJb6S/Sh0X+RRVFHyYnTz44RXOKaErrVPupi6Y+Kw4t/m0aPo03rXm62fQ50x/OYM3YMhOZmTGzeZbFrPmzumaHzd45hzInd87vc53nrpj7dl7KvMb5xvNnz3/8S9gvNSVqJZKSjgW+CzYtxBcKF7Ytclu0btG3Un7pxTLnsvKyL4t5iy/+6vLr2l8HlmQuaVvquXTjMuIy0bKbywOW71yhuaJ4xeOVo1bWrWKsKl31dvWE1RfK3cs3raGska7pXBu1tmGd5bpl676sz15/oyKoYm+lUeWiyvcb+BuubgzcWLvJeFPZpk+bhZtvbQnbUldlXVW+lbi1aOvTbcnbzv3G/K16u+H2su1fd4h2dO6M39lS7VVdvcto19IatEZa07N77O4re4L3NNQ61m7Zq7u3bB/YJ933fH/6/psHIg80H2QerD1kdajyMP1waR1SN7Wurz67vrMhtaH9SMSR5kbfxsNHnY7uOGZ2rOK4zvGlJygn5p8YaCpu6j8pPtl7KuvU4+YJzXdPjz59vSWupe1M5JnzZ0PPnj7HOtd03u/8sQs+F45cZF6sv+R5qa7Vo/Xw7x6/H27zbKu77HW54Yr3lcb2ke0nrgZcPXUt+NrZ65zrl25E32i/mXTzVsfYjs5b/Fvdt/Nuv7pTdOfz3dn3CPdK72vcL39g9KDqD7s/9nZ6dh5/GPyw9VHCo7uPeY9fPCl48qVr/lPa0/Jnps+qu127j/WE9lx5PuZ51wvxi8+9JX9q/ln50vblob8C/2rtG93X9UryauD14jcGb3a8dX/b3B/b/+Bd/rvP70s/GHzY+ZH58dynlE/PPk/+Qvqy9qvd18Zvkd/uDeQPDIi5Eq78VwCDFc3MBOD1DgBoqQDQ4fmMMkZx/pMXRHFmlSPwn7DijCgvngDUwv/3uF74d9MBwL5t8PgF9dXHAhBLAyDRG6BubkN18KwmP1fKChGeAzbHfc3IzwD/pijOnD/E/XMLZKru4Of2X2j1fG3ujtY9AAAAimVYSWZNTQAqAAAACAAEARoABQAAAAEAAAA+ARsABQAAAAEAAABGASgAAwAAAAEAAgAAh2kABAAAAAEAAABOAAAAAAAAAJAAAAABAAAAkAAAAAEAA5KGAAcAAAASAAAAeKACAAQAAAABAAABbKADAAQAAAABAAAAWgAAAABBU0NJSQAAAFNjcmVlbnNob3SYOm7IAAAACXBIWXMAABYlAAAWJQFJUiTwAAAB1WlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNi4wLjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgICAgICAgICB4bWxuczpleGlmPSJodHRwOi8vbnMuYWRvYmUuY29tL2V4aWYvMS4wLyI+CiAgICAgICAgIDxleGlmOlBpeGVsWURpbWVuc2lvbj45MDwvZXhpZjpQaXhlbFlEaW1lbnNpb24+CiAgICAgICAgIDxleGlmOlBpeGVsWERpbWVuc2lvbj4zNjQ8L2V4aWY6UGl4ZWxYRGltZW5zaW9uPgogICAgICAgICA8ZXhpZjpVc2VyQ29tbWVudD5TY3JlZW5zaG90PC9leGlmOlVzZXJDb21tZW50PgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4K4Tj0GAAAABxpRE9UAAAAAgAAAAAAAAAtAAAAKAAAAC0AAAAtAAAOeI2ifDwAAA5ESURBVHgB7F13eBVVFj8hIYEkVEGCFAGRvrgIoqiAIO63ytIFEYQgoMJC6Hx0UCCINJfei/Sl2mBdRFCRIiICSxPpzYQSSAglfc+5L3e+++bNa3mFF+bcP97cuffcMr+Z7zcnv3vuJKhh8+gsyAI4dPQkcGIEGAFGgBEIXASCGjZDwsbEhB24N4lnxggwAowAIRDEHjY/CIwAI8AI5A4ELB52EHrY/2NJJHfcMp4lI8AImBUBJmyz3nm+bkaAEch1CLAkkutuGU+YEWAEzIoALzqa9c7zdTMCjECuQ8DiYeO0WcPOdfeOJ8wIMAImQ4A9bJPdcL5cRoARyL0IsIade+8dz5wRYARMhoDfCDsoTzDkDS8CwfkKQHBoBOQJCQMq48QIMALmRSArMwMy01MgI/UuZDy4A2n3bgGVcTJGwOeEHRwaDqEFS0BoZHHjGXApI8AIMAIKAqnJ1yE1KR5J/J5SyllCADXszrg1PcgnW9PzFS0LYQWjGGlGgBFgBNxGICUpDh4kXHS73aPcwCceNnnV+YtVQOkj/FHGjq+NEWAEfIwAedn3b5xlbzsbZ69HiYSgRh3+eCXWp338IHP3jIBZECBN+961U5COGrfZk4WwvfQtEfKoI6KqMlmb/ani62cEvIwAkfbduBOm97S9KolEPlGDZRAvP6jcHSPACFgQIHkk+epRU8PhNUmEFxhN/RzxxTMCfkHA7AuRXiFskkLIu+bECDACjICvESAv26whfyiJdMF/EZblUVhf/mLl/RJn/Wy1cuJZOHj8vK+fCe6fEWAEAhQBitO+f+NcgM7Ot9Py2MOm3YoFy9b2+iyJnLu1aSj6fbbqk4b9HzxxAX7LJu9FG38wtOFCRoARePQQSLr4qyl3RFoWHfF+5vRrfaGRxUTMtbceie5I0pKo3e1zMZI2E7e7qLE9I5D7EKDY7NTkG7lv4h7O2OOwPm/JIZ4QtR4DJm49InzOCDxaCJhVFvFYEvE0lI+kj9kjOxs+TSR5UCICpiS1a2ojZZJaSl4YKT+9xi/X2ijFnGUEGIFcjoBZQ/w8jsMm/TqnX92z51UTURNJS4KmZ4tImpJaJgqyf+z1xd62ihLnGYFHAwHaSEM6ttmSxx52oXJ1c4SZEcHqiZpsjDxoe54z2VPSa+BM2jm6RdyIEQhoBBLP7w/o+flicg+FsI1kEJVUjchcvXjVVi2XeaP29khetuGj+wiULlEUWjWpDc9ULgMR+cMg7kYizF27A05diHO/M27BCLiJgHkJ24NvieTEw967erTVrZEEbETkVoZ4ovfC9fXy3Ii063UYK6v9fhzVowXUqV7OcNxMjINPSr4P8TeTYNO3B2DfkTOGdrVRFhrds4WoW7p5F3y+46ChnT8K//ZiDfiwVysICsKHR0ljZm+CbbvNvX1YgYOzPkTAvISNoB46ejJH0LpL2HoilWStL5eTkQRN5/b0a2mrP+r7lGPp7fxx/uWsflC8aEGXhrqekARvDZoD9x+kWtm3blIHBnd9Q5R9ufMgfLzwa6t6T0/qVC8PpUsUgbT0DNjy42G73eULyws7lwzFz6grZI0vnYzMLGjQORboBcSJEfA1AkzYOUDYXcJWvWtJoEaetSRqV0l69qhoETki+5SXIsvl+cPyslXCTktLh0wkN5lCQ0NsPFUi7Tf7z4JUtJXJ14S9dd5AKFIwAmjna72O4+SwNseWjZ+FId3/Icrv3k+BkTM2wL7DZ6BooQhISLxrY88FjIAvEDAvYftJErHn8aokTjdWT7rObrYjUta/DNzt29nYrtarhN0evecLV62D/iuWLQGvvlANurR4WfNcT6MW3GnYAm2IQCHsCf3aQqO6VcW8Nm0/AJOXbNXmyBlGwF8IMGHnAGl3PGyVmCVx2iNxV6eiJ2vZr9peb/MwvGxnhC3n2/j5ahDbp40g7Sz0dF9UPN1AIexJA9+C+rUriykPnfZv+OHA73L6fGQE/IaAOQm7eTR+/Mn3GraemCVpGpG4q3dcT8Qko/Qa95lNc72X/TAiRlwlbJr8umm9oEzUY+I6eny0DA7/bvm/dq4SdtMGz0BzlC1KoGYeGZEPHqSkwuX4W7D8i59gz6HTVvjkzRsMCz/sKuToSuVKanWnzv+p5WMXfAWnzsfBoo+6AtmrdvdQErkcnyBsDxw7DzNXfau1o0xIcB7o0rI+vFK3ChQrXADy5AmCW0l34cjvl2DW6u2QiIutRolkF4pAodRnwkoohREp7f5eF56rUR4iw/PBhv/uh5nYPg/q6HNGR0N+1NVJlpm/bic0a1RL/LVSGa8nITEZdv/2B6zf9gvEYxQLpccRl+ZoU++vFaEs4nz7zj04fuYKTFy8xWbdQDTgn4BEwJyE3QwJG5OvFx1VwpbEqpbRHIy8Yyo3Sq6StWyr2svxZZ0/ju4Q9riY1tCknuVztau37NVI0Blh16xUBiYOaGfRoe1c1MlzV+HdEYu02sjwMPh20RDt3Cgz7NN18P0vJ2HvqlGaXGNkd+ZSPLwzZL5WVbbkY7By4gdI8iFamVUG/4IYPn0D7Nx/wqqYTqYPewfq/qWCKB8793MYjVE26iLn9r1HYdTMTeKFsGvFSGFHpHvn7gN4vuZT4lz9oXWD1n1noM4eCYvHd8N2wWq1yJNNl5GL4OylazZ1XBB4CJiTsP3kYauEKYnZqMzRY0GeMi1Cqu3I3hUCVtu4Yu9oHjmpc4ewVclh6eYfYcH678WQjgib4qC3zBkAYehpagkJ8fqtOxAWmhcKRubXin86eAoGT1krziniY+OnMSJftHCkZpNwO1nk6c+vmNiVcO7Kddg8ow+EhoSAakeyza3shcYd+4/D1GXfiHaFcLxN0/tAOM7L0lGW8KYzMjKhCC5OynBAat999BLh4VoMLb8qYZONtE/PyICM9ExYhx72nLXfWRG2apeSkgYpSMDqdSeiJx2eL1S8QMiWPOsiBcKtXgRXr92CNv1mqlPhfIAiYE7CJg/bD4uORtKHUZnRs0FETbsX5fdDVBtXyVcvi0hJRu3Ll3l3CJuIMapYYTGdTkPnw+mL8SLviLAXje0K1SuWFnZEauPmfQE79h2HdCRISq/Xr4kx3C21+vqdYkVe/XE1SkR9oRDx0wtATSSDEFnLMMZrNxOhx9jP4M/rt4VZfiTNKYPaa58bIM+27cDZmmRBRiph0zn10X/SGhvvl8aSHjbZERH3/Xgl/HL0HJ0KCYX6koRPZbSY+z5KTRQ2SRLP26+/AD3bv0pVIr2JhH0FiZtTYCPAhJ2D++PqoqNKzlJDNiozmoJeOpE2rpI12ecWwo7GKJEebzUWl0je6MudxsvLBUeE3bBOZejU/CV4+skoGDR5jUZYWmPMLI3tDlXKPyGKSB6QBCptvEXYHZvWg94dXxPd0sujVcx0uJHtscuxSHv+eu4ATb7Zd/g09P9ktay2ImzSvFvE/AvS0jK0epnRE/YIlFh2/HxcVovj0O5NoUVjix6ejjHmr703CXX9NCubeWO64I7NsqJszCzc/LOHN/9YARSAJ+YkbD9IIkZkaVRm75lQiV21kcSvljnKq/2429ZRv67UOfKwC+DCYAOMumj4XBUt+oL63I87HvtOXKV174iwNSMHGdUznrrsP7ABF+LU5C3CXjO5J5QrVVx0PX3lNli7dZ86jJavUOZxWPVJD3FO8eYNoydodaqHvWHbfk1q0QyyMyph619w0rZJveowLqaNONXr7NImBl8wHfBFQ2nZ57vE4qWs42NgImBOwvbDoqM9cpYE6shT1rdVHx13ZQ05HvXxMAlbXAP+6a4ldcdgdiFFaUQPX6iZUMZdwq5ULgqqVngCKpQuDtWfKgXVKpbSpIG5qP8u/3K3Vf/eIuzvlw7TtPQm3T4B2lxjL6m2jbtO1KI0VMLujy8te9v1VcKOu3EbWvWZYTPUS7WehimD3xblvx47B71jV9jYUCTLB+0aifIViAvp45wCGwFzEjZ52Jhy+h9nPJFEiIwpOdvNqC4Yigb4Ixcu5bmzo5743SV7Z/07q1c9bGe2x05fhvfHLLXZ4u2MsAvjAlq3Ng0wpK26zWKafkxfEvYejCYhzZjkh/q4Vd1RWjcVQxgxmoTSuyMWwslzlnBClbB743fNf83+V3D6vlTCvhyXAG0HzNKbgLuEverrPSLk0KYjLggoBMxJ2H7wsOkue+LdEtnSgqP8bCp55ETYzohefbr0OvjDJGwiFopQkIm+vXETNV4q34g7B2W8sKyXR0eETTsll4zrZjeEjqImgnGBLiTEEs42Z813sOIr33jY8l4nY4gd6cWOkrpY2m/iSvj5yFlhzoTtCDWuIwTMSdh+0LAJXNVLdiSBkK2jROTtDlHLvlTC9mR82Z+7R9XDNtqa7kp/jgh728LBUCAiO3QPXwC0iWUvLuQRVhRlQtEiqk7rS8LetWKEJc4Z5+HomyR0zVtw4ZFioym1wYXQq9mRJEzYAhL+cYAAE7YDcOxVuSqJeIuw7c3DWbk6vrtyirO+Xan3JWFTzPM3CwaLaVBURvuBcwzD0tRvgPiSsNWXR4fBc0UMtz2MfsJNL+T5U3oJt+HLL/0xYdtDjMslAkzYEgk3jq4Stl5D9vein/wznS7tUSPsVzC65OP+7cRdo91+3UYtNryD2qIi1jrUsLG+QXSsYRgddaxGmxjFYav1R/+4DO+NWULNbNI/MfaZQhEp6RcMmbBt4OICHQLmJOxmnXHRMcjnW9MJa5U0/SlLqHIIzcPf+jWN6UsPW91eTjHLb/SYSkNapeHvNRPf2JCFRoS9flpvKB1VVJjI7ejSXj2qhGxE2BSZsmR8d62JUQhhlfIlYSnZZEfIzMJvkKzCbfgyMWFLJPhoDwEzEvb/AQAA//+/ikhKAAAHBElEQVTtnW1MHEUYx5/jeIeCUiq1toittUE0LWAaTS3EaqJpIzY2tdYYIGpSYxvToJiYUBOxRmPQxAThg/rBYit+MFGsURMb01QxNkIJUEtapLS2iEJapbzDcc6z1yH3sgd3e7t7m9v/JDA7s7PPzP5m78+TZ2Y5R2lZhZvcRB3dPaQlZeZtDPmy53aU0rPiR6a9Bw9R++/9smhI7t/nx18cp4/Ej9mppX4/LcvKULp98uUGujAwHPYQHn/oHqp+ZqtyXcuP7fTWh0fnbXzTWEVZmelKefjqNTr+Ww+d7OyjgttvoU1Fa2nNqpz5tnzQ2HyMDrX87FNXVfEI7XzYM5+zLhe1njqnnK9t/IrGJqbm277z0i7aXLxOKVfXNdNP7Wfnz8mDisfup+d3bfEU3W5q7eil71u7iJ+14oI82laygZzOOOX8r51/0P63D8tLlfz9V5+mjXevVo73ieekLchzEi9snGiqUdpdGrxCO6vqfexwYVPhWqqr3q3Ut50+T/vebApoU7l9M+154gGl/vDRVqo/8kNAG1RYi8B//SetNSATRuMofVQItkhmCDb388uR1zhTUvuZC7T3jU9k0ZDcX7Dve6rWkH4WM2q0YG8tWU8H9pQRORxBh8Kim5aSpJxv+OwYNX3tK9grc7Koue6FeSGVhmobv6RvT3TKIoUi2Ny4RoxnW+mG+evUDvovD9Hu6saAUxDsACSo8CNgX8EWn/GOLuM9bObtL6BGerxm9uX3LAUUjRZs7rAw/1Z6V3iSKcmJPv27hYf7qRBn15yb2JPkpCbYXJ9781JqOFBOS29YwkUlfSfE+nUh2jIdfHEHPXhvgVIM5mHLtuy1b99SRAkJ8bJKyXlM7Fm/8t7nNDPj8jnHBT0Fu/jOPKqvKVf6CMXDNvKZDLhRVGgmYE/BNjEkImfG28vmOiM+IP5izf1Ey7vmvs1MWZlpVCJCFqnCmz7de5m6zv1Jc0Ksw0ks+uvXraKR0Unq6RugOSGwWlOc8Prz16yg1SuXCRMO+mvoX+ruvUSTUzNaTeI6ECB7CrbJIRF+zoqEx/PBdY9HPnd6iraaWJsRL5f3ghwEQMB4AhBsDYzDWXT0Nq8mqizanLQuCvIfAl7ULBKhAe+k5x8Db7s4BgEQiB4Bewp2WaXYJeLWvOiYkVtMjjinpllTE202FK7ABhNqLbY03QguAgEQMJWAe85FIxfbTO3TCp1FvEskfcVd5ExM1XwvauERaYx3kZy6vp2Lj+UWQL6Gk9wi6O9RKyfFL4RBJAnkIBBbBFzT4zQ60B1bNxXC3TiUfdiiodZdIinZt1FiOi8mRZaCedtarIbroWvpA9eAAAhEj8D06BBNDJ+P3gCi1LPHw45gW19iejalZHtecNDjHiIRbgi1HjMAGyBgfQITw300PRr+y2fWv7OFRxhxSITj1xzH1juxcHMqFOGPYCEPDpNwYqGW4RKlAr9AAARimgDHrzmObbfkCYmILbZa33RkYHqFRRaDL2PXEOfFSOE8CMQuAbuGQ3hGI/aw2QgvOvLiIxIIgAAIGE2AFxt50dGOSRfBZnDJWbmUlLHcjgxxzyAAAiYRmBoZpMkrF03qzXrdRLzo6H1LkW7x87aFYxAAARDwJmDXrXzeDHTzsNkoh0bSludrfpHGe2A4BgEQAAFJgBcYxwbP2DYUIjnoKthsND55CaXedAdEWxJGDgIgEBEBFuvxf87S7OS1iOzEwsW6hkQkEPa0eW92JG9ASlvIQQAE7EuAwyC859qui4z+M2+IYMtOsBApSSAHARAIl4DdFxjVeOmyD1vNsKxjLzsxI0eX19elTeQgAAKxS4D3WU+P/A2vWmWKdY9hq/ShVPEbkQmpN5JTxLidiWkUF5+EOHcwWKgHAZsQ4Pj03OyUEOcxcokY9cz4VVu+wRjqdBvuYYc6ELQDARAAARBYmIChMeyFu8ZZEAABEACBcAhAsMOhhbYgAAIgEEUCCIlEET66BgEQAIFwCJi26BjOoNAWBEAABEAgkIDHwxb1Wr9xJtAkakAABEAABIwgAA/bCKqwCQIgAAIGEEAM2wCoMAkCIAACRhCAYBtBFTZBAARAwAACEGwDoMIkCIAACBhBQMSwy8U3Ojoi+k5HIwYGmyAAAiAAAr4E4GH78kAJBEAABCxLALtELDs1GBgIgAAI+BLwCLYD+7B9saAEAiAAAtYjgJCI9eYEIwIBEAABVQIIiahiQSUIgAAIWI8ABNt6c4IRgQAIgIAqARESqXST241tfap4UAkCIAAC1iEAD9s6c4GRgAAIgMCCBDyLjqIJ/lvfgpxwEgRAAASiTgDb+qI+BRgACIAACIRGACGR0DihFQiAAAhEnQD2YUd9CjAAEAABEAiNADzs0DihFQiAAAhEncD/yK7Hzc243RIAAAAASUVORK5CYII="},80022:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial1-2d5e9796ee1ace151c9363a0687b4fe0.png"},88644:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial10-3a64cc525b97c1e1140ba142e746ae42.png"},70701:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial2-ff964e064255de5320fa65c81dd5be5d.png"},44548:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial3-ead9bf6431c0a54973cb8364a624eca1.png"},38139:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial4-bff96a165921823b9bae672d544f126d.png"},89138:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial5-d8a6025a2c5bc622b0067f3997112536.png"},54281:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial6-8682ee794ff770b5976ac5d08ac664c0.png"},99456:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial7-43fabc462c181a164bec78ecede23a15.png"},26727:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial8-9795606cfc0a5b81b0d3b42608904af7.png"},55390:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial9-cdc86fc04357ea76273f38353c7e6782.png"},28453:(e,t,i)=>{i.d(t,{R:()=>a,x:()=>o});var n=i(96540);const A={},s=n.createContext(A);function a(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(A):e.components||A:a(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[348],{70166:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>d,frontMatter:()=>s,metadata:()=>o,toc:()=>r});var n=i(74848),A=i(28453);const s={title:"Getting started example",hide_title:!0,sidebar_position:1},a="Getting Started with the CTF Investigation",o={id:"cado/investigate/ctf-tutorial",title:"Getting started example",description:"Cado provides a Capture the Flag (CTF) data set to help you get familiar with the Cado platform.",source:"@site/docs/cado/investigate/ctf-tutorial.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/ctf-tutorial",permalink:"/cado/investigate/ctf-tutorial",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/ctf-tutorial.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Getting started example",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Tanium",permalink:"/cado/integrations/xdr/tanium"},next:{title:"Evidence",permalink:"/cado/investigate/evidence"}},c={},r=[{value:"Create an Investigation",id:"create-an-investigation",level:2},{value:"Scenario",id:"scenario",level:2},{value:"Investigate",id:"investigate",level:2},{value:"Conclusion",id:"conclusion",level:2}];function l(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,A.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"getting-started-with-the-ctf-investigation",children:"Getting Started with the CTF Investigation"}),"\n",(0,n.jsx)(t.p,{children:"Cado provides a Capture the Flag (CTF) data set to help you get familiar with the Cado platform."}),"\n",(0,n.jsx)(t.h2,{id:"create-an-investigation",children:"Create an Investigation"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Begin by creating a new ",(0,n.jsx)(t.a,{href:"/cado/discovery-import/investigations",children:"investigation"})," in the Cado platform."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Create investigation",src:i(80022).A+"",width:"2556",height:"1212"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Normally, you would import data from various sources by clicking the ",(0,n.jsx)(t.strong,{children:'"Import"'})," button within the project:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Import data",src:i(70701).A+"",width:"672",height:"102"})}),"\n",(0,n.jsxs)(t.p,{children:["For this CTF, the data has already been imported for you. Navigate to the ",(0,n.jsx)(t.strong,{children:"Help"})," page and click ",(0,n.jsx)(t.strong,{children:"\u201cImport CTF data\u201d"}),". The import process will take a few minutes."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Import CTF",src:i(23424).A+"",width:"1370",height:"186"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Click the ",(0,n.jsx)(t.strong,{children:"Platform"})," button on the left menu to monitor the processing status. Once processing is complete, you will see the data in your investigation."]}),"\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.img,{alt:"Platform button",src:i(91164).A+"",width:"364",height:"90"}),"\n",(0,n.jsx)(t.img,{alt:"Processing",src:i(18942).A+"",width:"2314",height:"855"})]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsx)(t.p,{children:"Open the investigation by returning to the main dashboard and selecting the investigation. You can now start exploring the data."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Investigation",src:i(44548).A+"",width:"1451",height:"682"})}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"scenario",children:"Scenario"}),"\n",(0,n.jsx)(t.p,{children:"AWS GuardDuty raised an alert about an instance in our AWS account accessing a known Bitcoin mining address. We imported AWS GuardDuty logs and a disk image of the instance in question. The original image file was over 8GB, but for this CTF, we reduced it to around 30MB."}),"\n",(0,n.jsx)(t.h2,{id:"investigate",children:"Investigate"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Insights"})," page will display key findings from the data:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Insights",src:i(38139).A+"",width:"1451",height:"707"})}),"\n",(0,n.jsx)(t.p,{children:"You can quickly assess what an attacker might have done by reviewing the timeline. There are two main ways to do this:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Select the ",(0,n.jsx)(t.strong,{children:"Automated Investigation"})," tab to view events ranked by a machine learning algorithm:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Timeline",src:i(89138).A+"",width:"3352",height:"1078"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:["Select ",(0,n.jsx)(t.strong,{children:"Search"})," and filter for ",(0,n.jsx)(t.strong,{children:"Malicious"})," and ",(0,n.jsx)(t.strong,{children:"Suspicious"})," events:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Search",src:i(54281).A+"",width:"3358",height:"880"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(t.p,{children:["In either view, click on the filename ",(0,n.jsx)(t.strong,{children:'"a.sh"'})," to examine the file contents. This is the script that installed a crypto miner on the instance:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"File",src:i(99456).A+"",width:"3246",height:"732"})}),"\n",(0,n.jsxs)(t.p,{children:["Next, click the ",(0,n.jsx)(t.strong,{children:"uploads"})," folder in the file tree to explore its contents. This is where the script was uploaded:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Folder",src:i(26727).A+"",width:"3252",height:"766"})}),"\n",(0,n.jsxs)(t.p,{children:["Returning to the ",(0,n.jsx)(t.strong,{children:"a.sh"})," file, you can see the script that was executed:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Script",src:i(55390).A+"",width:"3148",height:"622"})}),"\n",(0,n.jsxs)(t.p,{children:["Click the highlighted filepath ",(0,n.jsx)(t.strong,{children:'"/etc/crontab"'})," to investigate further using the search function:"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Crontab",src:i(88644).A+"",width:"1670",height:"815"})}),"\n",(0,n.jsx)(t.h2,{id:"conclusion",children:"Conclusion"}),"\n",(0,n.jsx)(t.p,{children:"This is a simple example of how you can use the Cado platform to investigate an incident. The platform enables you to quickly identify key events and artifacts, while providing powerful tools to dive deeper into the data."})]})}function d(e={}){const{wrapper:t}={...(0,A.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},18942:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/ctf-processing-6a9412a63b01a6b7b43840bc5435b512.png"},23424:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/ctf-fd7540731400cc26e41720f98e135317.png"},91164:(e,t,i)=>{i.d(t,{A:()=>n});const n="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAWwAAABaCAYAAACcy2y9AAAMP2lDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnluSkJDQQpcSehOkE0BKCC2A9CLYCEmAUGIMBBV7WVRw7WIBG7oqotgBsaCInUWxYV8sKCjrYsGuvEkBXfeV7833zZ3//nPmP2fOnbn3DgDqJ7licR6qAUC+qFASHxbEGJ2axiB1AwogACrQBi5cXoGYFRsbBWAZbP9e3t0EiKy95ijT+mf/fy2afEEBDwAkFuIMfgEvH+JDAOCVPLGkEACijLeYXCiWYViBtgQGCPFCGc5S4EoZzlDgfXKbxHg2xC0AqFC5XEkWAGpXIM8o4mVBDbU+iJ1FfKEIAHUGxP75+RP5EKdDbAttxBDL9JkZP+hk/U0zY0iTy80awoq5yItKsLBAnMed+n+m43+X/DzpoA9rWKnZkvB42Zxh3m7lToyUYSrEvaKM6BiItSD+IOTL7SFGKdnS8CSFPWrEK2DDnAFdiJ353OBIiI0gDhXlRUcp+YxMYSgHYrhC0CnCQk4ixPoQLxQUhCQobTZLJsYrfaF1mRI2S8mf50rkfmW+Hkhzk1hK/dfZAo5SH1Mrzk5MgZgCsWWRMDkaYjWInQpyEyKVNiOLs9nRgzYSabwsfkuI4wWisCCFPlaUKQmNV9qX5hcMzhfbnC3kRCvxgcLsxHBFfrAWHlceP5wLdkUgYiUN6ggKRkcNzoUvCA5RzB3rFoiSEpQ6H8SFQfGKsThFnBertMfNBXlhMt4cYveCogTlWDy5EC5IhT6eKS6MTVTEiRfncCNiFfHgy0AUYINgwABSWDPARJADhG299b3wTtETCrhAArKAADgqmcERKfIeEbwmgGLwJ0QCUDA0LkjeKwBFkP86xCqujiBT3lskH5ELnkKcDyJBHryXykeJhrwlgyeQEf7DOxdWHow3D1ZZ/7/nB9nvDAsyUUpGOuiRoT5oSQwhBhPDiaFEO9wQ98d98Sh4DYTVFWfi3oPz+G5PeEpoJzwi3CB0Em5PEM6V/BTlKNAJ9UOVucj4MRe4NdT0wINwP6gOlXFd3BA44u7QDwsPgJ49IMtWxi3LCuMn7b/N4IenobQjO5NRsh45kGz780g1ezWPIRVZrn/MjyLWjKF8s4d6fvbP/iH7fNhG/myJLcQOYuewU9gF7BhWDxhYE9aAtWLHZXhodT2Rr65Bb/HyeHKhjvAf/gafrCyTBc41zj3OXxR9hYIpsnc0YE8UT5UIs7ILGSz4RRAwOCKe03CGq7OrOwCy74vi9fUmTv7dQHRbv3Pz/gDAr2lgYODody6iCYD9XnD7H/nO2TLhp0MVgPNHeFJJkYLDZRcCfEuow51mAEyABbCF83EFnsAXBIIQEAFiQCJIBeNh9NlwnUvAZDAdzAEloAwsA6vBerAJbAU7wR5wANSDY+AUOAsugSvgBrgLV08XeAH6wDvwGUEQEkJD6IgBYopYIQ6IK8JE/JEQJAqJR1KRdCQLESFSZDoyDylDViDrkS1INbIfOYKcQi4g7cht5CHSg7xGPqEYSkW1UWPUGh2BMlEWGokmouPQLHQSWozOR5ega9EqdDdah55CL6E30E70BdqPAUwV08XMMEeMibGxGCwNy8Qk2EysFCvHqrBarBE+52tYJ9aLfcSJOB1n4I5wBYfjSTgPn4TPxBfj6/GdeB3egl/DH+J9+DcCjWBEcCD4EDiE0YQswmRCCaGcsJ1wmHAG7qUuwjsikahLtCF6wb2YSswhTiMuJm4g7iWeJLYTHxP7SSSSAcmB5EeKIXFJhaQS0jrSblIT6Sqpi/RBRVXFVMVVJVQlTUWkMlelXGWXygmVqyrPVD6TNchWZB9yDJlPnkpeSt5GbiRfJneRP1M0KTYUP0oiJYcyh7KWUks5Q7lHeaOqqmqu6q0apypUna26VnWf6nnVh6ofqVpUeyqbOpYqpS6h7qCepN6mvqHRaNa0QFoarZC2hFZNO017QPugRldzUuOo8dVmqVWo1aldVXupTla3Umepj1cvVi9XP6h+Wb1Xg6xhrcHW4GrM1KjQOKLRodGvSdd00YzRzNdcrLlL84JmtxZJy1orRIuvNV9rq9Zprcd0jG5BZ9N59Hn0bfQz9C5toraNNkc7R7tMe492m3afjpaOu06yzhSdCp3jOp26mK61Lkc3T3ep7gHdm7qf9Iz1WHoCvUV6tXpX9d7rD9MP1Bfol+rv1b+h/8mAYRBikGuw3KDe4L4hbmhvGGc42XCj4RnD3mHaw3yH8YaVDjsw7I4RamRvFG80zWirUatRv7GJcZix2Hid8WnjXhNdk0CTHJNVJidMekzppv6mQtNVpk2mzxk6DBYjj7GW0cLoMzMyCzeTmm0xazP7bG5jnmQ+13yv+X0LigXTItNilUWzRZ+lqeUoy+mWNZZ3rMhWTKtsqzVW56zeW9tYp1gvsK637rbRt+HYFNvU2NyzpdkG2E6yrbK9bke0Y9rl2m2wu2KP2nvYZ9tX2F92QB08HYQOGxzahxOGew8XDa8a3uFIdWQ5FjnWOD500nWKcprrVO/0coTliLQRy0ecG/HN2cM5z3mb810XLZcIl7kujS6vXe1dea4VrtfdaG6hbrPcGtxeuTu4C9w3ut/yoHuM8ljg0ezx1dPLU+JZ69njZemV7lXp1cHUZsYyFzPPexO8g7xneR/z/ujj6VPoc8DnL19H31zfXb7dI21GCkZuG/nYz9yP67fFr9Of4Z/uv9m/M8AsgBtQFfAo0CKQH7g98BnLjpXD2s16GeQcJAk6HPSe7cOewT4ZjAWHBZcGt4VohSSFrA95EGoemhVaE9oX5hE2LexkOCE8Mnx5eAfHmMPjVHP6IrwiZkS0RFIjEyLXRz6Kso+SRDWOQkdFjFo56l60VbQouj4GxHBiVsbcj7WJnRR7NI4YFxtXEfc03iV+evy5BHrChIRdCe8SgxKXJt5Nsk2SJjUnqyePTa5Ofp8SnLIipXP0iNEzRl9KNUwVpjakkdKS07an9Y8JGbN6TNdYj7ElY2+Osxk3ZdyF8Ybj88Yfn6A+gTvhYDohPSV9V/oXbgy3itufwcmozOjjsXlreC/4gfxV/B6Bn2CF4FmmX+aKzO4sv6yVWT3ZAdnl2b1CtnC98FVOeM6mnPe5Mbk7cgfyUvL25qvkp+cfEWmJckUtE00mTpnYLnYQl4g7J/lMWj2pTxIp2V6AFIwraCjUhj/yrVJb6S/Sh0X+RRVFHyYnTz44RXOKaErrVPupi6Y+Kw4t/m0aPo03rXm62fQ50x/OYM3YMhOZmTGzeZbFrPmzumaHzd45hzInd87vc53nrpj7dl7KvMb5xvNnz3/8S9gvNSVqJZKSjgW+CzYtxBcKF7Ytclu0btG3Un7pxTLnsvKyL4t5iy/+6vLr2l8HlmQuaVvquXTjMuIy0bKbywOW71yhuaJ4xeOVo1bWrWKsKl31dvWE1RfK3cs3raGska7pXBu1tmGd5bpl676sz15/oyKoYm+lUeWiyvcb+BuubgzcWLvJeFPZpk+bhZtvbQnbUldlXVW+lbi1aOvTbcnbzv3G/K16u+H2su1fd4h2dO6M39lS7VVdvcto19IatEZa07N77O4re4L3NNQ61m7Zq7u3bB/YJ933fH/6/psHIg80H2QerD1kdajyMP1waR1SN7Wurz67vrMhtaH9SMSR5kbfxsNHnY7uOGZ2rOK4zvGlJygn5p8YaCpu6j8pPtl7KuvU4+YJzXdPjz59vSWupe1M5JnzZ0PPnj7HOtd03u/8sQs+F45cZF6sv+R5qa7Vo/Xw7x6/H27zbKu77HW54Yr3lcb2ke0nrgZcPXUt+NrZ65zrl25E32i/mXTzVsfYjs5b/Fvdt/Nuv7pTdOfz3dn3CPdK72vcL39g9KDqD7s/9nZ6dh5/GPyw9VHCo7uPeY9fPCl48qVr/lPa0/Jnps+qu127j/WE9lx5PuZ51wvxi8+9JX9q/ln50vblob8C/2rtG93X9UryauD14jcGb3a8dX/b3B/b/+Bd/rvP70s/GHzY+ZH58dynlE/PPk/+Qvqy9qvd18Zvkd/uDeQPDIi5Eq78VwCDFc3MBOD1DgBoqQDQ4fmMMkZx/pMXRHFmlSPwn7DijCgvngDUwv/3uF74d9MBwL5t8PgF9dXHAhBLAyDRG6BubkN18KwmP1fKChGeAzbHfc3IzwD/pijOnD/E/XMLZKru4Of2X2j1fG3ujtY9AAAAimVYSWZNTQAqAAAACAAEARoABQAAAAEAAAA+ARsABQAAAAEAAABGASgAAwAAAAEAAgAAh2kABAAAAAEAAABOAAAAAAAAAJAAAAABAAAAkAAAAAEAA5KGAAcAAAASAAAAeKACAAQAAAABAAABbKADAAQAAAABAAAAWgAAAABBU0NJSQAAAFNjcmVlbnNob3SYOm7IAAAACXBIWXMAABYlAAAWJQFJUiTwAAAB1WlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNi4wLjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgICAgICAgICB4bWxuczpleGlmPSJodHRwOi8vbnMuYWRvYmUuY29tL2V4aWYvMS4wLyI+CiAgICAgICAgIDxleGlmOlBpeGVsWURpbWVuc2lvbj45MDwvZXhpZjpQaXhlbFlEaW1lbnNpb24+CiAgICAgICAgIDxleGlmOlBpeGVsWERpbWVuc2lvbj4zNjQ8L2V4aWY6UGl4ZWxYRGltZW5zaW9uPgogICAgICAgICA8ZXhpZjpVc2VyQ29tbWVudD5TY3JlZW5zaG90PC9leGlmOlVzZXJDb21tZW50PgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4K4Tj0GAAAABxpRE9UAAAAAgAAAAAAAAAtAAAAKAAAAC0AAAAtAAAOeI2ifDwAAA5ESURBVHgB7F13eBVVFj8hIYEkVEGCFAGRvrgIoqiAIO63ytIFEYQgoMJC6Hx0UCCINJfei/Sl2mBdRFCRIiICSxPpzYQSSAglfc+5L3e+++bNa3mFF+bcP97cuffcMr+Z7zcnv3vuJKhh8+gsyAI4dPQkcGIEGAFGgBEIXASCGjZDwsbEhB24N4lnxggwAowAIRDEHjY/CIwAI8AI5A4ELB52EHrY/2NJJHfcMp4lI8AImBUBJmyz3nm+bkaAEch1CLAkkutuGU+YEWAEzIoALzqa9c7zdTMCjECuQ8DiYeO0WcPOdfeOJ8wIMAImQ4A9bJPdcL5cRoARyL0IsIade+8dz5wRYARMhoDfCDsoTzDkDS8CwfkKQHBoBOQJCQMq48QIMALmRSArMwMy01MgI/UuZDy4A2n3bgGVcTJGwOeEHRwaDqEFS0BoZHHjGXApI8AIMAIKAqnJ1yE1KR5J/J5SyllCADXszrg1PcgnW9PzFS0LYQWjGGlGgBFgBNxGICUpDh4kXHS73aPcwCceNnnV+YtVQOkj/FHGjq+NEWAEfIwAedn3b5xlbzsbZ69HiYSgRh3+eCXWp338IHP3jIBZECBN+961U5COGrfZk4WwvfQtEfKoI6KqMlmb/ani62cEvIwAkfbduBOm97S9KolEPlGDZRAvP6jcHSPACFgQIHkk+epRU8PhNUmEFxhN/RzxxTMCfkHA7AuRXiFskkLIu+bECDACjICvESAv26whfyiJdMF/EZblUVhf/mLl/RJn/Wy1cuJZOHj8vK+fCe6fEWAEAhQBitO+f+NcgM7Ot9Py2MOm3YoFy9b2+iyJnLu1aSj6fbbqk4b9HzxxAX7LJu9FG38wtOFCRoARePQQSLr4qyl3RFoWHfF+5vRrfaGRxUTMtbceie5I0pKo3e1zMZI2E7e7qLE9I5D7EKDY7NTkG7lv4h7O2OOwPm/JIZ4QtR4DJm49InzOCDxaCJhVFvFYEvE0lI+kj9kjOxs+TSR5UCICpiS1a2ojZZJaSl4YKT+9xi/X2ijFnGUEGIFcjoBZQ/w8jsMm/TqnX92z51UTURNJS4KmZ4tImpJaJgqyf+z1xd62ihLnGYFHAwHaSEM6ttmSxx52oXJ1c4SZEcHqiZpsjDxoe54z2VPSa+BM2jm6RdyIEQhoBBLP7w/o+flicg+FsI1kEJVUjchcvXjVVi2XeaP29khetuGj+wiULlEUWjWpDc9ULgMR+cMg7kYizF27A05diHO/M27BCLiJgHkJ24NvieTEw967erTVrZEEbETkVoZ4ovfC9fXy3Ii063UYK6v9fhzVowXUqV7OcNxMjINPSr4P8TeTYNO3B2DfkTOGdrVRFhrds4WoW7p5F3y+46ChnT8K//ZiDfiwVysICsKHR0ljZm+CbbvNvX1YgYOzPkTAvISNoB46ejJH0LpL2HoilWStL5eTkQRN5/b0a2mrP+r7lGPp7fxx/uWsflC8aEGXhrqekARvDZoD9x+kWtm3blIHBnd9Q5R9ufMgfLzwa6t6T0/qVC8PpUsUgbT0DNjy42G73eULyws7lwzFz6grZI0vnYzMLGjQORboBcSJEfA1AkzYOUDYXcJWvWtJoEaetSRqV0l69qhoETki+5SXIsvl+cPyslXCTktLh0wkN5lCQ0NsPFUi7Tf7z4JUtJXJ14S9dd5AKFIwAmjna72O4+SwNseWjZ+FId3/Icrv3k+BkTM2wL7DZ6BooQhISLxrY88FjIAvEDAvYftJErHn8aokTjdWT7rObrYjUta/DNzt29nYrtarhN0evecLV62D/iuWLQGvvlANurR4WfNcT6MW3GnYAm2IQCHsCf3aQqO6VcW8Nm0/AJOXbNXmyBlGwF8IMGHnAGl3PGyVmCVx2iNxV6eiJ2vZr9peb/MwvGxnhC3n2/j5ahDbp40g7Sz0dF9UPN1AIexJA9+C+rUriykPnfZv+OHA73L6fGQE/IaAOQm7eTR+/Mn3GraemCVpGpG4q3dcT8Qko/Qa95lNc72X/TAiRlwlbJr8umm9oEzUY+I6eny0DA7/bvm/dq4SdtMGz0BzlC1KoGYeGZEPHqSkwuX4W7D8i59gz6HTVvjkzRsMCz/sKuToSuVKanWnzv+p5WMXfAWnzsfBoo+6AtmrdvdQErkcnyBsDxw7DzNXfau1o0xIcB7o0rI+vFK3ChQrXADy5AmCW0l34cjvl2DW6u2QiIutRolkF4pAodRnwkoohREp7f5eF56rUR4iw/PBhv/uh5nYPg/q6HNGR0N+1NVJlpm/bic0a1RL/LVSGa8nITEZdv/2B6zf9gvEYxQLpccRl+ZoU++vFaEs4nz7zj04fuYKTFy8xWbdQDTgn4BEwJyE3QwJG5OvFx1VwpbEqpbRHIy8Yyo3Sq6StWyr2svxZZ0/ju4Q9riY1tCknuVztau37NVI0Blh16xUBiYOaGfRoe1c1MlzV+HdEYu02sjwMPh20RDt3Cgz7NN18P0vJ2HvqlGaXGNkd+ZSPLwzZL5WVbbkY7By4gdI8iFamVUG/4IYPn0D7Nx/wqqYTqYPewfq/qWCKB8793MYjVE26iLn9r1HYdTMTeKFsGvFSGFHpHvn7gN4vuZT4lz9oXWD1n1noM4eCYvHd8N2wWq1yJNNl5GL4OylazZ1XBB4CJiTsP3kYauEKYnZqMzRY0GeMi1Cqu3I3hUCVtu4Yu9oHjmpc4ewVclh6eYfYcH678WQjgib4qC3zBkAYehpagkJ8fqtOxAWmhcKRubXin86eAoGT1krziniY+OnMSJftHCkZpNwO1nk6c+vmNiVcO7Kddg8ow+EhoSAakeyza3shcYd+4/D1GXfiHaFcLxN0/tAOM7L0lGW8KYzMjKhCC5OynBAat999BLh4VoMLb8qYZONtE/PyICM9ExYhx72nLXfWRG2apeSkgYpSMDqdSeiJx2eL1S8QMiWPOsiBcKtXgRXr92CNv1mqlPhfIAiYE7CJg/bD4uORtKHUZnRs0FETbsX5fdDVBtXyVcvi0hJRu3Ll3l3CJuIMapYYTGdTkPnw+mL8SLviLAXje0K1SuWFnZEauPmfQE79h2HdCRISq/Xr4kx3C21+vqdYkVe/XE1SkR9oRDx0wtATSSDEFnLMMZrNxOhx9jP4M/rt4VZfiTNKYPaa58bIM+27cDZmmRBRiph0zn10X/SGhvvl8aSHjbZERH3/Xgl/HL0HJ0KCYX6koRPZbSY+z5KTRQ2SRLP26+/AD3bv0pVIr2JhH0FiZtTYCPAhJ2D++PqoqNKzlJDNiozmoJeOpE2rpI12ecWwo7GKJEebzUWl0je6MudxsvLBUeE3bBOZejU/CV4+skoGDR5jUZYWmPMLI3tDlXKPyGKSB6QBCptvEXYHZvWg94dXxPd0sujVcx0uJHtscuxSHv+eu4ATb7Zd/g09P9ktay2ImzSvFvE/AvS0jK0epnRE/YIlFh2/HxcVovj0O5NoUVjix6ejjHmr703CXX9NCubeWO64I7NsqJszCzc/LOHN/9YARSAJ+YkbD9IIkZkaVRm75lQiV21kcSvljnKq/2429ZRv67UOfKwC+DCYAOMumj4XBUt+oL63I87HvtOXKV174iwNSMHGdUznrrsP7ABF+LU5C3CXjO5J5QrVVx0PX3lNli7dZ86jJavUOZxWPVJD3FO8eYNoydodaqHvWHbfk1q0QyyMyph619w0rZJveowLqaNONXr7NImBl8wHfBFQ2nZ57vE4qWs42NgImBOwvbDoqM9cpYE6shT1rdVHx13ZQ05HvXxMAlbXAP+6a4ldcdgdiFFaUQPX6iZUMZdwq5ULgqqVngCKpQuDtWfKgXVKpbSpIG5qP8u/3K3Vf/eIuzvlw7TtPQm3T4B2lxjL6m2jbtO1KI0VMLujy8te9v1VcKOu3EbWvWZYTPUS7WehimD3xblvx47B71jV9jYUCTLB+0aifIViAvp45wCGwFzEjZ52Jhy+h9nPJFEiIwpOdvNqC4Yigb4Ixcu5bmzo5743SV7Z/07q1c9bGe2x05fhvfHLLXZ4u2MsAvjAlq3Ng0wpK26zWKafkxfEvYejCYhzZjkh/q4Vd1RWjcVQxgxmoTSuyMWwslzlnBClbB743fNf83+V3D6vlTCvhyXAG0HzNKbgLuEverrPSLk0KYjLggoBMxJ2H7wsOkue+LdEtnSgqP8bCp55ETYzohefbr0OvjDJGwiFopQkIm+vXETNV4q34g7B2W8sKyXR0eETTsll4zrZjeEjqImgnGBLiTEEs42Z813sOIr33jY8l4nY4gd6cWOkrpY2m/iSvj5yFlhzoTtCDWuIwTMSdh+0LAJXNVLdiSBkK2jROTtDlHLvlTC9mR82Z+7R9XDNtqa7kp/jgh728LBUCAiO3QPXwC0iWUvLuQRVhRlQtEiqk7rS8LetWKEJc4Z5+HomyR0zVtw4ZFioym1wYXQq9mRJEzYAhL+cYAAE7YDcOxVuSqJeIuw7c3DWbk6vrtyirO+Xan3JWFTzPM3CwaLaVBURvuBcwzD0tRvgPiSsNWXR4fBc0UMtz2MfsJNL+T5U3oJt+HLL/0xYdtDjMslAkzYEgk3jq4Stl5D9vein/wznS7tUSPsVzC65OP+7cRdo91+3UYtNryD2qIi1jrUsLG+QXSsYRgddaxGmxjFYav1R/+4DO+NWULNbNI/MfaZQhEp6RcMmbBt4OICHQLmJOxmnXHRMcjnW9MJa5U0/SlLqHIIzcPf+jWN6UsPW91eTjHLb/SYSkNapeHvNRPf2JCFRoS9flpvKB1VVJjI7ejSXj2qhGxE2BSZsmR8d62JUQhhlfIlYSnZZEfIzMJvkKzCbfgyMWFLJPhoDwEzEvb/AQAA//+/ikhKAAAHBElEQVTtnW1MHEUYx5/jeIeCUiq1toittUE0LWAaTS3EaqJpIzY2tdYYIGpSYxvToJiYUBOxRmPQxAThg/rBYit+MFGsURMb01QxNkIJUEtapLS2iEJapbzDcc6z1yH3sgd3e7t7m9v/JDA7s7PPzP5m78+TZ2Y5R2lZhZvcRB3dPaQlZeZtDPmy53aU0rPiR6a9Bw9R++/9smhI7t/nx18cp4/Ej9mppX4/LcvKULp98uUGujAwHPYQHn/oHqp+ZqtyXcuP7fTWh0fnbXzTWEVZmelKefjqNTr+Ww+d7OyjgttvoU1Fa2nNqpz5tnzQ2HyMDrX87FNXVfEI7XzYM5+zLhe1njqnnK9t/IrGJqbm277z0i7aXLxOKVfXNdNP7Wfnz8mDisfup+d3bfEU3W5q7eil71u7iJ+14oI82laygZzOOOX8r51/0P63D8tLlfz9V5+mjXevVo73ieekLchzEi9snGiqUdpdGrxCO6vqfexwYVPhWqqr3q3Ut50+T/vebApoU7l9M+154gGl/vDRVqo/8kNAG1RYi8B//SetNSATRuMofVQItkhmCDb388uR1zhTUvuZC7T3jU9k0ZDcX7Dve6rWkH4WM2q0YG8tWU8H9pQRORxBh8Kim5aSpJxv+OwYNX3tK9grc7Koue6FeSGVhmobv6RvT3TKIoUi2Ny4RoxnW+mG+evUDvovD9Hu6saAUxDsACSo8CNgX8EWn/GOLuM9bObtL6BGerxm9uX3LAUUjRZs7rAw/1Z6V3iSKcmJPv27hYf7qRBn15yb2JPkpCbYXJ9781JqOFBOS29YwkUlfSfE+nUh2jIdfHEHPXhvgVIM5mHLtuy1b99SRAkJ8bJKyXlM7Fm/8t7nNDPj8jnHBT0Fu/jOPKqvKVf6CMXDNvKZDLhRVGgmYE/BNjEkImfG28vmOiM+IP5izf1Ey7vmvs1MWZlpVCJCFqnCmz7de5m6zv1Jc0Ksw0ks+uvXraKR0Unq6RugOSGwWlOc8Prz16yg1SuXCRMO+mvoX+ruvUSTUzNaTeI6ECB7CrbJIRF+zoqEx/PBdY9HPnd6iraaWJsRL5f3ghwEQMB4AhBsDYzDWXT0Nq8mqizanLQuCvIfAl7ULBKhAe+k5x8Db7s4BgEQiB4Bewp2WaXYJeLWvOiYkVtMjjinpllTE202FK7ABhNqLbY03QguAgEQMJWAe85FIxfbTO3TCp1FvEskfcVd5ExM1XwvauERaYx3kZy6vp2Lj+UWQL6Gk9wi6O9RKyfFL4RBJAnkIBBbBFzT4zQ60B1bNxXC3TiUfdiiodZdIinZt1FiOi8mRZaCedtarIbroWvpA9eAAAhEj8D06BBNDJ+P3gCi1LPHw45gW19iejalZHtecNDjHiIRbgi1HjMAGyBgfQITw300PRr+y2fWv7OFRxhxSITj1xzH1juxcHMqFOGPYCEPDpNwYqGW4RKlAr9AAARimgDHrzmObbfkCYmILbZa33RkYHqFRRaDL2PXEOfFSOE8CMQuAbuGQ3hGI/aw2QgvOvLiIxIIgAAIGE2AFxt50dGOSRfBZnDJWbmUlLHcjgxxzyAAAiYRmBoZpMkrF03qzXrdRLzo6H1LkW7x87aFYxAAARDwJmDXrXzeDHTzsNkoh0bSludrfpHGe2A4BgEQAAFJgBcYxwbP2DYUIjnoKthsND55CaXedAdEWxJGDgIgEBEBFuvxf87S7OS1iOzEwsW6hkQkEPa0eW92JG9ASlvIQQAE7EuAwyC859qui4z+M2+IYMtOsBApSSAHARAIl4DdFxjVeOmyD1vNsKxjLzsxI0eX19elTeQgAAKxS4D3WU+P/A2vWmWKdY9hq/ShVPEbkQmpN5JTxLidiWkUF5+EOHcwWKgHAZsQ4Pj03OyUEOcxcokY9cz4VVu+wRjqdBvuYYc6ELQDARAAARBYmIChMeyFu8ZZEAABEACBcAhAsMOhhbYgAAIgEEUCCIlEET66BgEQAIFwCJi26BjOoNAWBEAABEAgkIDHwxb1Wr9xJtAkakAABEAABIwgAA/bCKqwCQIgAAIGEEAM2wCoMAkCIAACRhCAYBtBFTZBAARAwAACEGwDoMIkCIAACBhBQMSwy8U3Ojoi+k5HIwYGmyAAAiAAAr4E4GH78kAJBEAABCxLALtELDs1GBgIgAAI+BLwCLYD+7B9saAEAiAAAtYjgJCI9eYEIwIBEAABVQIIiahiQSUIgAAIWI8ABNt6c4IRgQAIgIAqARESqXST241tfap4UAkCIAAC1iEAD9s6c4GRgAAIgMCCBDyLjqIJ/lvfgpxwEgRAAASiTgDb+qI+BRgACIAACIRGACGR0DihFQiAAAhEnQD2YUd9CjAAEAABEAiNADzs0DihFQiAAAhEncD/yK7Hzc243RIAAAAASUVORK5CYII="},80022:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial1-2d5e9796ee1ace151c9363a0687b4fe0.png"},88644:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial10-3a64cc525b97c1e1140ba142e746ae42.png"},70701:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial2-ff964e064255de5320fa65c81dd5be5d.png"},44548:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial3-ead9bf6431c0a54973cb8364a624eca1.png"},38139:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial4-bff96a165921823b9bae672d544f126d.png"},89138:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial5-d8a6025a2c5bc622b0067f3997112536.png"},54281:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial6-8682ee794ff770b5976ac5d08ac664c0.png"},99456:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial7-43fabc462c181a164bec78ecede23a15.png"},26727:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial8-9795606cfc0a5b81b0d3b42608904af7.png"},55390:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/tutorial9-cdc86fc04357ea76273f38353c7e6782.png"},28453:(e,t,i)=>{i.d(t,{R:()=>a,x:()=>o});var n=i(96540);const A={},s=n.createContext(A);function a(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(A):e.components||A:a(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/2666b20e.5a7c7cd4.js b/assets/js/2666b20e.ff940c61.js similarity index 98% rename from assets/js/2666b20e.5a7c7cd4.js rename to assets/js/2666b20e.ff940c61.js index 5d44012b3..2724f5e6f 100644 --- a/assets/js/2666b20e.5a7c7cd4.js +++ b/assets/js/2666b20e.ff940c61.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1126],{13520:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>l,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>r,toc:()=>d});var i=t(74848),s=t(28453);const n={title:"Upload single file",hide_title:!0,sidebar_position:7},a="How to Upload a Single File to Cado",r={id:"cado/discovery-import/cado-host/manual-upload",title:"Upload single file",description:"You can upload a single file, such as a disk image or a previously collected Cado Host zip file, using Cado Host with the --singlefileunzipped parameter. This method is useful when you do not have direct access to AWS, Azure, or GCP, as Cado will generate the required credentials during the import process.",source:"@site/docs/cado/discovery-import/cado-host/manual-upload.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/manual-upload",permalink:"/cado/discovery-import/cado-host/manual-upload",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/manual-upload.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"Upload single file",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Command line parameters",permalink:"/cado/discovery-import/cado-host/cli"},next:{title:"Script operation",permalink:"/cado/discovery-import/cado-host/script-operation"}},l={},d=[{value:"Steps to Upload a Single File:",id:"steps-to-upload-a-single-file",level:3}];function c(e){const o={br:"br",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(o.h1,{id:"how-to-upload-a-single-file-to-cado",children:"How to Upload a Single File to Cado"}),"\n",(0,i.jsxs)(o.p,{children:["You can upload a single file, such as a disk image or a previously collected Cado Host zip file, using Cado Host with the ",(0,i.jsx)(o.code,{children:"--single_file_unzipped"})," parameter. This method is useful when you do not have direct access to AWS, Azure, or GCP, as Cado will generate the required credentials during the import process."]}),"\n",(0,i.jsx)(o.h3,{id:"steps-to-upload-a-single-file",children:"Steps to Upload a Single File:"}),"\n",(0,i.jsxs)(o.ol,{children:["\n",(0,i.jsxs)(o.li,{children:["\n",(0,i.jsxs)(o.p,{children:[(0,i.jsx)(o.strong,{children:"Generate Upload Credentials"}),(0,i.jsx)(o.br,{}),"\n","In the Cado Platform, go to ",(0,i.jsx)(o.strong,{children:"Import > Forensic Artifacts"})," to generate the credentials for the upload."]}),"\n"]}),"\n",(0,i.jsxs)(o.li,{children:["\n",(0,i.jsxs)(o.p,{children:[(0,i.jsx)(o.strong,{children:"Copy Presigned Data"}),(0,i.jsx)(o.br,{}),"\n","In the investigator system, copy the ",(0,i.jsx)(o.code,{children:"--presigned_data"})," portion of the script to your clipboard."]}),"\n"]}),"\n",(0,i.jsxs)(o.li,{children:["\n",(0,i.jsxs)(o.p,{children:[(0,i.jsx)(o.strong,{children:"Execute the Command"}),(0,i.jsx)(o.br,{}),"\n","Run the following command on the investigator system:"]}),"\n",(0,i.jsx)(o.pre,{children:(0,i.jsx)(o.code,{className:"language-bash",children:"cado-host.exe --single_file_unzipped $file \n"})}),"\n",(0,i.jsxs)(o.p,{children:["Replace ",(0,i.jsx)(o.code,{children:"$file"})," with the path to the file you wish to upload."]}),"\n"]}),"\n",(0,i.jsxs)(o.li,{children:["\n",(0,i.jsxs)(o.p,{children:[(0,i.jsx)(o.strong,{children:"Automatic Processing"}),(0,i.jsx)(o.br,{}),"\n","Cado Host will upload the specified file, and Cado will automatically begin the import and processing of the file."]}),"\n"]}),"\n"]})]})}function p(e={}){const{wrapper:o}={...(0,s.R)(),...e.components};return o?(0,i.jsx)(o,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},28453:(e,o,t)=>{t.d(o,{R:()=>a,x:()=>r});var i=t(96540);const s={},n=i.createContext(s);function a(e){const o=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),i.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1126],{13520:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>l,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>r,toc:()=>d});var i=t(74848),s=t(28453);const n={title:"Upload single file",hide_title:!0,sidebar_position:7},a="How to Upload a Single File to Cado",r={id:"cado/discovery-import/cado-host/manual-upload",title:"Upload single file",description:"You can upload a single file, such as a disk image or a previously collected Cado Host zip file, using Cado Host with the --singlefileunzipped parameter. This method is useful when you do not have direct access to AWS, Azure, or GCP, as Cado will generate the required credentials during the import process.",source:"@site/docs/cado/discovery-import/cado-host/manual-upload.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/manual-upload",permalink:"/cado/discovery-import/cado-host/manual-upload",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/manual-upload.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"Upload single file",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Command line parameters",permalink:"/cado/discovery-import/cado-host/cli"},next:{title:"Script operation",permalink:"/cado/discovery-import/cado-host/script-operation"}},l={},d=[{value:"Steps to Upload a Single File:",id:"steps-to-upload-a-single-file",level:3}];function c(e){const o={br:"br",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(o.h1,{id:"how-to-upload-a-single-file-to-cado",children:"How to Upload a Single File to Cado"}),"\n",(0,i.jsxs)(o.p,{children:["You can upload a single file, such as a disk image or a previously collected Cado Host zip file, using Cado Host with the ",(0,i.jsx)(o.code,{children:"--single_file_unzipped"})," parameter. This method is useful when you do not have direct access to AWS, Azure, or GCP, as Cado will generate the required credentials during the import process."]}),"\n",(0,i.jsx)(o.h3,{id:"steps-to-upload-a-single-file",children:"Steps to Upload a Single File:"}),"\n",(0,i.jsxs)(o.ol,{children:["\n",(0,i.jsxs)(o.li,{children:["\n",(0,i.jsxs)(o.p,{children:[(0,i.jsx)(o.strong,{children:"Generate Upload Credentials"}),(0,i.jsx)(o.br,{}),"\n","In the Cado Platform, go to ",(0,i.jsx)(o.strong,{children:"Import > Forensic Artifacts"})," to generate the credentials for the upload."]}),"\n"]}),"\n",(0,i.jsxs)(o.li,{children:["\n",(0,i.jsxs)(o.p,{children:[(0,i.jsx)(o.strong,{children:"Copy Presigned Data"}),(0,i.jsx)(o.br,{}),"\n","In the investigator system, copy the ",(0,i.jsx)(o.code,{children:"--presigned_data"})," portion of the script to your clipboard."]}),"\n"]}),"\n",(0,i.jsxs)(o.li,{children:["\n",(0,i.jsxs)(o.p,{children:[(0,i.jsx)(o.strong,{children:"Execute the Command"}),(0,i.jsx)(o.br,{}),"\n","Run the following command on the investigator system:"]}),"\n",(0,i.jsx)(o.pre,{children:(0,i.jsx)(o.code,{className:"language-bash",children:"cado-host.exe --single_file_unzipped $file \n"})}),"\n",(0,i.jsxs)(o.p,{children:["Replace ",(0,i.jsx)(o.code,{children:"$file"})," with the path to the file you wish to upload."]}),"\n"]}),"\n",(0,i.jsxs)(o.li,{children:["\n",(0,i.jsxs)(o.p,{children:[(0,i.jsx)(o.strong,{children:"Automatic Processing"}),(0,i.jsx)(o.br,{}),"\n","Cado Host will upload the specified file, and Cado will automatically begin the import and processing of the file."]}),"\n"]}),"\n"]})]})}function p(e={}){const{wrapper:o}={...(0,s.R)(),...e.components};return o?(0,i.jsx)(o,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},28453:(e,o,t)=>{t.d(o,{R:()=>a,x:()=>r});var i=t(96540);const s={},n=i.createContext(s);function a(e){const o=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),i.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/28424281.b9c7cc63.js b/assets/js/28424281.a9367765.js similarity index 94% rename from assets/js/28424281.b9c7cc63.js rename to assets/js/28424281.a9367765.js index 8f3068e2d..93557473f 100644 --- a/assets/js/28424281.b9c7cc63.js +++ b/assets/js/28424281.a9367765.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8588],{89049:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>c,contentTitle:()=>a,default:()=>m,frontMatter:()=>i,metadata:()=>n,toc:()=>d});var r=o(74848),s=o(28453);const i={title:"Cloud import sources",hide_title:!0,sidebar_position:4},a="What cloud sources can Cado import from?",n={id:"cado/discovery-import/data-types/import-types",title:"Cloud import sources",description:"Import Types",source:"@site/docs/cado/discovery-import/data-types/import-types.md",sourceDirName:"cado/discovery-import/data-types",slug:"/cado/discovery-import/data-types/import-types",permalink:"/cado/discovery-import/data-types/import-types",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/data-types/import-types.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Cloud import sources",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Memory analysis",permalink:"/cado/discovery-import/data-types/memory"},next:{title:"Managing investigations",permalink:"/cado/discovery-import/investigations"}},c={},d=[];function p(t){const e={h1:"h1",img:"img",p:"p",...(0,s.R)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(e.h1,{id:"what-cloud-sources-can-cado-import-from",children:"What cloud sources can Cado import from?"}),"\n",(0,r.jsx)(e.p,{children:(0,r.jsx)(e.img,{alt:"Import Types",src:o(1814).A+"",width:"1251",height:"797"})})]})}function m(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,r.jsx)(e,{...t,children:(0,r.jsx)(p,{...t})}):p(t)}},1814:(t,e,o)=>{o.d(e,{A:()=>r});const r=o.p+"assets/images/import-types-00d7746a12ccf9ed81d11e06723e00b3.png"},28453:(t,e,o)=>{o.d(e,{R:()=>a,x:()=>n});var r=o(96540);const s={},i=r.createContext(s);function a(t){const e=r.useContext(i);return r.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function n(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:a(t.components),r.createElement(i.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8588],{89049:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>c,contentTitle:()=>a,default:()=>m,frontMatter:()=>i,metadata:()=>n,toc:()=>d});var r=o(74848),s=o(28453);const i={title:"Cloud import sources",hide_title:!0,sidebar_position:4},a="What cloud sources can Cado import from?",n={id:"cado/discovery-import/data-types/import-types",title:"Cloud import sources",description:"Import Types",source:"@site/docs/cado/discovery-import/data-types/import-types.md",sourceDirName:"cado/discovery-import/data-types",slug:"/cado/discovery-import/data-types/import-types",permalink:"/cado/discovery-import/data-types/import-types",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/data-types/import-types.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Cloud import sources",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Memory analysis",permalink:"/cado/discovery-import/data-types/memory"},next:{title:"Managing investigations",permalink:"/cado/discovery-import/investigations"}},c={},d=[];function p(t){const e={h1:"h1",img:"img",p:"p",...(0,s.R)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(e.h1,{id:"what-cloud-sources-can-cado-import-from",children:"What cloud sources can Cado import from?"}),"\n",(0,r.jsx)(e.p,{children:(0,r.jsx)(e.img,{alt:"Import Types",src:o(1814).A+"",width:"1251",height:"797"})})]})}function m(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,r.jsx)(e,{...t,children:(0,r.jsx)(p,{...t})}):p(t)}},1814:(t,e,o)=>{o.d(e,{A:()=>r});const r=o.p+"assets/images/import-types-00d7746a12ccf9ed81d11e06723e00b3.png"},28453:(t,e,o)=>{o.d(e,{R:()=>a,x:()=>n});var r=o(96540);const s={},i=r.createContext(s);function a(t){const e=r.useContext(i);return r.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function n(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:a(t.components),r.createElement(i.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/2979d8b1.e915c415.js b/assets/js/2979d8b1.d6bfe8c4.js similarity index 96% rename from assets/js/2979d8b1.e915c415.js rename to assets/js/2979d8b1.d6bfe8c4.js index eba03ca44..429d4f0a5 100644 --- a/assets/js/2979d8b1.e915c415.js +++ b/assets/js/2979d8b1.d6bfe8c4.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9907],{21911:(o,e,s)=>{s.r(e),s.d(e,{assets:()=>i,contentTitle:()=>d,default:()=>p,frontMatter:()=>n,metadata:()=>a,toc:()=>c});var t=s(74848),r=s(28453);const n={title:"Cross cloud",hide_title:!0,sidebar_position:1},d="How do cross cloud imports work in Cado?",a={id:"cado/deploy/cross/intro",title:"Cross cloud",description:"Cado allows you to import data across different cloud environments, meaning that you can deploy Cado in one cloud (AWS, Azure, or Google Cloud) and import data from another. This is referred to as cross-cloud importing.",source:"@site/docs/cado/deploy/cross/intro.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/intro",permalink:"/cado/deploy/cross/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/intro.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Cross cloud",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"GCP Logging Best Practices",permalink:"/cado/deploy/gcp/logs"},next:{title:"Manually deploy a cross-account role in AWS",permalink:"/cado/deploy/cross/cross-account-creation"}},i={},c=[{value:"AWS",id:"aws",level:3},{value:"Azure",id:"azure",level:3},{value:"Google Cloud",id:"google-cloud",level:3}];function l(o){const e={h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",...(0,r.R)(),...o.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"how-do-cross-cloud-imports-work-in-cado",children:"How do cross cloud imports work in Cado?"}),"\n",(0,t.jsxs)(e.p,{children:["Cado allows you to import data across different cloud environments, meaning that you can deploy Cado in one cloud (AWS, Azure, or Google Cloud) and import data from another. This is referred to as ",(0,t.jsx)(e.strong,{children:"cross-cloud"})," importing."]}),"\n",(0,t.jsx)(e.p,{children:"In a cross-cloud setup, Cado can seamlessly acquire data from cloud environments other than where the platform is deployed, enabling flexible and comprehensive data collection across multiple cloud providers."}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Cross-Cloud Collection",src:s(75097).A+"",width:"1082",height:"583"})}),"\n",(0,t.jsx)(e.p,{children:"Below are diagrams showing how cross-cloud imports work for each cloud provider:"}),"\n",(0,t.jsx)(e.h3,{id:"aws",children:"AWS"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"AWS Cross-Cloud Imports",src:s(8739).A+"",width:"1396",height:"746"})}),"\n",(0,t.jsx)(e.h3,{id:"azure",children:"Azure"}),"\n",(0,t.jsxs)(e.p,{children:[(0,t.jsx)(e.img,{alt:"Azure Imports",src:s(24933).A+"",width:"1948",height:"912"}),"\n",(0,t.jsx)(e.img,{alt:"Azure Cross-Cloud Imports",src:s(63755).A+"",width:"1896",height:"1056"})]}),"\n",(0,t.jsx)(e.h3,{id:"google-cloud",children:"Google Cloud"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Google Cloud Imports",src:s(79266).A+"",width:"1982",height:"930"})})]})}function p(o={}){const{wrapper:e}={...(0,r.R)(),...o.components};return e?(0,t.jsx)(e,{...o,children:(0,t.jsx)(l,{...o})}):l(o)}},8739:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/aws-network-860a48ba4892774643f49955a580677d.png"},63755:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/azure-cross-6f16704f6890ab992de046ba5ff6b986.png"},24933:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/azure-imports-28cc37a015043a3c20e4785cab6b7fa2.png"},75097:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/cross-cloud-d567d021d7d7207ba606f160cfd3bf05.png"},79266:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/gcp-imports-72c2a49df0ee23aa7f846e6c131fab20.png"},28453:(o,e,s)=>{s.d(e,{R:()=>d,x:()=>a});var t=s(96540);const r={},n=t.createContext(r);function d(o){const e=t.useContext(n);return t.useMemo((function(){return"function"==typeof o?o(e):{...e,...o}}),[e,o])}function a(o){let e;return e=o.disableParentContext?"function"==typeof o.components?o.components(r):o.components||r:d(o.components),t.createElement(n.Provider,{value:e},o.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9907],{21911:(o,e,s)=>{s.r(e),s.d(e,{assets:()=>i,contentTitle:()=>d,default:()=>p,frontMatter:()=>n,metadata:()=>a,toc:()=>c});var t=s(74848),r=s(28453);const n={title:"Cross cloud",hide_title:!0,sidebar_position:1},d="How do cross cloud imports work in Cado?",a={id:"cado/deploy/cross/intro",title:"Cross cloud",description:"Cado allows you to import data across different cloud environments, meaning that you can deploy Cado in one cloud (AWS, Azure, or Google Cloud) and import data from another. This is referred to as cross-cloud importing.",source:"@site/docs/cado/deploy/cross/intro.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/intro",permalink:"/cado/deploy/cross/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/intro.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Cross cloud",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"GCP Logging Best Practices",permalink:"/cado/deploy/gcp/logs"},next:{title:"Manually deploy a cross-account role in AWS",permalink:"/cado/deploy/cross/cross-account-creation"}},i={},c=[{value:"AWS",id:"aws",level:3},{value:"Azure",id:"azure",level:3},{value:"Google Cloud",id:"google-cloud",level:3}];function l(o){const e={h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",...(0,r.R)(),...o.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"how-do-cross-cloud-imports-work-in-cado",children:"How do cross cloud imports work in Cado?"}),"\n",(0,t.jsxs)(e.p,{children:["Cado allows you to import data across different cloud environments, meaning that you can deploy Cado in one cloud (AWS, Azure, or Google Cloud) and import data from another. This is referred to as ",(0,t.jsx)(e.strong,{children:"cross-cloud"})," importing."]}),"\n",(0,t.jsx)(e.p,{children:"In a cross-cloud setup, Cado can seamlessly acquire data from cloud environments other than where the platform is deployed, enabling flexible and comprehensive data collection across multiple cloud providers."}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Cross-Cloud Collection",src:s(75097).A+"",width:"1082",height:"583"})}),"\n",(0,t.jsx)(e.p,{children:"Below are diagrams showing how cross-cloud imports work for each cloud provider:"}),"\n",(0,t.jsx)(e.h3,{id:"aws",children:"AWS"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"AWS Cross-Cloud Imports",src:s(8739).A+"",width:"1396",height:"746"})}),"\n",(0,t.jsx)(e.h3,{id:"azure",children:"Azure"}),"\n",(0,t.jsxs)(e.p,{children:[(0,t.jsx)(e.img,{alt:"Azure Imports",src:s(24933).A+"",width:"1948",height:"912"}),"\n",(0,t.jsx)(e.img,{alt:"Azure Cross-Cloud Imports",src:s(63755).A+"",width:"1896",height:"1056"})]}),"\n",(0,t.jsx)(e.h3,{id:"google-cloud",children:"Google Cloud"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Google Cloud Imports",src:s(79266).A+"",width:"1982",height:"930"})})]})}function p(o={}){const{wrapper:e}={...(0,r.R)(),...o.components};return e?(0,t.jsx)(e,{...o,children:(0,t.jsx)(l,{...o})}):l(o)}},8739:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/aws-network-860a48ba4892774643f49955a580677d.png"},63755:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/azure-cross-6f16704f6890ab992de046ba5ff6b986.png"},24933:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/azure-imports-28cc37a015043a3c20e4785cab6b7fa2.png"},75097:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/cross-cloud-d567d021d7d7207ba606f160cfd3bf05.png"},79266:(o,e,s)=>{s.d(e,{A:()=>t});const t=s.p+"assets/images/gcp-imports-72c2a49df0ee23aa7f846e6c131fab20.png"},28453:(o,e,s)=>{s.d(e,{R:()=>d,x:()=>a});var t=s(96540);const r={},n=t.createContext(r);function d(o){const e=t.useContext(n);return t.useMemo((function(){return"function"==typeof o?o(e):{...e,...o}}),[e,o])}function a(o){let e;return e=o.disableParentContext?"function"==typeof o.components?o.components(r):o.components||r:d(o.components),t.createElement(n.Provider,{value:e},o.children)}}}]); \ No newline at end of file diff --git a/assets/js/2ad92a42.61e96da4.js b/assets/js/2ad92a42.36ce1dc6.js similarity index 98% rename from assets/js/2ad92a42.61e96da4.js rename to assets/js/2ad92a42.36ce1dc6.js index 3061410ab..424f799e8 100644 --- a/assets/js/2ad92a42.61e96da4.js +++ b/assets/js/2ad92a42.36ce1dc6.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9892],{18752:(o,e,t)=>{t.r(e),t.d(e,{assets:()=>i,contentTitle:()=>s,default:()=>u,frontMatter:()=>c,metadata:()=>r,toc:()=>d});var a=t(74848),n=t(28453);const c={title:"Manually add a cross-account role to Cado in AWS",hide_title:!0,sidebar_position:4},s="How to manually add a cross-account role to Cado",r={id:"cado/deploy/cross/add-cross-account-manual",title:"Manually add a cross-account role to Cado in AWS",description:"There are two main steps to set up cross-account acquisitions:",source:"@site/docs/cado/deploy/cross/add-cross-account-manual.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/add-cross-account-manual",permalink:"/cado/deploy/cross/add-cross-account-manual",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/add-cross-account-manual.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Manually add a cross-account role to Cado in AWS",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Automatically deploy a cross-account role with StackSets in AWS",permalink:"/cado/deploy/cross/cross-account-creation-auto"},next:{title:"Automatically add cross-account roles to Cado with AWS Organizations",permalink:"/cado/deploy/cross/aws-organizations"}},i={},d=[{value:"Step 2: Add the Target AWS Role ARN to the Cado Platform",id:"step-2-add-the-target-aws-role-arn-to-the-cado-platform",level:2}];function l(o){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...o.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(e.h1,{id:"how-to-manually-add-a-cross-account-role-to-cado",children:"How to manually add a cross-account role to Cado"}),"\n",(0,a.jsx)(e.p,{children:"There are two main steps to set up cross-account acquisitions:"}),"\n",(0,a.jsxs)(e.ol,{children:["\n",(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:"Create a Cross-Account IAM Policy and Role"})," in the target AWS account from which the Cado platform will acquire data. This allows Cado to assume the cross-account role for data acquisition."]}),"\n",(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:"Add the Cross-Account IAM Role ARN"})," to the Cado platform to enable access to that AWS account."]}),"\n"]}),"\n",(0,a.jsxs)(e.p,{children:["This page describes step 2. For step 1, see ",(0,a.jsx)(e.a,{href:"/cado/deploy/cross/cross-account-creation",children:"Manually deploy a cross-account IAM role in AWS"}),"."]}),"\n",(0,a.jsxs)(e.admonition,{type:"info",children:[(0,a.jsx)(e.p,{children:"Throughout this guide:"}),(0,a.jsxs)(e.ul,{children:["\n",(0,a.jsxs)(e.li,{children:["The ",(0,a.jsx)(e.strong,{children:"primary AWS account"})," is where Cado is deployed (referred to as account ",(0,a.jsx)(e.code,{children:"111111111111"}),")."]}),"\n",(0,a.jsxs)(e.li,{children:["The ",(0,a.jsx)(e.strong,{children:"target AWS account"})," is where cross-account access is being set up (referred to as account ",(0,a.jsx)(e.code,{children:"222222222222"}),")."]}),"\n"]})]}),"\n",(0,a.jsx)(e.h2,{id:"step-2-add-the-target-aws-role-arn-to-the-cado-platform",children:"Step 2: Add the Target AWS Role ARN to the Cado Platform"}),"\n",(0,a.jsxs)(e.p,{children:["Once the cross-account role is created in the target AWS account (",(0,a.jsx)(e.code,{children:"222222222222"}),"), add the Role ARN to the Cado platform:"]}),"\n",(0,a.jsxs)(e.ol,{children:["\n",(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:"Log into the Cado platform"})," and go to ",(0,a.jsx)(e.strong,{children:"Settings > Accounts"})," and click ",(0,a.jsx)(e.strong,{children:"Create an account"}),"."]}),"\n",(0,a.jsxs)(e.li,{children:["Select ",(0,a.jsx)(e.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,a.jsxs)(e.li,{children:["The ",(0,a.jsx)(e.strong,{children:"AWS Role"})," option should already be selected."]}),"\n"]}),"\n",(0,a.jsx)(e.p,{children:(0,a.jsx)(e.img,{alt:"Add AWS Account",src:t(82529).A+"",width:"2691",height:"1065"})}),"\n",(0,a.jsxs)(e.ol,{start:"4",children:["\n",(0,a.jsxs)(e.li,{children:["Enter the IAM Role ARN created in Step 1, and provide an ",(0,a.jsx)(e.strong,{children:"Account Name"}),". The Account Name should include the AWS account number for clarity."]}),"\n",(0,a.jsx)(e.li,{children:"The Cado platform will validate the role to ensure it is assumable. Once validated, the account name will appear in the list of available AWS accounts."}),"\n",(0,a.jsxs)(e.li,{children:["By default, Cado will perform an ",(0,a.jsx)(e.strong,{children:"Account Check"}),' to confirm the required permissions are in place for successful acquisitions. You can skip this by unchecking the "Run account check after adding account" option. For more information, refer to the ',(0,a.jsx)(e.a,{href:"/cado/manage/monitoring#account-check",children:"Account Check guide"}),"."]}),"\n"]}),"\n",(0,a.jsxs)(e.p,{children:["Adding the cross-account ARN to Cado can also be automated using Cado\u2019s API. See ",(0,a.jsx)(e.a,{href:"#automating-cado-cross-account-creation",children:"Automating Cado Cross-Account Creation"}),"."]})]})}function u(o={}){const{wrapper:e}={...(0,n.R)(),...o.components};return e?(0,a.jsx)(e,{...o,children:(0,a.jsx)(l,{...o})}):l(o)}},82529:(o,e,t)=>{t.d(e,{A:()=>a});const a=t.p+"assets/images/Accounts-AWSRole-178a60c0f1875e368762de969a08b3f1.png"},28453:(o,e,t)=>{t.d(e,{R:()=>s,x:()=>r});var a=t(96540);const n={},c=a.createContext(n);function s(o){const e=a.useContext(c);return a.useMemo((function(){return"function"==typeof o?o(e):{...e,...o}}),[e,o])}function r(o){let e;return e=o.disableParentContext?"function"==typeof o.components?o.components(n):o.components||n:s(o.components),a.createElement(c.Provider,{value:e},o.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9892],{18752:(o,e,t)=>{t.r(e),t.d(e,{assets:()=>i,contentTitle:()=>s,default:()=>u,frontMatter:()=>c,metadata:()=>r,toc:()=>d});var a=t(74848),n=t(28453);const c={title:"Manually add a cross-account role to Cado in AWS",hide_title:!0,sidebar_position:4},s="How to manually add a cross-account role to Cado",r={id:"cado/deploy/cross/add-cross-account-manual",title:"Manually add a cross-account role to Cado in AWS",description:"There are two main steps to set up cross-account acquisitions:",source:"@site/docs/cado/deploy/cross/add-cross-account-manual.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/add-cross-account-manual",permalink:"/cado/deploy/cross/add-cross-account-manual",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/add-cross-account-manual.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Manually add a cross-account role to Cado in AWS",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Automatically deploy a cross-account role with StackSets in AWS",permalink:"/cado/deploy/cross/cross-account-creation-auto"},next:{title:"Automatically add cross-account roles to Cado with AWS Organizations",permalink:"/cado/deploy/cross/aws-organizations"}},i={},d=[{value:"Step 2: Add the Target AWS Role ARN to the Cado Platform",id:"step-2-add-the-target-aws-role-arn-to-the-cado-platform",level:2}];function l(o){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...o.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(e.h1,{id:"how-to-manually-add-a-cross-account-role-to-cado",children:"How to manually add a cross-account role to Cado"}),"\n",(0,a.jsx)(e.p,{children:"There are two main steps to set up cross-account acquisitions:"}),"\n",(0,a.jsxs)(e.ol,{children:["\n",(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:"Create a Cross-Account IAM Policy and Role"})," in the target AWS account from which the Cado platform will acquire data. This allows Cado to assume the cross-account role for data acquisition."]}),"\n",(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:"Add the Cross-Account IAM Role ARN"})," to the Cado platform to enable access to that AWS account."]}),"\n"]}),"\n",(0,a.jsxs)(e.p,{children:["This page describes step 2. For step 1, see ",(0,a.jsx)(e.a,{href:"/cado/deploy/cross/cross-account-creation",children:"Manually deploy a cross-account IAM role in AWS"}),"."]}),"\n",(0,a.jsxs)(e.admonition,{type:"info",children:[(0,a.jsx)(e.p,{children:"Throughout this guide:"}),(0,a.jsxs)(e.ul,{children:["\n",(0,a.jsxs)(e.li,{children:["The ",(0,a.jsx)(e.strong,{children:"primary AWS account"})," is where Cado is deployed (referred to as account ",(0,a.jsx)(e.code,{children:"111111111111"}),")."]}),"\n",(0,a.jsxs)(e.li,{children:["The ",(0,a.jsx)(e.strong,{children:"target AWS account"})," is where cross-account access is being set up (referred to as account ",(0,a.jsx)(e.code,{children:"222222222222"}),")."]}),"\n"]})]}),"\n",(0,a.jsx)(e.h2,{id:"step-2-add-the-target-aws-role-arn-to-the-cado-platform",children:"Step 2: Add the Target AWS Role ARN to the Cado Platform"}),"\n",(0,a.jsxs)(e.p,{children:["Once the cross-account role is created in the target AWS account (",(0,a.jsx)(e.code,{children:"222222222222"}),"), add the Role ARN to the Cado platform:"]}),"\n",(0,a.jsxs)(e.ol,{children:["\n",(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:"Log into the Cado platform"})," and go to ",(0,a.jsx)(e.strong,{children:"Settings > Accounts"})," and click ",(0,a.jsx)(e.strong,{children:"Create an account"}),"."]}),"\n",(0,a.jsxs)(e.li,{children:["Select ",(0,a.jsx)(e.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,a.jsxs)(e.li,{children:["The ",(0,a.jsx)(e.strong,{children:"AWS Role"})," option should already be selected."]}),"\n"]}),"\n",(0,a.jsx)(e.p,{children:(0,a.jsx)(e.img,{alt:"Add AWS Account",src:t(82529).A+"",width:"2691",height:"1065"})}),"\n",(0,a.jsxs)(e.ol,{start:"4",children:["\n",(0,a.jsxs)(e.li,{children:["Enter the IAM Role ARN created in Step 1, and provide an ",(0,a.jsx)(e.strong,{children:"Account Name"}),". The Account Name should include the AWS account number for clarity."]}),"\n",(0,a.jsx)(e.li,{children:"The Cado platform will validate the role to ensure it is assumable. Once validated, the account name will appear in the list of available AWS accounts."}),"\n",(0,a.jsxs)(e.li,{children:["By default, Cado will perform an ",(0,a.jsx)(e.strong,{children:"Account Check"}),' to confirm the required permissions are in place for successful acquisitions. You can skip this by unchecking the "Run account check after adding account" option. For more information, refer to the ',(0,a.jsx)(e.a,{href:"/cado/manage/monitoring#account-check",children:"Account Check guide"}),"."]}),"\n"]}),"\n",(0,a.jsxs)(e.p,{children:["Adding the cross-account ARN to Cado can also be automated using Cado\u2019s API. See ",(0,a.jsx)(e.a,{href:"#automating-cado-cross-account-creation",children:"Automating Cado Cross-Account Creation"}),"."]})]})}function u(o={}){const{wrapper:e}={...(0,n.R)(),...o.components};return e?(0,a.jsx)(e,{...o,children:(0,a.jsx)(l,{...o})}):l(o)}},82529:(o,e,t)=>{t.d(e,{A:()=>a});const a=t.p+"assets/images/Accounts-AWSRole-178a60c0f1875e368762de969a08b3f1.png"},28453:(o,e,t)=>{t.d(e,{R:()=>s,x:()=>r});var a=t(96540);const n={},c=a.createContext(n);function s(o){const e=a.useContext(c);return a.useMemo((function(){return"function"==typeof o?o(e):{...e,...o}}),[e,o])}function r(o){let e;return e=o.disableParentContext?"function"==typeof o.components?o.components(n):o.components||n:s(o.components),a.createElement(c.Provider,{value:e},o.children)}}}]); \ No newline at end of file diff --git a/assets/js/2b3e752e.5d01fbdb.js b/assets/js/2b3e752e.7ba4b595.js similarity index 99% rename from assets/js/2b3e752e.5d01fbdb.js rename to assets/js/2b3e752e.7ba4b595.js index 8ff73a9cb..f72dfb6bf 100644 --- a/assets/js/2b3e752e.5d01fbdb.js +++ b/assets/js/2b3e752e.7ba4b595.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6612],{69687:(n,e,t)=>{t.r(e),t.d(e,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var s=t(74848),i=t(28453);const o={title:"Okta OAuth",hide_title:!0,sidebar_position:2},a="How to Set Up the Okta OAuth Integration",r={id:"cado/manage/users-authentication/sso/okta",title:"Okta OAuth",description:"If you encounter issues, please contact support@cadosecurity.com and provide detailed information about your configuration.",source:"@site/docs/cado/manage/users-authentication/sso/okta.md",sourceDirName:"cado/manage/users-authentication/sso",slug:"/cado/manage/users-authentication/sso/okta",permalink:"/cado/manage/users-authentication/sso/okta",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/sso/okta.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Okta OAuth",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Azure AD",permalink:"/cado/manage/users-authentication/sso/azure-ad"},next:{title:"Okta SAML",permalink:"/cado/manage/users-authentication/sso/okta_saml"}},c={},d=[{value:"Setting up Okta SSO",id:"setting-up-okta-sso",level:3}];function l(n){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...n.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.h1,{id:"how-to-set-up-the-okta-oauth-integration",children:"How to Set Up the Okta OAuth Integration"}),"\n",(0,s.jsx)(e.admonition,{type:"warning",children:(0,s.jsxs)(e.p,{children:["If you encounter issues, please contact ",(0,s.jsx)(e.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and provide detailed information about your configuration."]})}),"\n",(0,s.jsxs)(e.p,{children:["You can enable the Okta OAuth Integration beta in the Cado platform by navigating to ",(0,s.jsx)(e.code,{children:"Settings > SSO > Okta OAuth"}),"."]}),"\n",(0,s.jsx)(e.h3,{id:"setting-up-okta-sso",children:"Setting up Okta SSO"}),"\n",(0,s.jsxs)(e.ol,{children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Open the Okta admin dashboard and go to ",(0,s.jsx)(e.code,{children:"Applications > Applications"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Create App Integration"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Select:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsx)(e.li,{children:(0,s.jsx)(e.strong,{children:"OIDC - OpenID Connect"})}),"\n",(0,s.jsx)(e.li,{children:(0,s.jsx)(e.strong,{children:"Web Application"})}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Next"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Name the Cado OAuth app."}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Add a ",(0,s.jsx)(e.strong,{children:"Sign-in Redirect URI"}),". This should be the URL you use to access Cado, followed by ",(0,s.jsx)(e.code,{children:"/login"})," (e.g., ",(0,s.jsx)(e.a,{href:"https://my.cado.instance/login",children:"https://my.cado.instance/login"}),")."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Select who will have access to the application:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:["In ",(0,s.jsx)(e.strong,{children:"Assignments"}),", choose ",(0,s.jsx)(e.strong,{children:"Limit access to selected groups"}),"."]}),"\n",(0,s.jsx)(e.li,{children:"Add a user group. You can assign users later if needed."}),"\n",(0,s.jsxs)(e.li,{children:["In this example, the admin group is named ",(0,s.jsx)(e.code,{children:"CadoAdmin"}),", but you can use any name. Keep note of it for later steps."]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Assignments",src:t(66247).A+"",width:"725",height:"242"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(e.admonition,{type:"tip",children:(0,s.jsxs)(e.p,{children:["To assign non-admin users within Cado, create a group with a different name (e.g., ",(0,s.jsx)(e.code,{children:"CadoNonAdmin"}),"), and users in that group will be Normal Users in the Cado platform."]})}),"\n",(0,s.jsxs)(e.ol,{start:"8",children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["To adjust access control later, go to the ",(0,s.jsx)(e.strong,{children:"Assignments"})," tab of the OAuth application, where you can add individuals or groups. Only users in the ",(0,s.jsx)(e.code,{children:"CadoAdmin"})," group will have admin status in Cado."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Add a ",(0,s.jsx)(e.strong,{children:"Groups Claim"})," for the application:"]}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:["Go to the ",(0,s.jsx)(e.strong,{children:"Sign On"})," tab of the OAuth application."]}),"\n",(0,s.jsxs)(e.li,{children:["Click ",(0,s.jsx)(e.strong,{children:"Edit"})," in the ",(0,s.jsx)(e.strong,{children:"OpenID Connect ID Token"})," section."]}),"\n",(0,s.jsxs)(e.li,{children:["In the ",(0,s.jsx)(e.strong,{children:"Issuer"})," field, specify the ",(0,s.jsx)(e.strong,{children:"Okta URL"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["For ",(0,s.jsx)(e.strong,{children:"Groups claim type"}),", select ",(0,s.jsx)(e.strong,{children:"Filter"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Set ",(0,s.jsx)(e.strong,{children:"Groups claim filter"})," to ",(0,s.jsx)(e.strong,{children:"groups"})," and enter ",(0,s.jsx)(e.strong,{children:"Matches regex"})," ",(0,s.jsx)(e.code,{children:".*"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Click ",(0,s.jsx)(e.strong,{children:"Save"}),"."]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Groups Claim",src:t(79862).A+"",width:"696",height:"91"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["In the ",(0,s.jsx)(e.strong,{children:"General Settings"})," tab of the OAuth application, note down the ",(0,s.jsx)(e.code,{children:"Client ID"}),", ",(0,s.jsx)(e.code,{children:"Client Secret"}),", and ",(0,s.jsx)(e.code,{children:"Okta Domain"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Configure SSO in Cado:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsx)(e.li,{children:"Log in to your Cado instance as an admin."}),"\n",(0,s.jsxs)(e.li,{children:["Go to ",(0,s.jsx)(e.code,{children:"Settings > SSO > Okta OAuth"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Enter the details from the previous step and click ",(0,s.jsx)(e.strong,{children:"Update"}),". For the domain, add ",(0,s.jsx)(e.code,{children:"https://"})," at the beginning and ",(0,s.jsx)(e.code,{children:"/oauth2"})," at the end. The complete domain should look like this: ",(0,s.jsx)(e.code,{children:"https:///oauth2"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Enter the ",(0,s.jsx)(e.code,{children:"Admin Group Name"})," value from step 7."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Log out and log in using Okta OAuth."}),"\n"]}),"\n"]})]})}function h(n={}){const{wrapper:e}={...(0,i.R)(),...n.components};return e?(0,s.jsx)(e,{...n,children:(0,s.jsx)(l,{...n})}):l(n)}},66247:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-assignments-3b23b5eb60b1a663656d167431a6126c.png"},79862:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-groups-claim-0a2dfcb9c5c3f572132da5cdcc4ffe63.png"},28453:(n,e,t)=>{t.d(e,{R:()=>a,x:()=>r});var s=t(96540);const i={},o=s.createContext(i);function a(n){const e=s.useContext(o);return s.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function r(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(i):n.components||i:a(n.components),s.createElement(o.Provider,{value:e},n.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6612],{69687:(n,e,t)=>{t.r(e),t.d(e,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var s=t(74848),i=t(28453);const o={title:"Okta OAuth",hide_title:!0,sidebar_position:2},a="How to Set Up the Okta OAuth Integration",r={id:"cado/manage/users-authentication/sso/okta",title:"Okta OAuth",description:"If you encounter issues, please contact support@cadosecurity.com and provide detailed information about your configuration.",source:"@site/docs/cado/manage/users-authentication/sso/okta.md",sourceDirName:"cado/manage/users-authentication/sso",slug:"/cado/manage/users-authentication/sso/okta",permalink:"/cado/manage/users-authentication/sso/okta",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/sso/okta.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Okta OAuth",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Azure AD",permalink:"/cado/manage/users-authentication/sso/azure-ad"},next:{title:"Okta SAML",permalink:"/cado/manage/users-authentication/sso/okta_saml"}},c={},d=[{value:"Setting up Okta SSO",id:"setting-up-okta-sso",level:3}];function l(n){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...n.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.h1,{id:"how-to-set-up-the-okta-oauth-integration",children:"How to Set Up the Okta OAuth Integration"}),"\n",(0,s.jsx)(e.admonition,{type:"warning",children:(0,s.jsxs)(e.p,{children:["If you encounter issues, please contact ",(0,s.jsx)(e.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and provide detailed information about your configuration."]})}),"\n",(0,s.jsxs)(e.p,{children:["You can enable the Okta OAuth Integration beta in the Cado platform by navigating to ",(0,s.jsx)(e.code,{children:"Settings > SSO > Okta OAuth"}),"."]}),"\n",(0,s.jsx)(e.h3,{id:"setting-up-okta-sso",children:"Setting up Okta SSO"}),"\n",(0,s.jsxs)(e.ol,{children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Open the Okta admin dashboard and go to ",(0,s.jsx)(e.code,{children:"Applications > Applications"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Create App Integration"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Select:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsx)(e.li,{children:(0,s.jsx)(e.strong,{children:"OIDC - OpenID Connect"})}),"\n",(0,s.jsx)(e.li,{children:(0,s.jsx)(e.strong,{children:"Web Application"})}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Next"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Name the Cado OAuth app."}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Add a ",(0,s.jsx)(e.strong,{children:"Sign-in Redirect URI"}),". This should be the URL you use to access Cado, followed by ",(0,s.jsx)(e.code,{children:"/login"})," (e.g., ",(0,s.jsx)(e.a,{href:"https://my.cado.instance/login",children:"https://my.cado.instance/login"}),")."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Select who will have access to the application:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:["In ",(0,s.jsx)(e.strong,{children:"Assignments"}),", choose ",(0,s.jsx)(e.strong,{children:"Limit access to selected groups"}),"."]}),"\n",(0,s.jsx)(e.li,{children:"Add a user group. You can assign users later if needed."}),"\n",(0,s.jsxs)(e.li,{children:["In this example, the admin group is named ",(0,s.jsx)(e.code,{children:"CadoAdmin"}),", but you can use any name. Keep note of it for later steps."]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Assignments",src:t(66247).A+"",width:"725",height:"242"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(e.admonition,{type:"tip",children:(0,s.jsxs)(e.p,{children:["To assign non-admin users within Cado, create a group with a different name (e.g., ",(0,s.jsx)(e.code,{children:"CadoNonAdmin"}),"), and users in that group will be Normal Users in the Cado platform."]})}),"\n",(0,s.jsxs)(e.ol,{start:"8",children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["To adjust access control later, go to the ",(0,s.jsx)(e.strong,{children:"Assignments"})," tab of the OAuth application, where you can add individuals or groups. Only users in the ",(0,s.jsx)(e.code,{children:"CadoAdmin"})," group will have admin status in Cado."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Add a ",(0,s.jsx)(e.strong,{children:"Groups Claim"})," for the application:"]}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:["Go to the ",(0,s.jsx)(e.strong,{children:"Sign On"})," tab of the OAuth application."]}),"\n",(0,s.jsxs)(e.li,{children:["Click ",(0,s.jsx)(e.strong,{children:"Edit"})," in the ",(0,s.jsx)(e.strong,{children:"OpenID Connect ID Token"})," section."]}),"\n",(0,s.jsxs)(e.li,{children:["In the ",(0,s.jsx)(e.strong,{children:"Issuer"})," field, specify the ",(0,s.jsx)(e.strong,{children:"Okta URL"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["For ",(0,s.jsx)(e.strong,{children:"Groups claim type"}),", select ",(0,s.jsx)(e.strong,{children:"Filter"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Set ",(0,s.jsx)(e.strong,{children:"Groups claim filter"})," to ",(0,s.jsx)(e.strong,{children:"groups"})," and enter ",(0,s.jsx)(e.strong,{children:"Matches regex"})," ",(0,s.jsx)(e.code,{children:".*"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Click ",(0,s.jsx)(e.strong,{children:"Save"}),"."]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Groups Claim",src:t(79862).A+"",width:"696",height:"91"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["In the ",(0,s.jsx)(e.strong,{children:"General Settings"})," tab of the OAuth application, note down the ",(0,s.jsx)(e.code,{children:"Client ID"}),", ",(0,s.jsx)(e.code,{children:"Client Secret"}),", and ",(0,s.jsx)(e.code,{children:"Okta Domain"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Configure SSO in Cado:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsx)(e.li,{children:"Log in to your Cado instance as an admin."}),"\n",(0,s.jsxs)(e.li,{children:["Go to ",(0,s.jsx)(e.code,{children:"Settings > SSO > Okta OAuth"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Enter the details from the previous step and click ",(0,s.jsx)(e.strong,{children:"Update"}),". For the domain, add ",(0,s.jsx)(e.code,{children:"https://"})," at the beginning and ",(0,s.jsx)(e.code,{children:"/oauth2"})," at the end. The complete domain should look like this: ",(0,s.jsx)(e.code,{children:"https:///oauth2"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Enter the ",(0,s.jsx)(e.code,{children:"Admin Group Name"})," value from step 7."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Log out and log in using Okta OAuth."}),"\n"]}),"\n"]})]})}function h(n={}){const{wrapper:e}={...(0,i.R)(),...n.components};return e?(0,s.jsx)(e,{...n,children:(0,s.jsx)(l,{...n})}):l(n)}},66247:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-assignments-3b23b5eb60b1a663656d167431a6126c.png"},79862:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-groups-claim-0a2dfcb9c5c3f572132da5cdcc4ffe63.png"},28453:(n,e,t)=>{t.d(e,{R:()=>a,x:()=>r});var s=t(96540);const i={},o=s.createContext(i);function a(n){const e=s.useContext(o);return s.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function r(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(i):n.components||i:a(n.components),s.createElement(o.Provider,{value:e},n.children)}}}]); \ No newline at end of file diff --git a/assets/js/3162843c.4b6ac284.js b/assets/js/3162843c.08155711.js similarity index 98% rename from assets/js/3162843c.4b6ac284.js rename to assets/js/3162843c.08155711.js index cb82e011e..cf52569d3 100644 --- a/assets/js/3162843c.4b6ac284.js +++ b/assets/js/3162843c.08155711.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1965],{73218:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>p,frontMatter:()=>s,metadata:()=>n,toc:()=>d});var i=o(74848),a=o(28453);const s={title:"Deploy via API",hide_title:!0,sidebar_position:3},r="How to Use the API to Generate Cado Host Collection Scripts",n={id:"cado/discovery-import/cado-host/api-deploy",title:"Deploy via API",description:"If you want to deploy Cado Host via a custom integration, you can use the Cado API to generate the Cado Host collection script. This can be useful, especially since the pre-signed URLs used to upload data expire 12 hours after being generated.",source:"@site/docs/cado/discovery-import/cado-host/api-deploy.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/api-deploy",permalink:"/cado/discovery-import/cado-host/api-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/api-deploy.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Deploy via API",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Deploy",permalink:"/cado/discovery-import/cado-host/deploy"},next:{title:"Collected artifacts",permalink:"/cado/discovery-import/cado-host/artifacts"}},c={},d=[{value:"Workflow Overview",id:"workflow-overview",level:3}];function l(e){const t={a:"a",h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",...(0,a.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-use-the-api-to-generate-cado-host-collection-scripts",children:"How to Use the API to Generate Cado Host Collection Scripts"}),"\n",(0,i.jsxs)(t.p,{children:["If you want to deploy ",(0,i.jsx)(t.strong,{children:"Cado Host"})," via a custom integration, you can use the Cado API to generate the Cado Host collection script. This can be useful, especially since the pre-signed URLs used to upload data expire 12 hours after being generated."]}),"\n",(0,i.jsx)(t.p,{children:"The script generated through the API can be executed on the target device to collect triage artifacts and upload them to cloud storage."}),"\n",(0,i.jsxs)(t.p,{children:["You can find an ",(0,i.jsx)(t.a,{href:"https://github.com/cado-security/cado-api-examples/blob/main/examples/cado_host.py",children:"example script"})," in the Cado API GitHub repository, which demonstrates how to generate a Cado Host collection script."]}),"\n",(0,i.jsx)(t.h3,{id:"workflow-overview",children:"Workflow Overview"}),"\n",(0,i.jsx)(t.p,{children:"The general workflow for generating and using a Cado Host collection script is illustrated below:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"API Workflow",src:o(63032).A+"",width:"1644",height:"692"})}),"\n",(0,i.jsx)(t.p,{children:"This diagram provides an overview of how the API interacts with Cado Host to facilitate the collection and uploading of forensic data."})]})}function p(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},63032:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/cado-host-api-948ca83dc673ec59bfbdc20b14b956ab.png"},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>n});var i=o(96540);const a={},s=i.createContext(a);function r(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function n(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:r(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1965],{73218:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>p,frontMatter:()=>s,metadata:()=>n,toc:()=>d});var i=o(74848),a=o(28453);const s={title:"Deploy via API",hide_title:!0,sidebar_position:3},r="How to Use the API to Generate Cado Host Collection Scripts",n={id:"cado/discovery-import/cado-host/api-deploy",title:"Deploy via API",description:"If you want to deploy Cado Host via a custom integration, you can use the Cado API to generate the Cado Host collection script. This can be useful, especially since the pre-signed URLs used to upload data expire 12 hours after being generated.",source:"@site/docs/cado/discovery-import/cado-host/api-deploy.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/api-deploy",permalink:"/cado/discovery-import/cado-host/api-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/api-deploy.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Deploy via API",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Deploy",permalink:"/cado/discovery-import/cado-host/deploy"},next:{title:"Collected artifacts",permalink:"/cado/discovery-import/cado-host/artifacts"}},c={},d=[{value:"Workflow Overview",id:"workflow-overview",level:3}];function l(e){const t={a:"a",h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",...(0,a.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-use-the-api-to-generate-cado-host-collection-scripts",children:"How to Use the API to Generate Cado Host Collection Scripts"}),"\n",(0,i.jsxs)(t.p,{children:["If you want to deploy ",(0,i.jsx)(t.strong,{children:"Cado Host"})," via a custom integration, you can use the Cado API to generate the Cado Host collection script. This can be useful, especially since the pre-signed URLs used to upload data expire 12 hours after being generated."]}),"\n",(0,i.jsx)(t.p,{children:"The script generated through the API can be executed on the target device to collect triage artifacts and upload them to cloud storage."}),"\n",(0,i.jsxs)(t.p,{children:["You can find an ",(0,i.jsx)(t.a,{href:"https://github.com/cado-security/cado-api-examples/blob/main/examples/cado_host.py",children:"example script"})," in the Cado API GitHub repository, which demonstrates how to generate a Cado Host collection script."]}),"\n",(0,i.jsx)(t.h3,{id:"workflow-overview",children:"Workflow Overview"}),"\n",(0,i.jsx)(t.p,{children:"The general workflow for generating and using a Cado Host collection script is illustrated below:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"API Workflow",src:o(63032).A+"",width:"1644",height:"692"})}),"\n",(0,i.jsx)(t.p,{children:"This diagram provides an overview of how the API interacts with Cado Host to facilitate the collection and uploading of forensic data."})]})}function p(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},63032:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/cado-host-api-948ca83dc673ec59bfbdc20b14b956ab.png"},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>n});var i=o(96540);const a={},s=i.createContext(a);function r(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function n(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:r(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/3312fe7e.10d81558.js b/assets/js/3312fe7e.d589267a.js similarity index 99% rename from assets/js/3312fe7e.10d81558.js rename to assets/js/3312fe7e.d589267a.js index 7a6e56eae..eef5ed5f1 100644 --- a/assets/js/3312fe7e.10d81558.js +++ b/assets/js/3312fe7e.d589267a.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2399],{30137:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>l,contentTitle:()=>s,default:()=>h,frontMatter:()=>c,metadata:()=>i,toc:()=>d});var r=n(74848),t=n(28453);const c={title:"GCP Terraform deployment",hide_title:!0,sidebar_position:1},s="How to deploy Cado in GCP with Terraform",i={id:"cado/deploy/gcp/gcp-deploy",title:"GCP Terraform deployment",description:"To set up Cado in GCP you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack.",source:"@site/docs/cado/deploy/gcp/gcp-deploy.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-deploy",permalink:"/cado/deploy/gcp/gcp-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-deploy.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"GCP Terraform deployment",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Bucket",permalink:"/cado/deploy/azure/azure-bucket"},next:{title:"Set-up GCP for collection of data",permalink:"/cado/deploy/gcp/gcp-settings"}},l={},d=[];function a(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"how-to-deploy-cado-in-gcp-with-terraform",children:"How to deploy Cado in GCP with Terraform"}),"\n",(0,r.jsxs)(o.p,{children:["To set up Cado in GCP you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack.\nVisit the GCP Marketplace listing ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/cado-public/cado-response",children:"here"})})," to download the latest Terraform code."]}),"\n",(0,r.jsx)(o.p,{children:"Once you have downloaded the Terraform code from the Marketplace listing above, continue on to the steps below."}),"\n",(0,r.jsxs)(o.ol,{children:["\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:[(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://learn.hashicorp.com/tutorials/terraform/install-cli",children:"Install Terraform"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:[(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://cloud.google.com/sdk/docs/install",children:"Install GCloud CLI"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Create a project and generate some service account credentials for the project, exporting the credentials.json. To create and use a service account, the user account will need ",(0,r.jsx)(o.strong,{children:"Service Account User"})," and ",(0,r.jsx)(o.strong,{children:"Service Account Admin"})," roles.\nThe service account itself will need to have the following roles:"]}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:"Compute Admin"}),"\n",(0,r.jsx)(o.li,{children:"Service Account User"}),"\n",(0,r.jsx)(o.li,{children:"Storage Admin"}),"\n",(0,r.jsx)(o.li,{children:"Cloud Filestore Editor"}),"\n",(0,r.jsx)(o.li,{children:"Role Administrator"}),"\n",(0,r.jsx)(o.li,{children:"Security Admin"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Ensure the following ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/apis/library",children:"APIs"})})," are enabled in the project:"]}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com",children:"Compute Engine"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudbuild.googleapis.com",children:"Cloud Build"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/file.googleapis.com",children:"Cloud Filestore"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/secretmanager.googleapis.com",children:"Secret Manager"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com",children:"Cloud Resource Manager"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/iamcredentials.googleapis.com",children:"IAM Service Account Credentials"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/storage.googleapis.com",children:"Cloud Storage"})})}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Run ",(0,r.jsx)(o.code,{children:"gcloud auth activate-service-account --key-file "})," where key_file is the path to your GCP service account credentials.json."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Run ",(0,r.jsx)(o.code,{children:"gcloud config set project "})]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Extract gcp.zip This is the ZIP that was provided by Cado Sales, or downloaded from the GCP Marketplace, or cloned from ",(0,r.jsx)(o.a,{href:"https://github.com/cado-security/Deployment-Templates/tree/main/gcp",children:"https://github.com/cado-security/Deployment-Templates/tree/main/gcp"})]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsx)(o.p,{children:"Change directories into gcp/ which was extracted in the previous step."}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Customize the file ",(0,r.jsx)(o.code,{children:"gcpVars.tfvars"})," by filling in values:"]}),"\n",(0,r.jsxs)(o.table,{children:[(0,r.jsx)(o.thead,{children:(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.th,{children:"Parameter Name"}),(0,r.jsx)(o.th,{children:"Description"}),(0,r.jsx)(o.th,{children:"Example"})]})}),(0,r.jsxs)(o.tbody,{children:[(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"unique_name"})}),(0,r.jsx)(o.td,{children:"A string to ensure that resources created by Cado are unique"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"cado"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"credentials_file"})}),(0,r.jsx)(o.td,{children:"Path to your GCP service account credentials json"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"../credentials.json"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"project_id"})}),(0,r.jsx)(o.td,{children:"ID of the project Cado will be deployed into"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"cado-12839"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"region"})}),(0,r.jsx)(o.td,{children:"The region which Cado will be deployed to"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"us-east1"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"image"})}),(0,r.jsxs)(o.td,{children:["The link of the image provided by Sales or the ",(0,r.jsx)(o.a,{href:"https://cado-public.s3.amazonaws.com/cado_updates_json_v2.json",children:"public release URL"})]}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"https://www.googleapis.com/compute/v1/projects/cado-public/global/images/cadoresponse-xxx"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"tags"})}),(0,r.jsx)(o.td,{children:"Tags to be applied to your Cado instance"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:'{tag1 = "cado-test"}'})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"vm_size"})}),(0,r.jsx)(o.td,{children:"Size of main instance"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"n2d-standard-8"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"vol_size"})}),(0,r.jsx)(o.td,{children:"Size of main instance local disk in GB"}),(0,r.jsx)(o.td,{children:"This value is dependent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"allowed_ips"})}),(0,r.jsx)(o.td,{children:"List of incoming IPs"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"[\u201c1.2.3.6/32\u201d]"})})]})]})]}),"\n",(0,r.jsx)(o.admonition,{type:"tip",children:(0,r.jsxs)(o.p,{children:["We recommend a minimum setting of 500GB for ",(0,r.jsx)(o.code,{children:"vol_size"}),". The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Projects can always be deleted to recover space."]})}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Deploy by running the following commands in the directory ",(0,r.jsx)(o.code,{children:"gcp/"}),"\n",(0,r.jsx)(o.code,{children:"terraform init"})," followed by ",(0,r.jsx)(o.code,{children:"terraform plan -var-file=gcpVars.tfvars"}),". Once you confirm the plan looks correct, you can then run ",(0,r.jsx)(o.code,{children:"terraform apply -var-file=gcpVars.tfvars"})]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Find your Cado instance in the ",(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/compute/instances",children:"Compute Engine portal"}),", navigate to its public IP address in the browser"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsx)(o.p,{children:"Login with:"}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:"Username: admin"}),"\n",(0,r.jsx)(o.li,{children:"Password: (found in the Compute Engine console for your instance e.g. 8784481508256766876)"}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:o}={...(0,t.R)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>s,x:()=>i});var r=n(96540);const t={},c=r.createContext(t);function s(e){const o=r.useContext(c);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:s(e.components),r.createElement(c.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2399],{30137:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>l,contentTitle:()=>s,default:()=>h,frontMatter:()=>c,metadata:()=>i,toc:()=>d});var r=n(74848),t=n(28453);const c={title:"GCP Terraform deployment",hide_title:!0,sidebar_position:1},s="How to deploy Cado in GCP with Terraform",i={id:"cado/deploy/gcp/gcp-deploy",title:"GCP Terraform deployment",description:"To set up Cado in GCP you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack.",source:"@site/docs/cado/deploy/gcp/gcp-deploy.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-deploy",permalink:"/cado/deploy/gcp/gcp-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-deploy.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"GCP Terraform deployment",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Bucket",permalink:"/cado/deploy/azure/azure-bucket"},next:{title:"Set-up GCP for collection of data",permalink:"/cado/deploy/gcp/gcp-settings"}},l={},d=[];function a(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"how-to-deploy-cado-in-gcp-with-terraform",children:"How to deploy Cado in GCP with Terraform"}),"\n",(0,r.jsxs)(o.p,{children:["To set up Cado in GCP you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack.\nVisit the GCP Marketplace listing ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/cado-public/cado-response",children:"here"})})," to download the latest Terraform code."]}),"\n",(0,r.jsx)(o.p,{children:"Once you have downloaded the Terraform code from the Marketplace listing above, continue on to the steps below."}),"\n",(0,r.jsxs)(o.ol,{children:["\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:[(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://learn.hashicorp.com/tutorials/terraform/install-cli",children:"Install Terraform"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:[(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://cloud.google.com/sdk/docs/install",children:"Install GCloud CLI"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Create a project and generate some service account credentials for the project, exporting the credentials.json. To create and use a service account, the user account will need ",(0,r.jsx)(o.strong,{children:"Service Account User"})," and ",(0,r.jsx)(o.strong,{children:"Service Account Admin"})," roles.\nThe service account itself will need to have the following roles:"]}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:"Compute Admin"}),"\n",(0,r.jsx)(o.li,{children:"Service Account User"}),"\n",(0,r.jsx)(o.li,{children:"Storage Admin"}),"\n",(0,r.jsx)(o.li,{children:"Cloud Filestore Editor"}),"\n",(0,r.jsx)(o.li,{children:"Role Administrator"}),"\n",(0,r.jsx)(o.li,{children:"Security Admin"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Ensure the following ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/apis/library",children:"APIs"})})," are enabled in the project:"]}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com",children:"Compute Engine"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudbuild.googleapis.com",children:"Cloud Build"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/file.googleapis.com",children:"Cloud Filestore"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/secretmanager.googleapis.com",children:"Secret Manager"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com",children:"Cloud Resource Manager"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/iamcredentials.googleapis.com",children:"IAM Service Account Credentials"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/storage.googleapis.com",children:"Cloud Storage"})})}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Run ",(0,r.jsx)(o.code,{children:"gcloud auth activate-service-account --key-file "})," where key_file is the path to your GCP service account credentials.json."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Run ",(0,r.jsx)(o.code,{children:"gcloud config set project "})]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Extract gcp.zip This is the ZIP that was provided by Cado Sales, or downloaded from the GCP Marketplace, or cloned from ",(0,r.jsx)(o.a,{href:"https://github.com/cado-security/Deployment-Templates/tree/main/gcp",children:"https://github.com/cado-security/Deployment-Templates/tree/main/gcp"})]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsx)(o.p,{children:"Change directories into gcp/ which was extracted in the previous step."}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Customize the file ",(0,r.jsx)(o.code,{children:"gcpVars.tfvars"})," by filling in values:"]}),"\n",(0,r.jsxs)(o.table,{children:[(0,r.jsx)(o.thead,{children:(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.th,{children:"Parameter Name"}),(0,r.jsx)(o.th,{children:"Description"}),(0,r.jsx)(o.th,{children:"Example"})]})}),(0,r.jsxs)(o.tbody,{children:[(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"unique_name"})}),(0,r.jsx)(o.td,{children:"A string to ensure that resources created by Cado are unique"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"cado"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"credentials_file"})}),(0,r.jsx)(o.td,{children:"Path to your GCP service account credentials json"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"../credentials.json"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"project_id"})}),(0,r.jsx)(o.td,{children:"ID of the project Cado will be deployed into"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"cado-12839"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"region"})}),(0,r.jsx)(o.td,{children:"The region which Cado will be deployed to"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"us-east1"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"image"})}),(0,r.jsxs)(o.td,{children:["The link of the image provided by Sales or the ",(0,r.jsx)(o.a,{href:"https://cado-public.s3.amazonaws.com/cado_updates_json_v2.json",children:"public release URL"})]}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"https://www.googleapis.com/compute/v1/projects/cado-public/global/images/cadoresponse-xxx"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"tags"})}),(0,r.jsx)(o.td,{children:"Tags to be applied to your Cado instance"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:'{tag1 = "cado-test"}'})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"vm_size"})}),(0,r.jsx)(o.td,{children:"Size of main instance"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"n2d-standard-8"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"vol_size"})}),(0,r.jsx)(o.td,{children:"Size of main instance local disk in GB"}),(0,r.jsx)(o.td,{children:"This value is dependent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"allowed_ips"})}),(0,r.jsx)(o.td,{children:"List of incoming IPs"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"[\u201c1.2.3.6/32\u201d]"})})]})]})]}),"\n",(0,r.jsx)(o.admonition,{type:"tip",children:(0,r.jsxs)(o.p,{children:["We recommend a minimum setting of 500GB for ",(0,r.jsx)(o.code,{children:"vol_size"}),". The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Projects can always be deleted to recover space."]})}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Deploy by running the following commands in the directory ",(0,r.jsx)(o.code,{children:"gcp/"}),"\n",(0,r.jsx)(o.code,{children:"terraform init"})," followed by ",(0,r.jsx)(o.code,{children:"terraform plan -var-file=gcpVars.tfvars"}),". Once you confirm the plan looks correct, you can then run ",(0,r.jsx)(o.code,{children:"terraform apply -var-file=gcpVars.tfvars"})]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Find your Cado instance in the ",(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/compute/instances",children:"Compute Engine portal"}),", navigate to its public IP address in the browser"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsx)(o.p,{children:"Login with:"}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:"Username: admin"}),"\n",(0,r.jsx)(o.li,{children:"Password: (found in the Compute Engine console for your instance e.g. 8784481508256766876)"}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:o}={...(0,t.R)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>s,x:()=>i});var r=n(96540);const t={},c=r.createContext(t);function s(e){const o=r.useContext(c);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:s(e.components),r.createElement(c.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/34cfa87e.e2f65dfe.js b/assets/js/34cfa87e.d9613c18.js similarity index 99% rename from assets/js/34cfa87e.e2f65dfe.js rename to assets/js/34cfa87e.d9613c18.js index 5120d95e9..4511f9f37 100644 --- a/assets/js/34cfa87e.e2f65dfe.js +++ b/assets/js/34cfa87e.d9613c18.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8230],{33003:(e,i,s)=>{s.r(i),s.d(i,{assets:()=>o,contentTitle:()=>c,default:()=>A,frontMatter:()=>r,metadata:()=>d,toc:()=>l});var t=s(74848),n=s(28453);const r={title:"EBS Direct Acquisition",hide_title:!0,sidebar_position:11},c=void 0,d={id:"cado/discovery-import/aws/ebs-direct-acquisition",title:"EBS Direct Acquisition",description:"Why EBS Direct Acquisition",source:"@site/docs/cado/discovery-import/aws/ebs-direct-acquisition.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/ebs-direct-acquisition",permalink:"/cado/discovery-import/aws/ebs-direct-acquisition",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/ebs-direct-acquisition.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:11,frontMatter:{title:"EBS Direct Acquisition",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Import large EC2 instances",permalink:"/cado/discovery-import/aws/large-aws-imports"},next:{title:"Azure Compute",permalink:"/cado/discovery-import/azure/azure-compute"}},o={},l=[{value:"Why EBS Direct Acquisition",id:"why-ebs-direct-acquisition",level:3},{value:"Prerequisites",id:"prerequisites",level:3},{value:"Enable EBS Direct Acquisition",id:"enable-ebs-direct-acquisition",level:3},{value:"Enable Deployed Workers",id:"enable-deployed-workers",level:3},{value:"Roles Required",id:"roles-required",level:3},{value:"Steps to Import using EBS Direct Acquisition",id:"steps-to-import-using-ebs-direct-acquisition",level:3},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function a(e){const i={h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i.h3,{id:"why-ebs-direct-acquisition",children:"Why EBS Direct Acquisition"}),"\n",(0,t.jsx)(i.p,{children:"The EBS direct acquisition feature significantly improves the capture speed of disks. This feature also requires less permissions for acquisition."}),"\n",(0,t.jsx)(i.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,t.jsx)(i.h3,{id:"enable-ebs-direct-acquisition",children:"Enable EBS Direct Acquisition"}),"\n",(0,t.jsx)(i.p,{children:"To enable EBS Direct Acquisition (Admin required):"}),"\n",(0,t.jsxs)(i.ol,{children:["\n",(0,t.jsxs)(i.li,{children:["Go to ",(0,t.jsx)(i.strong,{children:"Settings"})," > ",(0,t.jsx)(i.strong,{children:"Experiments"}),"."]}),"\n",(0,t.jsxs)(i.li,{children:["Enable ",(0,t.jsx)(i.strong,{children:"EBS Direct Acquisitions"}),"."]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Direct Acquisition",src:s(42799).A+"",width:"563",height:"76"})}),"\n",(0,t.jsx)(i.h3,{id:"enable-deployed-workers",children:"Enable Deployed Workers"}),"\n",(0,t.jsxs)(i.ol,{children:["\n",(0,t.jsxs)(i.li,{children:["Navigate to ",(0,t.jsx)(i.strong,{children:"Settings"})," > ",(0,t.jsx)(i.strong,{children:"Advanced"})," (Admin required)"]}),"\n",(0,t.jsxs)(i.li,{children:["Enable ",(0,t.jsx)(i.strong,{children:"Deployed Workers"})," (This is needed for full acquisition)"]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Workers",src:s(70951).A+"",width:"1071",height:"181"})}),"\n",(0,t.jsx)(i.h3,{id:"roles-required",children:"Roles Required"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsxs)(i.li,{children:["ebs",":ListSnapshotBlocks"]}),"\n",(0,t.jsxs)(i.li,{children:["ebs",":ListChangedBlocks"]}),"\n",(0,t.jsxs)(i.li,{children:["ebs",":GetSnapshotBlock"]}),"\n"]}),"\n",(0,t.jsx)(i.h3,{id:"steps-to-import-using-ebs-direct-acquisition",children:"Steps to Import using EBS Direct Acquisition"}),"\n",(0,t.jsxs)(i.ol,{children:["\n",(0,t.jsxs)(i.li,{children:["On your investigation click ",(0,t.jsx)(i.strong,{children:"import"}),"."]}),"\n",(0,t.jsxs)(i.li,{children:["Select ",(0,t.jsx)(i.strong,{children:"cloud"})," from the list of providers"]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Providers",src:s(98284).A+"",width:"1303",height:"297"})}),"\n",(0,t.jsxs)(i.ol,{start:"3",children:["\n",(0,t.jsxs)(i.li,{children:["Select ",(0,t.jsx)(i.strong,{children:"AWS"})]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Cloud Account",src:s(70264).A+"",width:"241",height:"128"})}),"\n",(0,t.jsxs)(i.ol,{start:"4",children:["\n",(0,t.jsx)(i.li,{children:"Select Access method"}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Access Method",src:s(89213).A+"",width:"264",height:"79"})}),"\n",(0,t.jsxs)(i.ol,{start:"5",children:["\n",(0,t.jsxs)(i.li,{children:["Select ",(0,t.jsx)(i.strong,{children:"EC2"})]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS EC2",src:s(92248).A+"",width:"264",height:"251"})}),"\n",(0,t.jsxs)(i.ol,{start:"6",children:["\n",(0,t.jsx)(i.li,{children:"Select your region of choice"}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Region",src:s(17876).A+"",width:"955",height:"155"})}),"\n",(0,t.jsxs)(i.ol,{start:"7",children:["\n",(0,t.jsxs)(i.li,{children:["Select ",(0,t.jsx)(i.strong,{children:"Full acquisition"})]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Full Acquisition",src:s(39580).A+"",width:"446",height:"112"})}),"\n",(0,t.jsxs)(i.ol,{start:"8",children:["\n",(0,t.jsx)(i.li,{children:"Review your options then click continue to finish"}),"\n"]}),"\n",(0,t.jsx)(i.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Direct Acquisition",src:s(1055).A+"",width:"960",height:"540"})})]})}function A(e={}){const{wrapper:i}={...(0,n.R)(),...e.components};return i?(0,t.jsx)(i,{...e,children:(0,t.jsx)(a,{...e})}):a(e)}},89213:(e,i,s)=>{s.d(i,{A:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQgAAABPCAIAAACYvszIAAAAA3NCSVQICAjb4U/gAAAAknpUWHRSYXcgcHJvZmlsZSB0eXBlIEFQUDEAAAiZVY5LCsMwDET3PkWOMPpYto5TghMCpQm5/6Jy7S4ygxgxiIfS3j7tPtblus/teLe0/OSa1NX5BaBiiAEhUE+UWdlI81qgsdDsGx7KcWFiVGL+LMAHR8eNQDiMas69Jx69rk+WUhaV/t1ki0lhy+EW/Gpb0fQFroos+GSEz4QAABlvSURBVHic7Z13XBNJG8efJKRRxEAogiJVsYCCCAgoTbCDYlcs51lOOX1FsaKeKHbFs3tYULGjoigoFhRQQQ4LIILU0HuoaaTs+8d6uRxECCiiuN9P/tg8OzP7zDP57czsbnZwCIIABgbGf8F3tgMYGN8jmDAwMKSACQMDQwqYMDAwpIAJAwNDCpgwMDCkgAkDA0MKmDAwMKQgqzDYHM6rxKRrt8KfxyXW1Te0mv5ZTFxFJfPLfOsQsnMZT2PivqvbmhlZuVHPXvB4jU3sbA4n6tmL7FxGm0p7FhtfXlHVbmeEQlHUsxdVzOp2l9A1kEkYmdmM+UvXbd9zJCziye6Ak3MWr0pKSWshPYIg+4+c+ZCe2Q6HCotKduw7wWKx25FXFnYdPHXgyJm3yR86qPx2cCficcCxoKcxL5vYIx5GBxwLinwc23L2KzfuRT6JRrcRBNl/+HTax6x2O8Pn8wOOBWXl5Le7hK6BTMI48tcFFZrytXOHL50OuBJ0SFVV5cCR0x3kUHVNXVzCay6P3xGFM/ILS0vKCHL4+w9jOqL8L+HG3UdNLGHhTS1SiUt4k/KhPecgjBaQkyVRXkHhrCnuCgryAKCkqLBt48q09AyRSITH4wHg1t3I2OcJ5VXVJv2NF82frqqi3CQ7I78w5Pb9d8lpyt2Upri5OjnYStpT3qd37648cayzk4Pt87jE3QEnAWDxSl87K3NvrwVNinr0NDb07uNKZrW6qurcmZMsLUwBYP+R0720elRWVb5KTFbupjx72gRrSzOpFXn4JIZMpcyYPO7i1VAul0ehkMW70FpUVdf0N+67dOFM5W5KAMBisS9dv53wNhUA7CwHz5k5mUDAt1Cj9x8+nrt8q6i43NhIf7K768D+fQGgorLq+OnLGVm5mhp0VyfbUc72zR0jyOFLS8oysnL7GOqhlqSUNGZ1LUHu3zMX6kz862SRSORoZzVrqjuRKOezaVdObn5Obv6Hj1mbfJbp9e4FAMyaWr9dRzKyc3toqi39daaBni5aQnzC24iHz7IZBf37Gnm4ufbra4Daq5i1l66FJr5NoVCpC2ZP/tzP4KdCph7DbtjQq7fCn8clCoUiAOippeniNAJVxbmLIWcvhPQzNpg4ziXpfdrqTTvQNGIqKpmrN+3OyyueMnF0717aAceCnsXGi+2Z2Xlu41zU6XTUrtu7p/1wKwCY6jba2d6miRtPnr04dPy8hhp9znR3CpW0bc9hdDDNYBQFXw0tK2e6jXNhcdn++46VllU0rwWCIJFPX7rYW490sBUKRLFxCeJdQcEhZy+E9OmjN8bFIel92nKfrQiCCITCTdsORD596WBjYWk2IDT80aGT51uoUWUVc/0f+4hycgvmeAAOfLcfqGLWAsDqjTtz8/JnT51g0s/oyMngxDcpzX0z1NdVoSnfCvu3iwgNi9TsoaHdowf6VSgUbdp24HF0vIu9rYPN0JDQ+0cCgwHAfawzmmDW5PFqdFV0+8z563S68vhRjkXF5T6b9qItkvA62X/fMTwON9l9VGVl5fqtexiMAgBo5PPXbd0b93fSGBcHi8H9dx08IctPossjU4/x65xpIiGyO+AkQQ5v0q/vuNGOwyzNAYDL5d24E7ly2fyRjnYAYDtsyOLlG/9+nWQ1dLA4762w+woUcsDujSQiEQAEAuHFkLsOw61v3okg4PGHdm+iUikAcPbCtUpmjcNwzdHOI6JjX7k4DW/e85gONPZZsdBhuDUAjLC1nP2r94f0THU1VQBQ16D7+a7E4XA2VuaLl29MTcvQ1FBrkv1t8gceh+vqNJym3K1vH/2Ih9EujsPRWtwMi1wwd6rHhFEAYGVhGnw1rLKqOjsnLzMn7/Dezfp6vQHAQK/325S0FmqUlZ0HAEt/naXTS3ukg13C62QlJXkOh8usrl00f/rYUY4AYD7YpHcvbalBnjhh1NkL11ksTwUFeWZ1beK798t/m3MnPArdm/g2JTMnL/DITi1NdQDQ1FA7Gnhx2a+zhttYhtx+oNNLC20C9KKCq7Od16K5AKDbW3vHvuN5BYX6ujqB568NNum31XclALiNHblw+YbzV2//sX55QmJSaUnZ0QNbdXV6AgCtO+385Zuy/Cq6NjIJQ4WmvM578fzZk2LjXkdFx+3Yd9zZwcbba0FGdi4AvHj19t37dHHivIJiSWGkpGYxq2sPnzz/aW9hUUVFBQCkpuUMNTdBVQEAC+ZOb9UNNbqqtlb9xWt38vKLs/PyAKC+gYXu6t/XEIfDAYCWpjqZSqmsqmmePSQ0AgAoFEpxSdlAY6ObYZEVlUw1ukpGVi4A2Ntaosn09Xr/sWE5AIQ/eKKs3A1VBQA4O9g6O9i2UCNzs4FEEmn5Wr/hNpa2VubWQ81wOBwQiYMGGp86dy3xdYq1lZmzgw2FTG7mGgDAKCe7sxeuR0bFekwYFR4ZRZDDO46wEQsjLT0TAC6HhKFfa6prASC/sFg89JJkgLERumEywBgAKqtqdHpqlZaUzZ4yHrXLEQiOdlYPo14AQEZmtgpNGVUFAAyzMsOEAW26j6GhrjbFffTxAL8ZUyY8efaytq6+vp4FAGQSmYDHox9nB5ue2pqSuRrYDQAgTtCvj76DnbVIJGJx2VQyqU2+3rjzwHu9f8zLv5WUqBPHjpTcRcC3UhEul5eS+hEAFq/wXbzC92ZYJAA8fvoC/lFX898ri8MhkqScOD5XIxKReOn0ganuYxiMoh37jv+ybC2XxwMA/y2rV3n90ijkB567MnOBN6rD5igoyI+ws7x996FIJLr74Kmrkx3aI31yhs2SPKiqKs3ZwYbymQDKyX1yG4/HoRuNfD4AkEj/pqdQKGwOFwA4PB5ejiC2k0n/HvRnpvUeo6CwxG/v0RVL5pgOMEYtBnq9AIDHa+xrpAcAY1yGDzLph+5i5Bfq6vSUvEvQ39iooKBUPI2uqKySp1LxeLyxkf671AwEQdAz/ZukVJFQZGFugiYTiYTNPbkXGWVhZrp14woAaGCxA4Ouyl7P2JevAGDX1jUa6nTUsm330fuPns2cOgGtRXJqOjo+rG9gxb5IsB1mYWxkcP9hTF19QzclRbRqGZk5rs4jPlcjLo9XXlbpOWOS54xJuYz85Wu2vYhLdBwxLDs339HexsnBlsViL1zuezv80dr/LZbq5KTxrjHPE/4Kusxmsd3HukjuMu5jeP9R7NKFs1EBszmchgY2OowEAKFAJKU4CeSpVGXlbimpabbWQ1DLu+QPfQx7A0AfQz3Jan5Ib/+l3q5E6z1GT23Nurr6PQcDX8S/zi8sfhYTt//oWTqdpq6mSldVMTLU3XHgxN9vUsrKK06fu/r76q1pH7Mls48eOSI3L//4qeD8gqL3aRkr1vpv2fknAIwZaV9aUnb45Ln8gqLYlwlb/A+ip1JVVRoARDx8ysgvbOqJpkZmDiMzm5HLyN+x71ib6hkRGa3TS9tkQF91NVX0M3v6BGZ1bWY2g66q0reP/v6jZ18lJhUWlewJOPnXuSsUMtnC3JRMpWzaHpCekZ2ekb3F/2Bk1PMWahTz/NXva/yexsQVl5bHxiUCAF1Vpai4zHu9/6lzV4pLy98kpdbX16up0D7npJGBrpaWZviDZ0aGuj21e0jusjAzJVMpG7bu+5iZk19QtGXHn0tWbuZyeQCgTqe/S0l7k5SKdlCfY5yrw70Hz+49iGLkFZy/fDMl9eNYFwcAMB9kSiSR/tj5Z3pGdsLr5MOBwW0KbFel9R4Dh8Md3rPZf+/xXQc+Xa/o20ff18cL3d65xcd/71G/XYcAgCCHXzR/er++BpI9hukA41Vev5y6cCPiYTQA6OvpoOdLkwF9Vy6bfyb45qOoFwBgN8xymsdYANDSVHd2sAkJvR8b/+b04R2SniycN22DX4D3en8AsDAzlbyU2TJVzOrMnLzFv8yQNA4dMoggh38YFWNkoLt9k/f2PUe37zkCAPIK8js2ryaTSWQyaZ/fmp0HA318dwGATi/t9d6/tVAjV+cRyR8y/jwRhJ6/p7iPNh1ojMPhliyYGXztTlhEFACYDxow/Z+BvmSE0W4TAKa4uR4+ecFjgmuTNMrKSge2rfMPOLl6404AUFJS8tuwAr3cPGvquPV+B7b4H9y0xktydteEWdPc6hvqzwTf4Dc2kqmUBXOn2dtZAYCqirL/Ju89B0+i1ZwzY1Lw1VAZA9uFwcn+cEQjn19eXtlDUwO9li+JQCisrq6hq6qIG7g5zOpaKoUsnm1L2pUUFYjE/0iUy+MBApL3GcSUV1RRKWQlJUUZ3ZadRj6fxebQlLs1sbM5HESEoLdxJJFaI5FIVFHJVFdTbRKKisqq7srKTarZDtgcDr9RoKys1MReV9+gpKjQQvxREARhVtc1v+IHANW1dQryVMmJzc9MG4SBgfHzgD1di4EhBUwYGBhSwISBgSEFTBgYGFLAhIGBIQVMGBgYUsCEgYEhBUwYGBhSwISBgSEFTBgYGFJo26M7Xfj5kVafMpKRLhyib8zXapH2IaswEAQ5X5H8uD4rm1sjQFp5+v/HQg6HN6B0H6lkOE/N9EsaA0GQBhaHw+EJhAJMHV8CDgdyBDkqlayoQO0secj0EGEet9a38LEumTZJtZ8JVZ2EI7Sa5QeiERGmcMpDq9IYvOodPUf2pkh58rRV+HxBdU2dHImoSKUQiXKde7b70UEQhM8XNHC4gkY+rXu3L38kuR20LgyRSDQ3J3RU9z5z6CbfxqfOIrgyJbIm44L+JHxrf5RtgkgkqqyqkZenKipQO8i3n5MGFofN5tBVu7e1Rb6cVo6HIMiFiqTeJFqXVwUAzKGb9CbRLlQktWmegI6g5OSImCq+OooKVDk5YgOL8+1nbq0L43F9jge937fxptPxoPd7XJ/TVmFwuTxFhaZ/wML4KigqULhc3vclDARBEATJ5tWYUNW/mUOdiwlVPZtXg1ZclvRoSoFQ2Cnj4J8BIlFOIBTK3iJfi9Z7DAEi6mKz7RYg4QgCRNTWHgNBOvnaYhcGh8MhSCdcBMdu8GFgSAETBgaGFDBhYGBIARMGBoYUMGFgYEgBEwYGhhQwYWBgSAETRpdFJBJ13BqfXZ6OFYbPOj/P+b936CE+x+s3yRwOt1MOLSMlJWULl6zuM9DO3MrVd8vOr+7twUOBw50motsyRiP4UshQ2zFNPlnZUhb0KCwqHmo75us6/H2BfB6RSMTn8y1SAltI0wJVzBqahjFNwzgzK6d9JXwJNA3jtPTMdmS0SAnk8/kikUiWxGiICovL23EgO0f3VWv+yMjMjn0ebz9y0qo1f7SjkBYoL6948y4F3ZYxGmVlFSnv01Lep7mOnea3fT+6zeFwmqfMzc2jaRh/XYc/R2Fxuewt8rXowCd87oVHWlua9+ypeeNW+Po1n/qNurr68xevv0p4q6fb0+u3BZqa6gCQk8O4ePlmRlau5dDBvy2eh75wO/Z5/O2wB2wOe7Srk/uE0QAQF58Yn/DGe8ViAMjMyjkffM3fb0NcfOLrN8kK8tQnz14Y6un4rPZSVFT4n/dmAJg1d9m61V7Tp7l3XB3bDbO6NvXDx5DLgZqa6kaG+qdPHnj9z6KVaDQ+ZmRbWpotWTiHQqGAtBCt892+aIGnoYEeAOwPODHczsrK0nyd7/YRttahdx64OI/Q0dGOT3hjNmigZDRweHx1NXPJonkAIBAIl3tvWPW/34wM9dFDq6vT1dXpAKCsrKzdU3PgP0sFoUfPys6ztRkyf+4M8n9Xn7r/4MnDx9H+fuvl5alXroU+fvKcSiX++ounuZkJAKzz3e7qbB/xIIrJrJ09a+JIJymL1n6HdOBQ6ur1O9OmuE3xmHDx8k2RSAQAAoFwwRLv6Ng4j0ljS0oqxrp7CoXCkpKy0W6eHC5notuYO3cj1633B4DomJez5/9uaKBrbTlkzQb/c+evAkB+flFcfCJaeFl5ZcSDp6hxy7Z9aRmZE8a5Rj6J9d28GwA8Jo0BgF/mTR8yxLTjKvglqNCUh9ta+6zflpzyQSQSGRroTZ/qBgBoNBCRaNpUt4j7j33W+YmNTUIUeieyuroOLS06Nr60rBw1rvPd6WA/zMxsoDhcktHQ0tLYsecIr7ERAJ6/iA+/H6XbW6dlV8VHd5sw6s7dh14rNkrufRAZteT3dZ6zpigoyAf8+deR40GjXB0MDPRHjpmWmZWDurR+865h1kN1dbSmzfotNzfva8eyY2ihN/mSoVRODoOmYVxeUclrbOxlMCT2xSsEQZKSU3sZDGGzOQiC8BobL125WVtbdzLw3Kw5S9FchUXFN27dQxBk9jyvYyfOosbIR0/NLF0QBLl67fbUmYtQY+yLV2IjuoEgyJ27D8Tb3/9QqqKyym/7fpqGsdEA263b9tXW1iEIcjLw3G9ePmiCvPxCmoYxh8ORGiKjAbYJf79DjeMnzr0ddh813gt/iBolwyWOhkAgGDDYIfLRUwRBVqzctHnrLqm+TZ256HTQRXT7ZOC5GbOXoNvlFZU0DeOCwiJ0KBX56ClNwxh1QyAQSA6bV67asnvvEdQl1GEEQSxsRt+8Hd7WQHXKUKqjeoy9AccA4NSZS/sDTjQ0sDZs2gkA71PTLcxN0ZVWSETirBke3boppbxPt/hnHSBtrR6TJ40DgITEd0PMB6FGczNTRl5BXV39546lr//pnNdbp2fDj3Mdhq6qsmXT6tKC5FPH976M/3vp7+sAIOV9+rUb93QMLXQMLewc3QGgsKhEaog+h7p6S/8RIBAInrMmh94O53K5oXfvT/Fwa9XP5JQP1v+s3KdGV+3bxzD9Yyb6dYbnUgAwGzwQAPLzCwHAadRU1Pnzl64z8j51Djq9Pi0J28dAj/2DNFCHzDFEItG1kLt0uqocgQAA1pbm8Qlv2GxOD031gqIScTIOh0smk3r00CwtLRNn5PEaqVSKXm/tqiomaqyqYioqKigqKhDk5KqY1WKjuBw87l95c7nf9ZUoMQWFxe/evZ8w3pVEJNqPsFFSUho5ZppQKNTQUPOc6eHvt16cUklJUWqISERiQ8Onk0Vpebnsh57iMc7SdqyjwwhtrR6mJv1bTa+lpVVRUYluIwhSVFyiqaGBfo28d3WJ15pdew9t3rhKTY0OANGPb6qqqKB7SdIWgEV+kPdEdEiP8SrhDQC8S3i01sdrrY/XvdvBWj0070dGDTYzLSurOHfhmkAgjI55qa1nVlNb72A/7NSZy4mvkxAE2R9wYvykOQDgOtJx176jpaXl1bV1O3YdHu1qj8fjjQx13757/+Dh05wcxuFjZ1r2gU5XTf3wEV3G9zsEj8fNW/i/ayFhAoGQWV176mywtaU5gUBwdLC7fTcyl5HfrZtSdEzczDnLhEKR1BANMul3+uxlRl7BhYvXs7MZQlFLr26RjIahgZ7Z4IE+6/3meU6WxVUH+2HH/7rw5m0Kr7Hxz6OnKBRK3z6G6K6hFoOCg44cPHwqPOKRoqKC7TDLE4HniUQiACxZtubR45gvDVMn0sIwq91zjNVrty5bvlbSsmP3IXSc+jLubwub0TQN414GQ8RDz9Nng40G2NI0jM0sXd6npiMIwucLVq7ejF7tnTF7SV1dPYIgQqHQZ+1WdFDut32/hc1o5L8jaXQO86nMoIs0DeN2XAP9ZnOMsLuRaK1pGsZj3TzzC4pQ+9mgy6i9l8GQ8IhHqLF5iJKSU1HLoqWrXMdOE88xxBMPycg0iUbQuSs0DeOSkrLP+TZ15qIzQZfEX88EXeplMISmYWzn6P4hLQNBkFxGvvhybcjNe+jsoqysYvzEuWiNZs/zQltN0qXZ87wuXLze1kB1yhyjA+9jtEAVs0b4z/8VUYRCYRWzpkkyLo+HztQl4TU2yngULo8ne2Ix30wYKOXlFc3rKBKJyssrmvggNUTti8aho6fE82kZEQqFzJpaWVKyWGwWi92mwlumq93HaAEVWtN3N+Hx+OZGMonUPK/sy4pKzf69gQ7Nm4DD4ZrbpYaordFgsdjeazbfuBVxP+xSm/zE4/HN17OVirx8V3hbCvas1M8Fr5FvZ2MV8yTUytK8s335rsHebfFzoUJTnus5rbO9+AHAegwMDClgwsDAkAImDAwMKWDCwMCQAiYMDAwpYMLAwJBC68KQw+EbEeE3cOV7oBERyuHafLLA4X6YZ+N+OBAE6ZTXArf+IzAgd0/htOHhzR+aFE65Abl7W3MRCAQ+X9AR/mDw+QICoRPeKd6KMHA4nJOC7q3KtG/jTadzqzLNSUG3Ta8ux+FwJBKxgfVjPO7+w9HA4pJIxG//MvmWhIHD4XA4nKeqCaORGVyZ8s186iyCK1MYjUxPVRO04rJkQVMqUMl8Pr+BxeloD382GlgcPp+vQCXL3iJfi1bW4EMQRCgU5nOrN5dE65JVPOhddnHKW5VpDB5zew97HQqNQCDI3gxoiBr5/Pp6NpFIUlTAFqf8UhB0cUoWl89vVFKSJxGJbWqRr4JMi1OKRCKhUHixKiWKxchprO16yxnrk5SdFHQ9VU0IBAIej2/H4pRoiFhsLp8vEApF2Ez8S8ABEAh4IlFOQZ7Svhb5Cj7IcjlFJEGXvPyCw+HwErSjhC4fom/Ml7fIlzogYytK/oejo3369uAkaHchXTtE35iv0iJf5ECbWrELN/nXaoAuHKJvTOfO09omDAyMnwTskRAMDClgwsDAkML/AWK4Pn2GUn8VAAAAAElFTkSuQmCC"},39580:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-actype-526e66895f30d63445724914495af5ea.png"},70264:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-cloudaccount-61a0c8ecbb5833aeab4100ace830645a.png"},1055:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-direct-f3e737af2354a1b8c3efc0c7a3338d77.png"},42799:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-directac-63d107af0d28657e88828daebd4c4bb9.png"},92248:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-ec2-02a63ce80706b27fd85f0b2fc98e8136.png"},98284:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-providers-eb60fa011dac9aba6b9f65e5525a472a.png"},17876:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-region-9d1014cc0bd7055cc73de48e1b63ffc2.png"},70951:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-workers-eafb309374befed993e98677ebdded68.png"},28453:(e,i,s)=>{s.d(i,{R:()=>c,x:()=>d});var t=s(96540);const n={},r=t.createContext(n);function c(e){const i=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function d(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:c(e.components),t.createElement(r.Provider,{value:i},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8230],{33003:(e,i,s)=>{s.r(i),s.d(i,{assets:()=>o,contentTitle:()=>c,default:()=>A,frontMatter:()=>r,metadata:()=>d,toc:()=>l});var t=s(74848),n=s(28453);const r={title:"EBS Direct Acquisition",hide_title:!0,sidebar_position:11},c=void 0,d={id:"cado/discovery-import/aws/ebs-direct-acquisition",title:"EBS Direct Acquisition",description:"Why EBS Direct Acquisition",source:"@site/docs/cado/discovery-import/aws/ebs-direct-acquisition.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/ebs-direct-acquisition",permalink:"/cado/discovery-import/aws/ebs-direct-acquisition",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/ebs-direct-acquisition.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:11,frontMatter:{title:"EBS Direct Acquisition",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Import large EC2 instances",permalink:"/cado/discovery-import/aws/large-aws-imports"},next:{title:"Azure Compute",permalink:"/cado/discovery-import/azure/azure-compute"}},o={},l=[{value:"Why EBS Direct Acquisition",id:"why-ebs-direct-acquisition",level:3},{value:"Prerequisites",id:"prerequisites",level:3},{value:"Enable EBS Direct Acquisition",id:"enable-ebs-direct-acquisition",level:3},{value:"Enable Deployed Workers",id:"enable-deployed-workers",level:3},{value:"Roles Required",id:"roles-required",level:3},{value:"Steps to Import using EBS Direct Acquisition",id:"steps-to-import-using-ebs-direct-acquisition",level:3},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function a(e){const i={h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i.h3,{id:"why-ebs-direct-acquisition",children:"Why EBS Direct Acquisition"}),"\n",(0,t.jsx)(i.p,{children:"The EBS direct acquisition feature significantly improves the capture speed of disks. This feature also requires less permissions for acquisition."}),"\n",(0,t.jsx)(i.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,t.jsx)(i.h3,{id:"enable-ebs-direct-acquisition",children:"Enable EBS Direct Acquisition"}),"\n",(0,t.jsx)(i.p,{children:"To enable EBS Direct Acquisition (Admin required):"}),"\n",(0,t.jsxs)(i.ol,{children:["\n",(0,t.jsxs)(i.li,{children:["Go to ",(0,t.jsx)(i.strong,{children:"Settings"})," > ",(0,t.jsx)(i.strong,{children:"Experiments"}),"."]}),"\n",(0,t.jsxs)(i.li,{children:["Enable ",(0,t.jsx)(i.strong,{children:"EBS Direct Acquisitions"}),"."]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Direct Acquisition",src:s(42799).A+"",width:"563",height:"76"})}),"\n",(0,t.jsx)(i.h3,{id:"enable-deployed-workers",children:"Enable Deployed Workers"}),"\n",(0,t.jsxs)(i.ol,{children:["\n",(0,t.jsxs)(i.li,{children:["Navigate to ",(0,t.jsx)(i.strong,{children:"Settings"})," > ",(0,t.jsx)(i.strong,{children:"Advanced"})," (Admin required)"]}),"\n",(0,t.jsxs)(i.li,{children:["Enable ",(0,t.jsx)(i.strong,{children:"Deployed Workers"})," (This is needed for full acquisition)"]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Workers",src:s(70951).A+"",width:"1071",height:"181"})}),"\n",(0,t.jsx)(i.h3,{id:"roles-required",children:"Roles Required"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsxs)(i.li,{children:["ebs",":ListSnapshotBlocks"]}),"\n",(0,t.jsxs)(i.li,{children:["ebs",":ListChangedBlocks"]}),"\n",(0,t.jsxs)(i.li,{children:["ebs",":GetSnapshotBlock"]}),"\n"]}),"\n",(0,t.jsx)(i.h3,{id:"steps-to-import-using-ebs-direct-acquisition",children:"Steps to Import using EBS Direct Acquisition"}),"\n",(0,t.jsxs)(i.ol,{children:["\n",(0,t.jsxs)(i.li,{children:["On your investigation click ",(0,t.jsx)(i.strong,{children:"import"}),"."]}),"\n",(0,t.jsxs)(i.li,{children:["Select ",(0,t.jsx)(i.strong,{children:"cloud"})," from the list of providers"]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Providers",src:s(98284).A+"",width:"1303",height:"297"})}),"\n",(0,t.jsxs)(i.ol,{start:"3",children:["\n",(0,t.jsxs)(i.li,{children:["Select ",(0,t.jsx)(i.strong,{children:"AWS"})]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Cloud Account",src:s(70264).A+"",width:"241",height:"128"})}),"\n",(0,t.jsxs)(i.ol,{start:"4",children:["\n",(0,t.jsx)(i.li,{children:"Select Access method"}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Access Method",src:s(89213).A+"",width:"264",height:"79"})}),"\n",(0,t.jsxs)(i.ol,{start:"5",children:["\n",(0,t.jsxs)(i.li,{children:["Select ",(0,t.jsx)(i.strong,{children:"EC2"})]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS EC2",src:s(92248).A+"",width:"264",height:"251"})}),"\n",(0,t.jsxs)(i.ol,{start:"6",children:["\n",(0,t.jsx)(i.li,{children:"Select your region of choice"}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Region",src:s(17876).A+"",width:"955",height:"155"})}),"\n",(0,t.jsxs)(i.ol,{start:"7",children:["\n",(0,t.jsxs)(i.li,{children:["Select ",(0,t.jsx)(i.strong,{children:"Full acquisition"})]}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Full Acquisition",src:s(39580).A+"",width:"446",height:"112"})}),"\n",(0,t.jsxs)(i.ol,{start:"8",children:["\n",(0,t.jsx)(i.li,{children:"Review your options then click continue to finish"}),"\n"]}),"\n",(0,t.jsx)(i.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,t.jsx)(i.p,{children:(0,t.jsx)(i.img,{alt:"EBS Direct Acquisition",src:s(1055).A+"",width:"960",height:"540"})})]})}function A(e={}){const{wrapper:i}={...(0,n.R)(),...e.components};return i?(0,t.jsx)(i,{...e,children:(0,t.jsx)(a,{...e})}):a(e)}},89213:(e,i,s)=>{s.d(i,{A:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQgAAABPCAIAAACYvszIAAAAA3NCSVQICAjb4U/gAAAAknpUWHRSYXcgcHJvZmlsZSB0eXBlIEFQUDEAAAiZVY5LCsMwDET3PkWOMPpYto5TghMCpQm5/6Jy7S4ygxgxiIfS3j7tPtblus/teLe0/OSa1NX5BaBiiAEhUE+UWdlI81qgsdDsGx7KcWFiVGL+LMAHR8eNQDiMas69Jx69rk+WUhaV/t1ki0lhy+EW/Gpb0fQFroos+GSEz4QAABlvSURBVHic7Z13XBNJG8efJKRRxEAogiJVsYCCCAgoTbCDYlcs51lOOX1FsaKeKHbFs3tYULGjoigoFhRQQQ4LIILU0HuoaaTs+8d6uRxECCiiuN9P/tg8OzP7zDP57czsbnZwCIIABgbGf8F3tgMYGN8jmDAwMKSACQMDQwqYMDAwpIAJAwNDCpgwMDCkgAkDA0MKmDAwMKQgqzDYHM6rxKRrt8KfxyXW1Te0mv5ZTFxFJfPLfOsQsnMZT2PivqvbmhlZuVHPXvB4jU3sbA4n6tmL7FxGm0p7FhtfXlHVbmeEQlHUsxdVzOp2l9A1kEkYmdmM+UvXbd9zJCziye6Ak3MWr0pKSWshPYIg+4+c+ZCe2Q6HCotKduw7wWKx25FXFnYdPHXgyJm3yR86qPx2cCficcCxoKcxL5vYIx5GBxwLinwc23L2KzfuRT6JRrcRBNl/+HTax6x2O8Pn8wOOBWXl5Le7hK6BTMI48tcFFZrytXOHL50OuBJ0SFVV5cCR0x3kUHVNXVzCay6P3xGFM/ILS0vKCHL4+w9jOqL8L+HG3UdNLGHhTS1SiUt4k/KhPecgjBaQkyVRXkHhrCnuCgryAKCkqLBt48q09AyRSITH4wHg1t3I2OcJ5VXVJv2NF82frqqi3CQ7I78w5Pb9d8lpyt2Upri5OjnYStpT3qd37648cayzk4Pt87jE3QEnAWDxSl87K3NvrwVNinr0NDb07uNKZrW6qurcmZMsLUwBYP+R0720elRWVb5KTFbupjx72gRrSzOpFXn4JIZMpcyYPO7i1VAul0ehkMW70FpUVdf0N+67dOFM5W5KAMBisS9dv53wNhUA7CwHz5k5mUDAt1Cj9x8+nrt8q6i43NhIf7K768D+fQGgorLq+OnLGVm5mhp0VyfbUc72zR0jyOFLS8oysnL7GOqhlqSUNGZ1LUHu3zMX6kz862SRSORoZzVrqjuRKOezaVdObn5Obv6Hj1mbfJbp9e4FAMyaWr9dRzKyc3toqi39daaBni5aQnzC24iHz7IZBf37Gnm4ufbra4Daq5i1l66FJr5NoVCpC2ZP/tzP4KdCph7DbtjQq7fCn8clCoUiAOippeniNAJVxbmLIWcvhPQzNpg4ziXpfdrqTTvQNGIqKpmrN+3OyyueMnF0717aAceCnsXGi+2Z2Xlu41zU6XTUrtu7p/1wKwCY6jba2d6miRtPnr04dPy8hhp9znR3CpW0bc9hdDDNYBQFXw0tK2e6jXNhcdn++46VllU0rwWCIJFPX7rYW490sBUKRLFxCeJdQcEhZy+E9OmjN8bFIel92nKfrQiCCITCTdsORD596WBjYWk2IDT80aGT51uoUWUVc/0f+4hycgvmeAAOfLcfqGLWAsDqjTtz8/JnT51g0s/oyMngxDcpzX0z1NdVoSnfCvu3iwgNi9TsoaHdowf6VSgUbdp24HF0vIu9rYPN0JDQ+0cCgwHAfawzmmDW5PFqdFV0+8z563S68vhRjkXF5T6b9qItkvA62X/fMTwON9l9VGVl5fqtexiMAgBo5PPXbd0b93fSGBcHi8H9dx08IctPossjU4/x65xpIiGyO+AkQQ5v0q/vuNGOwyzNAYDL5d24E7ly2fyRjnYAYDtsyOLlG/9+nWQ1dLA4762w+woUcsDujSQiEQAEAuHFkLsOw61v3okg4PGHdm+iUikAcPbCtUpmjcNwzdHOI6JjX7k4DW/e85gONPZZsdBhuDUAjLC1nP2r94f0THU1VQBQ16D7+a7E4XA2VuaLl29MTcvQ1FBrkv1t8gceh+vqNJym3K1vH/2Ih9EujsPRWtwMi1wwd6rHhFEAYGVhGnw1rLKqOjsnLzMn7/Dezfp6vQHAQK/325S0FmqUlZ0HAEt/naXTS3ukg13C62QlJXkOh8usrl00f/rYUY4AYD7YpHcvbalBnjhh1NkL11ksTwUFeWZ1beK798t/m3MnPArdm/g2JTMnL/DITi1NdQDQ1FA7Gnhx2a+zhttYhtx+oNNLC20C9KKCq7Od16K5AKDbW3vHvuN5BYX6ujqB568NNum31XclALiNHblw+YbzV2//sX55QmJSaUnZ0QNbdXV6AgCtO+385Zuy/Cq6NjIJQ4WmvM578fzZk2LjXkdFx+3Yd9zZwcbba0FGdi4AvHj19t37dHHivIJiSWGkpGYxq2sPnzz/aW9hUUVFBQCkpuUMNTdBVQEAC+ZOb9UNNbqqtlb9xWt38vKLs/PyAKC+gYXu6t/XEIfDAYCWpjqZSqmsqmmePSQ0AgAoFEpxSdlAY6ObYZEVlUw1ukpGVi4A2Ntaosn09Xr/sWE5AIQ/eKKs3A1VBQA4O9g6O9i2UCNzs4FEEmn5Wr/hNpa2VubWQ81wOBwQiYMGGp86dy3xdYq1lZmzgw2FTG7mGgDAKCe7sxeuR0bFekwYFR4ZRZDDO46wEQsjLT0TAC6HhKFfa6prASC/sFg89JJkgLERumEywBgAKqtqdHpqlZaUzZ4yHrXLEQiOdlYPo14AQEZmtgpNGVUFAAyzMsOEAW26j6GhrjbFffTxAL8ZUyY8efaytq6+vp4FAGQSmYDHox9nB5ue2pqSuRrYDQAgTtCvj76DnbVIJGJx2VQyqU2+3rjzwHu9f8zLv5WUqBPHjpTcRcC3UhEul5eS+hEAFq/wXbzC92ZYJAA8fvoC/lFX898ri8MhkqScOD5XIxKReOn0ganuYxiMoh37jv+ybC2XxwMA/y2rV3n90ijkB567MnOBN6rD5igoyI+ws7x996FIJLr74Kmrkx3aI31yhs2SPKiqKs3ZwYbymQDKyX1yG4/HoRuNfD4AkEj/pqdQKGwOFwA4PB5ejiC2k0n/HvRnpvUeo6CwxG/v0RVL5pgOMEYtBnq9AIDHa+xrpAcAY1yGDzLph+5i5Bfq6vSUvEvQ39iooKBUPI2uqKySp1LxeLyxkf671AwEQdAz/ZukVJFQZGFugiYTiYTNPbkXGWVhZrp14woAaGCxA4Ouyl7P2JevAGDX1jUa6nTUsm330fuPns2cOgGtRXJqOjo+rG9gxb5IsB1mYWxkcP9hTF19QzclRbRqGZk5rs4jPlcjLo9XXlbpOWOS54xJuYz85Wu2vYhLdBwxLDs339HexsnBlsViL1zuezv80dr/LZbq5KTxrjHPE/4Kusxmsd3HukjuMu5jeP9R7NKFs1EBszmchgY2OowEAKFAJKU4CeSpVGXlbimpabbWQ1DLu+QPfQx7A0AfQz3Jan5Ib/+l3q5E6z1GT23Nurr6PQcDX8S/zi8sfhYTt//oWTqdpq6mSldVMTLU3XHgxN9vUsrKK06fu/r76q1pH7Mls48eOSI3L//4qeD8gqL3aRkr1vpv2fknAIwZaV9aUnb45Ln8gqLYlwlb/A+ip1JVVRoARDx8ysgvbOqJpkZmDiMzm5HLyN+x71ib6hkRGa3TS9tkQF91NVX0M3v6BGZ1bWY2g66q0reP/v6jZ18lJhUWlewJOPnXuSsUMtnC3JRMpWzaHpCekZ2ekb3F/2Bk1PMWahTz/NXva/yexsQVl5bHxiUCAF1Vpai4zHu9/6lzV4pLy98kpdbX16up0D7npJGBrpaWZviDZ0aGuj21e0jusjAzJVMpG7bu+5iZk19QtGXHn0tWbuZyeQCgTqe/S0l7k5SKdlCfY5yrw70Hz+49iGLkFZy/fDMl9eNYFwcAMB9kSiSR/tj5Z3pGdsLr5MOBwW0KbFel9R4Dh8Md3rPZf+/xXQc+Xa/o20ff18cL3d65xcd/71G/XYcAgCCHXzR/er++BpI9hukA41Vev5y6cCPiYTQA6OvpoOdLkwF9Vy6bfyb45qOoFwBgN8xymsdYANDSVHd2sAkJvR8b/+b04R2SniycN22DX4D3en8AsDAzlbyU2TJVzOrMnLzFv8yQNA4dMoggh38YFWNkoLt9k/f2PUe37zkCAPIK8js2ryaTSWQyaZ/fmp0HA318dwGATi/t9d6/tVAjV+cRyR8y/jwRhJ6/p7iPNh1ojMPhliyYGXztTlhEFACYDxow/Z+BvmSE0W4TAKa4uR4+ecFjgmuTNMrKSge2rfMPOLl6404AUFJS8tuwAr3cPGvquPV+B7b4H9y0xktydteEWdPc6hvqzwTf4Dc2kqmUBXOn2dtZAYCqirL/Ju89B0+i1ZwzY1Lw1VAZA9uFwcn+cEQjn19eXtlDUwO9li+JQCisrq6hq6qIG7g5zOpaKoUsnm1L2pUUFYjE/0iUy+MBApL3GcSUV1RRKWQlJUUZ3ZadRj6fxebQlLs1sbM5HESEoLdxJJFaI5FIVFHJVFdTbRKKisqq7srKTarZDtgcDr9RoKys1MReV9+gpKjQQvxREARhVtc1v+IHANW1dQryVMmJzc9MG4SBgfHzgD1di4EhBUwYGBhSwISBgSEFTBgYGFLAhIGBIQVMGBgYUsCEgYEhBUwYGBhSwISBgSEFTBgYGFJo26M7Xfj5kVafMpKRLhyib8zXapH2IaswEAQ5X5H8uD4rm1sjQFp5+v/HQg6HN6B0H6lkOE/N9EsaA0GQBhaHw+EJhAJMHV8CDgdyBDkqlayoQO0secj0EGEet9a38LEumTZJtZ8JVZ2EI7Sa5QeiERGmcMpDq9IYvOodPUf2pkh58rRV+HxBdU2dHImoSKUQiXKde7b70UEQhM8XNHC4gkY+rXu3L38kuR20LgyRSDQ3J3RU9z5z6CbfxqfOIrgyJbIm44L+JHxrf5RtgkgkqqyqkZenKipQO8i3n5MGFofN5tBVu7e1Rb6cVo6HIMiFiqTeJFqXVwUAzKGb9CbRLlQktWmegI6g5OSImCq+OooKVDk5YgOL8+1nbq0L43F9jge937fxptPxoPd7XJ/TVmFwuTxFhaZ/wML4KigqULhc3vclDARBEATJ5tWYUNW/mUOdiwlVPZtXg1ZclvRoSoFQ2Cnj4J8BIlFOIBTK3iJfi9Z7DAEi6mKz7RYg4QgCRNTWHgNBOvnaYhcGh8MhSCdcBMdu8GFgSAETBgaGFDBhYGBIARMGBoYUMGFgYEgBEwYGhhQwYWBgSAETRpdFJBJ13BqfXZ6OFYbPOj/P+b936CE+x+s3yRwOt1MOLSMlJWULl6zuM9DO3MrVd8vOr+7twUOBw50motsyRiP4UshQ2zFNPlnZUhb0KCwqHmo75us6/H2BfB6RSMTn8y1SAltI0wJVzBqahjFNwzgzK6d9JXwJNA3jtPTMdmS0SAnk8/kikUiWxGiICovL23EgO0f3VWv+yMjMjn0ebz9y0qo1f7SjkBYoL6948y4F3ZYxGmVlFSnv01Lep7mOnea3fT+6zeFwmqfMzc2jaRh/XYc/R2Fxuewt8rXowCd87oVHWlua9+ypeeNW+Po1n/qNurr68xevv0p4q6fb0+u3BZqa6gCQk8O4ePlmRlau5dDBvy2eh75wO/Z5/O2wB2wOe7Srk/uE0QAQF58Yn/DGe8ViAMjMyjkffM3fb0NcfOLrN8kK8tQnz14Y6un4rPZSVFT4n/dmAJg1d9m61V7Tp7l3XB3bDbO6NvXDx5DLgZqa6kaG+qdPHnj9z6KVaDQ+ZmRbWpotWTiHQqGAtBCt892+aIGnoYEeAOwPODHczsrK0nyd7/YRttahdx64OI/Q0dGOT3hjNmigZDRweHx1NXPJonkAIBAIl3tvWPW/34wM9dFDq6vT1dXpAKCsrKzdU3PgP0sFoUfPys6ztRkyf+4M8n9Xn7r/4MnDx9H+fuvl5alXroU+fvKcSiX++ounuZkJAKzz3e7qbB/xIIrJrJ09a+JIJymL1n6HdOBQ6ur1O9OmuE3xmHDx8k2RSAQAAoFwwRLv6Ng4j0ljS0oqxrp7CoXCkpKy0W6eHC5notuYO3cj1633B4DomJez5/9uaKBrbTlkzQb/c+evAkB+flFcfCJaeFl5ZcSDp6hxy7Z9aRmZE8a5Rj6J9d28GwA8Jo0BgF/mTR8yxLTjKvglqNCUh9ta+6zflpzyQSQSGRroTZ/qBgBoNBCRaNpUt4j7j33W+YmNTUIUeieyuroOLS06Nr60rBw1rvPd6WA/zMxsoDhcktHQ0tLYsecIr7ERAJ6/iA+/H6XbW6dlV8VHd5sw6s7dh14rNkrufRAZteT3dZ6zpigoyAf8+deR40GjXB0MDPRHjpmWmZWDurR+865h1kN1dbSmzfotNzfva8eyY2ihN/mSoVRODoOmYVxeUclrbOxlMCT2xSsEQZKSU3sZDGGzOQiC8BobL125WVtbdzLw3Kw5S9FchUXFN27dQxBk9jyvYyfOosbIR0/NLF0QBLl67fbUmYtQY+yLV2IjuoEgyJ27D8Tb3/9QqqKyym/7fpqGsdEA263b9tXW1iEIcjLw3G9ePmiCvPxCmoYxh8ORGiKjAbYJf79DjeMnzr0ddh813gt/iBolwyWOhkAgGDDYIfLRUwRBVqzctHnrLqm+TZ256HTQRXT7ZOC5GbOXoNvlFZU0DeOCwiJ0KBX56ClNwxh1QyAQSA6bV67asnvvEdQl1GEEQSxsRt+8Hd7WQHXKUKqjeoy9AccA4NSZS/sDTjQ0sDZs2gkA71PTLcxN0ZVWSETirBke3boppbxPt/hnHSBtrR6TJ40DgITEd0PMB6FGczNTRl5BXV39546lr//pnNdbp2fDj3Mdhq6qsmXT6tKC5FPH976M/3vp7+sAIOV9+rUb93QMLXQMLewc3QGgsKhEaog+h7p6S/8RIBAInrMmh94O53K5oXfvT/Fwa9XP5JQP1v+s3KdGV+3bxzD9Yyb6dYbnUgAwGzwQAPLzCwHAadRU1Pnzl64z8j51Djq9Pi0J28dAj/2DNFCHzDFEItG1kLt0uqocgQAA1pbm8Qlv2GxOD031gqIScTIOh0smk3r00CwtLRNn5PEaqVSKXm/tqiomaqyqYioqKigqKhDk5KqY1WKjuBw87l95c7nf9ZUoMQWFxe/evZ8w3pVEJNqPsFFSUho5ZppQKNTQUPOc6eHvt16cUklJUWqISERiQ8Onk0Vpebnsh57iMc7SdqyjwwhtrR6mJv1bTa+lpVVRUYluIwhSVFyiqaGBfo28d3WJ15pdew9t3rhKTY0OANGPb6qqqKB7SdIWgEV+kPdEdEiP8SrhDQC8S3i01sdrrY/XvdvBWj0070dGDTYzLSurOHfhmkAgjI55qa1nVlNb72A/7NSZy4mvkxAE2R9wYvykOQDgOtJx176jpaXl1bV1O3YdHu1qj8fjjQx13757/+Dh05wcxuFjZ1r2gU5XTf3wEV3G9zsEj8fNW/i/ayFhAoGQWV176mywtaU5gUBwdLC7fTcyl5HfrZtSdEzczDnLhEKR1BANMul3+uxlRl7BhYvXs7MZQlFLr26RjIahgZ7Z4IE+6/3meU6WxVUH+2HH/7rw5m0Kr7Hxz6OnKBRK3z6G6K6hFoOCg44cPHwqPOKRoqKC7TDLE4HniUQiACxZtubR45gvDVMn0sIwq91zjNVrty5bvlbSsmP3IXSc+jLubwub0TQN414GQ8RDz9Nng40G2NI0jM0sXd6npiMIwucLVq7ejF7tnTF7SV1dPYIgQqHQZ+1WdFDut32/hc1o5L8jaXQO86nMoIs0DeN2XAP9ZnOMsLuRaK1pGsZj3TzzC4pQ+9mgy6i9l8GQ8IhHqLF5iJKSU1HLoqWrXMdOE88xxBMPycg0iUbQuSs0DeOSkrLP+TZ15qIzQZfEX88EXeplMISmYWzn6P4hLQNBkFxGvvhybcjNe+jsoqysYvzEuWiNZs/zQltN0qXZ87wuXLze1kB1yhyjA+9jtEAVs0b4z/8VUYRCYRWzpkkyLo+HztQl4TU2yngULo8ne2Ix30wYKOXlFc3rKBKJyssrmvggNUTti8aho6fE82kZEQqFzJpaWVKyWGwWi92mwlumq93HaAEVWtN3N+Hx+OZGMonUPK/sy4pKzf69gQ7Nm4DD4ZrbpYaordFgsdjeazbfuBVxP+xSm/zE4/HN17OVirx8V3hbCvas1M8Fr5FvZ2MV8yTUytK8s335rsHebfFzoUJTnus5rbO9+AHAegwMDClgwsDAkAImDAwMKWDCwMCQAiYMDAwpYMLAwJBC68KQw+EbEeE3cOV7oBERyuHafLLA4X6YZ+N+OBAE6ZTXArf+IzAgd0/htOHhzR+aFE65Abl7W3MRCAQ+X9AR/mDw+QICoRPeKd6KMHA4nJOC7q3KtG/jTadzqzLNSUG3Ta8ux+FwJBKxgfVjPO7+w9HA4pJIxG//MvmWhIHD4XA4nKeqCaORGVyZ8s186iyCK1MYjUxPVRO04rJkQVMqUMl8Pr+BxeloD382GlgcPp+vQCXL3iJfi1bW4EMQRCgU5nOrN5dE65JVPOhddnHKW5VpDB5zew97HQqNQCDI3gxoiBr5/Pp6NpFIUlTAFqf8UhB0cUoWl89vVFKSJxGJbWqRr4JMi1OKRCKhUHixKiWKxchprO16yxnrk5SdFHQ9VU0IBAIej2/H4pRoiFhsLp8vEApF2Ez8S8ABEAh4IlFOQZ7Svhb5Cj7IcjlFJEGXvPyCw+HwErSjhC4fom/Ml7fIlzogYytK/oejo3369uAkaHchXTtE35iv0iJf5ECbWrELN/nXaoAuHKJvTOfO09omDAyMnwTskRAMDClgwsDAkML/AWK4Pn2GUn8VAAAAAElFTkSuQmCC"},39580:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-actype-526e66895f30d63445724914495af5ea.png"},70264:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-cloudaccount-61a0c8ecbb5833aeab4100ace830645a.png"},1055:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-direct-f3e737af2354a1b8c3efc0c7a3338d77.png"},42799:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-directac-63d107af0d28657e88828daebd4c4bb9.png"},92248:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-ec2-02a63ce80706b27fd85f0b2fc98e8136.png"},98284:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-providers-eb60fa011dac9aba6b9f65e5525a472a.png"},17876:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-region-9d1014cc0bd7055cc73de48e1b63ffc2.png"},70951:(e,i,s)=>{s.d(i,{A:()=>t});const t=s.p+"assets/images/ebs-workers-eafb309374befed993e98677ebdded68.png"},28453:(e,i,s)=>{s.d(i,{R:()=>c,x:()=>d});var t=s(96540);const n={},r=t.createContext(n);function c(e){const i=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function d(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:c(e.components),t.createElement(r.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/38dfc04a.8249b82e.js b/assets/js/38dfc04a.851a17df.js similarity index 98% rename from assets/js/38dfc04a.8249b82e.js rename to assets/js/38dfc04a.851a17df.js index f1b89ae2a..107b7970d 100644 --- a/assets/js/38dfc04a.8249b82e.js +++ b/assets/js/38dfc04a.851a17df.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7012],{1377:(e,i,s)=>{s.r(i),s.d(i,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>t,toc:()=>l});var n=s(74848),c=s(28453);const r={title:"IAM permissions description",hide_title:!0,sidebar_position:6},o="What IAM permissions does Cado use in GCP?",t={id:"cado/deploy/gcp/iam-description",title:"IAM permissions description",description:"Introduction",source:"@site/docs/cado/deploy/gcp/iam-description.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/iam-description",permalink:"/cado/deploy/gcp/iam-description",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/iam-description.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"IAM permissions description",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Cross-Project setup",permalink:"/cado/deploy/gcp/gcp-cross-project"},next:{title:"Architecture in GCP",permalink:"/cado/deploy/gcp/gcp-architecture"}},d={},l=[{value:"Introduction",id:"introduction",level:2},{value:"Permissions Overview",id:"permissions-overview",level:2},{value:"Minimal Permissions to Run",id:"minimal-permissions-to-run",level:3},{value:"Cado Host Permissions",id:"cado-host-permissions",level:3},{value:"Bucket Acquisition Permissions",id:"bucket-acquisition-permissions",level:3},{value:"Worker Permissions",id:"worker-permissions",level:3},{value:"Adjusting Settings",id:"adjusting-settings",level:4},{value:"Upgrade Permissions",id:"upgrade-permissions",level:3},{value:"Secret Management Permissions",id:"secret-management-permissions",level:3},{value:"Acquisition Permissions",id:"acquisition-permissions",level:3},{value:"Instance Acquisition",id:"instance-acquisition",level:4},{value:"GKE Acquisition",id:"gke-acquisition",level:4}];function a(e){const i={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",ul:"ul",...(0,c.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(i.h1,{id:"what-iam-permissions-does-cado-use-in-gcp",children:"What IAM permissions does Cado use in GCP?"}),"\n",(0,n.jsx)(i.h2,{id:"introduction",children:"Introduction"}),"\n",(0,n.jsxs)(i.p,{children:["Cado Security requires specific permissions in Google Cloud Platform (GCP) to function correctly. This document outlines the permissions needed, categorized by their functionality. For the most up-to-date permissions, please refer to the ",(0,n.jsx)(i.a,{href:"https://github.com/cado-security/Deployment-Templates/blob/main/gcp/modules/iam/main.tf",children:"Cado Security GCP Terraform Module"}),"."]}),"\n",(0,n.jsxs)(i.p,{children:["If these permissions are too broad for your environment, or if you have concerns regarding the scope of any permissions, please contact our support team at ",(0,n.jsx)(i.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," for assistance in reducing the permission set while maintaining necessary functionality."]}),"\n",(0,n.jsx)(i.h2,{id:"permissions-overview",children:"Permissions Overview"}),"\n",(0,n.jsx)(i.h3,{id:"minimal-permissions-to-run",children:"Minimal Permissions to Run"}),"\n",(0,n.jsx)(i.p,{children:"These are the essential permissions required for Cado Security to operate:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.actAs"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.getAccessToken"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.getIamPolicy"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"cado-host-permissions",children:"Cado Host Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Permissions related to the Cado Host operations:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.signBlob"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"bucket-acquisition-permissions",children:"Bucket Acquisition Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Needed for acquiring data from Cloud Storage buckets:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.buckets.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.buckets.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.objects.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.objects.delete"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.objects.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.objects.list"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"worker-permissions",children:"Worker Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Permissions required for worker instances to perform tasks:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.setMetadata"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.setServiceAccount"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.addresses.use"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.addAccessConfig"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.delete"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.setLabels"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.subnetworks.use"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.networks.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.networks.list"})}),"\n"]}),"\n",(0,n.jsx)(i.h4,{id:"adjusting-settings",children:"Adjusting Settings"}),"\n",(0,n.jsx)(i.p,{children:"Permissions for modifying compute resource settings:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.machineTypes.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.machineTypes.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.regions.get"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"upgrade-permissions",children:"Upgrade Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Required for upgrading Cado Security components:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.attachDisk"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.images.useReadOnly"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.addresses.use"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.detachDisk"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.deleteAccessConfig"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.zoneOperations.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.subnetworks.useExternalIp"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"secret-management-permissions",children:"Secret Management Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Needed for managing secrets in Secret Manager:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"secretmanager.secrets.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"secretmanager.versions.access"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"secretmanager.versions.add"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"acquisition-permissions",children:"Acquisition Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Permissions for acquiring resources and data within GCP:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"resourcemanager.projects.get"})}),"\n"]}),"\n",(0,n.jsx)(i.h4,{id:"instance-acquisition",children:"Instance Acquisition"}),"\n",(0,n.jsx)(i.p,{children:"Required for interacting with compute instances:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"cloudbuild.builds.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"cloudbuild.builds.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.use"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.useReadOnly"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.globalOperations.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.images.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.images.delete"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.images.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.getSerialPortOutput"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.projects.get"})}),"\n"]}),"\n",(0,n.jsx)(i.h4,{id:"gke-acquisition",children:"GKE Acquisition"}),"\n",(0,n.jsx)(i.p,{children:"Permissions related to Google Kubernetes Engine (GKE) clusters:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.clusters.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.clusters.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.pods.exec"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.pods.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.pods.list"})}),"\n"]})]})}function h(e={}){const{wrapper:i}={...(0,c.R)(),...e.components};return i?(0,n.jsx)(i,{...e,children:(0,n.jsx)(a,{...e})}):a(e)}},28453:(e,i,s)=>{s.d(i,{R:()=>o,x:()=>t});var n=s(96540);const c={},r=n.createContext(c);function o(e){const i=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function t(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:o(e.components),n.createElement(r.Provider,{value:i},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7012],{1377:(e,i,s)=>{s.r(i),s.d(i,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>t,toc:()=>l});var n=s(74848),c=s(28453);const r={title:"IAM permissions description",hide_title:!0,sidebar_position:6},o="What IAM permissions does Cado use in GCP?",t={id:"cado/deploy/gcp/iam-description",title:"IAM permissions description",description:"Introduction",source:"@site/docs/cado/deploy/gcp/iam-description.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/iam-description",permalink:"/cado/deploy/gcp/iam-description",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/iam-description.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"IAM permissions description",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Cross-Project setup",permalink:"/cado/deploy/gcp/gcp-cross-project"},next:{title:"Architecture in GCP",permalink:"/cado/deploy/gcp/gcp-architecture"}},d={},l=[{value:"Introduction",id:"introduction",level:2},{value:"Permissions Overview",id:"permissions-overview",level:2},{value:"Minimal Permissions to Run",id:"minimal-permissions-to-run",level:3},{value:"Cado Host Permissions",id:"cado-host-permissions",level:3},{value:"Bucket Acquisition Permissions",id:"bucket-acquisition-permissions",level:3},{value:"Worker Permissions",id:"worker-permissions",level:3},{value:"Adjusting Settings",id:"adjusting-settings",level:4},{value:"Upgrade Permissions",id:"upgrade-permissions",level:3},{value:"Secret Management Permissions",id:"secret-management-permissions",level:3},{value:"Acquisition Permissions",id:"acquisition-permissions",level:3},{value:"Instance Acquisition",id:"instance-acquisition",level:4},{value:"GKE Acquisition",id:"gke-acquisition",level:4}];function a(e){const i={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",ul:"ul",...(0,c.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(i.h1,{id:"what-iam-permissions-does-cado-use-in-gcp",children:"What IAM permissions does Cado use in GCP?"}),"\n",(0,n.jsx)(i.h2,{id:"introduction",children:"Introduction"}),"\n",(0,n.jsxs)(i.p,{children:["Cado Security requires specific permissions in Google Cloud Platform (GCP) to function correctly. This document outlines the permissions needed, categorized by their functionality. For the most up-to-date permissions, please refer to the ",(0,n.jsx)(i.a,{href:"https://github.com/cado-security/Deployment-Templates/blob/main/gcp/modules/iam/main.tf",children:"Cado Security GCP Terraform Module"}),"."]}),"\n",(0,n.jsxs)(i.p,{children:["If these permissions are too broad for your environment, or if you have concerns regarding the scope of any permissions, please contact our support team at ",(0,n.jsx)(i.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," for assistance in reducing the permission set while maintaining necessary functionality."]}),"\n",(0,n.jsx)(i.h2,{id:"permissions-overview",children:"Permissions Overview"}),"\n",(0,n.jsx)(i.h3,{id:"minimal-permissions-to-run",children:"Minimal Permissions to Run"}),"\n",(0,n.jsx)(i.p,{children:"These are the essential permissions required for Cado Security to operate:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.actAs"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.getAccessToken"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.getIamPolicy"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"cado-host-permissions",children:"Cado Host Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Permissions related to the Cado Host operations:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"iam.serviceAccounts.signBlob"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"bucket-acquisition-permissions",children:"Bucket Acquisition Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Needed for acquiring data from Cloud Storage buckets:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.buckets.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.buckets.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.objects.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.objects.delete"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.objects.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"storage.objects.list"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"worker-permissions",children:"Worker Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Permissions required for worker instances to perform tasks:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.setMetadata"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.setServiceAccount"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.addresses.use"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.addAccessConfig"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.delete"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.setLabels"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.subnetworks.use"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.networks.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.networks.list"})}),"\n"]}),"\n",(0,n.jsx)(i.h4,{id:"adjusting-settings",children:"Adjusting Settings"}),"\n",(0,n.jsx)(i.p,{children:"Permissions for modifying compute resource settings:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.machineTypes.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.machineTypes.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.regions.get"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"upgrade-permissions",children:"Upgrade Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Required for upgrading Cado Security components:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.attachDisk"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.images.useReadOnly"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.addresses.use"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.detachDisk"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.deleteAccessConfig"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.zoneOperations.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.subnetworks.useExternalIp"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"secret-management-permissions",children:"Secret Management Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Needed for managing secrets in Secret Manager:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"secretmanager.secrets.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"secretmanager.versions.access"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"secretmanager.versions.add"})}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"acquisition-permissions",children:"Acquisition Permissions"}),"\n",(0,n.jsx)(i.p,{children:"Permissions for acquiring resources and data within GCP:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"resourcemanager.projects.get"})}),"\n"]}),"\n",(0,n.jsx)(i.h4,{id:"instance-acquisition",children:"Instance Acquisition"}),"\n",(0,n.jsx)(i.p,{children:"Required for interacting with compute instances:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"cloudbuild.builds.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"cloudbuild.builds.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.use"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.disks.useReadOnly"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.globalOperations.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.images.create"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.images.delete"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.images.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.instances.getSerialPortOutput"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"compute.projects.get"})}),"\n"]}),"\n",(0,n.jsx)(i.h4,{id:"gke-acquisition",children:"GKE Acquisition"}),"\n",(0,n.jsx)(i.p,{children:"Permissions related to Google Kubernetes Engine (GKE) clusters:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.clusters.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.clusters.list"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.pods.exec"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.pods.get"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"container.pods.list"})}),"\n"]})]})}function h(e={}){const{wrapper:i}={...(0,c.R)(),...e.components};return i?(0,n.jsx)(i,{...e,children:(0,n.jsx)(a,{...e})}):a(e)}},28453:(e,i,s)=>{s.d(i,{R:()=>o,x:()=>t});var n=s(96540);const c={},r=n.createContext(c);function o(e){const i=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function t(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:o(e.components),n.createElement(r.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/3b0c3707.8f9c3c87.js b/assets/js/3b0c3707.55720bcf.js similarity index 99% rename from assets/js/3b0c3707.8f9c3c87.js rename to assets/js/3b0c3707.55720bcf.js index 7374a0c9e..26b8a202f 100644 --- a/assets/js/3b0c3707.8f9c3c87.js +++ b/assets/js/3b0c3707.55720bcf.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7030],{83139:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>s,default:()=>p,frontMatter:()=>c,metadata:()=>r,toc:()=>l});var n=o(74848),i=o(28453);const c={title:"Set-up GCP for collection of data",hide_title:!0,sidebar_position:2},s="How to set up GCP for collection of data by Cado",r={id:"cado/deploy/gcp/gcp-settings",title:"Set-up GCP for collection of data",description:"You can acquire compute and storage resources from GCP with the Cado platform by",source:"@site/docs/cado/deploy/gcp/gcp-settings.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-settings",permalink:"/cado/deploy/gcp/gcp-settings",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-settings.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Set-up GCP for collection of data",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"GCP Terraform deployment",permalink:"/cado/deploy/gcp/gcp-deploy"},next:{title:"Endpoint access",permalink:"/cado/deploy/gcp/endpoints"}},a={},l=[{value:"Setting up the Primary Google Project for Cado collection",id:"setting-up-the-primary-google-project-for-cado-collection",level:2},{value:"The Cado Role",id:"the-cado-role",level:3},{value:"Enabling the Cloud Build API for the project",id:"enabling-the-cloud-build-api-for-the-project",level:3},{value:"Defining a bucket for the Primary GCP Project",id:"defining-a-bucket-for-the-primary-gcp-project",level:3},{value:"Setting up a Service Account in Primary GCP Project",id:"setting-up-a-service-account-in-primary-gcp-project",level:2},{value:"Required Access",id:"required-access",level:3},{value:"Getting GCP Credentials",id:"getting-gcp-credentials",level:3},{value:"Service Account Credentials",id:"service-account-credentials",level:4},{value:"Workload Identity Federation",id:"workload-identity-federation",level:4},{value:"Entering Settings",id:"entering-settings",level:2},{value:"Collecting from multiple GCP Projects",id:"collecting-from-multiple-gcp-projects",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-set-up-gcp-for-collection-of-data-by-cado",children:"How to set up GCP for collection of data by Cado"}),"\n",(0,n.jsx)(t.p,{children:"You can acquire compute and storage resources from GCP with the Cado platform by"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsx)(t.li,{children:"Setting up the primary GCP project for Cado collection"}),"\n",(0,n.jsx)(t.li,{children:"Setting up a Service Account in GCP"}),"\n",(0,n.jsx)(t.li,{children:"Entering credentials into Cado"}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"The below guide walks through this process."}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["This setup can be automated using our ",(0,n.jsx)(t.a,{href:"/cado/deploy/gcp/gcp-auto-setup",children:"GCP Automated Setup"})]})}),"\n",(0,n.jsx)(t.h2,{id:"setting-up-the-primary-google-project-for-cado-collection",children:"Setting up the Primary Google Project for Cado collection"}),"\n",(0,n.jsx)(t.p,{children:"In order to set up the project for Cado collection you need to"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Enable the Cloud Build API for the project"}),"\n",(0,n.jsx)(t.li,{children:"Define a bucket for the Primary GCP Project where images will be stored and imported into Cado."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.em,{children:(0,n.jsxs)(t.strong,{children:["Note - if you are importing from more than one Google project you will need to designate one of those projects as the Primary GCP Project and ",(0,n.jsx)(t.a,{href:"/cado/deploy/gcp/gcp-settings#defining-a-bucket-for-the-primary-gcp-project",children:"create a bucket in that project"})," to enable collection across the multiple Google projects"]})})}),"\n",(0,n.jsx)(t.h3,{id:"the-cado-role",children:"The Cado Role"}),"\n",(0,n.jsxs)(t.p,{children:["To appropriately scope a service account for Cado to operate, creating a custom GCP role allows specifying individual permissions. To achieve this, navigate to the ",(0,n.jsx)(t.strong,{children:"Role"})," section under the ",(0,n.jsx)(t.strong,{children:"IAM and Admin"})," tab. Create a custom role and add the following permissions:"]}),"\n",(0,n.jsx)(t.admonition,{type:"note",children:(0,n.jsxs)(t.p,{children:["If you're deploying into GCP, the Terraform script provided by Cado should have already created this role for you, prefixed with ",(0,n.jsx)(t.strong,{children:"myCadoResponseRole"}),"."]})}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:' // Instance Acquisition\n "cloudbuild.builds.get",\n "cloudbuild.builds.create",\n "compute.disks.get",\n "compute.disks.use",\n "compute.disks.list",\n "compute.disks.useReadOnly",\n "compute.globalOperations.get",\n "compute.images.create",\n "compute.instances.get",\n "compute.instances.list",\n "compute.images.delete",\n "compute.images.get",\n "compute.instances.getSerialPortOutput",\n\n // Compute Management\n "compute.disks.create",\n "compute.disks.setLabels",\n "compute.images.useReadOnly",\n "compute.instances.attachDisk",\n "compute.instances.create",\n "compute.instances.delete",\n "compute.instances.setLabels",\n "compute.instances.setMetadata",\n "compute.instances.setServiceAccount",\n "compute.machineTypes.list",\n "compute.machineTypes.get",\n "compute.regions.get",\n "compute.subnetworks.use",\n "compute.subnetworks.useExternalIp",\n "compute.networks.get",\n "compute.networks.list",\n "compute.zones.list",\n "compute.zoneOperations.get",\n\n\n // Platform Update\n "compute.addresses.use",\n "compute.instances.addAccessConfig",\n "compute.instances.detachDisk",\n "compute.instances.deleteAccessConfig",\n\n // GKE Acquisition\n "container.clusters.get",\n "container.clusters.list",\n "container.pods.exec",\n "container.pods.get",\n "container.pods.list",\n\n // IAM & Authentication\n "iam.serviceAccounts.actAs",\n "iam.serviceAccounts.create",\n "iam.serviceAccounts.enable",\n "iam.serviceAccounts.get",\n "iam.serviceAccounts.getAccessToken",\n "iam.serviceAccounts.getIamPolicy",\n "iam.serviceAccounts.implicitDelegation",\n "iam.serviceAccounts.list",\n "iam.serviceAccounts.signBlob",\n\n // Project Management\n "resourcemanager.projects.get",\n "compute.projects.get",\n\n // Secret Management\n "secretmanager.versions.access",\n "secretmanager.versions.add",\n "secretmanager.secrets.create",\n\n // Bucket Acquisition\n "storage.buckets.get",\n "storage.buckets.list",\n "storage.objects.create",\n "storage.objects.delete",\n "storage.objects.get",\n "storage.objects.list",\n'})}),"\n",(0,n.jsx)(t.p,{children:"If you'll be wanting to use this Role across multiple projects, you can create it at the Organization level- this is required if you'll be wanting to acquire assets from multiple projects under one service account."}),"\n",(0,n.jsxs)(t.admonition,{type:"tip",children:[(0,n.jsx)(t.p,{children:"If deploying into GCP, this can be done easily if the Terraform-created role already exists by using the command:"}),(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"gcloud iam roles describe CUSTOM_ROLE_ID --project=YOUR_PROJECT_ID --format=yaml > cado-organization-role.yaml\n"})}),(0,n.jsx)(t.p,{children:"This will output the role to a yaml file, which can be edited to serve as a template for the new organization role. To edit the template for org use delete the 'name' and 'etag' sections, as these will be project specific, then use the command:"}),(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"gcloud iam roles create CUSTOM_ORG_ROLE_ID --organization=YOUR_ORG_ID --file=cado-organization-role.yaml\n"})})]}),"\n",(0,n.jsx)(t.h3,{id:"enabling-the-cloud-build-api-for-the-project",children:"Enabling the Cloud Build API for the project"}),"\n",(0,n.jsxs)(t.p,{children:["To enable Cloud Build API for a Google project, see the documentation at ",(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/cloud-build/",children:"https://console.cloud.google.com/cloud-build/"}),"."]}),"\n",(0,n.jsxs)(t.p,{children:["Once Cloud Build is enabled, a principal for Compute Engine will have been created in ",(0,n.jsx)(t.strong,{children:"'IAM and Admin > IAM'"})," called ",(0,n.jsx)(t.code,{children:"xxxxxxxxxxxx-compute@developer.gserviceaccount.com"}),", we also need this principal to have the custom role we created in the previous step ",(0,n.jsx)(t.strong,{children:"'Customer -> '"}),". Do this by editing the principal with the pen icon on the right and selecting the appropriate role."]}),"\n",(0,n.jsx)(t.h3,{id:"defining-a-bucket-for-the-primary-gcp-project",children:"Defining a bucket for the Primary GCP Project"}),"\n",(0,n.jsxs)(t.p,{children:["Create a bucket in the project that will store the captured raw data from across all GCP projects. For more information ",(0,n.jsx)(t.a,{href:"https://cloud.google.com/storage/docs/creating-buckets",children:"https://cloud.google.com/storage/docs/creating-buckets"})]}),"\n",(0,n.jsx)(t.h2,{id:"setting-up-a-service-account-in-primary-gcp-project",children:"Setting up a Service Account in Primary GCP Project"}),"\n",(0,n.jsx)(t.p,{children:"Next, you need to set up a Service Account in GCP. For information on how to do this more see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/iam-admin/serviceaccounts",children:"https://console.cloud.google.com/iam-admin/serviceaccounts"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/iam/docs/service-accounts",children:"https://cloud.google.com/iam/docs/service-accounts"})}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"required-access",children:"Required Access"}),"\n",(0,n.jsx)(t.p,{children:"Both the Cado service account and the service account for the Cloud API need the custom role's permissions 'Custom -> ' role:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Custom Role",src:o(43442).A+"",width:"1440",height:"958"})}),"\n",(0,n.jsxs)(t.p,{children:["To import GKE containers, the Cado service account also needs the ",(0,n.jsx)(t.code,{children:"iam.serviceAccounts.implicitDelegation"})," IAM permission."]}),"\n",(0,n.jsx)(t.h3,{id:"getting-gcp-credentials",children:"Getting GCP Credentials"}),"\n",(0,n.jsx)(t.p,{children:"When you add credentials to Cado you are creating a mapping from a set of credentials (in GCP json format) to a project name."}),"\n",(0,n.jsx)(t.p,{children:"Any time a user then attempts to access that particular GCP project name, the credentials that you registered in settings will be used. This keeps non-admin users from having to managing credentials themselves, while also allowing access to as many different GCP projects as you want."}),"\n",(0,n.jsx)(t.p,{children:"There are two ways to achieve this:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Service Account Credentials"})," - this is a simpler but less secure approach. ",(0,n.jsx)(t.em,{children:"Note - Cado running in Azure only supports the use of Service Account Credentials"})]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Workload Identity Federation"})," - This requires more expertise but is the recommended, more secure approach."]}),"\n"]}),"\n",(0,n.jsx)(t.h4,{id:"service-account-credentials",children:"Service Account Credentials"}),"\n",(0,n.jsx)(t.p,{children:"The simplest method to add GCP credentials to Cado is to use a service account, which will give you a permanent key. These are very sensitive credentials but they are easy to manage and simple to set up. Adding GCP credentials for service accounts is supported by Cado when deployed in both AWS and Azure."}),"\n",(0,n.jsx)(t.p,{children:"GCP credentials come in a json format that wraps around a \u2018regular\u2019 credential. It can be treated as functionally no different to how you would handle any type of password or key."}),"\n",(0,n.jsxs)(t.p,{children:["For example, a service account key would come in a structure such as the below. The \u2018credential\u2019 is a literal RSA key as a string in the ",(0,n.jsx)(t.code,{children:"private_key"})," field, all other fields are metadata for the benefit of the application that uses it:"]}),"\n",(0,n.jsxs)(t.p,{children:['{\n"type": "service_account",\n"project_id": "cool-project",\n"private_key_id": "22c14ac5b63...",\n"private_key": "-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKg...wggSkA.\\n-----END PRIVATE KEY-----\\n",\n"client_email": "cool-project.iam.gserviceaccount.com",\n"client_id": "...",\n"auth_uri": "',(0,n.jsx)(t.a,{href:"https://accounts.google.com/o/oauth2/auth",children:"https://accounts.google.com/o/oauth2/auth"}),'",\n"token_uri": "',(0,n.jsx)(t.a,{href:"https://oauth2.googleapis.com/token",children:"https://oauth2.googleapis.com/token"}),'",\n"auth_provider_x509_cert_url": "',(0,n.jsx)(t.a,{href:"https://www.googleapis.com/oauth2/v1/certs",children:"https://www.googleapis.com/oauth2/v1/certs"}),'",\n"client_x509_cert_url": "..."\n}']}),"\n",(0,n.jsx)(t.h4,{id:"workload-identity-federation",children:"Workload Identity Federation"}),"\n",(0,n.jsxs)(t.p,{children:["The GCP recommended best practice, is to use Workload Identity Federation, which allows credentials from another app to impersonate a GCP account. ",(0,n.jsx)(t.em,{children:"Note: Cado running in Azure does not support Workload Identity Federation credentials to import from GCP"})]}),"\n",(0,n.jsx)(t.p,{children:"Workload Identity Federation is more secure since the credentials are nothing but metadata telling the app where to go, while the validation is handled on the server side. Adding GCP credentials via Workload Identity Federation is currently only supported for Cado when deployed in AWS."}),"\n",(0,n.jsxs)(t.p,{children:["Rather than give out the key to a service account, you instead register the permission with GCP to allow AWS credentials for account ",(0,n.jsx)(t.code,{children:"123"})," to act as if they were the given GCP service account."]}),"\n",(0,n.jsxs)(t.p,{children:["You can download existing credentials by clicking the display name of the ",(0,n.jsx)(t.strong,{children:"Identity Pool > Connected Service Accounts > Download"}),", which will then ask you which identity\u2019s credentials you would like to download."]}),"\n",(0,n.jsx)(t.p,{children:"For example:"}),"\n",(0,n.jsxs)(t.p,{children:['{\n"type": "external_account",\n"audience": "//iam.googleapis.com/projects/...",\n"subject_token_type": "urn:ietf:params:aws:token-type',":aws4_request",'",\n"service_account_impersonation_url": "',(0,n.jsx)(t.a,{href:"https://...ount.comgenerateAccessToken",children:"https://...ount.comgenerateAccessToken"}),'",','\n"token_url": "',(0,n.jsx)(t.a,{href:"https://sts.googleapis.com/v1/token",children:"https://sts.googleapis.com/v1/token"}),'",\n"credential_source": {\n"environment_id": "...",\n"region_url": "',(0,n.jsx)(t.a,{href:"http://169.254.169.254/latest/meta-data/placement/availability-zone",children:"http://169.254.169.254/latest/meta-data/placement/availability-zone"}),'",\n"url": "',(0,n.jsx)(t.a,{href:"http://169.254.169.254/latest/meta-data/iam/security-credentials",children:"http://169.254.169.254/latest/meta-data/iam/security-credentials"}),'",\n"regional_cred_verification_url": "',(0,n.jsx)(t.a,{href:"https://sts.%7Bregion%7D.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",children:"https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"}),'"\n}\n}']}),"\n",(0,n.jsx)(t.p,{children:"For more information about GCP Workload Identity Federation see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/iam-admin/workload-identity-pools",children:"https://console.cloud.google.com/iam-admin/workload-identity-pools"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/iam/docs/workload-identity-federation",children:"https://cloud.google.com/iam/docs/workload-identity-federation"})}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"entering-settings",children:"Entering Settings"}),"\n",(0,n.jsxs)(t.p,{children:["You can add GCP Credentials to Cado in the ",(0,n.jsx)(t.strong,{children:"Settings > Cloud > GCP"}),' page.\nYou will be asked for a "GCP Project Name" and the "GCP Credentials". These credentials will be a JSON either directly containing the service account credentials, or the Workload Identity Federation credentials']}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"GCP Credentials",src:o(106).A+"",width:"537",height:"305"})}),"\n",(0,n.jsx)(t.h2,{id:"collecting-from-multiple-gcp-projects",children:"Collecting from multiple GCP Projects"}),"\n",(0,n.jsxs)(t.p,{children:["After setting up your Primary GCP Project, to collect from multiple GCP projects follow the instructions in ",(0,n.jsx)(t.a,{href:"/cado/deploy/gcp/gcp-cross-project",children:"GCP Cross-Project Setup"})]})]})}function p(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},106:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gcp-credentials-816d3bf0d3bb101ce25c109263ae445e.png"},43442:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gcp-custom-role-9fd262ae34778b25bbdd9aa284b5c51c.png"},28453:(e,t,o)=>{o.d(t,{R:()=>s,x:()=>r});var n=o(96540);const i={},c=n.createContext(i);function s(e){const t=n.useContext(c);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),n.createElement(c.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7030],{83139:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>s,default:()=>p,frontMatter:()=>c,metadata:()=>r,toc:()=>l});var n=o(74848),i=o(28453);const c={title:"Set-up GCP for collection of data",hide_title:!0,sidebar_position:2},s="How to set up GCP for collection of data by Cado",r={id:"cado/deploy/gcp/gcp-settings",title:"Set-up GCP for collection of data",description:"You can acquire compute and storage resources from GCP with the Cado platform by",source:"@site/docs/cado/deploy/gcp/gcp-settings.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-settings",permalink:"/cado/deploy/gcp/gcp-settings",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-settings.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Set-up GCP for collection of data",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"GCP Terraform deployment",permalink:"/cado/deploy/gcp/gcp-deploy"},next:{title:"Endpoint access",permalink:"/cado/deploy/gcp/endpoints"}},a={},l=[{value:"Setting up the Primary Google Project for Cado collection",id:"setting-up-the-primary-google-project-for-cado-collection",level:2},{value:"The Cado Role",id:"the-cado-role",level:3},{value:"Enabling the Cloud Build API for the project",id:"enabling-the-cloud-build-api-for-the-project",level:3},{value:"Defining a bucket for the Primary GCP Project",id:"defining-a-bucket-for-the-primary-gcp-project",level:3},{value:"Setting up a Service Account in Primary GCP Project",id:"setting-up-a-service-account-in-primary-gcp-project",level:2},{value:"Required Access",id:"required-access",level:3},{value:"Getting GCP Credentials",id:"getting-gcp-credentials",level:3},{value:"Service Account Credentials",id:"service-account-credentials",level:4},{value:"Workload Identity Federation",id:"workload-identity-federation",level:4},{value:"Entering Settings",id:"entering-settings",level:2},{value:"Collecting from multiple GCP Projects",id:"collecting-from-multiple-gcp-projects",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-set-up-gcp-for-collection-of-data-by-cado",children:"How to set up GCP for collection of data by Cado"}),"\n",(0,n.jsx)(t.p,{children:"You can acquire compute and storage resources from GCP with the Cado platform by"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsx)(t.li,{children:"Setting up the primary GCP project for Cado collection"}),"\n",(0,n.jsx)(t.li,{children:"Setting up a Service Account in GCP"}),"\n",(0,n.jsx)(t.li,{children:"Entering credentials into Cado"}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"The below guide walks through this process."}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["This setup can be automated using our ",(0,n.jsx)(t.a,{href:"/cado/deploy/gcp/gcp-auto-setup",children:"GCP Automated Setup"})]})}),"\n",(0,n.jsx)(t.h2,{id:"setting-up-the-primary-google-project-for-cado-collection",children:"Setting up the Primary Google Project for Cado collection"}),"\n",(0,n.jsx)(t.p,{children:"In order to set up the project for Cado collection you need to"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Enable the Cloud Build API for the project"}),"\n",(0,n.jsx)(t.li,{children:"Define a bucket for the Primary GCP Project where images will be stored and imported into Cado."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.em,{children:(0,n.jsxs)(t.strong,{children:["Note - if you are importing from more than one Google project you will need to designate one of those projects as the Primary GCP Project and ",(0,n.jsx)(t.a,{href:"/cado/deploy/gcp/gcp-settings#defining-a-bucket-for-the-primary-gcp-project",children:"create a bucket in that project"})," to enable collection across the multiple Google projects"]})})}),"\n",(0,n.jsx)(t.h3,{id:"the-cado-role",children:"The Cado Role"}),"\n",(0,n.jsxs)(t.p,{children:["To appropriately scope a service account for Cado to operate, creating a custom GCP role allows specifying individual permissions. To achieve this, navigate to the ",(0,n.jsx)(t.strong,{children:"Role"})," section under the ",(0,n.jsx)(t.strong,{children:"IAM and Admin"})," tab. Create a custom role and add the following permissions:"]}),"\n",(0,n.jsx)(t.admonition,{type:"note",children:(0,n.jsxs)(t.p,{children:["If you're deploying into GCP, the Terraform script provided by Cado should have already created this role for you, prefixed with ",(0,n.jsx)(t.strong,{children:"myCadoResponseRole"}),"."]})}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:' // Instance Acquisition\n "cloudbuild.builds.get",\n "cloudbuild.builds.create",\n "compute.disks.get",\n "compute.disks.use",\n "compute.disks.list",\n "compute.disks.useReadOnly",\n "compute.globalOperations.get",\n "compute.images.create",\n "compute.instances.get",\n "compute.instances.list",\n "compute.images.delete",\n "compute.images.get",\n "compute.instances.getSerialPortOutput",\n\n // Compute Management\n "compute.disks.create",\n "compute.disks.setLabels",\n "compute.images.useReadOnly",\n "compute.instances.attachDisk",\n "compute.instances.create",\n "compute.instances.delete",\n "compute.instances.setLabels",\n "compute.instances.setMetadata",\n "compute.instances.setServiceAccount",\n "compute.machineTypes.list",\n "compute.machineTypes.get",\n "compute.regions.get",\n "compute.subnetworks.use",\n "compute.subnetworks.useExternalIp",\n "compute.networks.get",\n "compute.networks.list",\n "compute.zones.list",\n "compute.zoneOperations.get",\n\n\n // Platform Update\n "compute.addresses.use",\n "compute.instances.addAccessConfig",\n "compute.instances.detachDisk",\n "compute.instances.deleteAccessConfig",\n\n // GKE Acquisition\n "container.clusters.get",\n "container.clusters.list",\n "container.pods.exec",\n "container.pods.get",\n "container.pods.list",\n\n // IAM & Authentication\n "iam.serviceAccounts.actAs",\n "iam.serviceAccounts.create",\n "iam.serviceAccounts.enable",\n "iam.serviceAccounts.get",\n "iam.serviceAccounts.getAccessToken",\n "iam.serviceAccounts.getIamPolicy",\n "iam.serviceAccounts.implicitDelegation",\n "iam.serviceAccounts.list",\n "iam.serviceAccounts.signBlob",\n\n // Project Management\n "resourcemanager.projects.get",\n "compute.projects.get",\n\n // Secret Management\n "secretmanager.versions.access",\n "secretmanager.versions.add",\n "secretmanager.secrets.create",\n\n // Bucket Acquisition\n "storage.buckets.get",\n "storage.buckets.list",\n "storage.objects.create",\n "storage.objects.delete",\n "storage.objects.get",\n "storage.objects.list",\n'})}),"\n",(0,n.jsx)(t.p,{children:"If you'll be wanting to use this Role across multiple projects, you can create it at the Organization level- this is required if you'll be wanting to acquire assets from multiple projects under one service account."}),"\n",(0,n.jsxs)(t.admonition,{type:"tip",children:[(0,n.jsx)(t.p,{children:"If deploying into GCP, this can be done easily if the Terraform-created role already exists by using the command:"}),(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"gcloud iam roles describe CUSTOM_ROLE_ID --project=YOUR_PROJECT_ID --format=yaml > cado-organization-role.yaml\n"})}),(0,n.jsx)(t.p,{children:"This will output the role to a yaml file, which can be edited to serve as a template for the new organization role. To edit the template for org use delete the 'name' and 'etag' sections, as these will be project specific, then use the command:"}),(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"gcloud iam roles create CUSTOM_ORG_ROLE_ID --organization=YOUR_ORG_ID --file=cado-organization-role.yaml\n"})})]}),"\n",(0,n.jsx)(t.h3,{id:"enabling-the-cloud-build-api-for-the-project",children:"Enabling the Cloud Build API for the project"}),"\n",(0,n.jsxs)(t.p,{children:["To enable Cloud Build API for a Google project, see the documentation at ",(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/cloud-build/",children:"https://console.cloud.google.com/cloud-build/"}),"."]}),"\n",(0,n.jsxs)(t.p,{children:["Once Cloud Build is enabled, a principal for Compute Engine will have been created in ",(0,n.jsx)(t.strong,{children:"'IAM and Admin > IAM'"})," called ",(0,n.jsx)(t.code,{children:"xxxxxxxxxxxx-compute@developer.gserviceaccount.com"}),", we also need this principal to have the custom role we created in the previous step ",(0,n.jsx)(t.strong,{children:"'Customer -> '"}),". Do this by editing the principal with the pen icon on the right and selecting the appropriate role."]}),"\n",(0,n.jsx)(t.h3,{id:"defining-a-bucket-for-the-primary-gcp-project",children:"Defining a bucket for the Primary GCP Project"}),"\n",(0,n.jsxs)(t.p,{children:["Create a bucket in the project that will store the captured raw data from across all GCP projects. For more information ",(0,n.jsx)(t.a,{href:"https://cloud.google.com/storage/docs/creating-buckets",children:"https://cloud.google.com/storage/docs/creating-buckets"})]}),"\n",(0,n.jsx)(t.h2,{id:"setting-up-a-service-account-in-primary-gcp-project",children:"Setting up a Service Account in Primary GCP Project"}),"\n",(0,n.jsx)(t.p,{children:"Next, you need to set up a Service Account in GCP. For information on how to do this more see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/iam-admin/serviceaccounts",children:"https://console.cloud.google.com/iam-admin/serviceaccounts"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/iam/docs/service-accounts",children:"https://cloud.google.com/iam/docs/service-accounts"})}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"required-access",children:"Required Access"}),"\n",(0,n.jsx)(t.p,{children:"Both the Cado service account and the service account for the Cloud API need the custom role's permissions 'Custom -> ' role:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Custom Role",src:o(43442).A+"",width:"1440",height:"958"})}),"\n",(0,n.jsxs)(t.p,{children:["To import GKE containers, the Cado service account also needs the ",(0,n.jsx)(t.code,{children:"iam.serviceAccounts.implicitDelegation"})," IAM permission."]}),"\n",(0,n.jsx)(t.h3,{id:"getting-gcp-credentials",children:"Getting GCP Credentials"}),"\n",(0,n.jsx)(t.p,{children:"When you add credentials to Cado you are creating a mapping from a set of credentials (in GCP json format) to a project name."}),"\n",(0,n.jsx)(t.p,{children:"Any time a user then attempts to access that particular GCP project name, the credentials that you registered in settings will be used. This keeps non-admin users from having to managing credentials themselves, while also allowing access to as many different GCP projects as you want."}),"\n",(0,n.jsx)(t.p,{children:"There are two ways to achieve this:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Service Account Credentials"})," - this is a simpler but less secure approach. ",(0,n.jsx)(t.em,{children:"Note - Cado running in Azure only supports the use of Service Account Credentials"})]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Workload Identity Federation"})," - This requires more expertise but is the recommended, more secure approach."]}),"\n"]}),"\n",(0,n.jsx)(t.h4,{id:"service-account-credentials",children:"Service Account Credentials"}),"\n",(0,n.jsx)(t.p,{children:"The simplest method to add GCP credentials to Cado is to use a service account, which will give you a permanent key. These are very sensitive credentials but they are easy to manage and simple to set up. Adding GCP credentials for service accounts is supported by Cado when deployed in both AWS and Azure."}),"\n",(0,n.jsx)(t.p,{children:"GCP credentials come in a json format that wraps around a \u2018regular\u2019 credential. It can be treated as functionally no different to how you would handle any type of password or key."}),"\n",(0,n.jsxs)(t.p,{children:["For example, a service account key would come in a structure such as the below. The \u2018credential\u2019 is a literal RSA key as a string in the ",(0,n.jsx)(t.code,{children:"private_key"})," field, all other fields are metadata for the benefit of the application that uses it:"]}),"\n",(0,n.jsxs)(t.p,{children:['{\n"type": "service_account",\n"project_id": "cool-project",\n"private_key_id": "22c14ac5b63...",\n"private_key": "-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKg...wggSkA.\\n-----END PRIVATE KEY-----\\n",\n"client_email": "cool-project.iam.gserviceaccount.com",\n"client_id": "...",\n"auth_uri": "',(0,n.jsx)(t.a,{href:"https://accounts.google.com/o/oauth2/auth",children:"https://accounts.google.com/o/oauth2/auth"}),'",\n"token_uri": "',(0,n.jsx)(t.a,{href:"https://oauth2.googleapis.com/token",children:"https://oauth2.googleapis.com/token"}),'",\n"auth_provider_x509_cert_url": "',(0,n.jsx)(t.a,{href:"https://www.googleapis.com/oauth2/v1/certs",children:"https://www.googleapis.com/oauth2/v1/certs"}),'",\n"client_x509_cert_url": "..."\n}']}),"\n",(0,n.jsx)(t.h4,{id:"workload-identity-federation",children:"Workload Identity Federation"}),"\n",(0,n.jsxs)(t.p,{children:["The GCP recommended best practice, is to use Workload Identity Federation, which allows credentials from another app to impersonate a GCP account. ",(0,n.jsx)(t.em,{children:"Note: Cado running in Azure does not support Workload Identity Federation credentials to import from GCP"})]}),"\n",(0,n.jsx)(t.p,{children:"Workload Identity Federation is more secure since the credentials are nothing but metadata telling the app where to go, while the validation is handled on the server side. Adding GCP credentials via Workload Identity Federation is currently only supported for Cado when deployed in AWS."}),"\n",(0,n.jsxs)(t.p,{children:["Rather than give out the key to a service account, you instead register the permission with GCP to allow AWS credentials for account ",(0,n.jsx)(t.code,{children:"123"})," to act as if they were the given GCP service account."]}),"\n",(0,n.jsxs)(t.p,{children:["You can download existing credentials by clicking the display name of the ",(0,n.jsx)(t.strong,{children:"Identity Pool > Connected Service Accounts > Download"}),", which will then ask you which identity\u2019s credentials you would like to download."]}),"\n",(0,n.jsx)(t.p,{children:"For example:"}),"\n",(0,n.jsxs)(t.p,{children:['{\n"type": "external_account",\n"audience": "//iam.googleapis.com/projects/...",\n"subject_token_type": "urn:ietf:params:aws:token-type',":aws4_request",'",\n"service_account_impersonation_url": "',(0,n.jsx)(t.a,{href:"https://...ount.comgenerateAccessToken",children:"https://...ount.comgenerateAccessToken"}),'",','\n"token_url": "',(0,n.jsx)(t.a,{href:"https://sts.googleapis.com/v1/token",children:"https://sts.googleapis.com/v1/token"}),'",\n"credential_source": {\n"environment_id": "...",\n"region_url": "',(0,n.jsx)(t.a,{href:"http://169.254.169.254/latest/meta-data/placement/availability-zone",children:"http://169.254.169.254/latest/meta-data/placement/availability-zone"}),'",\n"url": "',(0,n.jsx)(t.a,{href:"http://169.254.169.254/latest/meta-data/iam/security-credentials",children:"http://169.254.169.254/latest/meta-data/iam/security-credentials"}),'",\n"regional_cred_verification_url": "',(0,n.jsx)(t.a,{href:"https://sts.%7Bregion%7D.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",children:"https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"}),'"\n}\n}']}),"\n",(0,n.jsx)(t.p,{children:"For more information about GCP Workload Identity Federation see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/iam-admin/workload-identity-pools",children:"https://console.cloud.google.com/iam-admin/workload-identity-pools"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/iam/docs/workload-identity-federation",children:"https://cloud.google.com/iam/docs/workload-identity-federation"})}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"entering-settings",children:"Entering Settings"}),"\n",(0,n.jsxs)(t.p,{children:["You can add GCP Credentials to Cado in the ",(0,n.jsx)(t.strong,{children:"Settings > Cloud > GCP"}),' page.\nYou will be asked for a "GCP Project Name" and the "GCP Credentials". These credentials will be a JSON either directly containing the service account credentials, or the Workload Identity Federation credentials']}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"GCP Credentials",src:o(106).A+"",width:"537",height:"305"})}),"\n",(0,n.jsx)(t.h2,{id:"collecting-from-multiple-gcp-projects",children:"Collecting from multiple GCP Projects"}),"\n",(0,n.jsxs)(t.p,{children:["After setting up your Primary GCP Project, to collect from multiple GCP projects follow the instructions in ",(0,n.jsx)(t.a,{href:"/cado/deploy/gcp/gcp-cross-project",children:"GCP Cross-Project Setup"})]})]})}function p(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},106:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gcp-credentials-816d3bf0d3bb101ce25c109263ae445e.png"},43442:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gcp-custom-role-9fd262ae34778b25bbdd9aa284b5c51c.png"},28453:(e,t,o)=>{o.d(t,{R:()=>s,x:()=>r});var n=o(96540);const i={},c=n.createContext(i);function s(e){const t=n.useContext(c);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),n.createElement(c.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/3c11cd59.c5df6f23.js b/assets/js/3c11cd59.11edd61c.js similarity index 98% rename from assets/js/3c11cd59.c5df6f23.js rename to assets/js/3c11cd59.11edd61c.js index cc171a4ce..5aa343a39 100644 --- a/assets/js/3c11cd59.c5df6f23.js +++ b/assets/js/3c11cd59.11edd61c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[588],{35577:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>i,default:()=>h,frontMatter:()=>r,metadata:()=>c,toc:()=>d});var n=o(74848),s=o(28453);const r={title:"RedHat Openshift",hide_title:!0,sidebar_position:8},i="How to Import Data from RedHat OpenShift",c={id:"cado/discovery-import/openshift",title:"RedHat Openshift",description:"To import data from RedHat OpenShift, follow these steps:",source:"@site/docs/cado/discovery-import/openshift.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/openshift",permalink:"/cado/discovery-import/openshift",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/openshift.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"RedHat Openshift",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"XDR platforms",permalink:"/cado/discovery-import/xdr"},next:{title:"Kubernetes",permalink:"/cado/discovery-import/kubernetes"}},a={},d=[];function p(e){const t={br:"br",code:"code",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-import-data-from-redhat-openshift",children:"How to Import Data from RedHat OpenShift"}),"\n",(0,n.jsx)(t.p,{children:"To import data from RedHat OpenShift, follow these steps:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Generate a Collection Script"}),":",(0,n.jsx)(t.br,{}),"\n","First, generate a Cado Host collection script by navigating to ",(0,n.jsx)(t.strong,{children:"Import > Cado Host"})," in the Cado platform."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Execute the Script on the Target Container"}),":",(0,n.jsx)(t.br,{}),"\n","Use the commands below to execute the script on the desired container within OpenShift:"]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"oc login --token=sha256~... --server=https://api.system.openshiftapps.com:443\noc exec pod-name -c container-name -- mkdir -p /tmp/cado-host\noc exec pod-name -c container-name -- curl -s https://cado-public.s3-accelerate.amazonaws.com/cado-host/v1.5.4/linux/cado-host --output /tmp/cado-host/cado-host\noc exec pod-name -c container-name -- chmod +x /tmp/cado-host/cado-host\noc exec pod-name -c container-name -- /tmp/cado-host/cado-host --presigned_data ...\n"})}),"\n",(0,n.jsxs)(t.p,{children:["Replace ",(0,n.jsx)(t.code,{children:"pod-name"}),", ",(0,n.jsx)(t.code,{children:"container-name"}),", and ",(0,n.jsx)(t.code,{children:"--presigned_data"})," with the relevant values from your setup."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"OpenShift",src:o(6829).A+"",width:"1728",height:"482"})})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},6829:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/openshift-a16dfd025c2c2fbe34cf31afc1523e2e.png"},28453:(e,t,o)=>{o.d(t,{R:()=>i,x:()=>c});var n=o(96540);const s={},r=n.createContext(s);function i(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[588],{35577:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>i,default:()=>h,frontMatter:()=>r,metadata:()=>c,toc:()=>d});var n=o(74848),s=o(28453);const r={title:"RedHat Openshift",hide_title:!0,sidebar_position:8},i="How to Import Data from RedHat OpenShift",c={id:"cado/discovery-import/openshift",title:"RedHat Openshift",description:"To import data from RedHat OpenShift, follow these steps:",source:"@site/docs/cado/discovery-import/openshift.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/openshift",permalink:"/cado/discovery-import/openshift",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/openshift.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"RedHat Openshift",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"XDR platforms",permalink:"/cado/discovery-import/xdr"},next:{title:"Kubernetes",permalink:"/cado/discovery-import/kubernetes"}},a={},d=[];function p(e){const t={br:"br",code:"code",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-import-data-from-redhat-openshift",children:"How to Import Data from RedHat OpenShift"}),"\n",(0,n.jsx)(t.p,{children:"To import data from RedHat OpenShift, follow these steps:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Generate a Collection Script"}),":",(0,n.jsx)(t.br,{}),"\n","First, generate a Cado Host collection script by navigating to ",(0,n.jsx)(t.strong,{children:"Import > Cado Host"})," in the Cado platform."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Execute the Script on the Target Container"}),":",(0,n.jsx)(t.br,{}),"\n","Use the commands below to execute the script on the desired container within OpenShift:"]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"oc login --token=sha256~... --server=https://api.system.openshiftapps.com:443\noc exec pod-name -c container-name -- mkdir -p /tmp/cado-host\noc exec pod-name -c container-name -- curl -s https://cado-public.s3-accelerate.amazonaws.com/cado-host/v1.5.4/linux/cado-host --output /tmp/cado-host/cado-host\noc exec pod-name -c container-name -- chmod +x /tmp/cado-host/cado-host\noc exec pod-name -c container-name -- /tmp/cado-host/cado-host --presigned_data ...\n"})}),"\n",(0,n.jsxs)(t.p,{children:["Replace ",(0,n.jsx)(t.code,{children:"pod-name"}),", ",(0,n.jsx)(t.code,{children:"container-name"}),", and ",(0,n.jsx)(t.code,{children:"--presigned_data"})," with the relevant values from your setup."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"OpenShift",src:o(6829).A+"",width:"1728",height:"482"})})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},6829:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/openshift-a16dfd025c2c2fbe34cf31afc1523e2e.png"},28453:(e,t,o)=>{o.d(t,{R:()=>i,x:()=>c});var n=o(96540);const s={},r=n.createContext(s);function i(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/41e311c1.696b6921.js b/assets/js/41e311c1.41876f51.js similarity index 98% rename from assets/js/41e311c1.696b6921.js rename to assets/js/41e311c1.41876f51.js index bec043683..7c5ffbb2a 100644 --- a/assets/js/41e311c1.696b6921.js +++ b/assets/js/41e311c1.41876f51.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[852],{62790:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>r,contentTitle:()=>a,default:()=>d,frontMatter:()=>s,metadata:()=>c,toc:()=>l});var n=i(74848),o=i(28453);const s={title:"Monitor platform health",hide_title:!0,sidebar_position:11},a="How to Monitor the Platform Health",c={id:"cado/manage/monitoring",title:"Monitor platform health",description:"Cado provides two types of checks to help users monitor the platform's health and proper functioning: Platform Check and Account Check.",source:"@site/docs/cado/manage/monitoring.md",sourceDirName:"cado/manage",slug:"/cado/manage/monitoring",permalink:"/cado/manage/monitoring",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/monitoring.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:11,frontMatter:{title:"Monitor platform health",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Cost estimates",permalink:"/cado/manage/cost-management"},next:{title:"Platform security",permalink:"/cado/manage/platform-security"}},r={},l=[{value:"Platform Check",id:"platform-check",level:2},{value:"Account Check",id:"account-check",level:2},{value:"Account Check Permissions",id:"account-check-permissions",level:3}];function h(e){const t={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-monitor-the-platform-health",children:"How to Monitor the Platform Health"}),"\n",(0,n.jsxs)(t.p,{children:["Cado provides two types of checks to help users monitor the platform's health and proper functioning: ",(0,n.jsx)(t.a,{href:"/cado/manage/monitoring#platform-check",children:"Platform Check"})," and ",(0,n.jsx)(t.a,{href:"/cado/manage/monitoring#account-check",children:"Account Check"}),"."]}),"\n",(0,n.jsxs)(t.p,{children:["Additionally, you can view the overall platform health and statistics by navigating to the ",(0,n.jsx)(t.strong,{children:"Platform"})," tab. This section displays information such as Free Disk Space, Available Memory, Total Memory, CPU Usage, and pipeline processing details. The roundtrip response time for the API ",(0,n.jsx)(t.code,{children:"/api/v2/system/status"})," should be less than or equal to 200ms for optimal performance."]}),"\n",(0,n.jsx)(t.p,{children:"For best results, maintaining maximum uptime of the Cado platform is recommended. Frequently shutting down the platform can cause database issues, so avoid doing this whenever possible."}),"\n",(0,n.jsx)(t.h2,{id:"platform-check",children:"Platform Check"}),"\n",(0,n.jsxs)(t.p,{children:["For a more in-depth assessment, you can run a Platform Check by navigating to ",(0,n.jsx)(t.strong,{children:"/platform"})," and clicking the ",(0,n.jsx)(t.strong,{children:"Run a Platform Check"})," button. This initiates a health check pipeline, which performs several tasks, including:"]}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Testing outbound connectivity."}),"\n",(0,n.jsx)(t.li,{children:"Validating the Cado Host download location."}),"\n",(0,n.jsx)(t.li,{children:"Verifying worker spin-up and shutdown."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Platform Check",src:i(33585).A+"",width:"1908",height:"628"})}),"\n",(0,n.jsx)(t.p,{children:"You can expand the pipeline to view the status of each task, allowing you to diagnose any issues. For example, if the Policy Simulation check task fails, you can expand it to view detailed error messages."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Platform Check Result",src:i(98051).A+"",width:"1831",height:"805"})}),"\n",(0,n.jsx)(t.h2,{id:"account-check",children:"Account Check"}),"\n",(0,n.jsxs)(t.p,{children:["To verify account-based settings, navigate to ",(0,n.jsx)(t.strong,{children:"/settings/cloud"}),", select an account, and click the ",(0,n.jsx)(t.strong,{children:"Run Account Check"})," button. This will perform a permissions and policy simulation check, ensuring that the correct permissions are in place for successful data acquisition. Account Checks can be run on both the account where Cado is deployed and any cross-accounts."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Account Check",src:i(89829).A+"",width:"1567",height:"874"})}),"\n",(0,n.jsx)(t.p,{children:"Like the Platform Check, the Account Check will create a pipeline where tasks can be inspected to diagnose any issues that arise during the process."}),"\n",(0,n.jsx)(t.h3,{id:"account-check-permissions",children:"Account Check Permissions"}),"\n",(0,n.jsx)(t.p,{children:"These require:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-json",children:'{\n\t\t\t"Effect": "Allow",\n\t\t\t"Resource": "*",\n\t\t\t"Action": [\n\t\t\t"iam:ListRolePolicies",\n\t\t\t"iam:GetPolicy",\n\t\t\t"iam:GetRolePolicy",\n\t\t\t"iam:GetPolicyVersion",\n\t\t\t"iam:SimulatePrincipalPolicy"\n\t\t\t],\n\t\t\t"Sid": "RequiredToCheckPolicy"\n}\n'})}),"\n",(0,n.jsx)(t.p,{children:"Or in Yaml format:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-yaml",children:'- Effect: Allow\n Resource: "*"\n Action:\n - iam:ListRolePolicies\n - iam:GetPolicy\n - iam:GetRolePolicy\n - iam:GetPolicyVersion\n - iam:SimulatePrincipalPolicy\n Sid: RequiredToCheckPolicy\n'})}),"\n",(0,n.jsx)(t.p,{children:"The permissions are required to run the Account Check. The permissions are used as follows:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["iam",":ListRolePolicies"," is used to get all the policies associated with your cross-account role."]}),"\n",(0,n.jsxs)(t.li,{children:["iam",":GetRolePolicy"," is used to get the permissions associated with the policies retrieved above. These permissions are used for a permission check that determines if the policies required by Cado Response match those specified in our template. We check against the permissions that are specified in our cross-account template."]}),"\n",(0,n.jsxs)(t.li,{children:["iam",":SimulatePrincipalPolicy"," is used to run an AWS policy simulation against your role, for the permissions required by Cado Response. These are run against the permissions specified in our cross account template."]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"If the above permissions aren\u2019t added to your Cross-Account role, the Cross-Account checks, if run - will fail."}),"\n",(0,n.jsx)(t.p,{children:"Adding these permissions, however, it is optional - if you do not intend to run Cross-Account checks, this will not impact your Cado instance."}),"\n",(0,n.jsx)(t.p,{children:"If you decide to run the checks without updating the permissions, then they will fail, but this should not affect the platform functionality."})]})}function d(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(h,{...e})}):h(e)}},89829:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/manage-account-check-3fa1557f4fe9813821907a388487dbac.png"},98051:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/manage-platform-check-result-ebc5572096453d669a8a839dfe45cee1.png"},33585:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/manage-platform-check-d0b9464363fdee0f88167da7822fe052.png"},28453:(e,t,i)=>{i.d(t,{R:()=>a,x:()=>c});var n=i(96540);const o={},s=n.createContext(o);function a(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[852],{62790:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>r,contentTitle:()=>a,default:()=>d,frontMatter:()=>s,metadata:()=>c,toc:()=>l});var n=i(74848),o=i(28453);const s={title:"Monitor platform health",hide_title:!0,sidebar_position:11},a="How to Monitor the Platform Health",c={id:"cado/manage/monitoring",title:"Monitor platform health",description:"Cado provides two types of checks to help users monitor the platform's health and proper functioning: Platform Check and Account Check.",source:"@site/docs/cado/manage/monitoring.md",sourceDirName:"cado/manage",slug:"/cado/manage/monitoring",permalink:"/cado/manage/monitoring",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/monitoring.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:11,frontMatter:{title:"Monitor platform health",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Cost estimates",permalink:"/cado/manage/cost-management"},next:{title:"Platform security",permalink:"/cado/manage/platform-security"}},r={},l=[{value:"Platform Check",id:"platform-check",level:2},{value:"Account Check",id:"account-check",level:2},{value:"Account Check Permissions",id:"account-check-permissions",level:3}];function h(e){const t={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-monitor-the-platform-health",children:"How to Monitor the Platform Health"}),"\n",(0,n.jsxs)(t.p,{children:["Cado provides two types of checks to help users monitor the platform's health and proper functioning: ",(0,n.jsx)(t.a,{href:"/cado/manage/monitoring#platform-check",children:"Platform Check"})," and ",(0,n.jsx)(t.a,{href:"/cado/manage/monitoring#account-check",children:"Account Check"}),"."]}),"\n",(0,n.jsxs)(t.p,{children:["Additionally, you can view the overall platform health and statistics by navigating to the ",(0,n.jsx)(t.strong,{children:"Platform"})," tab. This section displays information such as Free Disk Space, Available Memory, Total Memory, CPU Usage, and pipeline processing details. The roundtrip response time for the API ",(0,n.jsx)(t.code,{children:"/api/v2/system/status"})," should be less than or equal to 200ms for optimal performance."]}),"\n",(0,n.jsx)(t.p,{children:"For best results, maintaining maximum uptime of the Cado platform is recommended. Frequently shutting down the platform can cause database issues, so avoid doing this whenever possible."}),"\n",(0,n.jsx)(t.h2,{id:"platform-check",children:"Platform Check"}),"\n",(0,n.jsxs)(t.p,{children:["For a more in-depth assessment, you can run a Platform Check by navigating to ",(0,n.jsx)(t.strong,{children:"/platform"})," and clicking the ",(0,n.jsx)(t.strong,{children:"Run a Platform Check"})," button. This initiates a health check pipeline, which performs several tasks, including:"]}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Testing outbound connectivity."}),"\n",(0,n.jsx)(t.li,{children:"Validating the Cado Host download location."}),"\n",(0,n.jsx)(t.li,{children:"Verifying worker spin-up and shutdown."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Platform Check",src:i(33585).A+"",width:"1908",height:"628"})}),"\n",(0,n.jsx)(t.p,{children:"You can expand the pipeline to view the status of each task, allowing you to diagnose any issues. For example, if the Policy Simulation check task fails, you can expand it to view detailed error messages."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Platform Check Result",src:i(98051).A+"",width:"1831",height:"805"})}),"\n",(0,n.jsx)(t.h2,{id:"account-check",children:"Account Check"}),"\n",(0,n.jsxs)(t.p,{children:["To verify account-based settings, navigate to ",(0,n.jsx)(t.strong,{children:"/settings/cloud"}),", select an account, and click the ",(0,n.jsx)(t.strong,{children:"Run Account Check"})," button. This will perform a permissions and policy simulation check, ensuring that the correct permissions are in place for successful data acquisition. Account Checks can be run on both the account where Cado is deployed and any cross-accounts."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Account Check",src:i(89829).A+"",width:"1567",height:"874"})}),"\n",(0,n.jsx)(t.p,{children:"Like the Platform Check, the Account Check will create a pipeline where tasks can be inspected to diagnose any issues that arise during the process."}),"\n",(0,n.jsx)(t.h3,{id:"account-check-permissions",children:"Account Check Permissions"}),"\n",(0,n.jsx)(t.p,{children:"These require:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-json",children:'{\n\t\t\t"Effect": "Allow",\n\t\t\t"Resource": "*",\n\t\t\t"Action": [\n\t\t\t"iam:ListRolePolicies",\n\t\t\t"iam:GetPolicy",\n\t\t\t"iam:GetRolePolicy",\n\t\t\t"iam:GetPolicyVersion",\n\t\t\t"iam:SimulatePrincipalPolicy"\n\t\t\t],\n\t\t\t"Sid": "RequiredToCheckPolicy"\n}\n'})}),"\n",(0,n.jsx)(t.p,{children:"Or in Yaml format:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-yaml",children:'- Effect: Allow\n Resource: "*"\n Action:\n - iam:ListRolePolicies\n - iam:GetPolicy\n - iam:GetRolePolicy\n - iam:GetPolicyVersion\n - iam:SimulatePrincipalPolicy\n Sid: RequiredToCheckPolicy\n'})}),"\n",(0,n.jsx)(t.p,{children:"The permissions are required to run the Account Check. The permissions are used as follows:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["iam",":ListRolePolicies"," is used to get all the policies associated with your cross-account role."]}),"\n",(0,n.jsxs)(t.li,{children:["iam",":GetRolePolicy"," is used to get the permissions associated with the policies retrieved above. These permissions are used for a permission check that determines if the policies required by Cado Response match those specified in our template. We check against the permissions that are specified in our cross-account template."]}),"\n",(0,n.jsxs)(t.li,{children:["iam",":SimulatePrincipalPolicy"," is used to run an AWS policy simulation against your role, for the permissions required by Cado Response. These are run against the permissions specified in our cross account template."]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"If the above permissions aren\u2019t added to your Cross-Account role, the Cross-Account checks, if run - will fail."}),"\n",(0,n.jsx)(t.p,{children:"Adding these permissions, however, it is optional - if you do not intend to run Cross-Account checks, this will not impact your Cado instance."}),"\n",(0,n.jsx)(t.p,{children:"If you decide to run the checks without updating the permissions, then they will fail, but this should not affect the platform functionality."})]})}function d(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(h,{...e})}):h(e)}},89829:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/manage-account-check-3fa1557f4fe9813821907a388487dbac.png"},98051:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/manage-platform-check-result-ebc5572096453d669a8a839dfe45cee1.png"},33585:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/manage-platform-check-d0b9464363fdee0f88167da7822fe052.png"},28453:(e,t,i)=>{i.d(t,{R:()=>a,x:()=>c});var n=i(96540);const o={},s=n.createContext(o);function a(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/45ce7214.8290cc0c.js b/assets/js/45ce7214.c49c4a96.js similarity index 95% rename from assets/js/45ce7214.8290cc0c.js rename to assets/js/45ce7214.c49c4a96.js index e8992112b..bff7da189 100644 --- a/assets/js/45ce7214.8290cc0c.js +++ b/assets/js/45ce7214.c49c4a96.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[118],{55191:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>i,default:()=>l,frontMatter:()=>s,metadata:()=>r,toc:()=>d});var n=o(74848),c=o(28453);const s={title:"Dedicated forensics account",hide_title:!0,sidebar_position:4},i="What is a dedicated forensics account?",r={id:"cado/deploy/aws/security/forensics-account",title:"Dedicated forensics account",description:"You may choose to deploy into an AWS account dedicated to storing forensics data securely.",source:"@site/docs/cado/deploy/aws/security/forensics-account.md",sourceDirName:"cado/deploy/aws/security",slug:"/cado/deploy/aws/security/forensics-account",permalink:"/cado/deploy/aws/security/forensics-account",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/security/forensics-account.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Dedicated forensics account",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Platform encryption in AWS",permalink:"/cado/deploy/aws/security/data-encryption-overview"},next:{title:"Backup and recover",permalink:"/cado/deploy/aws/performance-resiliency/aws-backups"}},a={},d=[];function u(e){const t={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,c.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-is-a-dedicated-forensics-account",children:"What is a dedicated forensics account?"}),"\n",(0,n.jsx)(t.p,{children:"You may choose to deploy into an AWS account dedicated to storing forensics data securely."}),"\n",(0,n.jsx)(t.p,{children:"You can then use cross-account roles to bring data into the forensics account. Cado copies data back into the forensics account, and performs processing there."}),"\n",(0,n.jsx)(t.p,{children:"For more on this best practice, see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.a,{href:"https://aws.amazon.com/blogs/security/forensic-investigation-environment-strategies-in-the-aws-cloud/",children:"Forensic investigation environment strategies in the AWS Cloud"}),"."]}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/architecture/example-scenario/forensics/",children:"Computer forensics chain of custody in Azure"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/blog/products/identity-security/how-to-use-live-forensics-to-analyze-a-cyberattack",children:"How to conduct live network forensics in GCP"})}),"\n"]})]})}function l(e={}){const{wrapper:t}={...(0,c.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(u,{...e})}):u(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>i,x:()=>r});var n=o(96540);const c={},s=n.createContext(c);function i(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:i(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[118],{55191:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>i,default:()=>l,frontMatter:()=>s,metadata:()=>r,toc:()=>d});var n=o(74848),c=o(28453);const s={title:"Dedicated forensics account",hide_title:!0,sidebar_position:4},i="What is a dedicated forensics account?",r={id:"cado/deploy/aws/security/forensics-account",title:"Dedicated forensics account",description:"You may choose to deploy into an AWS account dedicated to storing forensics data securely.",source:"@site/docs/cado/deploy/aws/security/forensics-account.md",sourceDirName:"cado/deploy/aws/security",slug:"/cado/deploy/aws/security/forensics-account",permalink:"/cado/deploy/aws/security/forensics-account",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/security/forensics-account.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Dedicated forensics account",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Platform encryption in AWS",permalink:"/cado/deploy/aws/security/data-encryption-overview"},next:{title:"Backup and recover",permalink:"/cado/deploy/aws/performance-resiliency/aws-backups"}},a={},d=[];function u(e){const t={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,c.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-is-a-dedicated-forensics-account",children:"What is a dedicated forensics account?"}),"\n",(0,n.jsx)(t.p,{children:"You may choose to deploy into an AWS account dedicated to storing forensics data securely."}),"\n",(0,n.jsx)(t.p,{children:"You can then use cross-account roles to bring data into the forensics account. Cado copies data back into the forensics account, and performs processing there."}),"\n",(0,n.jsx)(t.p,{children:"For more on this best practice, see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.a,{href:"https://aws.amazon.com/blogs/security/forensic-investigation-environment-strategies-in-the-aws-cloud/",children:"Forensic investigation environment strategies in the AWS Cloud"}),"."]}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/architecture/example-scenario/forensics/",children:"Computer forensics chain of custody in Azure"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/blog/products/identity-security/how-to-use-live-forensics-to-analyze-a-cyberattack",children:"How to conduct live network forensics in GCP"})}),"\n"]})]})}function l(e={}){const{wrapper:t}={...(0,c.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(u,{...e})}):u(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>i,x:()=>r});var n=o(96540);const c={},s=n.createContext(c);function i(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:i(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/46b41660.f44e018d.js b/assets/js/46b41660.cf2fb45a.js similarity index 97% rename from assets/js/46b41660.f44e018d.js rename to assets/js/46b41660.cf2fb45a.js index f4223d7b9..1b2655829 100644 --- a/assets/js/46b41660.f44e018d.js +++ b/assets/js/46b41660.cf2fb45a.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6740],{14636:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>r,toc:()=>c});var i=n(74848),o=n(28453);const s={title:"API overview",hide_title:!0,sidebar_position:1},a="How to Use the Cado API",r={id:"cado/integrations/api-overview",title:"API overview",description:"The Cado API allows third-party tools and automation scripts to interact seamlessly with the Cado platform. You can use the API, along with pre-built integrations, to perform tasks like:",source:"@site/docs/cado/integrations/api-overview.md",sourceDirName:"cado/integrations",slug:"/cado/integrations/api-overview",permalink:"/cado/integrations/api-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/api-overview.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"API overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Managing investigations",permalink:"/cado/discovery-import/investigations"},next:{title:"Export to on-premise forensic tools",permalink:"/cado/integrations/forensic-tools"}},l={},c=[{value:"Creating and Storing an API Access Key",id:"creating-and-storing-an-api-access-key",level:3},{value:"Platform Base URL",id:"platform-base-url",level:3},{value:"Full API Documentation",id:"full-api-documentation",level:3}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-use-the-cado-api",children:"How to Use the Cado API"}),"\n",(0,i.jsx)(t.p,{children:"The Cado API allows third-party tools and automation scripts to interact seamlessly with the Cado platform. You can use the API, along with pre-built integrations, to perform tasks like:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Triggering platform operations (e.g., acquiring instances from your cloud environments)"}),"\n",(0,i.jsx)(t.li,{children:"Retrieving captured data (e.g., suspicious events)"}),"\n",(0,i.jsx)(t.li,{children:"Managing and controlling investigations"}),"\n",(0,i.jsx)(t.li,{children:"And more"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"This guide will walk you through the essential steps to onboard and integrate with the Cado API."}),"\n",(0,i.jsx)(t.h3,{id:"creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"}),"\n",(0,i.jsx)(t.p,{children:"To access the Cado API, you\u2019ll need to authenticate with a valid API Key. Follow these steps to generate an API Key within the Cado platform:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Settings"})," in the bottom-left corner, then click on the ",(0,i.jsx)(t.strong,{children:"API"})," tab."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"API Settings Page",src:n(62201).A+"",width:"2524",height:"1328"})}),"\n",(0,i.jsxs)(t.ol,{start:"2",children:["\n",(0,i.jsxs)(t.li,{children:["Under the ",(0,i.jsx)(t.strong,{children:"API Keys"})," section, click the ",(0,i.jsx)(t.strong,{children:"Create New API Key"})," button."]}),"\n",(0,i.jsxs)(t.li,{children:["Copy the ",(0,i.jsx)(t.strong,{children:"Public Key"}),". This key serves as the identifier for the API Key, which can be used later to revoke access if needed."]}),"\n",(0,i.jsxs)(t.li,{children:["Copy the ",(0,i.jsx)(t.strong,{children:"Secret Key"})," and store it in a secure location (e.g., a password manager). You will not be able to view the Secret Key again after closing the dialog. This key is required when integrating with third-party providers."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Get API Key",src:n(65043).A+"",width:"1779",height:"1025"})}),"\n",(0,i.jsx)(t.p,{children:"The Secret Key functions as the Access Token for authenticating your requests."}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsx)(t.p,{children:"The Secret Key is shown only once. Be sure to save it securely, such as in a password manager."})}),"\n",(0,i.jsx)(t.h3,{id:"platform-base-url",children:"Platform Base URL"}),"\n",(0,i.jsx)(t.p,{children:'In the following tutorials, the term "Platform Base URL" refers to the IP address or domain name where your Cado platform is deployed. For example:'}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{children:"https://ec2example.compute.amazonaws.com\n"})}),"\n",(0,i.jsx)(t.h3,{id:"full-api-documentation",children:"Full API Documentation"}),"\n",(0,i.jsxs)(t.p,{children:["You can find detailed API references and examples for versions V2 and V3 in the ",(0,i.jsx)(t.strong,{children:"API"})," settings page. Additional API examples are available on GitHub: ",(0,i.jsx)(t.a,{href:"https://github.com/cado-security/cado-api-examples",children:"https://github.com/cado-security/cado-api-examples"})]})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},65043:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/api-key-aacf4201d6deb4f8502e39a6d075ed2d.png"},62201:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/api-faab75b4b26c2d4632e297c0b70deef7.png"},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>r});var i=n(96540);const o={},s=i.createContext(o);function a(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6740],{14636:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>r,toc:()=>c});var i=n(74848),o=n(28453);const s={title:"API overview",hide_title:!0,sidebar_position:1},a="How to Use the Cado API",r={id:"cado/integrations/api-overview",title:"API overview",description:"The Cado API allows third-party tools and automation scripts to interact seamlessly with the Cado platform. You can use the API, along with pre-built integrations, to perform tasks like:",source:"@site/docs/cado/integrations/api-overview.md",sourceDirName:"cado/integrations",slug:"/cado/integrations/api-overview",permalink:"/cado/integrations/api-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/api-overview.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"API overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Managing investigations",permalink:"/cado/discovery-import/investigations"},next:{title:"Export to on-premise forensic tools",permalink:"/cado/integrations/forensic-tools"}},l={},c=[{value:"Creating and Storing an API Access Key",id:"creating-and-storing-an-api-access-key",level:3},{value:"Platform Base URL",id:"platform-base-url",level:3},{value:"Full API Documentation",id:"full-api-documentation",level:3}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-use-the-cado-api",children:"How to Use the Cado API"}),"\n",(0,i.jsx)(t.p,{children:"The Cado API allows third-party tools and automation scripts to interact seamlessly with the Cado platform. You can use the API, along with pre-built integrations, to perform tasks like:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Triggering platform operations (e.g., acquiring instances from your cloud environments)"}),"\n",(0,i.jsx)(t.li,{children:"Retrieving captured data (e.g., suspicious events)"}),"\n",(0,i.jsx)(t.li,{children:"Managing and controlling investigations"}),"\n",(0,i.jsx)(t.li,{children:"And more"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"This guide will walk you through the essential steps to onboard and integrate with the Cado API."}),"\n",(0,i.jsx)(t.h3,{id:"creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"}),"\n",(0,i.jsx)(t.p,{children:"To access the Cado API, you\u2019ll need to authenticate with a valid API Key. Follow these steps to generate an API Key within the Cado platform:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Settings"})," in the bottom-left corner, then click on the ",(0,i.jsx)(t.strong,{children:"API"})," tab."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"API Settings Page",src:n(62201).A+"",width:"2524",height:"1328"})}),"\n",(0,i.jsxs)(t.ol,{start:"2",children:["\n",(0,i.jsxs)(t.li,{children:["Under the ",(0,i.jsx)(t.strong,{children:"API Keys"})," section, click the ",(0,i.jsx)(t.strong,{children:"Create New API Key"})," button."]}),"\n",(0,i.jsxs)(t.li,{children:["Copy the ",(0,i.jsx)(t.strong,{children:"Public Key"}),". This key serves as the identifier for the API Key, which can be used later to revoke access if needed."]}),"\n",(0,i.jsxs)(t.li,{children:["Copy the ",(0,i.jsx)(t.strong,{children:"Secret Key"})," and store it in a secure location (e.g., a password manager). You will not be able to view the Secret Key again after closing the dialog. This key is required when integrating with third-party providers."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Get API Key",src:n(65043).A+"",width:"1779",height:"1025"})}),"\n",(0,i.jsx)(t.p,{children:"The Secret Key functions as the Access Token for authenticating your requests."}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsx)(t.p,{children:"The Secret Key is shown only once. Be sure to save it securely, such as in a password manager."})}),"\n",(0,i.jsx)(t.h3,{id:"platform-base-url",children:"Platform Base URL"}),"\n",(0,i.jsx)(t.p,{children:'In the following tutorials, the term "Platform Base URL" refers to the IP address or domain name where your Cado platform is deployed. For example:'}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{children:"https://ec2example.compute.amazonaws.com\n"})}),"\n",(0,i.jsx)(t.h3,{id:"full-api-documentation",children:"Full API Documentation"}),"\n",(0,i.jsxs)(t.p,{children:["You can find detailed API references and examples for versions V2 and V3 in the ",(0,i.jsx)(t.strong,{children:"API"})," settings page. Additional API examples are available on GitHub: ",(0,i.jsx)(t.a,{href:"https://github.com/cado-security/cado-api-examples",children:"https://github.com/cado-security/cado-api-examples"})]})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},65043:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/api-key-aacf4201d6deb4f8502e39a6d075ed2d.png"},62201:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/api-faab75b4b26c2d4632e297c0b70deef7.png"},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>r});var i=n(96540);const o={},s=i.createContext(o);function a(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4745e9e4.e7f0dc21.js b/assets/js/4745e9e4.2844164f.js similarity index 94% rename from assets/js/4745e9e4.e7f0dc21.js rename to assets/js/4745e9e4.2844164f.js index 03513de4b..a1e207b80 100644 --- a/assets/js/4745e9e4.e7f0dc21.js +++ b/assets/js/4745e9e4.2844164f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5116],{76427:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>n,metadata:()=>c,toc:()=>i});var o=s(74848),r=s(28453);const n={title:"Release Notes",hide_title:!0,sidebar_position:1},a="Cado Release Notes",c={id:"release-notes/release-notes",title:"Release Notes",description:"Release notes are now accessible exclusively to current customers through our customer knowledge base.",source:"@site/docs/release-notes/release-notes.md",sourceDirName:"release-notes",slug:"/release-notes/",permalink:"/release-notes/",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/release-notes/release-notes.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Release Notes",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Service level agreements",permalink:"/troubleshooting/faq"}},l={},i=[];function u(e){const t={a:"a",h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"cado-release-notes",children:"Cado Release Notes"}),"\n",(0,o.jsx)(t.p,{children:"Release notes are now accessible exclusively to current customers through our customer knowledge base."}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.strong,{children:"Current customers"}),": If you need access, please reach out to ",(0,o.jsx)(t.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"}),"."]}),"\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.strong,{children:"Trial or evaluation users"}),": For details on a specific release, please contact your Cado representative or email ",(0,o.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]}),"\n"]})]})}function d(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(u,{...e})}):u(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>a,x:()=>c});var o=s(96540);const r={},n=o.createContext(r);function a(e){const t=o.useContext(n);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),o.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5116],{76427:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>n,metadata:()=>c,toc:()=>i});var o=s(74848),r=s(28453);const n={title:"Release Notes",hide_title:!0,sidebar_position:1},a="Cado Release Notes",c={id:"release-notes/release-notes",title:"Release Notes",description:"Release notes are now accessible exclusively to current customers through our customer knowledge base.",source:"@site/docs/release-notes/release-notes.md",sourceDirName:"release-notes",slug:"/release-notes/",permalink:"/release-notes/",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/release-notes/release-notes.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Release Notes",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Service level agreements",permalink:"/troubleshooting/faq"}},l={},i=[];function u(e){const t={a:"a",h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"cado-release-notes",children:"Cado Release Notes"}),"\n",(0,o.jsx)(t.p,{children:"Release notes are now accessible exclusively to current customers through our customer knowledge base."}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.strong,{children:"Current customers"}),": If you need access, please reach out to ",(0,o.jsx)(t.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"}),"."]}),"\n",(0,o.jsxs)(t.li,{children:[(0,o.jsx)(t.strong,{children:"Trial or evaluation users"}),": For details on a specific release, please contact your Cado representative or email ",(0,o.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]}),"\n"]})]})}function d(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(u,{...e})}):u(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>a,x:()=>c});var o=s(96540);const r={},n=o.createContext(r);function a(e){const t=o.useContext(n);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),o.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4a3e894d.febec811.js b/assets/js/4a3e894d.02535adb.js similarity index 99% rename from assets/js/4a3e894d.febec811.js rename to assets/js/4a3e894d.02535adb.js index 7ed3c36d7..5715de4d0 100644 --- a/assets/js/4a3e894d.febec811.js +++ b/assets/js/4a3e894d.02535adb.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7123],{10153:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>r,default:()=>o,frontMatter:()=>d,metadata:()=>c,toc:()=>a});var i=n(74848),s=n(28453);const d={title:"Cortex XSOAR",hide_title:!0,sidebar_position:6},r="How to integrate with XSOAR",c={id:"cado/integrations/soar/cortex-xsoar",title:"Cortex XSOAR",description:"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you're going to increase efficiency and productive by automating Cado's powerful data acquisition and processing.",source:"@site/docs/cado/integrations/soar/cortex-xsoar.md",sourceDirName:"cado/integrations/soar",slug:"/cado/integrations/soar/cortex-xsoar",permalink:"/cado/integrations/soar/cortex-xsoar",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/soar/cortex-xsoar.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Cortex XSOAR",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Splunk SOAR",permalink:"/cado/integrations/soar/splunk-soar"},next:{title:"Wiz",permalink:"/cado/integrations/cnapp/wiz"}},l={},a=[{value:"Getting Started with XSOAR",id:"getting-started-with-xsoar",level:2},{value:"Contents",id:"contents",level:3},{value:"Downloading from Marketplace",id:"downloading-from-marketplace",level:3},{value:"Setup",id:"setup",level:3},{value:"Testing your Settings",id:"testing-your-settings",level:3},{value:"List of Commands",id:"list-of-commands",level:2},{value:"Contents",id:"contents-1",level:3},{value:"List EC2 Instances",id:"list-ec2-instances",level:3},{value:"Arguments",id:"arguments",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output",level:4},{value:"Command example",id:"command-example",level:4},{value:"Context Example",id:"context-example",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output",level:4},{value:"List S3 Buckets",id:"list-s3-buckets",level:3},{value:"Arguments",id:"arguments-1",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-1",level:4},{value:"Command Example",id:"command-example-1",level:4},{value:"Context Example",id:"context-example-1",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-1",level:4},{value:"List Projects",id:"list-projects",level:3},{value:"Arguments",id:"arguments-2",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-2",level:4},{value:"Command Example",id:"command-example-2",level:4},{value:"Context Example",id:"context-example-2",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-2",level:4},{value:"List Project Pipelines",id:"list-project-pipelines",level:3},{value:"Arguments",id:"arguments-3",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-3",level:4},{value:"Command Example",id:"command-example-3",level:4},{value:"Context Example",id:"context-example-3",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-3",level:4},{value:"Create a Project",id:"create-a-project",level:3},{value:"Arguments",id:"arguments-4",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-4",level:4},{value:"Command Example",id:"command-example-4",level:4},{value:"Context Example",id:"context-example-4",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-4",level:4},{value:"Acquire a Disk Image From EC2",id:"acquire-a-disk-image-from-ec2",level:3},{value:"Arguments",id:"arguments-5",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-5",level:4},{value:"Command Example",id:"command-example-5",level:4},{value:"Context Example",id:"context-example-5",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-5",level:4},{value:"Acquire a Disk Image From S3",id:"acquire-a-disk-image-from-s3",level:3},{value:"Arguments",id:"arguments-6",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-6",level:4},{value:"Command Example",id:"command-example-6",level:4},{value:"Context Example",id:"context-example-6",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-6",level:4}];function h(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-integrate-with-xsoar",children:"How to integrate with XSOAR"}),"\n",(0,i.jsx)(t.p,{children:"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you're going to increase efficiency and productive by automating Cado's powerful data acquisition and processing."}),"\n",(0,i.jsxs)(t.p,{children:["For more information, see the ",(0,i.jsx)(t.a,{href:"https://xsoar.pan.dev/docs/reference/integrations/cado-response",children:"Cortex XSOAR documentation for the Cado Pack."}),"."]}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsxs)(t.p,{children:["If you're confused by the terminology mentioned here, or have never used XSOAR before, please consider checking out the ",(0,i.jsx)(t.a,{href:"https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-tutorials.html",children:"XSOAR documentation"}),"."]})}),"\n",(0,i.jsx)(t.h2,{id:"getting-started-with-xsoar",children:"Getting Started with XSOAR"}),"\n",(0,i.jsx)(t.p,{children:"Before properly getting started please see the following for general instructions on setting up the Cado platform for integrating with third-party tools:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})}),"\n",(0,i.jsx)(t.h3,{id:"contents",children:"Contents"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#downloading-from-marketplace",children:"Downloading from Marketplace"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#setup",children:"Setup"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#testing-your-settings",children:"Testing your Settings"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"downloading-from-marketplace",children:"Downloading from Marketplace"}),"\n",(0,i.jsxs)(t.p,{children:["In your Cortex XSOAR instance, click on the ",(0,i.jsx)(t.strong,{children:"Marketplace"})," section in the left-hand sidebar and search for ",(0,i.jsx)(t.code,{children:"Cado"})," in the search bar."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Cado in the XSOAR marketplace",src:n(10125).A+"",width:"1218",height:"187"})}),"\n",(0,i.jsx)(t.h3,{id:"setup",children:"Setup"}),"\n",(0,i.jsx)(t.p,{children:"When configuring the Cado integration (which should open up when you install the application), you'll see the following screen to configure the XSOAR application:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Cado XSOAR Setup Wizard",src:n(71260).A+"",width:"1502",height:"1025"})}),"\n",(0,i.jsx)(t.p,{children:"In this screen, you'll need to setup the following:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"Application Instance Name"}),":"]}),"\n",(0,i.jsx)(t.p,{children:"This will be the name of the Application as it shows in XSOAR. If you're unsure, it's best to leave as default."}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The URL of your Cado instance"}),":"]}),"\n",(0,i.jsxs)(t.p,{children:["This will the URL of your deployed Cado instance, if you're unsure, please see ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The API key you retrieved from your platform"}),":"]}),"\n",(0,i.jsxs)(t.p,{children:["This will the generated private API key you retrieved earlier, if you're unsure, please see ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default Project ID"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a fallback Project ID from Cado if you forget to add an ID to a command. If you're not sure, don't change! ",(0,i.jsx)(t.em,{children:"Defaults to 1"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default AWS Region"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a default AWS region to fallback on if you forget to add it to a command. ",(0,i.jsx)(t.em,{children:"Defaults to us-east-1"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default AWS S3 bucket"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a default AWS bucket to fallback on if you forget to add it to a command. ",(0,i.jsx)(t.em,{children:"Defaults to cado-default-bucket"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"testing-your-settings",children:"Testing your Settings"}),"\n",(0,i.jsxs)(t.p,{children:["To test your settings, click the ",(0,i.jsx)(t.code,{children:"Test"})," button in the setup screen. Ensure the result of the test is green and says ",(0,i.jsx)(t.code,{children:"result ok"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"list-of-commands",children:"List of Commands"}),"\n",(0,i.jsx)(t.h3,{id:"contents-1",children:"Contents"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#retrieve-a-pipeline",children:"Retrieve a Pipeline"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"list-ec2-instances",children:"List EC2 Instances"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-ec2"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the EC2 instances in an AWS region."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"region"})}),(0,i.jsx)(t.td,{children:"The AWS region to list instances from. This is a required parameter."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"AWS ID of the EC2 Instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.instance_name"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Name of the EC2 Instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.instance_type"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"AWS Type of the EC2 instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.region"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"AWS region of the EC2 instance"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example",children:"Command example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-list-ec2 project_id=1 region="us-east-1" limit=100'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "EC2Instances": [\n {\n "_placement": "us-east-1c",\n "_state": "stopped",\n "celery_worker_name": null,\n "deployment_id": null,\n "evidence_id": null,\n "id": "i-00000000000",\n "instance_name": "Instance",\n "instance_type": "t3a.2xlarge",\n "ip_address": null,\n "launch_time": "Thu, 25 Mar 2021 18:38:13 GMT",\n "processing_type": null,\n "project_id": null,\n "queue_name": null,\n "region": {\n "name": "us-east-1"\n },\n "worker_used": null\n }\n ]\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"_placement"}),(0,i.jsx)(t.th,{children:"_state"}),(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"instance_name"}),(0,i.jsx)(t.th,{children:"instance_type"}),(0,i.jsx)(t.th,{children:"launch_time"}),(0,i.jsx)(t.th,{children:"region"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"us-east-1c"}),(0,i.jsx)(t.td,{children:"stopped"}),(0,i.jsx)(t.td,{children:"i-00000000000"}),(0,i.jsx)(t.td,{children:"Instance"}),(0,i.jsx)(t.td,{children:"t3a.2xlarge"}),(0,i.jsx)(t.td,{children:"Thu, 25 Mar 2021 18:38:13 GMT"}),(0,i.jsx)(t.td,{children:"name: us-east-1"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-s3-buckets",children:"List S3 Buckets"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-s3"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the S3 buckets in an AWS account."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-1",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-1",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.S3Buckets.buckets"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of S3 buckets available to the project"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-1",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-list-s3 project_id=1 limit=100"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-1",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "S3Buckets": {\n "buckets": [\n "bucket",\n ]\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-1",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsx)(t.tr,{children:(0,i.jsx)(t.th,{children:"buckets"})})}),(0,i.jsx)(t.tbody,{children:(0,i.jsx)(t.tr,{children:(0,i.jsx)(t.td,{children:"bucket"})})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-project"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the projects, or a single project, in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-2",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you want to retrieve."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-2",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.caseName"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Name of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.description"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Description of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.users"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"Array of users assigned to the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.created"}),(0,i.jsx)(t.td,{children:"Date"}),(0,i.jsx)(t.td,{children:"Creation date of the project"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-2",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-list-project limit=100"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-2",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Projects": {\n "caseName": "Project Name_XSOAR",\n "created": "2022-01-17T12:21:46.613814",\n "deleted": false,\n "description": "This is a project in Cado created through Cortex XSOAR!",\n "id": 1,\n "status": "Pending",\n "users": [\n {\n "display_name": "admin",\n "id": 1,\n "is_admin": true,\n "login_type": 0,\n "username": "admin"\n }\n ]\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-2",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"caseName"}),(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"deleted"}),(0,i.jsx)(t.th,{children:"description"}),(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"status"}),(0,i.jsx)(t.th,{children:"users"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Project Name_XSOAR"}),(0,i.jsx)(t.td,{children:"2022-01-17T12:21:46.613814"}),(0,i.jsx)(t.td,{children:"false"}),(0,i.jsx)(t.td,{children:"This is a project in Cado created through Cortex XSOAR!"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"Pending"}),(0,i.jsx)(t.td,{children:"{'display_name': 'admin', 'id': 1, 'is_admin': True, 'login_type': 0, 'username': 'admin'}"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-project-pipelines",children:"List Project Pipelines"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-get-pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the pipelines, or a single pipeline, for a given project in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-3",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"The id of the pipeline to retrieve."}),(0,i.jsx)(t.td,{children:"None"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The id of the project the pipeline belongs to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"limit"}),(0,i.jsx)(t.td,{children:"Limit results to retrieve."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-3",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The ID of the retrieved pipeline"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.pipeline_type"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"The type of pipeline that was retrieved"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.created"}),(0,i.jsx)(t.td,{children:"Date"}),(0,i.jsx)(t.td,{children:"The date at which the retrieved pipeline was started"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.evidence_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The evidence ID linked to the retrieved pipeline"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.project_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The ID of the project the pipeline belongs to"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.is_terminated"}),(0,i.jsx)(t.td,{children:"Boolean"}),(0,i.jsx)(t.td,{children:"A boolean which says if the retrieved pipeline has been finished/terminated"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.summary"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of values containing the cancelled, failed, pending, running and successful pipeline subtasks"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.subtask"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of tasks in the retrieved pipeline"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-3",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-get-pipeline project_id=1 pipeline_id=1"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-3",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Pipeline": {\n \t"pipeline_id": 1,\n\t\t\t"pipeline_type": "processing",\n \t\t"created": "2022-01-17T12:22:00.843869",\n \t\t"evidence_id": 1,\n \t\t"project_id": 1,\n \t\t"is_terminated": false,\n\t\t\t"subtasks": [\n \t\t\t{\n\t\t\t\t\t"execution_duration": 0,\n\t\t\t\t\t"finish_time": 0,\n\t\t\t\t\t"name": "Triage: Attaching disk for local data storage.",\n\t\t\t\t\t"name_key": "infrastructure.check_ssd",\n\t\t\t\t\t"notification_level": "Info",\n\t\t\t\t\t"progress_text": [],\n\t\t\t\t\t"start_time": 0,\n\t\t\t\t\t"state": "PENDING",\n\t\t\t\t\t"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",\n\t\t\t\t\t"total_stages": null\n\t\t\t\t }\n\t\t\t],\n\t\t\t"summary": {\n\t\t\t "cancelled": 0,\n\t\t\t "failure": 0,\n\t\t\t "pending": 14,\n\t\t\t "running": 0,\n\t\t\t "success": 0,\n\t\t\t "total": 14\n\t\t\t}\n }\n }\n\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-3",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"is_terminated"}),(0,i.jsx)(t.th,{children:"summary"}),(0,i.jsx)(t.th,{children:"subtask"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"processing"}),(0,i.jsx)(t.td,{children:"2022-01-17T12:22:00.843869"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"false"}),(0,i.jsxs)(t.td,{children:['"execution_duration": 0,',(0,i.jsx)("br",{}),'"finish_time": 0,',(0,i.jsx)("br",{}),'"name": "Triage: attaching disk for local data storage.",',(0,i.jsx)("br",{}),'"name_key": infrastructure.check_ssd",',(0,i.jsx)("br",{}),'"notification_level": "Info",',(0,i.jsx)("br",{}),'"progress_text": [],',(0,i.jsx)("br",{}),'"start_time": 0,',(0,i.jsx)("br",{}),'"state": "PENDING",',(0,i.jsx)("br",{}),'"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",',(0,i.jsx)("br",{}),'"total_stages": null',(0,i.jsx)("br",{})]}),(0,i.jsxs)(t.td,{children:['"cancelled": 0,',(0,i.jsx)("br",{}),'"failure": 0,',(0,i.jsx)("br",{}),'"pending": 14,',(0,i.jsx)("br",{}),'"running": 0,',(0,i.jsx)("br",{}),'"success": 0,',(0,i.jsx)("br",{}),'"total": 14',(0,i.jsx)("br",{})]})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"create-a-project",children:"Create a Project"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-create-project"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to create a new project in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-4",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_name"}),(0,i.jsx)(t.td,{children:"Name of the project."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_description"}),(0,i.jsx)(t.td,{children:"Description for the project."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-4",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Project.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The Project ID of the newly created project"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-4",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-create-project project_name="Project Name" description="Project Description"'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-4",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Project": {\n "id": 1,\n "msg": "Created"\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-4",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"msg"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"Created"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-trigger-ec2"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will trigger a disk image acquisition task in Cado for a specified EC2 instance."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-5",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"instance_id"}),(0,i.jsx)(t.td,{children:"ID of the EC2 instance to acquire."}),(0,i.jsx)(t.td,{children:"Required"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"region"}),(0,i.jsx)(t.td,{children:"AWS region in which the EC2 instance is located."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"S3 bucket where the uploaded disk image resides."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"compress"}),(0,i.jsx)(t.td,{children:"Flag indicating if disk compression is enabled."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_disks"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include disk images in the acquisition."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_hash"}),(0,i.jsx)(t.td,{children:"Flag indicating if we calculate the hash of the disk."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_logs"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include system logs in the acquisition."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_screenshot"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include a screenshot of the system in the acquisition."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-5",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Acquisition.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the created pipeline"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-5",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-trigger-ec2 project_id=1 instance_id="i-00000000000" region="us-east-1" bucket="bucket" compress=true include_disks=true include_hash=true include_logs=true include_screenshot=true'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-5",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "EC2acquisition": {\n "created": "2022-01-17T12:21:59.084282",\n "evidence_id": 0,\n "name": "Acquiring i-00000000000",\n "pipeline_id": 1,\n "pipeline_type": "acquisition",\n "project_id": 1,\n "subtasks": [\n {\n "id": "1587a9c9-c02c-464b-a6f7-d4b7e720bd93"\n },\n {\n "id": "4f798bf8-c7d3-427c-9498-10a85cfe3978"\n },\n {\n "id": "c5fa26f1-e282-47a6-8335-1160766e089b"\n },\n {\n "id": "82ec9a7e-47ac-4539-9623-166a44a59d0f"\n },\n {\n "id": "88151005-a999-422e-b4cb-9e76699d6e42"\n }\n ],\n "user_id": 1\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-5",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"name"}),(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"subtasks"}),(0,i.jsx)(t.th,{children:"user_id"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2022-01-17T12:21:59.084282"}),(0,i.jsx)(t.td,{children:"0"}),(0,i.jsx)(t.td,{children:"Acquiring i-00000000000"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"acquisition"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsxs)(t.td,{children:["{'id': '1587a9c9-c02c-464b-a6f7-d4b7e720bd93'},",(0,i.jsx)("br",{}),"{'id': '4f798bf8-c7d3-427c-9498-10a85cfe3978'},",(0,i.jsx)("br",{}),"{'id': 'c5fa26f1-e282-47a6-8335-1160766e089b'},",(0,i.jsx)("br",{}),"{'id': '82ec9a7e-47ac-4539-9623-166a44a59d0f'},",(0,i.jsx)("br",{}),"{'id': '88151005-a999-422e-b4cb-9e76699d6e42'}"]}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-trigger-s3"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will trigger a disk image acquisition task in Cado from a file in a S3 Bucket."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-6",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"The S3 bucket name containing the file."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"file_name"}),(0,i.jsx)(t.td,{children:"The name of the file to process."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-6",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.S3Acquisition.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the created pipeline"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-6",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-trigger-s3 project_id=1 bucket="bucket" file_name="file"'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-6",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "S3Acquisition": {\n "created": "2022-01-17T12:22:00.843869",\n "evidence_id": 1,\n "name": "",\n "pipeline_id": 2,\n "pipeline_type": "processing",\n "project_id": 1,\n "subtasks": [\n {\n "id": "3699827f-63c4-4408-88a4-0ae899187ed3"\n },\n {\n "id": "727e2072-8bf7-4847-89ea-9447f5fd8fd0"\n },\n {\n "id": "857d48b8-abaf-4ea6-b159-d25c9784b837"\n },\n {\n "id": "533f7deb-74bc-4ffb-b81f-788ed714bead"\n },\n {\n "id": "3f1defde-3986-4292-a423-1bef62d4c52b"\n },\n {\n "id": "e41a0934-266b-4868-9a7d-5f083b1efcc1"\n },\n {\n "id": "75411e10-46e9-41dd-8bf7-9b5fbdc8df71"\n },\n {\n "id": "0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c"\n },\n {\n "id": "ca063c7b-1135-4922-8542-49f40ce71449"\n },\n {\n "id": "67fdb0ea-dcee-4f65-a003-4f40fcd567fb"\n },\n {\n "id": "1437ec33-6af2-4eb8-9c43-e071dcb7e0ac"\n },\n {\n "id": "06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d"\n },\n {\n "id": "e3cc930e-9a60-46c3-97a1-611824c24437"\n },\n {\n "id": "ad2c8877-39e7-4bff-9756-81278802ee76"\n }\n ],\n "user_id": 1\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-6",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"name"}),(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"subtasks"}),(0,i.jsx)(t.th,{children:"user_id"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2022-01-17T12:22:00.843869"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{}),(0,i.jsx)(t.td,{children:"2"}),(0,i.jsx)(t.td,{children:"processing"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsxs)(t.td,{children:["{'id': '3699827f-63c4-4408-88a4-0ae899187ed3'},",(0,i.jsx)("br",{}),"{'id': '727e2072-8bf7-4847-89ea-9447f5fd8fd0'},",(0,i.jsx)("br",{}),"{'id': '857d48b8-abaf-4ea6-b159-d25c9784b837'},",(0,i.jsx)("br",{}),"{'id': '533f7deb-74bc-4ffb-b81f-788ed714bead'},",(0,i.jsx)("br",{}),"{'id': '3f1defde-3986-4292-a423-1bef62d4c52b'},",(0,i.jsx)("br",{}),"{'id': 'e41a0934-266b-4868-9a7d-5f083b1efcc1'},",(0,i.jsx)("br",{}),"{'id': '75411e10-46e9-41dd-8bf7-9b5fbdc8df71'},",(0,i.jsx)("br",{}),"{'id': '0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c'},",(0,i.jsx)("br",{}),"{'id': 'ca063c7b-1135-4922-8542-49f40ce71449'},",(0,i.jsx)("br",{}),"{'id': '67fdb0ea-dcee-4f65-a003-4f40fcd567fb'},",(0,i.jsx)("br",{}),"{'id': '1437ec33-6af2-4eb8-9c43-e071dcb7e0ac'},",(0,i.jsx)("br",{}),"{'id': '06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d'},",(0,i.jsx)("br",{}),"{'id': 'e3cc930e-9a60-46c3-97a1-611824c24437'},",(0,i.jsx)("br",{}),"{'id': 'ad2c8877-39e7-4bff-9756-81278802ee76'}"]}),(0,i.jsx)(t.td,{children:"1"})]})})]})]})}function o(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},10125:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/xsoar-market-435c41f4081debcf9f540f815a2c3ac7.png"},71260:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/xsoar-wizard-d512d7ac7ff1fe21af8d01b695deacd6.png"},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>c});var i=n(96540);const s={},d=i.createContext(s);function r(e){const t=i.useContext(d);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(d.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7123],{10153:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>r,default:()=>o,frontMatter:()=>d,metadata:()=>c,toc:()=>a});var i=n(74848),s=n(28453);const d={title:"Cortex XSOAR",hide_title:!0,sidebar_position:6},r="How to integrate with XSOAR",c={id:"cado/integrations/soar/cortex-xsoar",title:"Cortex XSOAR",description:"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you're going to increase efficiency and productive by automating Cado's powerful data acquisition and processing.",source:"@site/docs/cado/integrations/soar/cortex-xsoar.md",sourceDirName:"cado/integrations/soar",slug:"/cado/integrations/soar/cortex-xsoar",permalink:"/cado/integrations/soar/cortex-xsoar",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/soar/cortex-xsoar.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Cortex XSOAR",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Splunk SOAR",permalink:"/cado/integrations/soar/splunk-soar"},next:{title:"Wiz",permalink:"/cado/integrations/cnapp/wiz"}},l={},a=[{value:"Getting Started with XSOAR",id:"getting-started-with-xsoar",level:2},{value:"Contents",id:"contents",level:3},{value:"Downloading from Marketplace",id:"downloading-from-marketplace",level:3},{value:"Setup",id:"setup",level:3},{value:"Testing your Settings",id:"testing-your-settings",level:3},{value:"List of Commands",id:"list-of-commands",level:2},{value:"Contents",id:"contents-1",level:3},{value:"List EC2 Instances",id:"list-ec2-instances",level:3},{value:"Arguments",id:"arguments",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output",level:4},{value:"Command example",id:"command-example",level:4},{value:"Context Example",id:"context-example",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output",level:4},{value:"List S3 Buckets",id:"list-s3-buckets",level:3},{value:"Arguments",id:"arguments-1",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-1",level:4},{value:"Command Example",id:"command-example-1",level:4},{value:"Context Example",id:"context-example-1",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-1",level:4},{value:"List Projects",id:"list-projects",level:3},{value:"Arguments",id:"arguments-2",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-2",level:4},{value:"Command Example",id:"command-example-2",level:4},{value:"Context Example",id:"context-example-2",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-2",level:4},{value:"List Project Pipelines",id:"list-project-pipelines",level:3},{value:"Arguments",id:"arguments-3",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-3",level:4},{value:"Command Example",id:"command-example-3",level:4},{value:"Context Example",id:"context-example-3",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-3",level:4},{value:"Create a Project",id:"create-a-project",level:3},{value:"Arguments",id:"arguments-4",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-4",level:4},{value:"Command Example",id:"command-example-4",level:4},{value:"Context Example",id:"context-example-4",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-4",level:4},{value:"Acquire a Disk Image From EC2",id:"acquire-a-disk-image-from-ec2",level:3},{value:"Arguments",id:"arguments-5",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-5",level:4},{value:"Command Example",id:"command-example-5",level:4},{value:"Context Example",id:"context-example-5",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-5",level:4},{value:"Acquire a Disk Image From S3",id:"acquire-a-disk-image-from-s3",level:3},{value:"Arguments",id:"arguments-6",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-6",level:4},{value:"Command Example",id:"command-example-6",level:4},{value:"Context Example",id:"context-example-6",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output-6",level:4}];function h(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-integrate-with-xsoar",children:"How to integrate with XSOAR"}),"\n",(0,i.jsx)(t.p,{children:"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you're going to increase efficiency and productive by automating Cado's powerful data acquisition and processing."}),"\n",(0,i.jsxs)(t.p,{children:["For more information, see the ",(0,i.jsx)(t.a,{href:"https://xsoar.pan.dev/docs/reference/integrations/cado-response",children:"Cortex XSOAR documentation for the Cado Pack."}),"."]}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsxs)(t.p,{children:["If you're confused by the terminology mentioned here, or have never used XSOAR before, please consider checking out the ",(0,i.jsx)(t.a,{href:"https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-tutorials.html",children:"XSOAR documentation"}),"."]})}),"\n",(0,i.jsx)(t.h2,{id:"getting-started-with-xsoar",children:"Getting Started with XSOAR"}),"\n",(0,i.jsx)(t.p,{children:"Before properly getting started please see the following for general instructions on setting up the Cado platform for integrating with third-party tools:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})}),"\n",(0,i.jsx)(t.h3,{id:"contents",children:"Contents"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#downloading-from-marketplace",children:"Downloading from Marketplace"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#setup",children:"Setup"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#testing-your-settings",children:"Testing your Settings"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"downloading-from-marketplace",children:"Downloading from Marketplace"}),"\n",(0,i.jsxs)(t.p,{children:["In your Cortex XSOAR instance, click on the ",(0,i.jsx)(t.strong,{children:"Marketplace"})," section in the left-hand sidebar and search for ",(0,i.jsx)(t.code,{children:"Cado"})," in the search bar."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Cado in the XSOAR marketplace",src:n(10125).A+"",width:"1218",height:"187"})}),"\n",(0,i.jsx)(t.h3,{id:"setup",children:"Setup"}),"\n",(0,i.jsx)(t.p,{children:"When configuring the Cado integration (which should open up when you install the application), you'll see the following screen to configure the XSOAR application:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Cado XSOAR Setup Wizard",src:n(71260).A+"",width:"1502",height:"1025"})}),"\n",(0,i.jsx)(t.p,{children:"In this screen, you'll need to setup the following:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"Application Instance Name"}),":"]}),"\n",(0,i.jsx)(t.p,{children:"This will be the name of the Application as it shows in XSOAR. If you're unsure, it's best to leave as default."}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The URL of your Cado instance"}),":"]}),"\n",(0,i.jsxs)(t.p,{children:["This will the URL of your deployed Cado instance, if you're unsure, please see ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The API key you retrieved from your platform"}),":"]}),"\n",(0,i.jsxs)(t.p,{children:["This will the generated private API key you retrieved earlier, if you're unsure, please see ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default Project ID"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a fallback Project ID from Cado if you forget to add an ID to a command. If you're not sure, don't change! ",(0,i.jsx)(t.em,{children:"Defaults to 1"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default AWS Region"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a default AWS region to fallback on if you forget to add it to a command. ",(0,i.jsx)(t.em,{children:"Defaults to us-east-1"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default AWS S3 bucket"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a default AWS bucket to fallback on if you forget to add it to a command. ",(0,i.jsx)(t.em,{children:"Defaults to cado-default-bucket"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"testing-your-settings",children:"Testing your Settings"}),"\n",(0,i.jsxs)(t.p,{children:["To test your settings, click the ",(0,i.jsx)(t.code,{children:"Test"})," button in the setup screen. Ensure the result of the test is green and says ",(0,i.jsx)(t.code,{children:"result ok"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"list-of-commands",children:"List of Commands"}),"\n",(0,i.jsx)(t.h3,{id:"contents-1",children:"Contents"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#retrieve-a-pipeline",children:"Retrieve a Pipeline"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"list-ec2-instances",children:"List EC2 Instances"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-ec2"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the EC2 instances in an AWS region."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"region"})}),(0,i.jsx)(t.td,{children:"The AWS region to list instances from. This is a required parameter."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"AWS ID of the EC2 Instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.instance_name"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Name of the EC2 Instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.instance_type"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"AWS Type of the EC2 instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.region"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"AWS region of the EC2 instance"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example",children:"Command example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-list-ec2 project_id=1 region="us-east-1" limit=100'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "EC2Instances": [\n {\n "_placement": "us-east-1c",\n "_state": "stopped",\n "celery_worker_name": null,\n "deployment_id": null,\n "evidence_id": null,\n "id": "i-00000000000",\n "instance_name": "Instance",\n "instance_type": "t3a.2xlarge",\n "ip_address": null,\n "launch_time": "Thu, 25 Mar 2021 18:38:13 GMT",\n "processing_type": null,\n "project_id": null,\n "queue_name": null,\n "region": {\n "name": "us-east-1"\n },\n "worker_used": null\n }\n ]\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"_placement"}),(0,i.jsx)(t.th,{children:"_state"}),(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"instance_name"}),(0,i.jsx)(t.th,{children:"instance_type"}),(0,i.jsx)(t.th,{children:"launch_time"}),(0,i.jsx)(t.th,{children:"region"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"us-east-1c"}),(0,i.jsx)(t.td,{children:"stopped"}),(0,i.jsx)(t.td,{children:"i-00000000000"}),(0,i.jsx)(t.td,{children:"Instance"}),(0,i.jsx)(t.td,{children:"t3a.2xlarge"}),(0,i.jsx)(t.td,{children:"Thu, 25 Mar 2021 18:38:13 GMT"}),(0,i.jsx)(t.td,{children:"name: us-east-1"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-s3-buckets",children:"List S3 Buckets"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-s3"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the S3 buckets in an AWS account."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-1",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-1",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.S3Buckets.buckets"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of S3 buckets available to the project"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-1",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-list-s3 project_id=1 limit=100"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-1",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "S3Buckets": {\n "buckets": [\n "bucket",\n ]\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-1",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsx)(t.tr,{children:(0,i.jsx)(t.th,{children:"buckets"})})}),(0,i.jsx)(t.tbody,{children:(0,i.jsx)(t.tr,{children:(0,i.jsx)(t.td,{children:"bucket"})})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-project"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the projects, or a single project, in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-2",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you want to retrieve."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-2",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.caseName"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Name of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.description"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Description of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.users"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"Array of users assigned to the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.created"}),(0,i.jsx)(t.td,{children:"Date"}),(0,i.jsx)(t.td,{children:"Creation date of the project"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-2",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-list-project limit=100"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-2",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Projects": {\n "caseName": "Project Name_XSOAR",\n "created": "2022-01-17T12:21:46.613814",\n "deleted": false,\n "description": "This is a project in Cado created through Cortex XSOAR!",\n "id": 1,\n "status": "Pending",\n "users": [\n {\n "display_name": "admin",\n "id": 1,\n "is_admin": true,\n "login_type": 0,\n "username": "admin"\n }\n ]\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-2",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"caseName"}),(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"deleted"}),(0,i.jsx)(t.th,{children:"description"}),(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"status"}),(0,i.jsx)(t.th,{children:"users"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Project Name_XSOAR"}),(0,i.jsx)(t.td,{children:"2022-01-17T12:21:46.613814"}),(0,i.jsx)(t.td,{children:"false"}),(0,i.jsx)(t.td,{children:"This is a project in Cado created through Cortex XSOAR!"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"Pending"}),(0,i.jsx)(t.td,{children:"{'display_name': 'admin', 'id': 1, 'is_admin': True, 'login_type': 0, 'username': 'admin'}"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-project-pipelines",children:"List Project Pipelines"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-get-pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the pipelines, or a single pipeline, for a given project in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-3",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"The id of the pipeline to retrieve."}),(0,i.jsx)(t.td,{children:"None"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The id of the project the pipeline belongs to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"limit"}),(0,i.jsx)(t.td,{children:"Limit results to retrieve."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-3",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The ID of the retrieved pipeline"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.pipeline_type"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"The type of pipeline that was retrieved"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.created"}),(0,i.jsx)(t.td,{children:"Date"}),(0,i.jsx)(t.td,{children:"The date at which the retrieved pipeline was started"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.evidence_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The evidence ID linked to the retrieved pipeline"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.project_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The ID of the project the pipeline belongs to"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.is_terminated"}),(0,i.jsx)(t.td,{children:"Boolean"}),(0,i.jsx)(t.td,{children:"A boolean which says if the retrieved pipeline has been finished/terminated"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.summary"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of values containing the cancelled, failed, pending, running and successful pipeline subtasks"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.subtask"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of tasks in the retrieved pipeline"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-3",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-get-pipeline project_id=1 pipeline_id=1"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-3",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Pipeline": {\n \t"pipeline_id": 1,\n\t\t\t"pipeline_type": "processing",\n \t\t"created": "2022-01-17T12:22:00.843869",\n \t\t"evidence_id": 1,\n \t\t"project_id": 1,\n \t\t"is_terminated": false,\n\t\t\t"subtasks": [\n \t\t\t{\n\t\t\t\t\t"execution_duration": 0,\n\t\t\t\t\t"finish_time": 0,\n\t\t\t\t\t"name": "Triage: Attaching disk for local data storage.",\n\t\t\t\t\t"name_key": "infrastructure.check_ssd",\n\t\t\t\t\t"notification_level": "Info",\n\t\t\t\t\t"progress_text": [],\n\t\t\t\t\t"start_time": 0,\n\t\t\t\t\t"state": "PENDING",\n\t\t\t\t\t"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",\n\t\t\t\t\t"total_stages": null\n\t\t\t\t }\n\t\t\t],\n\t\t\t"summary": {\n\t\t\t "cancelled": 0,\n\t\t\t "failure": 0,\n\t\t\t "pending": 14,\n\t\t\t "running": 0,\n\t\t\t "success": 0,\n\t\t\t "total": 14\n\t\t\t}\n }\n }\n\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-3",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"is_terminated"}),(0,i.jsx)(t.th,{children:"summary"}),(0,i.jsx)(t.th,{children:"subtask"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"processing"}),(0,i.jsx)(t.td,{children:"2022-01-17T12:22:00.843869"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"false"}),(0,i.jsxs)(t.td,{children:['"execution_duration": 0,',(0,i.jsx)("br",{}),'"finish_time": 0,',(0,i.jsx)("br",{}),'"name": "Triage: attaching disk for local data storage.",',(0,i.jsx)("br",{}),'"name_key": infrastructure.check_ssd",',(0,i.jsx)("br",{}),'"notification_level": "Info",',(0,i.jsx)("br",{}),'"progress_text": [],',(0,i.jsx)("br",{}),'"start_time": 0,',(0,i.jsx)("br",{}),'"state": "PENDING",',(0,i.jsx)("br",{}),'"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",',(0,i.jsx)("br",{}),'"total_stages": null',(0,i.jsx)("br",{})]}),(0,i.jsxs)(t.td,{children:['"cancelled": 0,',(0,i.jsx)("br",{}),'"failure": 0,',(0,i.jsx)("br",{}),'"pending": 14,',(0,i.jsx)("br",{}),'"running": 0,',(0,i.jsx)("br",{}),'"success": 0,',(0,i.jsx)("br",{}),'"total": 14',(0,i.jsx)("br",{})]})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"create-a-project",children:"Create a Project"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-create-project"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to create a new project in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-4",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_name"}),(0,i.jsx)(t.td,{children:"Name of the project."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_description"}),(0,i.jsx)(t.td,{children:"Description for the project."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-4",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Project.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The Project ID of the newly created project"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-4",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-create-project project_name="Project Name" description="Project Description"'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-4",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Project": {\n "id": 1,\n "msg": "Created"\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-4",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"msg"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"Created"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-trigger-ec2"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will trigger a disk image acquisition task in Cado for a specified EC2 instance."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-5",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"instance_id"}),(0,i.jsx)(t.td,{children:"ID of the EC2 instance to acquire."}),(0,i.jsx)(t.td,{children:"Required"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"region"}),(0,i.jsx)(t.td,{children:"AWS region in which the EC2 instance is located."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"S3 bucket where the uploaded disk image resides."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"compress"}),(0,i.jsx)(t.td,{children:"Flag indicating if disk compression is enabled."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_disks"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include disk images in the acquisition."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_hash"}),(0,i.jsx)(t.td,{children:"Flag indicating if we calculate the hash of the disk."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_logs"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include system logs in the acquisition."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_screenshot"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include a screenshot of the system in the acquisition."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-5",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Acquisition.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the created pipeline"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-5",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-trigger-ec2 project_id=1 instance_id="i-00000000000" region="us-east-1" bucket="bucket" compress=true include_disks=true include_hash=true include_logs=true include_screenshot=true'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-5",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "EC2acquisition": {\n "created": "2022-01-17T12:21:59.084282",\n "evidence_id": 0,\n "name": "Acquiring i-00000000000",\n "pipeline_id": 1,\n "pipeline_type": "acquisition",\n "project_id": 1,\n "subtasks": [\n {\n "id": "1587a9c9-c02c-464b-a6f7-d4b7e720bd93"\n },\n {\n "id": "4f798bf8-c7d3-427c-9498-10a85cfe3978"\n },\n {\n "id": "c5fa26f1-e282-47a6-8335-1160766e089b"\n },\n {\n "id": "82ec9a7e-47ac-4539-9623-166a44a59d0f"\n },\n {\n "id": "88151005-a999-422e-b4cb-9e76699d6e42"\n }\n ],\n "user_id": 1\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-5",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"name"}),(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"subtasks"}),(0,i.jsx)(t.th,{children:"user_id"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2022-01-17T12:21:59.084282"}),(0,i.jsx)(t.td,{children:"0"}),(0,i.jsx)(t.td,{children:"Acquiring i-00000000000"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"acquisition"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsxs)(t.td,{children:["{'id': '1587a9c9-c02c-464b-a6f7-d4b7e720bd93'},",(0,i.jsx)("br",{}),"{'id': '4f798bf8-c7d3-427c-9498-10a85cfe3978'},",(0,i.jsx)("br",{}),"{'id': 'c5fa26f1-e282-47a6-8335-1160766e089b'},",(0,i.jsx)("br",{}),"{'id': '82ec9a7e-47ac-4539-9623-166a44a59d0f'},",(0,i.jsx)("br",{}),"{'id': '88151005-a999-422e-b4cb-9e76699d6e42'}"]}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-trigger-s3"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will trigger a disk image acquisition task in Cado from a file in a S3 Bucket."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-6",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"The S3 bucket name containing the file."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"file_name"}),(0,i.jsx)(t.td,{children:"The name of the file to process."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-6",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.S3Acquisition.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the created pipeline"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-6",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-trigger-s3 project_id=1 bucket="bucket" file_name="file"'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-6",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "S3Acquisition": {\n "created": "2022-01-17T12:22:00.843869",\n "evidence_id": 1,\n "name": "",\n "pipeline_id": 2,\n "pipeline_type": "processing",\n "project_id": 1,\n "subtasks": [\n {\n "id": "3699827f-63c4-4408-88a4-0ae899187ed3"\n },\n {\n "id": "727e2072-8bf7-4847-89ea-9447f5fd8fd0"\n },\n {\n "id": "857d48b8-abaf-4ea6-b159-d25c9784b837"\n },\n {\n "id": "533f7deb-74bc-4ffb-b81f-788ed714bead"\n },\n {\n "id": "3f1defde-3986-4292-a423-1bef62d4c52b"\n },\n {\n "id": "e41a0934-266b-4868-9a7d-5f083b1efcc1"\n },\n {\n "id": "75411e10-46e9-41dd-8bf7-9b5fbdc8df71"\n },\n {\n "id": "0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c"\n },\n {\n "id": "ca063c7b-1135-4922-8542-49f40ce71449"\n },\n {\n "id": "67fdb0ea-dcee-4f65-a003-4f40fcd567fb"\n },\n {\n "id": "1437ec33-6af2-4eb8-9c43-e071dcb7e0ac"\n },\n {\n "id": "06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d"\n },\n {\n "id": "e3cc930e-9a60-46c3-97a1-611824c24437"\n },\n {\n "id": "ad2c8877-39e7-4bff-9756-81278802ee76"\n }\n ],\n "user_id": 1\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output-6",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"name"}),(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"subtasks"}),(0,i.jsx)(t.th,{children:"user_id"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2022-01-17T12:22:00.843869"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{}),(0,i.jsx)(t.td,{children:"2"}),(0,i.jsx)(t.td,{children:"processing"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsxs)(t.td,{children:["{'id': '3699827f-63c4-4408-88a4-0ae899187ed3'},",(0,i.jsx)("br",{}),"{'id': '727e2072-8bf7-4847-89ea-9447f5fd8fd0'},",(0,i.jsx)("br",{}),"{'id': '857d48b8-abaf-4ea6-b159-d25c9784b837'},",(0,i.jsx)("br",{}),"{'id': '533f7deb-74bc-4ffb-b81f-788ed714bead'},",(0,i.jsx)("br",{}),"{'id': '3f1defde-3986-4292-a423-1bef62d4c52b'},",(0,i.jsx)("br",{}),"{'id': 'e41a0934-266b-4868-9a7d-5f083b1efcc1'},",(0,i.jsx)("br",{}),"{'id': '75411e10-46e9-41dd-8bf7-9b5fbdc8df71'},",(0,i.jsx)("br",{}),"{'id': '0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c'},",(0,i.jsx)("br",{}),"{'id': 'ca063c7b-1135-4922-8542-49f40ce71449'},",(0,i.jsx)("br",{}),"{'id': '67fdb0ea-dcee-4f65-a003-4f40fcd567fb'},",(0,i.jsx)("br",{}),"{'id': '1437ec33-6af2-4eb8-9c43-e071dcb7e0ac'},",(0,i.jsx)("br",{}),"{'id': '06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d'},",(0,i.jsx)("br",{}),"{'id': 'e3cc930e-9a60-46c3-97a1-611824c24437'},",(0,i.jsx)("br",{}),"{'id': 'ad2c8877-39e7-4bff-9756-81278802ee76'}"]}),(0,i.jsx)(t.td,{children:"1"})]})})]})]})}function o(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},10125:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/xsoar-market-435c41f4081debcf9f540f815a2c3ac7.png"},71260:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/xsoar-wizard-d512d7ac7ff1fe21af8d01b695deacd6.png"},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>c});var i=n(96540);const s={},d=i.createContext(s);function r(e){const t=i.useContext(d);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(d.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/55d2c3d2.f5d1e013.js b/assets/js/55d2c3d2.92dcaaa2.js similarity index 98% rename from assets/js/55d2c3d2.f5d1e013.js rename to assets/js/55d2c3d2.92dcaaa2.js index b16d5497d..24467897c 100644 --- a/assets/js/55d2c3d2.f5d1e013.js +++ b/assets/js/55d2c3d2.92dcaaa2.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8243],{13645:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>d,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>l,toc:()=>a});var s=o(74848),t=o(28453);const i={title:"Supported regions and GovCloud",hide_title:!0,sidebar_position:3},r="What regions does the Cado platform support?",l={id:"cado/deploy/aws/regions",title:"Supported regions and GovCloud",description:"Cado provides AWS AMIs (Amazon Machine Images) for deployment in the following regions:",source:"@site/docs/cado/deploy/aws/regions.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/regions",permalink:"/cado/deploy/aws/regions",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/regions.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Supported regions and GovCloud",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Cado architecture in AWS",permalink:"/cado/deploy/aws/architecture"},next:{title:"Bucket",permalink:"/cado/deploy/aws/aws-bucket"}},d={},a=[{value:"AWS GovCloud Support",id:"aws-govcloud-support",level:2}];function c(e){const n={h1:"h1",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"what-regions-does-the-cado-platform-support",children:"What regions does the Cado platform support?"}),"\n",(0,s.jsx)(n.p,{children:"Cado provides AWS AMIs (Amazon Machine Images) for deployment in the following regions:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"US Regions:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"us-east-1"}),"\n",(0,s.jsx)(n.li,{children:"us-east-2"}),"\n",(0,s.jsx)(n.li,{children:"us-west-1"}),"\n",(0,s.jsx)(n.li,{children:"us-west-2"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"European Regions:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"eu-west-1"}),"\n",(0,s.jsx)(n.li,{children:"eu-west-2"}),"\n",(0,s.jsx)(n.li,{children:"eu-west-3"}),"\n",(0,s.jsx)(n.li,{children:"eu-central-1"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Asia-Pacific Regions:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"ap-southeast-2"}),"\n",(0,s.jsx)(n.li,{children:"ap-south-1"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Canada Region:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"ca-central-1"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"If you need to deploy the Cado platform in a region not listed above, we can extend support by deploying our release AMIs to additional AWS regions. It's important to note that data acquisition is possible from all AWS regions, regardless of deployment location."}),"\n",(0,s.jsx)(n.h2,{id:"aws-govcloud-support",children:"AWS GovCloud Support"}),"\n",(0,s.jsxs)(n.p,{children:["The Cado platform also supports deployment in AWS GovCloud. We offer full support for both the ",(0,s.jsx)(n.strong,{children:"us-gov-west-1"})," and ",(0,s.jsx)(n.strong,{children:"us-gov-east-1"})," regions, ensuring compliance with government security requirements."]})]})}function p(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},28453:(e,n,o)=>{o.d(n,{R:()=>r,x:()=>l});var s=o(96540);const t={},i=s.createContext(t);function r(e){const n=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:r(e.components),s.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8243],{13645:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>d,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>l,toc:()=>a});var s=o(74848),t=o(28453);const i={title:"Supported regions and GovCloud",hide_title:!0,sidebar_position:3},r="What regions does the Cado platform support?",l={id:"cado/deploy/aws/regions",title:"Supported regions and GovCloud",description:"Cado provides AWS AMIs (Amazon Machine Images) for deployment in the following regions:",source:"@site/docs/cado/deploy/aws/regions.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/regions",permalink:"/cado/deploy/aws/regions",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/regions.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Supported regions and GovCloud",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Cado architecture in AWS",permalink:"/cado/deploy/aws/architecture"},next:{title:"Bucket",permalink:"/cado/deploy/aws/aws-bucket"}},d={},a=[{value:"AWS GovCloud Support",id:"aws-govcloud-support",level:2}];function c(e){const n={h1:"h1",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"what-regions-does-the-cado-platform-support",children:"What regions does the Cado platform support?"}),"\n",(0,s.jsx)(n.p,{children:"Cado provides AWS AMIs (Amazon Machine Images) for deployment in the following regions:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"US Regions:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"us-east-1"}),"\n",(0,s.jsx)(n.li,{children:"us-east-2"}),"\n",(0,s.jsx)(n.li,{children:"us-west-1"}),"\n",(0,s.jsx)(n.li,{children:"us-west-2"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"European Regions:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"eu-west-1"}),"\n",(0,s.jsx)(n.li,{children:"eu-west-2"}),"\n",(0,s.jsx)(n.li,{children:"eu-west-3"}),"\n",(0,s.jsx)(n.li,{children:"eu-central-1"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Asia-Pacific Regions:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"ap-southeast-2"}),"\n",(0,s.jsx)(n.li,{children:"ap-south-1"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Canada Region:"})}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"ca-central-1"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"If you need to deploy the Cado platform in a region not listed above, we can extend support by deploying our release AMIs to additional AWS regions. It's important to note that data acquisition is possible from all AWS regions, regardless of deployment location."}),"\n",(0,s.jsx)(n.h2,{id:"aws-govcloud-support",children:"AWS GovCloud Support"}),"\n",(0,s.jsxs)(n.p,{children:["The Cado platform also supports deployment in AWS GovCloud. We offer full support for both the ",(0,s.jsx)(n.strong,{children:"us-gov-west-1"})," and ",(0,s.jsx)(n.strong,{children:"us-gov-east-1"})," regions, ensuring compliance with government security requirements."]})]})}function p(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},28453:(e,n,o)=>{o.d(n,{R:()=>r,x:()=>l});var s=o(96540);const t={},i=s.createContext(t);function r(e){const n=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:r(e.components),s.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/56c19fd2.162a3059.js b/assets/js/56c19fd2.f5971ca8.js similarity index 97% rename from assets/js/56c19fd2.162a3059.js rename to assets/js/56c19fd2.f5971ca8.js index 127b79672..cc9bb884d 100644 --- a/assets/js/56c19fd2.162a3059.js +++ b/assets/js/56c19fd2.f5971ca8.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[949],{77137:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>u,frontMatter:()=>s,metadata:()=>a,toc:()=>l});var o=r(74848),n=r(28453);const s={title:"Service level agreements",hide_title:!0,sidebar_position:4},i="What are the Cado Service Level Agreements?",a={id:"troubleshooting/faq",title:"Service level agreements",description:"Cado's Service Level Agreements (SLAs) are outlined in the customer's End-User License Agreement (EULA).",source:"@site/docs/troubleshooting/faq.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/faq",permalink:"/troubleshooting/faq",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/faq.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Service level agreements",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Community Edition EULA",permalink:"/troubleshooting/eula/community-eula"},next:{title:"Release Notes",permalink:"/release-notes/"}},c={},l=[];function d(e){const t={a:"a",h1:"h1",p:"p",...(0,n.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"what-are-the-cado-service-level-agreements",children:"What are the Cado Service Level Agreements?"}),"\n",(0,o.jsx)(t.p,{children:"Cado's Service Level Agreements (SLAs) are outlined in the customer's End-User License Agreement (EULA)."}),"\n",(0,o.jsxs)(t.p,{children:["For more details, please review your EULA or contact ",(0,o.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]})]})}function u(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},28453:(e,t,r)=>{r.d(t,{R:()=>i,x:()=>a});var o=r(96540);const n={},s=o.createContext(n);function i(e){const t=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),o.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[949],{77137:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>u,frontMatter:()=>s,metadata:()=>a,toc:()=>l});var o=r(74848),n=r(28453);const s={title:"Service level agreements",hide_title:!0,sidebar_position:4},i="What are the Cado Service Level Agreements?",a={id:"troubleshooting/faq",title:"Service level agreements",description:"Cado's Service Level Agreements (SLAs) are outlined in the customer's End-User License Agreement (EULA).",source:"@site/docs/troubleshooting/faq.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/faq",permalink:"/troubleshooting/faq",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/faq.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Service level agreements",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Community Edition EULA",permalink:"/troubleshooting/eula/community-eula"},next:{title:"Release Notes",permalink:"/release-notes/"}},c={},l=[];function d(e){const t={a:"a",h1:"h1",p:"p",...(0,n.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"what-are-the-cado-service-level-agreements",children:"What are the Cado Service Level Agreements?"}),"\n",(0,o.jsx)(t.p,{children:"Cado's Service Level Agreements (SLAs) are outlined in the customer's End-User License Agreement (EULA)."}),"\n",(0,o.jsxs)(t.p,{children:["For more details, please review your EULA or contact ",(0,o.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]})]})}function u(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},28453:(e,t,r)=>{r.d(t,{R:()=>i,x:()=>a});var o=r(96540);const n={},s=o.createContext(n);function i(e){const t=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),o.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/57e5e07a.fb92b63d.js b/assets/js/57e5e07a.10c553b0.js similarity index 96% rename from assets/js/57e5e07a.fb92b63d.js rename to assets/js/57e5e07a.10c553b0.js index 1441d69e3..16797aa39 100644 --- a/assets/js/57e5e07a.fb92b63d.js +++ b/assets/js/57e5e07a.10c553b0.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2614],{13124:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>a,metadata:()=>i,toc:()=>l});var s=t(74848),r=t(28453);const a={title:"Secret Manager",hide_title:!0,sidebar_position:4},o="Secret Manager",i={id:"cado/deploy/aws/aws-secret-manager",title:"Secret Manager",description:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in AWS Secrets Manager.",source:"@site/docs/cado/deploy/aws/aws-secret-manager.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/aws-secret-manager",permalink:"/cado/deploy/aws/aws-secret-manager",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/aws-secret-manager.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Secret Manager",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"NFS",permalink:"/cado/deploy/aws/aws-nfs"},next:{title:"Workers",permalink:"/cado/deploy/aws/aws-workers"}},c={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function d(e){const n={code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"secret-manager",children:"Secret Manager"}),"\n",(0,s.jsx)(n.p,{children:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in AWS Secrets Manager."}),"\n",(0,s.jsx)(n.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"The IAM instance role used in the initial deployment, and permission to edit it"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"steps",children:"Steps"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsx)(n.li,{children:"Add the necessary permissions by adding the following Sid to your IAM instance role:"}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-json",children:'{\n "Sid": "RequiredForSecretsManagement",\n "Effect": "Allow",\n "Action": [\n "secretsmanager:PutSecretValue",\n "secretsmanager:CreateSecret",\n "secretsmanager:GetSecretValue",\n "secretsmanager:TagResource"\n ],\n "Resource": "*",\n "Condition": {\n "StringLike": {\n "aws:ResourceTag/Name": "CadoResponse*"\n }\n }\n}\n'})}),"\n",(0,s.jsxs)(n.ol,{start:"2",children:["\n",(0,s.jsxs)(n.li,{children:["Enable in the UI: ",(0,s.jsx)(n.strong,{children:"Settings"})," > ",(0,s.jsx)(n.strong,{children:"Advanced"})," > ",(0,s.jsx)(n.strong,{children:"Secret Management"})," > ",(0,s.jsx)(n.strong,{children:"Turn On Secrets Manager"})]}),"\n"]})]})}function p(e={}){const{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>i});var s=t(96540);const r={},a=s.createContext(r);function o(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function i(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2614],{13124:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>a,metadata:()=>i,toc:()=>l});var s=t(74848),r=t(28453);const a={title:"Secret Manager",hide_title:!0,sidebar_position:4},o="Secret Manager",i={id:"cado/deploy/aws/aws-secret-manager",title:"Secret Manager",description:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in AWS Secrets Manager.",source:"@site/docs/cado/deploy/aws/aws-secret-manager.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/aws-secret-manager",permalink:"/cado/deploy/aws/aws-secret-manager",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/aws-secret-manager.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Secret Manager",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"NFS",permalink:"/cado/deploy/aws/aws-nfs"},next:{title:"Workers",permalink:"/cado/deploy/aws/aws-workers"}},c={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function d(e){const n={code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"secret-manager",children:"Secret Manager"}),"\n",(0,s.jsx)(n.p,{children:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in AWS Secrets Manager."}),"\n",(0,s.jsx)(n.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"The IAM instance role used in the initial deployment, and permission to edit it"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"steps",children:"Steps"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsx)(n.li,{children:"Add the necessary permissions by adding the following Sid to your IAM instance role:"}),"\n"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-json",children:'{\n "Sid": "RequiredForSecretsManagement",\n "Effect": "Allow",\n "Action": [\n "secretsmanager:PutSecretValue",\n "secretsmanager:CreateSecret",\n "secretsmanager:GetSecretValue",\n "secretsmanager:TagResource"\n ],\n "Resource": "*",\n "Condition": {\n "StringLike": {\n "aws:ResourceTag/Name": "CadoResponse*"\n }\n }\n}\n'})}),"\n",(0,s.jsxs)(n.ol,{start:"2",children:["\n",(0,s.jsxs)(n.li,{children:["Enable in the UI: ",(0,s.jsx)(n.strong,{children:"Settings"})," > ",(0,s.jsx)(n.strong,{children:"Advanced"})," > ",(0,s.jsx)(n.strong,{children:"Secret Management"})," > ",(0,s.jsx)(n.strong,{children:"Turn On Secrets Manager"})]}),"\n"]})]})}function p(e={}){const{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>i});var s=t(96540);const r={},a=s.createContext(r);function o(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function i(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5a2693c2.5f729d48.js b/assets/js/5a2693c2.c50c9899.js similarity index 94% rename from assets/js/5a2693c2.5f729d48.js rename to assets/js/5a2693c2.c50c9899.js index 941670c64..47c89803c 100644 --- a/assets/js/5a2693c2.5f729d48.js +++ b/assets/js/5a2693c2.c50c9899.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5058],{30763:(t,o,e)=>{e.r(o),e.d(o,{assets:()=>a,contentTitle:()=>p,default:()=>d,frontMatter:()=>n,metadata:()=>c,toc:()=>i});var r=e(74848),s=e(28453);const n={title:"How to get support",hide_title:!0,sidebar_position:1},p="How to Get Support",c={id:"troubleshooting/get-support",title:"How to get support",description:"You can access the Cado Support portal at https://support.cadosecurity.com.",source:"@site/docs/troubleshooting/get-support.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/get-support",permalink:"/troubleshooting/get-support",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/get-support.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"How to get support",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Platform security",permalink:"/cado/manage/platform-security"},next:{title:"How to send logs to Cado",permalink:"/troubleshooting/send-logs"}},a={},i=[];function u(t){const o={a:"a",h1:"h1",p:"p",...(0,s.R)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"how-to-get-support",children:"How to Get Support"}),"\n",(0,r.jsxs)(o.p,{children:["You can access the Cado Support portal at ",(0,r.jsx)(o.a,{href:"https://support.cadosecurity.com",children:"https://support.cadosecurity.com"}),"."]}),"\n",(0,r.jsxs)(o.p,{children:["Alternatively, you can contact Cado Support by emailing ",(0,r.jsx)(o.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," or by reaching out to your account manager for assistance."]})]})}function d(t={}){const{wrapper:o}={...(0,s.R)(),...t.components};return o?(0,r.jsx)(o,{...t,children:(0,r.jsx)(u,{...t})}):u(t)}},28453:(t,o,e)=>{e.d(o,{R:()=>p,x:()=>c});var r=e(96540);const s={},n=r.createContext(s);function p(t){const o=r.useContext(n);return r.useMemo((function(){return"function"==typeof t?t(o):{...o,...t}}),[o,t])}function c(t){let o;return o=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:p(t.components),r.createElement(n.Provider,{value:o},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5058],{30763:(t,o,e)=>{e.r(o),e.d(o,{assets:()=>a,contentTitle:()=>p,default:()=>d,frontMatter:()=>n,metadata:()=>c,toc:()=>i});var r=e(74848),s=e(28453);const n={title:"How to get support",hide_title:!0,sidebar_position:1},p="How to Get Support",c={id:"troubleshooting/get-support",title:"How to get support",description:"You can access the Cado Support portal at https://support.cadosecurity.com.",source:"@site/docs/troubleshooting/get-support.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/get-support",permalink:"/troubleshooting/get-support",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/get-support.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"How to get support",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Platform security",permalink:"/cado/manage/platform-security"},next:{title:"How to send logs to Cado",permalink:"/troubleshooting/send-logs"}},a={},i=[];function u(t){const o={a:"a",h1:"h1",p:"p",...(0,s.R)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"how-to-get-support",children:"How to Get Support"}),"\n",(0,r.jsxs)(o.p,{children:["You can access the Cado Support portal at ",(0,r.jsx)(o.a,{href:"https://support.cadosecurity.com",children:"https://support.cadosecurity.com"}),"."]}),"\n",(0,r.jsxs)(o.p,{children:["Alternatively, you can contact Cado Support by emailing ",(0,r.jsx)(o.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," or by reaching out to your account manager for assistance."]})]})}function d(t={}){const{wrapper:o}={...(0,s.R)(),...t.components};return o?(0,r.jsx)(o,{...t,children:(0,r.jsx)(u,{...t})}):u(t)}},28453:(t,o,e)=>{e.d(o,{R:()=>p,x:()=>c});var r=e(96540);const s={},n=r.createContext(s);function p(t){const o=r.useContext(n);return r.useMemo((function(){return"function"==typeof t?t(o):{...o,...t}}),[o,t])}function c(t){let o;return o=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:p(t.components),r.createElement(n.Provider,{value:o},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/5ac9b2e6.a6cf9aae.js b/assets/js/5ac9b2e6.d447e73c.js similarity index 98% rename from assets/js/5ac9b2e6.a6cf9aae.js rename to assets/js/5ac9b2e6.d447e73c.js index f50152589..b495042e6 100644 --- a/assets/js/5ac9b2e6.a6cf9aae.js +++ b/assets/js/5ac9b2e6.d447e73c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1100],{32185:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>a,contentTitle:()=>d,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>l});var t=n(74848),i=n(28453);const r={title:"NFS",hide_title:!0,sidebar_position:4},d="NFS",o={id:"cado/deploy/aws/aws-nfs",title:"NFS",description:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis.",source:"@site/docs/cado/deploy/aws/aws-nfs.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/aws-nfs",permalink:"/cado/deploy/aws/aws-nfs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/aws-nfs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"NFS",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Bucket",permalink:"/cado/deploy/aws/aws-bucket"},next:{title:"Secret Manager",permalink:"/cado/deploy/aws/aws-secret-manager"}},a={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function c(e){const s={br:"br",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"nfs",children:"NFS"}),"\n",(0,t.jsx)(s.p,{children:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis."}),"\n",(0,t.jsx)(s.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"The VPC and subnet you used in the initial deployment"}),"\n",(0,t.jsx)(s.li,{children:"The security group you used in the initial deployment, and permission to edit it"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"steps",children:"Steps"}),"\n",(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsx)(s.li,{children:"Configure inbound Security Group rules. Use security group id as Custom Source"}),"\n"]}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Type"}),(0,t.jsx)(s.th,{children:"Port"}),(0,t.jsx)(s.th,{children:"Source"}),(0,t.jsx)(s.th,{children:"Reason"})]})}),(0,t.jsx)(s.tbody,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Custom TCP"}),(0,t.jsx)(s.td,{children:"2049"}),(0,t.jsx)(s.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(s.td,{children:"Communicating with NFS"})]})})]}),"\n",(0,t.jsxs)(s.ol,{start:"2",children:["\n",(0,t.jsx)(s.li,{children:"Navigate to the EFS page in AWS Console"}),"\n",(0,t.jsxs)(s.li,{children:["Click \u201c",(0,t.jsx)(s.strong,{children:"Create file system"}),"\u201d"]}),"\n",(0,t.jsxs)(s.li,{children:["Select your VPC from step 1, then press \u201c",(0,t.jsx)(s.strong,{children:"Customize"}),"\u201d."]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS Create FS",src:n(46141).A+"",width:"1212",height:"826"})}),"\n",(0,t.jsxs)(s.ol,{start:"5",children:["\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"Leave defaults unchanged for General, Performance settings and Tags. Click Next."}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"On the Network Access page"}),"\n",(0,t.jsx)(s.p,{children:"a. Under Virtual Private Cloud (VPC): Select the VPC where your instance is deployed."}),"\n",(0,t.jsx)(s.p,{children:"b. Under mount targets: Create a mount target using the subnet and security group your instance is deployed with"}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS Network Access",src:n(46364).A+"",width:"1600",height:"691"})}),"\n",(0,t.jsxs)(s.ol,{start:"7",children:["\n",(0,t.jsx)(s.li,{children:"Leave the File system policy settings unchanged. Click Next."}),"\n",(0,t.jsxs)(s.li,{children:['On the Review and Create page: click "',(0,t.jsx)(s.strong,{children:"Create"}),'"']}),"\n",(0,t.jsxs)(s.li,{children:["On the last page, confirm the settings are correct, then press \u201c",(0,t.jsx)(s.strong,{children:"Create"}),"\u201d."]}),"\n",(0,t.jsx)(s.li,{children:"Select the filesystem ID of the newly created filesystem and open the access points tab."}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS FS Overview",src:n(87330).A+"",width:"1600",height:"880"})}),"\n",(0,t.jsxs)(s.ol,{start:"11",children:["\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"Create a new access point with the following settings:"}),"\n",(0,t.jsxs)(s.p,{children:["a. Under ",(0,t.jsx)(s.strong,{children:"Details"}),", set ",(0,t.jsx)(s.strong,{children:"Root directory path"})," to ",(0,t.jsx)(s.strong,{children:"/process"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS Details",src:n(36651).A+"",width:"1600",height:"788"})}),"\n",(0,t.jsxs)(s.p,{children:["b. Under ",(0,t.jsx)(s.strong,{children:"POSIX user"}),":",(0,t.jsx)(s.br,{}),"\n","i. Set ",(0,t.jsx)(s.strong,{children:"User ID"})," to ",(0,t.jsx)(s.code,{children:"0"}),".",(0,t.jsx)(s.br,{}),"\n","ii. Set ",(0,t.jsx)(s.strong,{children:"Group ID"})," to ",(0,t.jsx)(s.code,{children:"0"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS POSIX",src:n(51840).A+"",width:"1600",height:"900"})}),"\n",(0,t.jsxs)(s.p,{children:["c. Under Root directory creation permissions:",(0,t.jsx)(s.br,{}),"\n","i. Set ",(0,t.jsx)(s.strong,{children:"Owner user ID"})," to ",(0,t.jsx)(s.code,{children:"0"}),".",(0,t.jsx)(s.br,{}),"\n","ii. Set ",(0,t.jsx)(s.strong,{children:"Owner group ID"})," to ",(0,t.jsx)(s.code,{children:"0"}),".",(0,t.jsx)(s.br,{}),"\n","iii. Set ",(0,t.jsx)(s.strong,{children:"Access point permissions"})," to ",(0,t.jsx)(s.code,{children:"0755"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS Root Permission",src:n(46369).A+"",width:"1600",height:"898"})}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Click Create"})}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"For the file system go to the Network tab and make a note of the ip address for the availability zone your VM is in"}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS AZ",src:n(28728).A+"",width:"1600",height:"1416"})}),"\n",(0,t.jsxs)(s.ol,{start:"14",children:["\n",(0,t.jsxs)(s.li,{children:["Once the access point and mount target have finished creation, Mount in the UI (",(0,t.jsx)(s.strong,{children:"Settings"})," > ",(0,t.jsx)(s.strong,{children:"Advanced"})," > ",(0,t.jsx)(s.strong,{children:"NFS"})," > ",(0,t.jsx)(s.strong,{children:"Setup NFS"}),") using the ip address of the mount target:"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS NFS",src:n(70750).A+"",width:"1600",height:"488"})})]})}function h(e={}){const{wrapper:s}={...(0,i.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28728:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-az-ddbee811dcb1fb9ef4979dcd39ac7393.png"},46141:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-create-fs-3420f1ff55e2d599df1b1bb9eaa0d098.png"},36651:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-details-9fb91b7bd66a6291a04dd5a91f4ac94f.png"},87330:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-fs-overview-9a3bacf59181a1999384c0e16e7f45a0.png"},46364:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-network-access-3b43597b6e51384b679a865798b08d73.png"},70750:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-nfs-c03dcd5b7f372709807eefe4160eab6f.png"},51840:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-posix-cbfabd042a50a35dbbd1129c26d044af.png"},46369:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-root-permission-b7e45f4fe4a276463ccfb37f37c0e6b4.png"},28453:(e,s,n)=>{n.d(s,{R:()=>d,x:()=>o});var t=n(96540);const i={},r=t.createContext(i);function d(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function o(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:d(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1100],{32185:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>a,contentTitle:()=>d,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>l});var t=n(74848),i=n(28453);const r={title:"NFS",hide_title:!0,sidebar_position:4},d="NFS",o={id:"cado/deploy/aws/aws-nfs",title:"NFS",description:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis.",source:"@site/docs/cado/deploy/aws/aws-nfs.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/aws-nfs",permalink:"/cado/deploy/aws/aws-nfs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/aws-nfs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"NFS",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Bucket",permalink:"/cado/deploy/aws/aws-bucket"},next:{title:"Secret Manager",permalink:"/cado/deploy/aws/aws-secret-manager"}},a={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function c(e){const s={br:"br",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"nfs",children:"NFS"}),"\n",(0,t.jsx)(s.p,{children:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis."}),"\n",(0,t.jsx)(s.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"The VPC and subnet you used in the initial deployment"}),"\n",(0,t.jsx)(s.li,{children:"The security group you used in the initial deployment, and permission to edit it"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"steps",children:"Steps"}),"\n",(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsx)(s.li,{children:"Configure inbound Security Group rules. Use security group id as Custom Source"}),"\n"]}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Type"}),(0,t.jsx)(s.th,{children:"Port"}),(0,t.jsx)(s.th,{children:"Source"}),(0,t.jsx)(s.th,{children:"Reason"})]})}),(0,t.jsx)(s.tbody,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Custom TCP"}),(0,t.jsx)(s.td,{children:"2049"}),(0,t.jsx)(s.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(s.td,{children:"Communicating with NFS"})]})})]}),"\n",(0,t.jsxs)(s.ol,{start:"2",children:["\n",(0,t.jsx)(s.li,{children:"Navigate to the EFS page in AWS Console"}),"\n",(0,t.jsxs)(s.li,{children:["Click \u201c",(0,t.jsx)(s.strong,{children:"Create file system"}),"\u201d"]}),"\n",(0,t.jsxs)(s.li,{children:["Select your VPC from step 1, then press \u201c",(0,t.jsx)(s.strong,{children:"Customize"}),"\u201d."]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS Create FS",src:n(46141).A+"",width:"1212",height:"826"})}),"\n",(0,t.jsxs)(s.ol,{start:"5",children:["\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"Leave defaults unchanged for General, Performance settings and Tags. Click Next."}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"On the Network Access page"}),"\n",(0,t.jsx)(s.p,{children:"a. Under Virtual Private Cloud (VPC): Select the VPC where your instance is deployed."}),"\n",(0,t.jsx)(s.p,{children:"b. Under mount targets: Create a mount target using the subnet and security group your instance is deployed with"}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS Network Access",src:n(46364).A+"",width:"1600",height:"691"})}),"\n",(0,t.jsxs)(s.ol,{start:"7",children:["\n",(0,t.jsx)(s.li,{children:"Leave the File system policy settings unchanged. Click Next."}),"\n",(0,t.jsxs)(s.li,{children:['On the Review and Create page: click "',(0,t.jsx)(s.strong,{children:"Create"}),'"']}),"\n",(0,t.jsxs)(s.li,{children:["On the last page, confirm the settings are correct, then press \u201c",(0,t.jsx)(s.strong,{children:"Create"}),"\u201d."]}),"\n",(0,t.jsx)(s.li,{children:"Select the filesystem ID of the newly created filesystem and open the access points tab."}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS FS Overview",src:n(87330).A+"",width:"1600",height:"880"})}),"\n",(0,t.jsxs)(s.ol,{start:"11",children:["\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"Create a new access point with the following settings:"}),"\n",(0,t.jsxs)(s.p,{children:["a. Under ",(0,t.jsx)(s.strong,{children:"Details"}),", set ",(0,t.jsx)(s.strong,{children:"Root directory path"})," to ",(0,t.jsx)(s.strong,{children:"/process"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS Details",src:n(36651).A+"",width:"1600",height:"788"})}),"\n",(0,t.jsxs)(s.p,{children:["b. Under ",(0,t.jsx)(s.strong,{children:"POSIX user"}),":",(0,t.jsx)(s.br,{}),"\n","i. Set ",(0,t.jsx)(s.strong,{children:"User ID"})," to ",(0,t.jsx)(s.code,{children:"0"}),".",(0,t.jsx)(s.br,{}),"\n","ii. Set ",(0,t.jsx)(s.strong,{children:"Group ID"})," to ",(0,t.jsx)(s.code,{children:"0"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS POSIX",src:n(51840).A+"",width:"1600",height:"900"})}),"\n",(0,t.jsxs)(s.p,{children:["c. Under Root directory creation permissions:",(0,t.jsx)(s.br,{}),"\n","i. Set ",(0,t.jsx)(s.strong,{children:"Owner user ID"})," to ",(0,t.jsx)(s.code,{children:"0"}),".",(0,t.jsx)(s.br,{}),"\n","ii. Set ",(0,t.jsx)(s.strong,{children:"Owner group ID"})," to ",(0,t.jsx)(s.code,{children:"0"}),".",(0,t.jsx)(s.br,{}),"\n","iii. Set ",(0,t.jsx)(s.strong,{children:"Access point permissions"})," to ",(0,t.jsx)(s.code,{children:"0755"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS Root Permission",src:n(46369).A+"",width:"1600",height:"898"})}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.strong,{children:"Click Create"})}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"For the file system go to the Network tab and make a note of the ip address for the availability zone your VM is in"}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS AZ",src:n(28728).A+"",width:"1600",height:"1416"})}),"\n",(0,t.jsxs)(s.ol,{start:"14",children:["\n",(0,t.jsxs)(s.li,{children:["Once the access point and mount target have finished creation, Mount in the UI (",(0,t.jsx)(s.strong,{children:"Settings"})," > ",(0,t.jsx)(s.strong,{children:"Advanced"})," > ",(0,t.jsx)(s.strong,{children:"NFS"})," > ",(0,t.jsx)(s.strong,{children:"Setup NFS"}),") using the ip address of the mount target:"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"AWS NFS",src:n(70750).A+"",width:"1600",height:"488"})})]})}function h(e={}){const{wrapper:s}={...(0,i.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28728:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-az-ddbee811dcb1fb9ef4979dcd39ac7393.png"},46141:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-create-fs-3420f1ff55e2d599df1b1bb9eaa0d098.png"},36651:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-details-9fb91b7bd66a6291a04dd5a91f4ac94f.png"},87330:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-fs-overview-9a3bacf59181a1999384c0e16e7f45a0.png"},46364:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-network-access-3b43597b6e51384b679a865798b08d73.png"},70750:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-nfs-c03dcd5b7f372709807eefe4160eab6f.png"},51840:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-posix-cbfabd042a50a35dbbd1129c26d044af.png"},46369:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aws-root-permission-b7e45f4fe4a276463ccfb37f37c0e6b4.png"},28453:(e,s,n)=>{n.d(s,{R:()=>d,x:()=>o});var t=n(96540);const i={},r=t.createContext(i);function d(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function o(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:d(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5b158446.a394ff00.js b/assets/js/5b158446.281ec80c.js similarity index 99% rename from assets/js/5b158446.a394ff00.js rename to assets/js/5b158446.281ec80c.js index 5532f15a4..a3a3418f6 100644 --- a/assets/js/5b158446.a394ff00.js +++ b/assets/js/5b158446.281ec80c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8870],{22321:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var n=t(74848),r=t(28453);const i={title:"Kubernetes",hide_title:!0,sidebar_position:9},o="How to Import Data from Kubernetes",c={id:"cado/discovery-import/kubernetes",title:"Kubernetes",description:"How Does Cado Import Data from EKS, ECS, AKS, and GKE?",source:"@site/docs/cado/discovery-import/kubernetes.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/kubernetes",permalink:"/cado/discovery-import/kubernetes",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/kubernetes.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:9,frontMatter:{title:"Kubernetes",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"RedHat Openshift",permalink:"/cado/discovery-import/openshift"},next:{title:"Google Workspace logs",permalink:"/cado/discovery-import/google-workspace-logs"}},a={},l=[{value:"How Does Cado Import Data from EKS, ECS, AKS, and GKE?",id:"how-does-cado-import-data-from-eks-ecs-aks-and-gke",level:2},{value:"Alternate Collection by Acquiring the Volume of the Node",id:"alternate-collection-by-acquiring-the-volume-of-the-node",level:2},{value:"Alternate Collection by Using Cado Host with a Sidecar Container",id:"alternate-collection-by-using-cado-host-with-a-sidecar-container",level:2},{value:"Kubernetes RBAC Requirements",id:"kubernetes-rbac-requirements",level:3},{value:"Using a Custom Image",id:"using-a-custom-image",level:3},{value:"Root Access",id:"root-access",level:3},{value:"Private Clusters with No Network Access",id:"private-clusters-with-no-network-access",level:2},{value:"Private AKS Clusters",id:"private-aks-clusters",level:3},{value:"Private GKE Clusters",id:"private-gke-clusters",level:3},{value:"Private EKS Clusters",id:"private-eks-clusters",level:3},{value:"Alternate Private EKS Cluster Access",id:"alternate-private-eks-cluster-access",level:4},{value:"Methods for Executing Kubernetes API Commands Inside a Private Cluster VPC",id:"methods-for-executing-kubernetes-api-commands-inside-a-private-cluster-vpc",level:3}];function d(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"how-to-import-data-from-kubernetes",children:"How to Import Data from Kubernetes"}),"\n",(0,n.jsx)(s.h2,{id:"how-does-cado-import-data-from-eks-ecs-aks-and-gke",children:"How Does Cado Import Data from EKS, ECS, AKS, and GKE?"}),"\n",(0,n.jsx)(s.p,{children:"When acquiring data from Kubernetes containers, Cado follows these steps by default:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:"Executes a shell script to download the Cado Host binary."}),"\n",(0,n.jsx)(s.li,{children:"Runs the binary to collect forensic artifacts."}),"\n",(0,n.jsx)(s.li,{children:"Uploads the collected files to cloud storage for processing."}),"\n"]}),"\n",(0,n.jsxs)(s.p,{children:["The method used to execute the script depends on the environment. For example, ECS uses ECS execute, while EKS, AKS, and GKE use the Kubernetes control plane API, as explained ",(0,n.jsx)(s.a,{href:"https://www.cadosecurity.com/how-we-sped-up-acquiring-forensic-data-from-aws-kubernetes-and-azure-kubernetes-services-by-10-times/",children:"here"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"Authentication to the Kubernetes API may require both IAM and Kubernetes RBAC permissions, which are described in service-specific documentation."}),"\n",(0,n.jsx)(s.h2,{id:"alternate-collection-by-acquiring-the-volume-of-the-node",children:"Alternate Collection by Acquiring the Volume of the Node"}),"\n",(0,n.jsx)(s.p,{children:"If executing code inside the container or connecting over the network is not possible, you can acquire the volume of the node running the container. For example, this approach works for EKS running on EC2 nodes."}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["If using the Docker container runtime, container file systems are usually available at ",(0,n.jsx)(s.code,{children:"/var/lib/docker/overlay2"}),"."]}),"\n",(0,n.jsx)(s.li,{children:"If using the Containerd runtime (which is now the default for EKS), the container file system is not immediately visible. Cado is working on supporting containerd-based volume acquisitions."}),"\n"]}),"\n",(0,n.jsx)(s.h2,{id:"alternate-collection-by-using-cado-host-with-a-sidecar-container",children:"Alternate Collection by Using Cado Host with a Sidecar Container"}),"\n",(0,n.jsxs)(s.p,{children:["Cado supports collecting from private clusters and distroless containers by using a ",(0,n.jsx)(s.a,{href:"https://kubernetes.io/docs/reference/kubectl/generated/kubectl_debug/",children:"debug container"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"To acquire data:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["Navigate to ",(0,n.jsx)(s.strong,{children:"Import > Cado Host"}),"."]}),"\n",(0,n.jsxs)(s.li,{children:["Select ",(0,n.jsx)(s.strong,{children:"Kubernetes"})," and follow the prompts."]}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Cado Host K8s UI",src:t(53584).A+"",width:"479",height:"569"})}),"\n",(0,n.jsx)(s.p,{children:"This will use a command such as the following to start a debug container and execute Cado Host:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"kubectl debug -it pod-name --image=debian:latest --target=target-container -n pod-namespace -- sh -c\n"})}),"\n",(0,n.jsx)(s.p,{children:"The diagram below provides a high-level overview of how this works:"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Cado Host K8s Flow",src:t(90124).A+"",width:"1600",height:"861"})}),"\n",(0,n.jsx)(s.h3,{id:"kubernetes-rbac-requirements",children:"Kubernetes RBAC Requirements"}),"\n",(0,n.jsxs)(s.p,{children:["Cado requires write and execute access to containers to download and run the Cado Host binary. Specifically, Cado requires ",(0,n.jsx)(s.code,{children:"get"})," and ",(0,n.jsx)(s.code,{children:"list"})," permissions for the ",(0,n.jsx)(s.code,{children:"pods"})," resource, and ",(0,n.jsx)(s.code,{children:"get"})," and ",(0,n.jsx)(s.code,{children:"create"})," permissions for the ",(0,n.jsx)(s.code,{children:"pods/exec"})," resource."]}),"\n",(0,n.jsx)(s.h3,{id:"using-a-custom-image",children:"Using a Custom Image"}),"\n",(0,n.jsxs)(s.p,{children:["In environments where the default ",(0,n.jsx)(s.code,{children:"debian:latest"})," image is not supported, you can use a custom image. The custom image must have the latest Cado Host Linux binary located at ",(0,n.jsx)(s.code,{children:"/tmp/cado-host-static/cado-host"}),". However, Cado recommends using the default ",(0,n.jsx)(s.code,{children:"debian:latest"})," image for supportability."]}),"\n",(0,n.jsx)(s.h3,{id:"root-access",children:"Root Access"}),"\n",(0,n.jsxs)(s.p,{children:["By default, Cado Host requires root access to access the underlying container file system (usually under ",(0,n.jsx)(s.code,{children:"/proc/{PID}/root"}),"). The ",(0,n.jsx)(s.code,{children:"runuser"})," command with the root user is also required to give the Cado Host process the appropriate UID and GID."]}),"\n",(0,n.jsxs)(s.p,{children:['For Kubernetes v1.30 or later, you can optionally use the "Run as non-root user" option, which leverages the ',(0,n.jsx)(s.a,{href:"https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/",children:"sysadmin"})," profile to access the container file system."]}),"\n",(0,n.jsx)(s.h2,{id:"private-clusters-with-no-network-access",children:"Private Clusters with No Network Access"}),"\n",(0,n.jsx)(s.p,{children:"Cado requires access to the Kubernetes control plane API to acquire containers via the user interface. If network access to the Kubernetes API is not available, alternate options for acquiring data are needed."}),"\n",(0,n.jsx)(s.h3,{id:"private-aks-clusters",children:"Private AKS Clusters"}),"\n",(0,n.jsx)(s.p,{children:'Cado can acquire private AKS clusters using the normal user interface, thanks to Azure\'s "command invoke" feature for private clusters.'}),"\n",(0,n.jsx)(s.h3,{id:"private-gke-clusters",children:"Private GKE Clusters"}),"\n",(0,n.jsx)(s.p,{children:"Cado is exploring support for private GKE clusters through public endpoints on private clusters."}),"\n",(0,n.jsx)(s.h3,{id:"private-eks-clusters",children:"Private EKS Clusters"}),"\n",(0,n.jsx)(s.p,{children:'Private EKS clusters can be configured to be accessible only from within the VPC they reside in or connected networks (e.g., peered VPCs). If the cluster is configured with "Private endpoint only," you will need to use a method like VPC peering or another connection option to access the API.'}),"\n",(0,n.jsxs)(s.p,{children:["If Cado cannot access the cluster endpoint, you can use the ",(0,n.jsx)(s.strong,{children:"Alternate Private EKS Cluster Access"})," method described below."]}),"\n",(0,n.jsx)(s.h4,{id:"alternate-private-eks-cluster-access",children:"Alternate Private EKS Cluster Access"}),"\n",(0,n.jsx)(s.p,{children:"If the Cado platform does not have access to the cluster endpoint, you can acquire data by deploying the Cado Host acquisition script."}),"\n",(0,n.jsx)(s.p,{children:"To do this, connect to your EKS cluster using a command like:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"aws eks update-kubeconfig --region $Region --name $ClusterName\n"})}),"\n",(0,n.jsxs)(s.p,{children:["Follow AWS\u2019s instructions ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html",children:"here"}),"."]}),"\n",(0,n.jsxs)(s.p,{children:["Then execute the ",(0,n.jsx)(s.code,{children:"kubectl"})," script generated at ",(0,n.jsx)(s.strong,{children:"Import > Cado Host > Kubernetes"}),"."]}),"\n",(0,n.jsx)(s.h3,{id:"methods-for-executing-kubernetes-api-commands-inside-a-private-cluster-vpc",children:"Methods for Executing Kubernetes API Commands Inside a Private Cluster VPC"}),"\n",(0,n.jsx)(s.p,{children:"Various methods can be used to access the Kubernetes API in a private VPC, including:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.strong,{children:"Bastion Hosts"})}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"SSM"})," (AWS Systems Manager)"]}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.strong,{children:"AWS PrivateLink"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.strong,{children:"AWS Cloud9"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.strong,{children:"VPN/Direct Connect"})}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:"For details on these methods, refer to the following resources:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Bastion Hosts"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://cloudtipss.com/Create-Private-EKS-With-Bastion/",children:"How to connect using a Bastion Host"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://medium.com/@muppedaanvesh/jump-box-setup-on-eks-cluster-383ca92f51ef",children:"Terraform setup for a Bastion Host"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"SSM"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://awstip.com/securely-connect-to-a-private-eks-cluster-using-aws-ssm-session-forwarding-systems-manager-5d0767edea61",children:"Securely connect to a private EKS cluster using AWS SSM"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"VPN/Direct Connect"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect.html",children:"AWS VPC Connectivity Options"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://hodovi.cc/blog/private-eks-api-endpoint-behind-openvpn/",children:"OpenVPN setup for private EKS API endpoint"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"PrivateLink"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://docs.zeet.co/guides/advanced/eks-privatelink/",children:"Using PrivateLink with EKS"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/eks/latest/userguide/vpc-interface-endpoints.html",children:"EKS VPC Interface Endpoints"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Cloud9"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://stackoverflow.com/questions/65049271/how-to-connect-to-eks-cluster-from-cloud-9-instance-using-kubectl",children:"Connecting to an EKS Cluster from Cloud9"})}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},53584:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/cado-host-k8s-9104fa210ad3e4b85816262656d9ace6.png"},90124:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/kubernetes-flow-351ca536095a264300f480d80c086329.png"},28453:(e,s,t)=>{t.d(s,{R:()=>o,x:()=>c});var n=t(96540);const r={},i=n.createContext(r);function o(e){const s=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8870],{22321:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var n=t(74848),r=t(28453);const i={title:"Kubernetes",hide_title:!0,sidebar_position:9},o="How to Import Data from Kubernetes",c={id:"cado/discovery-import/kubernetes",title:"Kubernetes",description:"How Does Cado Import Data from EKS, ECS, AKS, and GKE?",source:"@site/docs/cado/discovery-import/kubernetes.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/kubernetes",permalink:"/cado/discovery-import/kubernetes",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/kubernetes.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:9,frontMatter:{title:"Kubernetes",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"RedHat Openshift",permalink:"/cado/discovery-import/openshift"},next:{title:"Google Workspace logs",permalink:"/cado/discovery-import/google-workspace-logs"}},a={},l=[{value:"How Does Cado Import Data from EKS, ECS, AKS, and GKE?",id:"how-does-cado-import-data-from-eks-ecs-aks-and-gke",level:2},{value:"Alternate Collection by Acquiring the Volume of the Node",id:"alternate-collection-by-acquiring-the-volume-of-the-node",level:2},{value:"Alternate Collection by Using Cado Host with a Sidecar Container",id:"alternate-collection-by-using-cado-host-with-a-sidecar-container",level:2},{value:"Kubernetes RBAC Requirements",id:"kubernetes-rbac-requirements",level:3},{value:"Using a Custom Image",id:"using-a-custom-image",level:3},{value:"Root Access",id:"root-access",level:3},{value:"Private Clusters with No Network Access",id:"private-clusters-with-no-network-access",level:2},{value:"Private AKS Clusters",id:"private-aks-clusters",level:3},{value:"Private GKE Clusters",id:"private-gke-clusters",level:3},{value:"Private EKS Clusters",id:"private-eks-clusters",level:3},{value:"Alternate Private EKS Cluster Access",id:"alternate-private-eks-cluster-access",level:4},{value:"Methods for Executing Kubernetes API Commands Inside a Private Cluster VPC",id:"methods-for-executing-kubernetes-api-commands-inside-a-private-cluster-vpc",level:3}];function d(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"how-to-import-data-from-kubernetes",children:"How to Import Data from Kubernetes"}),"\n",(0,n.jsx)(s.h2,{id:"how-does-cado-import-data-from-eks-ecs-aks-and-gke",children:"How Does Cado Import Data from EKS, ECS, AKS, and GKE?"}),"\n",(0,n.jsx)(s.p,{children:"When acquiring data from Kubernetes containers, Cado follows these steps by default:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:"Executes a shell script to download the Cado Host binary."}),"\n",(0,n.jsx)(s.li,{children:"Runs the binary to collect forensic artifacts."}),"\n",(0,n.jsx)(s.li,{children:"Uploads the collected files to cloud storage for processing."}),"\n"]}),"\n",(0,n.jsxs)(s.p,{children:["The method used to execute the script depends on the environment. For example, ECS uses ECS execute, while EKS, AKS, and GKE use the Kubernetes control plane API, as explained ",(0,n.jsx)(s.a,{href:"https://www.cadosecurity.com/how-we-sped-up-acquiring-forensic-data-from-aws-kubernetes-and-azure-kubernetes-services-by-10-times/",children:"here"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"Authentication to the Kubernetes API may require both IAM and Kubernetes RBAC permissions, which are described in service-specific documentation."}),"\n",(0,n.jsx)(s.h2,{id:"alternate-collection-by-acquiring-the-volume-of-the-node",children:"Alternate Collection by Acquiring the Volume of the Node"}),"\n",(0,n.jsx)(s.p,{children:"If executing code inside the container or connecting over the network is not possible, you can acquire the volume of the node running the container. For example, this approach works for EKS running on EC2 nodes."}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["If using the Docker container runtime, container file systems are usually available at ",(0,n.jsx)(s.code,{children:"/var/lib/docker/overlay2"}),"."]}),"\n",(0,n.jsx)(s.li,{children:"If using the Containerd runtime (which is now the default for EKS), the container file system is not immediately visible. Cado is working on supporting containerd-based volume acquisitions."}),"\n"]}),"\n",(0,n.jsx)(s.h2,{id:"alternate-collection-by-using-cado-host-with-a-sidecar-container",children:"Alternate Collection by Using Cado Host with a Sidecar Container"}),"\n",(0,n.jsxs)(s.p,{children:["Cado supports collecting from private clusters and distroless containers by using a ",(0,n.jsx)(s.a,{href:"https://kubernetes.io/docs/reference/kubectl/generated/kubectl_debug/",children:"debug container"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"To acquire data:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["Navigate to ",(0,n.jsx)(s.strong,{children:"Import > Cado Host"}),"."]}),"\n",(0,n.jsxs)(s.li,{children:["Select ",(0,n.jsx)(s.strong,{children:"Kubernetes"})," and follow the prompts."]}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Cado Host K8s UI",src:t(53584).A+"",width:"479",height:"569"})}),"\n",(0,n.jsx)(s.p,{children:"This will use a command such as the following to start a debug container and execute Cado Host:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"kubectl debug -it pod-name --image=debian:latest --target=target-container -n pod-namespace -- sh -c\n"})}),"\n",(0,n.jsx)(s.p,{children:"The diagram below provides a high-level overview of how this works:"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Cado Host K8s Flow",src:t(90124).A+"",width:"1600",height:"861"})}),"\n",(0,n.jsx)(s.h3,{id:"kubernetes-rbac-requirements",children:"Kubernetes RBAC Requirements"}),"\n",(0,n.jsxs)(s.p,{children:["Cado requires write and execute access to containers to download and run the Cado Host binary. Specifically, Cado requires ",(0,n.jsx)(s.code,{children:"get"})," and ",(0,n.jsx)(s.code,{children:"list"})," permissions for the ",(0,n.jsx)(s.code,{children:"pods"})," resource, and ",(0,n.jsx)(s.code,{children:"get"})," and ",(0,n.jsx)(s.code,{children:"create"})," permissions for the ",(0,n.jsx)(s.code,{children:"pods/exec"})," resource."]}),"\n",(0,n.jsx)(s.h3,{id:"using-a-custom-image",children:"Using a Custom Image"}),"\n",(0,n.jsxs)(s.p,{children:["In environments where the default ",(0,n.jsx)(s.code,{children:"debian:latest"})," image is not supported, you can use a custom image. The custom image must have the latest Cado Host Linux binary located at ",(0,n.jsx)(s.code,{children:"/tmp/cado-host-static/cado-host"}),". However, Cado recommends using the default ",(0,n.jsx)(s.code,{children:"debian:latest"})," image for supportability."]}),"\n",(0,n.jsx)(s.h3,{id:"root-access",children:"Root Access"}),"\n",(0,n.jsxs)(s.p,{children:["By default, Cado Host requires root access to access the underlying container file system (usually under ",(0,n.jsx)(s.code,{children:"/proc/{PID}/root"}),"). The ",(0,n.jsx)(s.code,{children:"runuser"})," command with the root user is also required to give the Cado Host process the appropriate UID and GID."]}),"\n",(0,n.jsxs)(s.p,{children:['For Kubernetes v1.30 or later, you can optionally use the "Run as non-root user" option, which leverages the ',(0,n.jsx)(s.a,{href:"https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/",children:"sysadmin"})," profile to access the container file system."]}),"\n",(0,n.jsx)(s.h2,{id:"private-clusters-with-no-network-access",children:"Private Clusters with No Network Access"}),"\n",(0,n.jsx)(s.p,{children:"Cado requires access to the Kubernetes control plane API to acquire containers via the user interface. If network access to the Kubernetes API is not available, alternate options for acquiring data are needed."}),"\n",(0,n.jsx)(s.h3,{id:"private-aks-clusters",children:"Private AKS Clusters"}),"\n",(0,n.jsx)(s.p,{children:'Cado can acquire private AKS clusters using the normal user interface, thanks to Azure\'s "command invoke" feature for private clusters.'}),"\n",(0,n.jsx)(s.h3,{id:"private-gke-clusters",children:"Private GKE Clusters"}),"\n",(0,n.jsx)(s.p,{children:"Cado is exploring support for private GKE clusters through public endpoints on private clusters."}),"\n",(0,n.jsx)(s.h3,{id:"private-eks-clusters",children:"Private EKS Clusters"}),"\n",(0,n.jsx)(s.p,{children:'Private EKS clusters can be configured to be accessible only from within the VPC they reside in or connected networks (e.g., peered VPCs). If the cluster is configured with "Private endpoint only," you will need to use a method like VPC peering or another connection option to access the API.'}),"\n",(0,n.jsxs)(s.p,{children:["If Cado cannot access the cluster endpoint, you can use the ",(0,n.jsx)(s.strong,{children:"Alternate Private EKS Cluster Access"})," method described below."]}),"\n",(0,n.jsx)(s.h4,{id:"alternate-private-eks-cluster-access",children:"Alternate Private EKS Cluster Access"}),"\n",(0,n.jsx)(s.p,{children:"If the Cado platform does not have access to the cluster endpoint, you can acquire data by deploying the Cado Host acquisition script."}),"\n",(0,n.jsx)(s.p,{children:"To do this, connect to your EKS cluster using a command like:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"aws eks update-kubeconfig --region $Region --name $ClusterName\n"})}),"\n",(0,n.jsxs)(s.p,{children:["Follow AWS\u2019s instructions ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html",children:"here"}),"."]}),"\n",(0,n.jsxs)(s.p,{children:["Then execute the ",(0,n.jsx)(s.code,{children:"kubectl"})," script generated at ",(0,n.jsx)(s.strong,{children:"Import > Cado Host > Kubernetes"}),"."]}),"\n",(0,n.jsx)(s.h3,{id:"methods-for-executing-kubernetes-api-commands-inside-a-private-cluster-vpc",children:"Methods for Executing Kubernetes API Commands Inside a Private Cluster VPC"}),"\n",(0,n.jsx)(s.p,{children:"Various methods can be used to access the Kubernetes API in a private VPC, including:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.strong,{children:"Bastion Hosts"})}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"SSM"})," (AWS Systems Manager)"]}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.strong,{children:"AWS PrivateLink"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.strong,{children:"AWS Cloud9"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.strong,{children:"VPN/Direct Connect"})}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:"For details on these methods, refer to the following resources:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Bastion Hosts"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://cloudtipss.com/Create-Private-EKS-With-Bastion/",children:"How to connect using a Bastion Host"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://medium.com/@muppedaanvesh/jump-box-setup-on-eks-cluster-383ca92f51ef",children:"Terraform setup for a Bastion Host"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"SSM"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://awstip.com/securely-connect-to-a-private-eks-cluster-using-aws-ssm-session-forwarding-systems-manager-5d0767edea61",children:"Securely connect to a private EKS cluster using AWS SSM"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"VPN/Direct Connect"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect.html",children:"AWS VPC Connectivity Options"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://hodovi.cc/blog/private-eks-api-endpoint-behind-openvpn/",children:"OpenVPN setup for private EKS API endpoint"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"PrivateLink"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://docs.zeet.co/guides/advanced/eks-privatelink/",children:"Using PrivateLink with EKS"})}),"\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/eks/latest/userguide/vpc-interface-endpoints.html",children:"EKS VPC Interface Endpoints"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Cloud9"}),":"]}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"https://stackoverflow.com/questions/65049271/how-to-connect-to-eks-cluster-from-cloud-9-instance-using-kubectl",children:"Connecting to an EKS Cluster from Cloud9"})}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},53584:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/cado-host-k8s-9104fa210ad3e4b85816262656d9ace6.png"},90124:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/kubernetes-flow-351ca536095a264300f480d80c086329.png"},28453:(e,s,t)=>{t.d(s,{R:()=>o,x:()=>c});var n=t(96540);const r={},i=n.createContext(r);function o(e){const s=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5b1f4994.4487fe9c.js b/assets/js/5b1f4994.49cc5c22.js similarity index 98% rename from assets/js/5b1f4994.4487fe9c.js rename to assets/js/5b1f4994.49cc5c22.js index 8c2cc7d33..82e943509 100644 --- a/assets/js/5b1f4994.4487fe9c.js +++ b/assets/js/5b1f4994.49cc5c22.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5285],{72038:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>d,toc:()=>l});var i=n(74848),s=n(28453);const o={title:"How to export to SIEM",hide_title:!0,sidebar_position:3},r="How to Export to SIEM",d={id:"cado/integrations/siem",title:"How to export to SIEM",description:"Security Information and Event Management (SIEM) tools provide real-time analysis of security events from applications and network devices. SIEM systems are essential for SecOps teams to correlate events, analyze logs across different systems, and manage security risks efficiently. By integrating the Cado platform with SIEM, you can leverage the power of both SIEM and Cado\u2019s unique cloud-based forensic capabilities.",source:"@site/docs/cado/integrations/siem.md",sourceDirName:"cado/integrations",slug:"/cado/integrations/siem",permalink:"/cado/integrations/siem",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/siem.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"How to export to SIEM",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Export to on-premise forensic tools",permalink:"/cado/integrations/forensic-tools"},next:{title:"Webhooks",permalink:"/cado/integrations/webhooks"}},a={},l=[{value:"Getting Started",id:"getting-started",level:2},{value:"Cado CEF Standard",id:"cado-cef-standard",level:2},{value:"CEF Extensions",id:"cef-extensions",level:3},{value:"CadoJson Format",id:"cadojson-format",level:2},{value:"Log Analysis Considerations between SIEM & Cado",id:"log-analysis-considerations-between-siem--cado",level:2}];function c(e){const t={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-export-to-siem",children:"How to Export to SIEM"}),"\n",(0,i.jsx)(t.p,{children:"Security Information and Event Management (SIEM) tools provide real-time analysis of security events from applications and network devices. SIEM systems are essential for SecOps teams to correlate events, analyze logs across different systems, and manage security risks efficiently. By integrating the Cado platform with SIEM, you can leverage the power of both SIEM and Cado\u2019s unique cloud-based forensic capabilities."}),"\n",(0,i.jsx)(t.p,{children:"Cado converts the processed timeline into two formats:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"CEF (Common Event Format)"}),": A widely recognized format for SIEM systems"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"CadoJson"}),": A custom JSON format optimized for certain SIEM systems like Splunk and Sentinel"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Both formats are uploaded to the AWS S3 bucket and folder of your choice, and you can configure your SIEM system to automatically import these files."}),"\n",(0,i.jsx)(t.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,i.jsx)(t.p,{children:"To begin exporting timelines to your SIEM:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Enable the SIEM integration by navigating to ",(0,i.jsx)(t.strong,{children:"Settings -> Platform Settings -> Integrations -> SIEM"}),"."]}),"\n",(0,i.jsx)(t.li,{children:"Set the desired S3 bucket and folder where the timeline files will be exported."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"SIEM Settings in Cado",src:n(24633).A+"",width:"1221",height:"967"})}),"\n",(0,i.jsx)(t.p,{children:"Once enabled, whenever you import evidence into Cado, the timeline will automatically be converted and uploaded to the specified S3 location. You will need to configure your SIEM to monitor this folder for new files and import them automatically."}),"\n",(0,i.jsx)(t.h2,{id:"cado-cef-standard",children:"Cado CEF Standard"}),"\n",(0,i.jsx)(t.p,{children:"Below is an example of a CEF log generated by Cado:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{children:"CEF:0|CadoSecurity|CadoResponse|1.0.2|0|Content Modification Time|10|alarm=True evidence_id=2 evidence_name=aws_compromise.zip macb=M... source=FILE eventTime=1595194940 filePath=/tmp/file.txt eventId=Q5FBqHwBX9dvp1T5IsHT msg=Malicious File Detected: cryptomining_malware_wannamine\n"})}),"\n",(0,i.jsx)(t.p,{children:"The CEF log follows this standard format:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"CEF:0|CadoSecurity|CadoResponse|Version|Signature ID|Name|Severity|Extension"})}),"\n",(0,i.jsx)(t.p,{children:'The "Extension" part contains key-value pairs with additional fields, as detailed below.'}),"\n",(0,i.jsx)(t.h3,{id:"cef-extensions",children:"CEF Extensions"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"EXTENSION FIELD"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"eventTime"}),(0,i.jsx)(t.td,{children:"890430600"}),(0,i.jsx)(t.td,{children:"int"}),(0,i.jsx)(t.td,{children:"Unix timestamp of the event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"source"}),(0,i.jsx)(t.td,{children:"REG"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Subtype of the event source."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"sourcetype"}),(0,i.jsx)(t.td,{children:"LOG"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Type of file or data producing the event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"type"}),(0,i.jsx)(t.td,{children:"Content Modification Time"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Event type (e.g., Last Executed Time, Content Modification Time)."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"filePath"}),(0,i.jsx)(t.td,{children:"/Users/nromanoff/NTUSER.DAT"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Path of the file linked to this event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"short"}),(0,i.jsx)(t.td,{children:"Executable in suspicious location"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Summary of the event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"evidence_id"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"int"}),(0,i.jsx)(t.td,{children:"ID of the evidence item in Cado."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"alarm_severity"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"int"}),(0,i.jsx)(t.td,{children:"Event severity (Malicious: 1, Suspicious: 3, Other: 10)."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"macb"}),(0,i.jsx)(t.td,{children:".A.."}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"MACB (Modification, Access, Change, Birth) representation."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"host"}),(0,i.jsx)(t.td,{children:"EC2AMAZ-T80EJE1"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Hostname linked to the event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"inode"}),(0,i.jsx)(t.td,{children:"123"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Inode or file system identifier."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"alarm"}),(0,i.jsx)(t.td,{children:"True"}),(0,i.jsx)(t.td,{children:"bool"}),(0,i.jsx)(t.td,{children:"Whether this event has an associated alarm."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"sha256"}),(0,i.jsx)(t.td,{children:"9473976..."}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"SHA-256 hash of the related file."})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"cadojson-format",children:"CadoJson Format"}),"\n",(0,i.jsxs)(t.p,{children:["The ",(0,i.jsx)(t.strong,{children:"CadoJson"})," format contains the same fields as CEF, represented in JSON structure. Here is an example:"]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n\t"macb": "M...",\n\t"source": "REG",\n\t"sourcetype": "Registry Key",\n\t"type": "Content Modification Time",\n\t"host": "-",\n\t"short": "[HKEY_CURRENT_USER/AppEvents/Schemes/Apps/.Default/Notification.Proximity] (empty)",\n\t"inode": "-",\n\t"sha256": "9473976b2769337ca9a7243bf1ceddb3335f9551e113240ebb0c53ae789878d5",\n\t"eventTime": 1610559005,\n\t"filePath": "/NTUSER.DAT"\n}\n'})}),"\n",(0,i.jsx)(t.h2,{id:"log-analysis-considerations-between-siem--cado",children:"Log Analysis Considerations between SIEM & Cado"}),"\n",(0,i.jsxs)(t.p,{children:["For more information about how SIEM logs compare to Cado's forensic capabilities, refer to ",(0,i.jsx)(t.a,{href:"/cado/discovery-import/data-types/logs#log-analysis-considerations",children:"this guide"}),"."]})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},24633:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/siem-settings-72e698a1df218c4294f1588602513965.png"},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>d});var i=n(96540);const s={},o=i.createContext(s);function r(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5285],{72038:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>d,toc:()=>l});var i=n(74848),s=n(28453);const o={title:"How to export to SIEM",hide_title:!0,sidebar_position:3},r="How to Export to SIEM",d={id:"cado/integrations/siem",title:"How to export to SIEM",description:"Security Information and Event Management (SIEM) tools provide real-time analysis of security events from applications and network devices. SIEM systems are essential for SecOps teams to correlate events, analyze logs across different systems, and manage security risks efficiently. By integrating the Cado platform with SIEM, you can leverage the power of both SIEM and Cado\u2019s unique cloud-based forensic capabilities.",source:"@site/docs/cado/integrations/siem.md",sourceDirName:"cado/integrations",slug:"/cado/integrations/siem",permalink:"/cado/integrations/siem",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/siem.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"How to export to SIEM",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Export to on-premise forensic tools",permalink:"/cado/integrations/forensic-tools"},next:{title:"Webhooks",permalink:"/cado/integrations/webhooks"}},a={},l=[{value:"Getting Started",id:"getting-started",level:2},{value:"Cado CEF Standard",id:"cado-cef-standard",level:2},{value:"CEF Extensions",id:"cef-extensions",level:3},{value:"CadoJson Format",id:"cadojson-format",level:2},{value:"Log Analysis Considerations between SIEM & Cado",id:"log-analysis-considerations-between-siem--cado",level:2}];function c(e){const t={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-export-to-siem",children:"How to Export to SIEM"}),"\n",(0,i.jsx)(t.p,{children:"Security Information and Event Management (SIEM) tools provide real-time analysis of security events from applications and network devices. SIEM systems are essential for SecOps teams to correlate events, analyze logs across different systems, and manage security risks efficiently. By integrating the Cado platform with SIEM, you can leverage the power of both SIEM and Cado\u2019s unique cloud-based forensic capabilities."}),"\n",(0,i.jsx)(t.p,{children:"Cado converts the processed timeline into two formats:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"CEF (Common Event Format)"}),": A widely recognized format for SIEM systems"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"CadoJson"}),": A custom JSON format optimized for certain SIEM systems like Splunk and Sentinel"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Both formats are uploaded to the AWS S3 bucket and folder of your choice, and you can configure your SIEM system to automatically import these files."}),"\n",(0,i.jsx)(t.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,i.jsx)(t.p,{children:"To begin exporting timelines to your SIEM:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Enable the SIEM integration by navigating to ",(0,i.jsx)(t.strong,{children:"Settings -> Platform Settings -> Integrations -> SIEM"}),"."]}),"\n",(0,i.jsx)(t.li,{children:"Set the desired S3 bucket and folder where the timeline files will be exported."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"SIEM Settings in Cado",src:n(24633).A+"",width:"1221",height:"967"})}),"\n",(0,i.jsx)(t.p,{children:"Once enabled, whenever you import evidence into Cado, the timeline will automatically be converted and uploaded to the specified S3 location. You will need to configure your SIEM to monitor this folder for new files and import them automatically."}),"\n",(0,i.jsx)(t.h2,{id:"cado-cef-standard",children:"Cado CEF Standard"}),"\n",(0,i.jsx)(t.p,{children:"Below is an example of a CEF log generated by Cado:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{children:"CEF:0|CadoSecurity|CadoResponse|1.0.2|0|Content Modification Time|10|alarm=True evidence_id=2 evidence_name=aws_compromise.zip macb=M... source=FILE eventTime=1595194940 filePath=/tmp/file.txt eventId=Q5FBqHwBX9dvp1T5IsHT msg=Malicious File Detected: cryptomining_malware_wannamine\n"})}),"\n",(0,i.jsx)(t.p,{children:"The CEF log follows this standard format:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"CEF:0|CadoSecurity|CadoResponse|Version|Signature ID|Name|Severity|Extension"})}),"\n",(0,i.jsx)(t.p,{children:'The "Extension" part contains key-value pairs with additional fields, as detailed below.'}),"\n",(0,i.jsx)(t.h3,{id:"cef-extensions",children:"CEF Extensions"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"EXTENSION FIELD"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"eventTime"}),(0,i.jsx)(t.td,{children:"890430600"}),(0,i.jsx)(t.td,{children:"int"}),(0,i.jsx)(t.td,{children:"Unix timestamp of the event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"source"}),(0,i.jsx)(t.td,{children:"REG"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Subtype of the event source."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"sourcetype"}),(0,i.jsx)(t.td,{children:"LOG"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Type of file or data producing the event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"type"}),(0,i.jsx)(t.td,{children:"Content Modification Time"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Event type (e.g., Last Executed Time, Content Modification Time)."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"filePath"}),(0,i.jsx)(t.td,{children:"/Users/nromanoff/NTUSER.DAT"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Path of the file linked to this event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"short"}),(0,i.jsx)(t.td,{children:"Executable in suspicious location"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Summary of the event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"evidence_id"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"int"}),(0,i.jsx)(t.td,{children:"ID of the evidence item in Cado."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"alarm_severity"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"int"}),(0,i.jsx)(t.td,{children:"Event severity (Malicious: 1, Suspicious: 3, Other: 10)."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"macb"}),(0,i.jsx)(t.td,{children:".A.."}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"MACB (Modification, Access, Change, Birth) representation."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"host"}),(0,i.jsx)(t.td,{children:"EC2AMAZ-T80EJE1"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Hostname linked to the event."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"inode"}),(0,i.jsx)(t.td,{children:"123"}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"Inode or file system identifier."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"alarm"}),(0,i.jsx)(t.td,{children:"True"}),(0,i.jsx)(t.td,{children:"bool"}),(0,i.jsx)(t.td,{children:"Whether this event has an associated alarm."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"sha256"}),(0,i.jsx)(t.td,{children:"9473976..."}),(0,i.jsx)(t.td,{children:"str"}),(0,i.jsx)(t.td,{children:"SHA-256 hash of the related file."})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"cadojson-format",children:"CadoJson Format"}),"\n",(0,i.jsxs)(t.p,{children:["The ",(0,i.jsx)(t.strong,{children:"CadoJson"})," format contains the same fields as CEF, represented in JSON structure. Here is an example:"]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n\t"macb": "M...",\n\t"source": "REG",\n\t"sourcetype": "Registry Key",\n\t"type": "Content Modification Time",\n\t"host": "-",\n\t"short": "[HKEY_CURRENT_USER/AppEvents/Schemes/Apps/.Default/Notification.Proximity] (empty)",\n\t"inode": "-",\n\t"sha256": "9473976b2769337ca9a7243bf1ceddb3335f9551e113240ebb0c53ae789878d5",\n\t"eventTime": 1610559005,\n\t"filePath": "/NTUSER.DAT"\n}\n'})}),"\n",(0,i.jsx)(t.h2,{id:"log-analysis-considerations-between-siem--cado",children:"Log Analysis Considerations between SIEM & Cado"}),"\n",(0,i.jsxs)(t.p,{children:["For more information about how SIEM logs compare to Cado's forensic capabilities, refer to ",(0,i.jsx)(t.a,{href:"/cado/discovery-import/data-types/logs#log-analysis-considerations",children:"this guide"}),"."]})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},24633:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/siem-settings-72e698a1df218c4294f1588602513965.png"},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>d});var i=n(96540);const s={},o=i.createContext(s);function r(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5b5d7d75.6c36debc.js b/assets/js/5b5d7d75.53bb183b.js similarity index 97% rename from assets/js/5b5d7d75.6c36debc.js rename to assets/js/5b5d7d75.53bb183b.js index 06fc4a0cc..1b43593d5 100644 --- a/assets/js/5b5d7d75.6c36debc.js +++ b/assets/js/5b5d7d75.53bb183b.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1908],{17219:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>s,default:()=>p,frontMatter:()=>r,metadata:()=>d,toc:()=>c});var i=n(74848),o=n(28453);const r={title:"XDR platforms",hide_title:!0,sidebar_position:7},s="How to Import Data from XDR Platforms",d={id:"cado/discovery-import/xdr",title:"XDR platforms",description:"You can import data into the Cado platform using an eXtended Detection and Response (XDR) system. Cado Host can be quickly deployed to compromised Windows and Linux machines via XDR vendors such as CrowdStrike, SentinelOne, and Microsoft Defender. However, macOS is not currently supported for SentinelOne and Defender integrations.",source:"@site/docs/cado/discovery-import/xdr.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/xdr",permalink:"/cado/discovery-import/xdr",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/xdr.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"XDR platforms",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Oracle Cloud Virtual Machines",permalink:"/cado/discovery-import/virtual-machine"},next:{title:"RedHat Openshift",permalink:"/cado/discovery-import/openshift"}},a={},c=[{value:"Importing Data via XDR",id:"importing-data-via-xdr",level:2}];function l(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-data-from-xdr-platforms",children:"How to Import Data from XDR Platforms"}),"\n",(0,i.jsx)(t.p,{children:"You can import data into the Cado platform using an eXtended Detection and Response (XDR) system. Cado Host can be quickly deployed to compromised Windows and Linux machines via XDR vendors such as CrowdStrike, SentinelOne, and Microsoft Defender. However, macOS is not currently supported for SentinelOne and Defender integrations."}),"\n",(0,i.jsx)(t.p,{children:"For detailed setup instructions, refer to the following pages:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/xdr/sentinelone",children:"SentinelOne Integration Setup"})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/xdr/crowdstrike",children:"CrowdStrike Integration Setup"})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/xdr/defender",children:"Defender Integration Setup"})}),"\n"]}),"\n",(0,i.jsx)(t.h2,{id:"importing-data-via-xdr",children:"Importing Data via XDR"}),"\n",(0,i.jsx)(t.p,{children:"Once the integration is set up, follow these steps to import data:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["From within an investigation, click ",(0,i.jsx)(t.strong,{children:"Import from XDR"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Select the XDR platform you have set up and click ",(0,i.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Choose XDR Platform",src:n(64588).A+"",width:"957",height:"197"})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Search for or select the endpoint you want to collect data from, and click ",(0,i.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Import XDR Endpoints",src:n(33685).A+"",width:"1847",height:"408"})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Confirm your selections and click ",(0,i.jsx)(t.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Once initiated, Cado will begin importing data from the selected endpoint via the XDR platform."})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},64588:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/xdr-import-2-5b5410836dbf05bb46ef55a7674385a2.png"},33685:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/xdr-import-3-94a70eb2c01cb4fad976f534c453edb3.png"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>d});var i=n(96540);const o={},r=i.createContext(o);function s(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1908],{17219:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>s,default:()=>p,frontMatter:()=>r,metadata:()=>d,toc:()=>c});var i=n(74848),o=n(28453);const r={title:"XDR platforms",hide_title:!0,sidebar_position:7},s="How to Import Data from XDR Platforms",d={id:"cado/discovery-import/xdr",title:"XDR platforms",description:"You can import data into the Cado platform using an eXtended Detection and Response (XDR) system. Cado Host can be quickly deployed to compromised Windows and Linux machines via XDR vendors such as CrowdStrike, SentinelOne, and Microsoft Defender. However, macOS is not currently supported for SentinelOne and Defender integrations.",source:"@site/docs/cado/discovery-import/xdr.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/xdr",permalink:"/cado/discovery-import/xdr",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/xdr.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"XDR platforms",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Oracle Cloud Virtual Machines",permalink:"/cado/discovery-import/virtual-machine"},next:{title:"RedHat Openshift",permalink:"/cado/discovery-import/openshift"}},a={},c=[{value:"Importing Data via XDR",id:"importing-data-via-xdr",level:2}];function l(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-data-from-xdr-platforms",children:"How to Import Data from XDR Platforms"}),"\n",(0,i.jsx)(t.p,{children:"You can import data into the Cado platform using an eXtended Detection and Response (XDR) system. Cado Host can be quickly deployed to compromised Windows and Linux machines via XDR vendors such as CrowdStrike, SentinelOne, and Microsoft Defender. However, macOS is not currently supported for SentinelOne and Defender integrations."}),"\n",(0,i.jsx)(t.p,{children:"For detailed setup instructions, refer to the following pages:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/xdr/sentinelone",children:"SentinelOne Integration Setup"})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/xdr/crowdstrike",children:"CrowdStrike Integration Setup"})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/xdr/defender",children:"Defender Integration Setup"})}),"\n"]}),"\n",(0,i.jsx)(t.h2,{id:"importing-data-via-xdr",children:"Importing Data via XDR"}),"\n",(0,i.jsx)(t.p,{children:"Once the integration is set up, follow these steps to import data:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["From within an investigation, click ",(0,i.jsx)(t.strong,{children:"Import from XDR"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Select the XDR platform you have set up and click ",(0,i.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Choose XDR Platform",src:n(64588).A+"",width:"957",height:"197"})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Search for or select the endpoint you want to collect data from, and click ",(0,i.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Import XDR Endpoints",src:n(33685).A+"",width:"1847",height:"408"})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Confirm your selections and click ",(0,i.jsx)(t.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Once initiated, Cado will begin importing data from the selected endpoint via the XDR platform."})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},64588:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/xdr-import-2-5b5410836dbf05bb46ef55a7674385a2.png"},33685:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/xdr-import-3-94a70eb2c01cb4fad976f534c453edb3.png"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>d});var i=n(96540);const o={},r=i.createContext(o);function s(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5c704a9a.2c4133e1.js b/assets/js/5c704a9a.6d398e42.js similarity index 98% rename from assets/js/5c704a9a.2c4133e1.js rename to assets/js/5c704a9a.6d398e42.js index 675fe09a5..7535db809 100644 --- a/assets/js/5c704a9a.2c4133e1.js +++ b/assets/js/5c704a9a.6d398e42.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1509],{46892:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>t,default:()=>g,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var i=s(74848),l=s(28453);const o={title:"GCP Logging Best Practices",hide_title:!0,sidebar_position:12},t="GCP Logging Best Practices",r={id:"cado/deploy/gcp/logs",title:"GCP Logging Best Practices",description:"Google Cloud Platform (GCP) centralizes logs with Cloud Logging. Properly enabling, storing, and analyzing logs helps secure your environment and streamline incident response (IR). Below are key practices:",source:"@site/docs/cado/deploy/gcp/logs.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/logs",permalink:"/cado/deploy/gcp/logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/logs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:12,frontMatter:{title:"GCP Logging Best Practices",hide_title:!0,sidebar_position:12},sidebar:"tutorialSidebar",previous:{title:"Workers",permalink:"/cado/deploy/gcp/gcp-workers"},next:{title:"Cross cloud",permalink:"/cado/deploy/cross/intro"}},c={},d=[{value:"1. Use Cloud Audit Logs",id:"1-use-cloud-audit-logs",level:2},{value:"2. Configure Buckets and Retention",id:"2-configure-buckets-and-retention",level:2},{value:"3. Protect and Control Access",id:"3-protect-and-control-access",level:2},{value:"4. Monitor with Alerts",id:"4-monitor-with-alerts",level:2},{value:"5. VPC Flow Logs",id:"5-vpc-flow-logs",level:2},{value:"6. Logging Highlights by Service",id:"6-logging-highlights-by-service",level:2},{value:"References",id:"references",level:3}];function a(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,l.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"gcp-logging-best-practices",children:"GCP Logging Best Practices"}),"\n",(0,i.jsxs)(n.p,{children:["Google Cloud Platform (GCP) centralizes logs with ",(0,i.jsx)(n.a,{href:"https://cloud.google.com/logging/",children:"Cloud Logging"}),". Properly enabling, storing, and analyzing logs helps secure your environment and streamline incident response (IR). Below are key practices:"]}),"\n",(0,i.jsx)(n.h2,{id:"1-use-cloud-audit-logs",children:"1. Use Cloud Audit Logs"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Admin Activity Logs"})," (always on) track configuration changes (e.g., creating or deleting resources)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Data Access Logs"})," (disabled by default) capture data read/write operations\u2014be sure to enable them."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"System Event Logs"})," (always on) note Google system-driven changes (e.g., maintenance events)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Policy Denied Logs"})," (enabled by default) record security policy violations."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"2-configure-buckets-and-retention",children:"2. Configure Buckets and Retention"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"_Required Bucket"}),": Retains critical logs (Admin Activity, System Event) for 400 days (not adjustable)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"_Default Bucket"}),": Retains other logs (e.g., Data Access) for 30 days (can adjust)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"User-Defined Buckets"}),": Route logs here using sinks. Customize retention and apply ",(0,i.jsx)(n.strong,{children:"Bucket Lock"})," if needed."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"3-protect-and-control-access",children:"3. Protect and Control Access"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Customer-Managed Encryption Keys (CMEK)"})," for tighter encryption control."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"IAM Roles"}),": Use least privilege (e.g., ",(0,i.jsx)(n.code,{children:"logging.viewer"}),", ",(0,i.jsx)(n.code,{children:"logging.privateLogViewer"}),", ",(0,i.jsx)(n.code,{children:"logging.admin"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Log Views"})," to segment access for different teams."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Field-Level Access Controls"})," to redact sensitive data (incompatible with Log Analytics)."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"4-monitor-with-alerts",children:"4. Monitor with Alerts"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Log-Based Metrics"})," detect critical events (e.g., changes to audit configurations or firewall rules)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Cloud Monitoring"})," generates alerts for suspicious logs."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Security Command Center (SCC)"})," surfaces potential threats in near-real time."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"5-vpc-flow-logs",children:"5. VPC Flow Logs"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Enable ",(0,i.jsx)(n.a,{href:"https://cloud.google.com/vpc/docs/using-flow-logs",children:"VPC Flow Logs"})," for network visibility."]}),"\n",(0,i.jsxs)(n.li,{children:["Adjust ",(0,i.jsx)(n.strong,{children:"aggregation interval"})," and ",(0,i.jsx)(n.strong,{children:"sample rate"})," to balance detail vs. cost."]}),"\n",(0,i.jsx)(n.li,{children:"Export to BigQuery or Cloud Storage if you need long-term retention."}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"6-logging-highlights-by-service",children:"6. Logging Highlights by Service"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Compute Engine (GCE)"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Admin logs: creation, deletion, modification (on by default)."}),"\n",(0,i.jsx)(n.li,{children:"Data logs: must be manually enabled for reads/lists."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Kubernetes Engine (GKE)"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Admin logs: cannot be disabled."}),"\n",(0,i.jsx)(n.li,{children:"Control Plane logs: optionally enabled."}),"\n",(0,i.jsx)(n.li,{children:"Container logs: ephemeral by default\u2014use the GKE logging agent."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Cloud Storage (GCS)"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Admin logs: always on (e.g., bucket creation)."}),"\n",(0,i.jsx)(n.li,{children:"Data logs: enable for object access/read/write."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Virtual Private Cloud (VPC)"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Admin logs: track subnets, firewalls, routes."}),"\n",(0,i.jsx)(n.li,{children:"Data logs: enable for listing networks, subnets, etc."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"references",children:"References"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"https://www.cadosecurity.com/blog/how-to-be-ir-prepared-in-google-cloud-platform-gcp",children:"How to be IR Prepared in GCP"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"https://www.cadosecurity.com/blog/decoding-logs-in-the-cloud-gcp-admin-activity-logs",children:"Decoding GCP Logs"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"https://cloud.google.com/logging/docs/audit/best-practices",children:"Cloud Audit Logs Best Practices"})}),"\n"]})]})}function g(e={}){const{wrapper:n}={...(0,l.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},28453:(e,n,s)=>{s.d(n,{R:()=>t,x:()=>r});var i=s(96540);const l={},o=i.createContext(l);function t(e){const n=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(l):e.components||l:t(e.components),i.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1509],{46892:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>t,default:()=>g,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var i=s(74848),l=s(28453);const o={title:"GCP Logging Best Practices",hide_title:!0,sidebar_position:12},t="GCP Logging Best Practices",r={id:"cado/deploy/gcp/logs",title:"GCP Logging Best Practices",description:"Google Cloud Platform (GCP) centralizes logs with Cloud Logging. Properly enabling, storing, and analyzing logs helps secure your environment and streamline incident response (IR). Below are key practices:",source:"@site/docs/cado/deploy/gcp/logs.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/logs",permalink:"/cado/deploy/gcp/logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/logs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:12,frontMatter:{title:"GCP Logging Best Practices",hide_title:!0,sidebar_position:12},sidebar:"tutorialSidebar",previous:{title:"Workers",permalink:"/cado/deploy/gcp/gcp-workers"},next:{title:"Cross cloud",permalink:"/cado/deploy/cross/intro"}},c={},d=[{value:"1. Use Cloud Audit Logs",id:"1-use-cloud-audit-logs",level:2},{value:"2. Configure Buckets and Retention",id:"2-configure-buckets-and-retention",level:2},{value:"3. Protect and Control Access",id:"3-protect-and-control-access",level:2},{value:"4. Monitor with Alerts",id:"4-monitor-with-alerts",level:2},{value:"5. VPC Flow Logs",id:"5-vpc-flow-logs",level:2},{value:"6. Logging Highlights by Service",id:"6-logging-highlights-by-service",level:2},{value:"References",id:"references",level:3}];function a(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,l.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"gcp-logging-best-practices",children:"GCP Logging Best Practices"}),"\n",(0,i.jsxs)(n.p,{children:["Google Cloud Platform (GCP) centralizes logs with ",(0,i.jsx)(n.a,{href:"https://cloud.google.com/logging/",children:"Cloud Logging"}),". Properly enabling, storing, and analyzing logs helps secure your environment and streamline incident response (IR). Below are key practices:"]}),"\n",(0,i.jsx)(n.h2,{id:"1-use-cloud-audit-logs",children:"1. Use Cloud Audit Logs"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Admin Activity Logs"})," (always on) track configuration changes (e.g., creating or deleting resources)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Data Access Logs"})," (disabled by default) capture data read/write operations\u2014be sure to enable them."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"System Event Logs"})," (always on) note Google system-driven changes (e.g., maintenance events)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Policy Denied Logs"})," (enabled by default) record security policy violations."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"2-configure-buckets-and-retention",children:"2. Configure Buckets and Retention"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"_Required Bucket"}),": Retains critical logs (Admin Activity, System Event) for 400 days (not adjustable)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"_Default Bucket"}),": Retains other logs (e.g., Data Access) for 30 days (can adjust)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"User-Defined Buckets"}),": Route logs here using sinks. Customize retention and apply ",(0,i.jsx)(n.strong,{children:"Bucket Lock"})," if needed."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"3-protect-and-control-access",children:"3. Protect and Control Access"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Customer-Managed Encryption Keys (CMEK)"})," for tighter encryption control."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"IAM Roles"}),": Use least privilege (e.g., ",(0,i.jsx)(n.code,{children:"logging.viewer"}),", ",(0,i.jsx)(n.code,{children:"logging.privateLogViewer"}),", ",(0,i.jsx)(n.code,{children:"logging.admin"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Log Views"})," to segment access for different teams."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Field-Level Access Controls"})," to redact sensitive data (incompatible with Log Analytics)."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"4-monitor-with-alerts",children:"4. Monitor with Alerts"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Log-Based Metrics"})," detect critical events (e.g., changes to audit configurations or firewall rules)."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Cloud Monitoring"})," generates alerts for suspicious logs."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Security Command Center (SCC)"})," surfaces potential threats in near-real time."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"5-vpc-flow-logs",children:"5. VPC Flow Logs"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Enable ",(0,i.jsx)(n.a,{href:"https://cloud.google.com/vpc/docs/using-flow-logs",children:"VPC Flow Logs"})," for network visibility."]}),"\n",(0,i.jsxs)(n.li,{children:["Adjust ",(0,i.jsx)(n.strong,{children:"aggregation interval"})," and ",(0,i.jsx)(n.strong,{children:"sample rate"})," to balance detail vs. cost."]}),"\n",(0,i.jsx)(n.li,{children:"Export to BigQuery or Cloud Storage if you need long-term retention."}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"6-logging-highlights-by-service",children:"6. Logging Highlights by Service"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Compute Engine (GCE)"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Admin logs: creation, deletion, modification (on by default)."}),"\n",(0,i.jsx)(n.li,{children:"Data logs: must be manually enabled for reads/lists."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Kubernetes Engine (GKE)"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Admin logs: cannot be disabled."}),"\n",(0,i.jsx)(n.li,{children:"Control Plane logs: optionally enabled."}),"\n",(0,i.jsx)(n.li,{children:"Container logs: ephemeral by default\u2014use the GKE logging agent."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Cloud Storage (GCS)"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Admin logs: always on (e.g., bucket creation)."}),"\n",(0,i.jsx)(n.li,{children:"Data logs: enable for object access/read/write."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Virtual Private Cloud (VPC)"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Admin logs: track subnets, firewalls, routes."}),"\n",(0,i.jsx)(n.li,{children:"Data logs: enable for listing networks, subnets, etc."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"references",children:"References"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"https://www.cadosecurity.com/blog/how-to-be-ir-prepared-in-google-cloud-platform-gcp",children:"How to be IR Prepared in GCP"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"https://www.cadosecurity.com/blog/decoding-logs-in-the-cloud-gcp-admin-activity-logs",children:"Decoding GCP Logs"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"https://cloud.google.com/logging/docs/audit/best-practices",children:"Cloud Audit Logs Best Practices"})}),"\n"]})]})}function g(e={}){const{wrapper:n}={...(0,l.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},28453:(e,n,s)=>{s.d(n,{R:()=>t,x:()=>r});var i=s(96540);const l={},o=i.createContext(l);function t(e){const n=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(l):e.components||l:t(e.components),i.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5d4adb54.460d1299.js b/assets/js/5d4adb54.ffca21fe.js similarity index 97% rename from assets/js/5d4adb54.460d1299.js rename to assets/js/5d4adb54.ffca21fe.js index d324b7eb6..591f179e1 100644 --- a/assets/js/5d4adb54.460d1299.js +++ b/assets/js/5d4adb54.ffca21fe.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4076],{27863:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>l,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var s=i(74848),n=i(28453);const a={title:"Insights Tab",hide_title:!0,sidebar_position:3},o="What is the Insights Tab?",r={id:"cado/investigate/insights",title:"Insights Tab",description:"The Insights tab provides a high-level overview of the data in your investigation.",source:"@site/docs/cado/investigate/insights.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/insights",permalink:"/cado/investigate/insights",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/insights.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Insights Tab",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Evidence",permalink:"/cado/investigate/evidence"},next:{title:"Overview Tab",permalink:"/cado/investigate/overview"}},d={},c=[{value:"Key Events",id:"key-events",level:2},{value:"Potentially Compromised Users and Assets",id:"potentially-compromised-users-and-assets",level:2},{value:"OS Distribution",id:"os-distribution",level:2},{value:"Acquisition Source",id:"acquisition-source",level:2},{value:"MITRE ATT&CK Categories Observed",id:"mitre-attck-categories-observed",level:2},{value:"Data Sources",id:"data-sources",level:2},{value:"Event Types",id:"event-types",level:2},{value:"Indicator Matches",id:"indicator-matches",level:2},{value:"Extracted Indicators",id:"extracted-indicators",level:2},{value:"Evidence Items by Unique Indicator Matches",id:"evidence-items-by-unique-indicator-matches",level:2}];function h(e){const t={h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"what-is-the-insights-tab",children:"What is the Insights Tab?"}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.strong,{children:"Insights"})," tab provides a high-level overview of the data in your investigation."]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Insights tab",src:i(30062).A+"",width:"960",height:"540"})}),"\n",(0,s.jsx)(t.h2,{id:"key-events",children:"Key Events"}),"\n",(0,s.jsxs)(t.p,{children:["Displays detections of malicious and suspicious activity. Click ",(0,s.jsx)(t.strong,{children:'"View More"'})," to see additional events."]}),"\n",(0,s.jsx)(t.h2,{id:"potentially-compromised-users-and-assets",children:"Potentially Compromised Users and Assets"}),"\n",(0,s.jsxs)(t.p,{children:["This section identifies users and assets that may be compromised. It's similar to the ",(0,s.jsx)(t.strong,{children:"Search"}),' tab when you filter by "Users" or "Hostnames" on the left.']}),"\n",(0,s.jsx)(t.h2,{id:"os-distribution",children:"OS Distribution"}),"\n",(0,s.jsx)(t.p,{children:"Shows the distribution of operating systems present in the investigation."}),"\n",(0,s.jsx)(t.h2,{id:"acquisition-source",children:"Acquisition Source"}),"\n",(0,s.jsx)(t.p,{children:"Displays the source of the data acquired during the investigation."}),"\n",(0,s.jsx)(t.h2,{id:"mitre-attck-categories-observed",children:"MITRE ATT&CK Categories Observed"}),"\n",(0,s.jsx)(t.p,{children:"Shows which MITRE ATT&CK categories were detected during the investigation. Click on a bar to view related events."}),"\n",(0,s.jsx)(t.h2,{id:"data-sources",children:"Data Sources"}),"\n",(0,s.jsxs)(t.p,{children:["Represents the types of events in the investigation (e.g., Windows Event logs, Linux audit logs). Click to search for events from that source. A more detailed view is available under the ",(0,s.jsx)(t.strong,{children:"Search"}),' tab by selecting "Datasource" on the left.']}),"\n",(0,s.jsx)(t.h2,{id:"event-types",children:"Event Types"}),"\n",(0,s.jsx)(t.p,{children:"Displays the types of events found in the investigation, such as logon events or process creation events. Click to search for events by type."}),"\n",(0,s.jsx)(t.h2,{id:"indicator-matches",children:"Indicator Matches"}),"\n",(0,s.jsxs)(t.p,{children:["Shows the number of indicator matches in the investigation. You can add more indicators under ",(0,s.jsx)(t.strong,{children:"Settings > Detections"}),"."]}),"\n",(0,s.jsx)(t.h2,{id:"extracted-indicators",children:"Extracted Indicators"}),"\n",(0,s.jsx)(t.p,{children:"If a file triggers a detection, its file hash is extracted and displayed here."}),"\n",(0,s.jsx)(t.h2,{id:"evidence-items-by-unique-indicator-matches",children:"Evidence Items by Unique Indicator Matches"}),"\n",(0,s.jsx)(t.p,{children:"Shows the number of evidence items associated with unique indicator matches."})]})}function l(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},30062:(e,t,i)=>{i.d(t,{A:()=>s});const s=i.p+"assets/images/Insights-78d87bd6a6a7e6592cafbdddbf8cd6ea.png"},28453:(e,t,i)=>{i.d(t,{R:()=>o,x:()=>r});var s=i(96540);const n={},a=s.createContext(n);function o(e){const t=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),s.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4076],{27863:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>l,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var s=i(74848),n=i(28453);const a={title:"Insights Tab",hide_title:!0,sidebar_position:3},o="What is the Insights Tab?",r={id:"cado/investigate/insights",title:"Insights Tab",description:"The Insights tab provides a high-level overview of the data in your investigation.",source:"@site/docs/cado/investigate/insights.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/insights",permalink:"/cado/investigate/insights",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/insights.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Insights Tab",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Evidence",permalink:"/cado/investigate/evidence"},next:{title:"Overview Tab",permalink:"/cado/investigate/overview"}},d={},c=[{value:"Key Events",id:"key-events",level:2},{value:"Potentially Compromised Users and Assets",id:"potentially-compromised-users-and-assets",level:2},{value:"OS Distribution",id:"os-distribution",level:2},{value:"Acquisition Source",id:"acquisition-source",level:2},{value:"MITRE ATT&CK Categories Observed",id:"mitre-attck-categories-observed",level:2},{value:"Data Sources",id:"data-sources",level:2},{value:"Event Types",id:"event-types",level:2},{value:"Indicator Matches",id:"indicator-matches",level:2},{value:"Extracted Indicators",id:"extracted-indicators",level:2},{value:"Evidence Items by Unique Indicator Matches",id:"evidence-items-by-unique-indicator-matches",level:2}];function h(e){const t={h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"what-is-the-insights-tab",children:"What is the Insights Tab?"}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.strong,{children:"Insights"})," tab provides a high-level overview of the data in your investigation."]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Insights tab",src:i(30062).A+"",width:"960",height:"540"})}),"\n",(0,s.jsx)(t.h2,{id:"key-events",children:"Key Events"}),"\n",(0,s.jsxs)(t.p,{children:["Displays detections of malicious and suspicious activity. Click ",(0,s.jsx)(t.strong,{children:'"View More"'})," to see additional events."]}),"\n",(0,s.jsx)(t.h2,{id:"potentially-compromised-users-and-assets",children:"Potentially Compromised Users and Assets"}),"\n",(0,s.jsxs)(t.p,{children:["This section identifies users and assets that may be compromised. It's similar to the ",(0,s.jsx)(t.strong,{children:"Search"}),' tab when you filter by "Users" or "Hostnames" on the left.']}),"\n",(0,s.jsx)(t.h2,{id:"os-distribution",children:"OS Distribution"}),"\n",(0,s.jsx)(t.p,{children:"Shows the distribution of operating systems present in the investigation."}),"\n",(0,s.jsx)(t.h2,{id:"acquisition-source",children:"Acquisition Source"}),"\n",(0,s.jsx)(t.p,{children:"Displays the source of the data acquired during the investigation."}),"\n",(0,s.jsx)(t.h2,{id:"mitre-attck-categories-observed",children:"MITRE ATT&CK Categories Observed"}),"\n",(0,s.jsx)(t.p,{children:"Shows which MITRE ATT&CK categories were detected during the investigation. Click on a bar to view related events."}),"\n",(0,s.jsx)(t.h2,{id:"data-sources",children:"Data Sources"}),"\n",(0,s.jsxs)(t.p,{children:["Represents the types of events in the investigation (e.g., Windows Event logs, Linux audit logs). Click to search for events from that source. A more detailed view is available under the ",(0,s.jsx)(t.strong,{children:"Search"}),' tab by selecting "Datasource" on the left.']}),"\n",(0,s.jsx)(t.h2,{id:"event-types",children:"Event Types"}),"\n",(0,s.jsx)(t.p,{children:"Displays the types of events found in the investigation, such as logon events or process creation events. Click to search for events by type."}),"\n",(0,s.jsx)(t.h2,{id:"indicator-matches",children:"Indicator Matches"}),"\n",(0,s.jsxs)(t.p,{children:["Shows the number of indicator matches in the investigation. You can add more indicators under ",(0,s.jsx)(t.strong,{children:"Settings > Detections"}),"."]}),"\n",(0,s.jsx)(t.h2,{id:"extracted-indicators",children:"Extracted Indicators"}),"\n",(0,s.jsx)(t.p,{children:"If a file triggers a detection, its file hash is extracted and displayed here."}),"\n",(0,s.jsx)(t.h2,{id:"evidence-items-by-unique-indicator-matches",children:"Evidence Items by Unique Indicator Matches"}),"\n",(0,s.jsx)(t.p,{children:"Shows the number of evidence items associated with unique indicator matches."})]})}function l(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},30062:(e,t,i)=>{i.d(t,{A:()=>s});const s=i.p+"assets/images/Insights-78d87bd6a6a7e6592cafbdddbf8cd6ea.png"},28453:(e,t,i)=>{i.d(t,{R:()=>o,x:()=>r});var s=i(96540);const n={},a=s.createContext(n);function o(e){const t=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),s.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5dcab45d.c0167119.js b/assets/js/5dcab45d.73ca0046.js similarity index 97% rename from assets/js/5dcab45d.c0167119.js rename to assets/js/5dcab45d.73ca0046.js index 6b224ec53..907a7e804 100644 --- a/assets/js/5dcab45d.c0167119.js +++ b/assets/js/5dcab45d.73ca0046.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4681],{65251:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var n=s(74848),i=s(28453);const o={title:"Response actions",hide_title:!0,sidebar_position:4},r="What are Response Actions?",c={id:"cado/investigate/response-actions",title:"Response actions",description:"Response Actions allow you to take remediation steps when malicious activity is detected on a virtual machine. You can also trigger these actions using Automation Rules.",source:"@site/docs/cado/investigate/response-actions.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/response-actions",permalink:"/cado/investigate/response-actions",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/response-actions.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Response actions",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Browse Disk",permalink:"/cado/investigate/browse-disk"},next:{title:"Adding detections",permalink:"/cado/investigate/detections"}},a={},d=[{value:"Permissions Required",id:"permissions-required",level:3}];function l(e){const t={a:"a",code:"code",h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-are-response-actions",children:"What are Response Actions?"}),"\n",(0,n.jsxs)(t.p,{children:["Response Actions allow you to take remediation steps when malicious activity is detected on a virtual machine. You can also trigger these actions using ",(0,n.jsx)(t.a,{href:"/cado/discovery-import/automation",children:"Automation Rules"}),"."]}),"\n",(0,n.jsxs)(t.p,{children:["Currently, Response Actions support only ",(0,n.jsx)(t.a,{href:"/cado/discovery-import/aws/aws-ec2#triage-capture",children:"AWS EC2 instances acquired as a triage collection"}),'. To initiate a response action, select the instance ID from the "Suspected Compromised Assets" table.']}),"\n",(0,n.jsxs)(t.p,{children:["Use the panel on the right to select the ",(0,n.jsx)(t.strong,{children:'"Actions"'})," tab, choose the desired action, and click ",(0,n.jsx)(t.strong,{children:'"Invoke"'}),"."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Actions",src:s(47010).A+"",width:"842",height:"418"})}),"\n",(0,n.jsx)(t.h3,{id:"permissions-required",children:"Permissions Required"}),"\n",(0,n.jsx)(t.p,{children:"Each action requires specific AWS IAM permissions. The table below lists each action, its description, and the permissions needed. Ensure these permissions are added to your Cado role and that the role has the required scope to cover the resource you want to perform actions on."}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Action"}),(0,n.jsx)(t.th,{children:"Description"}),(0,n.jsx)(t.th,{children:"Required Permissions"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Stop Instance"}),(0,n.jsx)(t.td,{children:"Stops an EC2 instance via the AWS API"}),(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"ec2:StopInstances"})})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Isolate Role"}),(0,n.jsx)(t.td,{children:'Isolates the IAM role attached to an EC2 instance by adding a "deny all" inline policy to the IAM role.'}),(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"iam:PutRolePolicy"})})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Isolate Security Group"}),(0,n.jsx)(t.td,{children:"Isolates the security group attached to an EC2 instance by attaching a new blank security group. Existing connections will not be dropped."}),(0,n.jsxs)(t.td,{children:[(0,n.jsx)(t.code,{children:"ec2:CreateSecurityGroup"}),", ",(0,n.jsx)(t.code,{children:"ec2:RevokeSecurityGroupEgress"}),", ",(0,n.jsx)(t.code,{children:"ec2:ModifyInstanceAttribute"})]})]})]})]}),"\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Note"}),": To perform an action on an asset in a different AWS account, you must have ",(0,n.jsx)(t.a,{href:"/cado/deploy/cross/cross-account-creation",children:"Cross Account roles"})," configured, and the relevant permissions must be added to the role in the other account."]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},47010:(e,t,s)=>{s.d(t,{A:()=>n});const n=s.p+"assets/images/actions-tab-5585992eb81a41af00c49a1f502ff8e2.png"},28453:(e,t,s)=>{s.d(t,{R:()=>r,x:()=>c});var n=s(96540);const i={},o=n.createContext(i);function r(e){const t=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4681],{65251:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var n=s(74848),i=s(28453);const o={title:"Response actions",hide_title:!0,sidebar_position:4},r="What are Response Actions?",c={id:"cado/investigate/response-actions",title:"Response actions",description:"Response Actions allow you to take remediation steps when malicious activity is detected on a virtual machine. You can also trigger these actions using Automation Rules.",source:"@site/docs/cado/investigate/response-actions.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/response-actions",permalink:"/cado/investigate/response-actions",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/response-actions.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Response actions",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Browse Disk",permalink:"/cado/investigate/browse-disk"},next:{title:"Adding detections",permalink:"/cado/investigate/detections"}},a={},d=[{value:"Permissions Required",id:"permissions-required",level:3}];function l(e){const t={a:"a",code:"code",h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-are-response-actions",children:"What are Response Actions?"}),"\n",(0,n.jsxs)(t.p,{children:["Response Actions allow you to take remediation steps when malicious activity is detected on a virtual machine. You can also trigger these actions using ",(0,n.jsx)(t.a,{href:"/cado/discovery-import/automation",children:"Automation Rules"}),"."]}),"\n",(0,n.jsxs)(t.p,{children:["Currently, Response Actions support only ",(0,n.jsx)(t.a,{href:"/cado/discovery-import/aws/aws-ec2#triage-capture",children:"AWS EC2 instances acquired as a triage collection"}),'. To initiate a response action, select the instance ID from the "Suspected Compromised Assets" table.']}),"\n",(0,n.jsxs)(t.p,{children:["Use the panel on the right to select the ",(0,n.jsx)(t.strong,{children:'"Actions"'})," tab, choose the desired action, and click ",(0,n.jsx)(t.strong,{children:'"Invoke"'}),"."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Actions",src:s(47010).A+"",width:"842",height:"418"})}),"\n",(0,n.jsx)(t.h3,{id:"permissions-required",children:"Permissions Required"}),"\n",(0,n.jsx)(t.p,{children:"Each action requires specific AWS IAM permissions. The table below lists each action, its description, and the permissions needed. Ensure these permissions are added to your Cado role and that the role has the required scope to cover the resource you want to perform actions on."}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Action"}),(0,n.jsx)(t.th,{children:"Description"}),(0,n.jsx)(t.th,{children:"Required Permissions"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Stop Instance"}),(0,n.jsx)(t.td,{children:"Stops an EC2 instance via the AWS API"}),(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"ec2:StopInstances"})})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Isolate Role"}),(0,n.jsx)(t.td,{children:'Isolates the IAM role attached to an EC2 instance by adding a "deny all" inline policy to the IAM role.'}),(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"iam:PutRolePolicy"})})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Isolate Security Group"}),(0,n.jsx)(t.td,{children:"Isolates the security group attached to an EC2 instance by attaching a new blank security group. Existing connections will not be dropped."}),(0,n.jsxs)(t.td,{children:[(0,n.jsx)(t.code,{children:"ec2:CreateSecurityGroup"}),", ",(0,n.jsx)(t.code,{children:"ec2:RevokeSecurityGroupEgress"}),", ",(0,n.jsx)(t.code,{children:"ec2:ModifyInstanceAttribute"})]})]})]})]}),"\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Note"}),": To perform an action on an asset in a different AWS account, you must have ",(0,n.jsx)(t.a,{href:"/cado/deploy/cross/cross-account-creation",children:"Cross Account roles"})," configured, and the relevant permissions must be added to the role in the other account."]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},47010:(e,t,s)=>{s.d(t,{A:()=>n});const n=s.p+"assets/images/actions-tab-5585992eb81a41af00c49a1f502ff8e2.png"},28453:(e,t,s)=>{s.d(t,{R:()=>r,x:()=>c});var n=s(96540);const i={},o=n.createContext(i);function r(e){const t=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6019cb09.d4e33d4b.js b/assets/js/6019cb09.09197b09.js similarity index 97% rename from assets/js/6019cb09.d4e33d4b.js rename to assets/js/6019cb09.09197b09.js index 158c9d1c5..680549492 100644 --- a/assets/js/6019cb09.d4e33d4b.js +++ b/assets/js/6019cb09.09197b09.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3361],{70197:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>s,toc:()=>d});var r=i(74848),o=i(28453);const n={title:"Cado architecture in AWS",hide_title:!0,sidebar_position:3},a="What is the Cado architecture in AWS?",s={id:"cado/deploy/aws/architecture",title:"Cado architecture in AWS",description:"The Cado platform is deployed directly into your AWS environment using either a CloudFormation Template, a Terraform script, or via the AWS Marketplace. Once deployed, the platform creates an isolated VPC (Virtual Private Cloud) where you can control access and permissions. This allows for secure and customized deployment within your AWS infrastructure. The entire process typically takes less than 25 minutes from start to finish.",source:"@site/docs/cado/deploy/aws/architecture.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/architecture",permalink:"/cado/deploy/aws/architecture",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/architecture.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Cado architecture in AWS",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Deploy with Terraform",permalink:"/cado/deploy/aws/terraform"},next:{title:"Supported regions and GovCloud",permalink:"/cado/deploy/aws/regions"}},c={},d=[{value:"CPU Limits and Recommendations",id:"cpu-limits-and-recommendations",level:2},{value:"Cado Platform Components",id:"cado-platform-components",level:2},{value:"Security Features",id:"security-features",level:2}];function l(e){const t={a:"a",blockquote:"blockquote",h1:"h1",h2:"h2",img:"img",p:"p",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"what-is-the-cado-architecture-in-aws",children:"What is the Cado architecture in AWS?"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform is deployed directly into your AWS environment using either a CloudFormation Template, a Terraform script, or via the AWS Marketplace. Once deployed, the platform creates an isolated VPC (Virtual Private Cloud) where you can control access and permissions. This allows for secure and customized deployment within your AWS infrastructure. The entire process typically takes less than 25 minutes from start to finish."}),"\n",(0,r.jsx)(t.h2,{id:"cpu-limits-and-recommendations",children:"CPU Limits and Recommendations"}),"\n",(0,r.jsxs)(t.p,{children:["By default, AWS limits the number of vCPUs you can run in a region to 32. For optimal performance, we recommend increasing this limit to 128 vCPUs, especially for faster processing. You can request this increase by filling out ",(0,r.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-on-demand-instances.html#vcpu-limits-request-increase",children:"this form"}),' and asking for 128 vCPUs under "Running On-Demand All Standard Instances."']}),"\n",(0,r.jsx)(t.h2,{id:"cado-platform-components",children:"Cado Platform Components"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform consists of several key components that work together to deliver its capabilities. The platform is designed to be flexible and secure, supporting both internet-connected and private deployments. For environments with strict security requirements, the platform supports private deployments with no internet access and proxy inspection."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Cado AWS Architecture",src:i(82532).A+"",width:"960",height:"540"})}),"\n",(0,r.jsxs)(t.blockquote,{children:["\n",(0,r.jsx)(t.p,{children:"Note: The diagram above provides a simplified overview of the Cado architecture in AWS."}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"security-features",children:"Security Features"}),"\n",(0,r.jsx)(t.p,{children:"Cado\u2019s architecture supports environments with stringent security needs, offering private deployments with no internet access and the ability to utilize proxy inspection, ensuring compliance with security policies."})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},82532:(e,t,i)=>{i.d(t,{A:()=>r});const r=i.p+"assets/images/aws-architecture-a6303ba92ca40461c3a1e0d2d3dcad63.png"},28453:(e,t,i)=>{i.d(t,{R:()=>a,x:()=>s});var r=i(96540);const o={},n=r.createContext(o);function a(e){const t=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),r.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3361],{70197:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>s,toc:()=>d});var r=i(74848),o=i(28453);const n={title:"Cado architecture in AWS",hide_title:!0,sidebar_position:3},a="What is the Cado architecture in AWS?",s={id:"cado/deploy/aws/architecture",title:"Cado architecture in AWS",description:"The Cado platform is deployed directly into your AWS environment using either a CloudFormation Template, a Terraform script, or via the AWS Marketplace. Once deployed, the platform creates an isolated VPC (Virtual Private Cloud) where you can control access and permissions. This allows for secure and customized deployment within your AWS infrastructure. The entire process typically takes less than 25 minutes from start to finish.",source:"@site/docs/cado/deploy/aws/architecture.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/architecture",permalink:"/cado/deploy/aws/architecture",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/architecture.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Cado architecture in AWS",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Deploy with Terraform",permalink:"/cado/deploy/aws/terraform"},next:{title:"Supported regions and GovCloud",permalink:"/cado/deploy/aws/regions"}},c={},d=[{value:"CPU Limits and Recommendations",id:"cpu-limits-and-recommendations",level:2},{value:"Cado Platform Components",id:"cado-platform-components",level:2},{value:"Security Features",id:"security-features",level:2}];function l(e){const t={a:"a",blockquote:"blockquote",h1:"h1",h2:"h2",img:"img",p:"p",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"what-is-the-cado-architecture-in-aws",children:"What is the Cado architecture in AWS?"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform is deployed directly into your AWS environment using either a CloudFormation Template, a Terraform script, or via the AWS Marketplace. Once deployed, the platform creates an isolated VPC (Virtual Private Cloud) where you can control access and permissions. This allows for secure and customized deployment within your AWS infrastructure. The entire process typically takes less than 25 minutes from start to finish."}),"\n",(0,r.jsx)(t.h2,{id:"cpu-limits-and-recommendations",children:"CPU Limits and Recommendations"}),"\n",(0,r.jsxs)(t.p,{children:["By default, AWS limits the number of vCPUs you can run in a region to 32. For optimal performance, we recommend increasing this limit to 128 vCPUs, especially for faster processing. You can request this increase by filling out ",(0,r.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-on-demand-instances.html#vcpu-limits-request-increase",children:"this form"}),' and asking for 128 vCPUs under "Running On-Demand All Standard Instances."']}),"\n",(0,r.jsx)(t.h2,{id:"cado-platform-components",children:"Cado Platform Components"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform consists of several key components that work together to deliver its capabilities. The platform is designed to be flexible and secure, supporting both internet-connected and private deployments. For environments with strict security requirements, the platform supports private deployments with no internet access and proxy inspection."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Cado AWS Architecture",src:i(82532).A+"",width:"960",height:"540"})}),"\n",(0,r.jsxs)(t.blockquote,{children:["\n",(0,r.jsx)(t.p,{children:"Note: The diagram above provides a simplified overview of the Cado architecture in AWS."}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"security-features",children:"Security Features"}),"\n",(0,r.jsx)(t.p,{children:"Cado\u2019s architecture supports environments with stringent security needs, offering private deployments with no internet access and the ability to utilize proxy inspection, ensuring compliance with security policies."})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},82532:(e,t,i)=>{i.d(t,{A:()=>r});const r=i.p+"assets/images/aws-architecture-a6303ba92ca40461c3a1e0d2d3dcad63.png"},28453:(e,t,i)=>{i.d(t,{R:()=>a,x:()=>s});var r=i(96540);const o={},n=r.createContext(o);function a(e){const t=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),r.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/63772713.ea1681ee.js b/assets/js/63772713.2d53216d.js similarity index 98% rename from assets/js/63772713.ea1681ee.js rename to assets/js/63772713.2d53216d.js index 2550437a6..0b510f9d0 100644 --- a/assets/js/63772713.ea1681ee.js +++ b/assets/js/63772713.2d53216d.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2801],{21868:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var i=t(74848),r=t(28453);const o={title:"CrowdStrike",hide_title:!0,sidebar_position:4},s="How to Integrate with CrowdStrike",a={id:"cado/integrations/xdr/crowdstrike",title:"CrowdStrike",description:"Integrating CrowdStrike Falcon with Cado allows you to initiate triage acquisition on hosts running the Falcon Sensor via CrowdStrike Real Time Response.",source:"@site/docs/cado/integrations/xdr/crowdstrike.md",sourceDirName:"cado/integrations/xdr",slug:"/cado/integrations/xdr/crowdstrike",permalink:"/cado/integrations/xdr/crowdstrike",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/xdr/crowdstrike.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"CrowdStrike",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"SentinelOne",permalink:"/cado/integrations/xdr/sentinelone"},next:{title:"Microsoft Defender XDR",permalink:"/cado/integrations/xdr/defender"}},c={},d=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Enabling the Integration in Cado Platform",id:"enabling-the-integration-in-cado-platform",level:2}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-integrate-with-crowdstrike",children:"How to Integrate with CrowdStrike"}),"\n",(0,i.jsx)(n.p,{children:"Integrating CrowdStrike Falcon with Cado allows you to initiate triage acquisition on hosts running the Falcon Sensor via CrowdStrike Real Time Response."}),"\n",(0,i.jsxs)(n.p,{children:["Once initiated, CrowdStrike Falcon Real Time Response will locate the endpoint with the Falcon Sensor, execute a ",(0,i.jsx)(n.a,{href:"/cado/discovery-import/cado-host/intro",children:"Cado Host"})," command to collect the triage package, and upload it to Cado for processing."]}),"\n",(0,i.jsxs)(n.p,{children:["For more information, see the ",(0,i.jsx)(n.a,{href:"https://offers.cadosecurity.com/cado-security-and-crowdstrike-integration",children:"CrowdStrike and Cado Security Joint Solution Brief"})," and the ",(0,i.jsx)(n.a,{href:"https://marketplace.crowdstrike.com/listings/the-cado-platform",children:"CrowdStrike Marketplace listing"}),"."]}),"\n",(0,i.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Create an API Client"})," with the following permissions. Refer to this ",(0,i.jsx)(n.a,{href:"https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/",children:"blog article"})," for instructions:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response Admin"}),": Write"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Hosts"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response"}),": Write"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Alerts"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Detections"}),": Read"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["Note the ",(0,i.jsx)(n.strong,{children:"Client ID"}),", ",(0,i.jsx)(n.strong,{children:"Client Secret"}),", and ",(0,i.jsx)(n.strong,{children:"Endpoint URL"})," for entry into the Cado Platform."]}),"\n",(0,i.jsxs)(n.li,{children:["Enable ",(0,i.jsx)(n.strong,{children:"Real Time Response"})," in the Default policies for each OS or in custom policies attached to host groups."]}),"\n",(0,i.jsxs)(n.li,{children:["Create ",(0,i.jsx)(n.strong,{children:"Detections and Preventions Machine Learning exclusions"})," with the following patterns to enable Windows integration:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"Windows\\Temp\\_MEI*\\**\\CadoHostRawGrabber.exe"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"Windows\\Temp\\cado-host-*\\cado-host.exe"})}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["(Optional) To prevent endpoint detection alerts for ",(0,i.jsx)(n.code,{children:"CadoHostRawGrabber.exe"})," related to ",(0,i.jsx)(n.code,{children:"HiveCredTheft"}),", ",(0,i.jsx)(n.code,{children:"RawReadOnSAMHive"}),", and ",(0,i.jsx)(n.code,{children:"RawReadOnSecurityHive"}),", create IOA exclusions with the following patterns:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Image Filename"}),": ",(0,i.jsx)(n.code,{children:".*\\\\Windows\\\\Temp\\\\_MEI.*\\\\.*\\\\CadoHostRawGrabber\\.exe"})]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Command Line"}),": ",(0,i.jsx)(n.code,{children:".*\\\\Windows\\\\TEMP\\\\_MEI.*\\\\binaries\\\\CadoHostRawGrabber\\.exe\\s+--inputPath\\s+.*\\s+--outputPath\\s+.*\\\\Windows\\\\TEMP\\\\.*"})]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"Exclusions are not required for Linux and macOS."}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsx)(n.p,{children:"CrowdStrike Falcon defines policies by platform, so you will need separate Windows and Linux Response Policies that allow RTR Admin. macOS is not currently supported."})}),"\n",(0,i.jsx)(n.h2,{id:"enabling-the-integration-in-cado-platform",children:"Enabling the Integration in Cado Platform"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Navigate to ",(0,i.jsx)(n.strong,{children:"Settings > Accounts"})," and click ",(0,i.jsx)(n.strong,{children:"Create an account"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"CrowdStrike"})," from the set of providers."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"CrowdStrike Integration",src:t(58311).A+"",width:"3800",height:"1486"})}),"\n",(0,i.jsxs)(n.ol,{start:"3",children:["\n",(0,i.jsxs)(n.li,{children:["Give the account a ",(0,i.jsx)(n.strong,{children:"Name"})," and enter the ",(0,i.jsx)(n.strong,{children:"Endpoint"}),", ",(0,i.jsx)(n.strong,{children:"Client ID"}),", and ",(0,i.jsx)(n.strong,{children:"Client Secret"}),". Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'."]}),"\n",(0,i.jsx)(n.li,{children:"Navigate to the 'Accounts' table and the newly created CrowdStrike account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,i.jsxs)(n.li,{children:["An alternative way to check the account has been set up correctly is to browse to any investigation, and click ",(0,i.jsx)(n.strong,{children:"Import > XDR > CrowdStrike"}),". If configured correctly, a paginated list of hosts with the CrowdStrike Falcon Sensor installed will appear, showing those within the appropriate Host Group."]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},58311:(e,n,t)=>{t.d(n,{A:()=>i});const i=t.p+"assets/images/Accounts-CrowdStrike-e73332fc998ed3ea7436a417b3d214c3.png"},28453:(e,n,t)=>{t.d(n,{R:()=>s,x:()=>a});var i=t(96540);const r={},o=i.createContext(r);function s(e){const n=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:s(e.components),i.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2801],{21868:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var i=t(74848),r=t(28453);const o={title:"CrowdStrike",hide_title:!0,sidebar_position:4},s="How to Integrate with CrowdStrike",a={id:"cado/integrations/xdr/crowdstrike",title:"CrowdStrike",description:"Integrating CrowdStrike Falcon with Cado allows you to initiate triage acquisition on hosts running the Falcon Sensor via CrowdStrike Real Time Response.",source:"@site/docs/cado/integrations/xdr/crowdstrike.md",sourceDirName:"cado/integrations/xdr",slug:"/cado/integrations/xdr/crowdstrike",permalink:"/cado/integrations/xdr/crowdstrike",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/xdr/crowdstrike.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"CrowdStrike",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"SentinelOne",permalink:"/cado/integrations/xdr/sentinelone"},next:{title:"Microsoft Defender XDR",permalink:"/cado/integrations/xdr/defender"}},c={},d=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Enabling the Integration in Cado Platform",id:"enabling-the-integration-in-cado-platform",level:2}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-integrate-with-crowdstrike",children:"How to Integrate with CrowdStrike"}),"\n",(0,i.jsx)(n.p,{children:"Integrating CrowdStrike Falcon with Cado allows you to initiate triage acquisition on hosts running the Falcon Sensor via CrowdStrike Real Time Response."}),"\n",(0,i.jsxs)(n.p,{children:["Once initiated, CrowdStrike Falcon Real Time Response will locate the endpoint with the Falcon Sensor, execute a ",(0,i.jsx)(n.a,{href:"/cado/discovery-import/cado-host/intro",children:"Cado Host"})," command to collect the triage package, and upload it to Cado for processing."]}),"\n",(0,i.jsxs)(n.p,{children:["For more information, see the ",(0,i.jsx)(n.a,{href:"https://offers.cadosecurity.com/cado-security-and-crowdstrike-integration",children:"CrowdStrike and Cado Security Joint Solution Brief"})," and the ",(0,i.jsx)(n.a,{href:"https://marketplace.crowdstrike.com/listings/the-cado-platform",children:"CrowdStrike Marketplace listing"}),"."]}),"\n",(0,i.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Create an API Client"})," with the following permissions. Refer to this ",(0,i.jsx)(n.a,{href:"https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/",children:"blog article"})," for instructions:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response Admin"}),": Write"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Hosts"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response"}),": Write"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Alerts"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Detections"}),": Read"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["Note the ",(0,i.jsx)(n.strong,{children:"Client ID"}),", ",(0,i.jsx)(n.strong,{children:"Client Secret"}),", and ",(0,i.jsx)(n.strong,{children:"Endpoint URL"})," for entry into the Cado Platform."]}),"\n",(0,i.jsxs)(n.li,{children:["Enable ",(0,i.jsx)(n.strong,{children:"Real Time Response"})," in the Default policies for each OS or in custom policies attached to host groups."]}),"\n",(0,i.jsxs)(n.li,{children:["Create ",(0,i.jsx)(n.strong,{children:"Detections and Preventions Machine Learning exclusions"})," with the following patterns to enable Windows integration:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"Windows\\Temp\\_MEI*\\**\\CadoHostRawGrabber.exe"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"Windows\\Temp\\cado-host-*\\cado-host.exe"})}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["(Optional) To prevent endpoint detection alerts for ",(0,i.jsx)(n.code,{children:"CadoHostRawGrabber.exe"})," related to ",(0,i.jsx)(n.code,{children:"HiveCredTheft"}),", ",(0,i.jsx)(n.code,{children:"RawReadOnSAMHive"}),", and ",(0,i.jsx)(n.code,{children:"RawReadOnSecurityHive"}),", create IOA exclusions with the following patterns:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Image Filename"}),": ",(0,i.jsx)(n.code,{children:".*\\\\Windows\\\\Temp\\\\_MEI.*\\\\.*\\\\CadoHostRawGrabber\\.exe"})]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Command Line"}),": ",(0,i.jsx)(n.code,{children:".*\\\\Windows\\\\TEMP\\\\_MEI.*\\\\binaries\\\\CadoHostRawGrabber\\.exe\\s+--inputPath\\s+.*\\s+--outputPath\\s+.*\\\\Windows\\\\TEMP\\\\.*"})]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"Exclusions are not required for Linux and macOS."}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsx)(n.p,{children:"CrowdStrike Falcon defines policies by platform, so you will need separate Windows and Linux Response Policies that allow RTR Admin. macOS is not currently supported."})}),"\n",(0,i.jsx)(n.h2,{id:"enabling-the-integration-in-cado-platform",children:"Enabling the Integration in Cado Platform"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Navigate to ",(0,i.jsx)(n.strong,{children:"Settings > Accounts"})," and click ",(0,i.jsx)(n.strong,{children:"Create an account"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"CrowdStrike"})," from the set of providers."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"CrowdStrike Integration",src:t(58311).A+"",width:"3800",height:"1486"})}),"\n",(0,i.jsxs)(n.ol,{start:"3",children:["\n",(0,i.jsxs)(n.li,{children:["Give the account a ",(0,i.jsx)(n.strong,{children:"Name"})," and enter the ",(0,i.jsx)(n.strong,{children:"Endpoint"}),", ",(0,i.jsx)(n.strong,{children:"Client ID"}),", and ",(0,i.jsx)(n.strong,{children:"Client Secret"}),". Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'."]}),"\n",(0,i.jsx)(n.li,{children:"Navigate to the 'Accounts' table and the newly created CrowdStrike account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,i.jsxs)(n.li,{children:["An alternative way to check the account has been set up correctly is to browse to any investigation, and click ",(0,i.jsx)(n.strong,{children:"Import > XDR > CrowdStrike"}),". If configured correctly, a paginated list of hosts with the CrowdStrike Falcon Sensor installed will appear, showing those within the appropriate Host Group."]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},58311:(e,n,t)=>{t.d(n,{A:()=>i});const i=t.p+"assets/images/Accounts-CrowdStrike-e73332fc998ed3ea7436a417b3d214c3.png"},28453:(e,n,t)=>{t.d(n,{R:()=>s,x:()=>a});var i=t(96540);const r={},o=i.createContext(r);function s(e){const n=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:s(e.components),i.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/64b73e22.49871720.js b/assets/js/64b73e22.f4c26c37.js similarity index 97% rename from assets/js/64b73e22.49871720.js rename to assets/js/64b73e22.f4c26c37.js index 9ffdfaa23..c3360eabf 100644 --- a/assets/js/64b73e22.49871720.js +++ b/assets/js/64b73e22.f4c26c37.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5624],{36434:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>n,metadata:()=>r,toc:()=>l});var s=o(74848),i=o(28453);const n={title:"What is Cado Host",hide_title:!0,sidebar_position:1},a="What is Cado Host",r={id:"cado/discovery-import/cado-host/intro",title:"What is Cado Host",description:"Cado Host is a tool for acquiring forensic artifacts from target systems and storing them in cloud storage. It enables quick triage investigations by collecting essential data, which is stored in a zip file that can be automatically uploaded to Amazon AWS, Microsoft Azure, or Google Cloud Storage. Cado Host also supports local file storage, making it usable in air-gapped environments where cloud access is unavailable. Once the artifacts are collected, they can be imported, processed, and analyzed using the Cado platform.",source:"@site/docs/cado/discovery-import/cado-host/intro.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/intro",permalink:"/cado/discovery-import/cado-host/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/intro.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"What is Cado Host",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Kubernetes Engine",permalink:"/cado/discovery-import/gcp/kubernetes-engine"},next:{title:"Deploy",permalink:"/cado/discovery-import/cado-host/deploy"}},d={},l=[];function c(e){const t={a:"a",h1:"h1",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"what-is-cado-host",children:"What is Cado Host"}),"\n",(0,s.jsx)(t.p,{children:"Cado Host is a tool for acquiring forensic artifacts from target systems and storing them in cloud storage. It enables quick triage investigations by collecting essential data, which is stored in a zip file that can be automatically uploaded to Amazon AWS, Microsoft Azure, or Google Cloud Storage. Cado Host also supports local file storage, making it usable in air-gapped environments where cloud access is unavailable. Once the artifacts are collected, they can be imported, processed, and analyzed using the Cado platform."}),"\n",(0,s.jsx)(t.h1,{id:"data-collected",children:"Data Collected"}),"\n",(0,s.jsx)(t.p,{children:"Cado Host collects the following data from a target system:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Files from key forensic artifact locations."}),"\n",(0,s.jsx)(t.li,{children:"Open files."}),"\n",(0,s.jsx)(t.li,{children:"Metadata on running processes and network connections."}),"\n",(0,s.jsx)(t.li,{children:"Memory (optional)."}),"\n"]}),"\n",(0,s.jsxs)(t.p,{children:["For more details, see ",(0,s.jsx)(t.a,{href:"/cado/discovery-import/cado-host/intro",children:"Collected Artifacts"}),"."]}),"\n",(0,s.jsx)(t.h1,{id:"use-cases-and-integrations",children:"Use Cases and Integrations"}),"\n",(0,s.jsx)(t.p,{children:"Cado Host integrates with the Cado platform to collect data from:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"AWS EC2 instances via SSM."}),"\n",(0,s.jsx)(t.li,{children:"Kubernetes systems like ECS, EKS, GKE, and AKS."}),"\n",(0,s.jsx)(t.li,{children:"XDR systems such as CrowdStrike and SentinelOne."}),"\n"]}),"\n",(0,s.jsx)(t.h1,{id:"high-level-data-flow",children:"High-Level Data Flow"}),"\n",(0,s.jsx)(t.p,{children:"The diagram below illustrates the high-level data flow for Cado Host with AWS. The process is similar for Azure and Google Cloud Storage, differing only in the cloud storage provider."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Cado Host Dataflow",src:o(92366).A+"",width:"1726",height:"1018"})}),"\n",(0,s.jsx)(t.h1,{id:"supported-operating-systems",children:"Supported Operating Systems"}),"\n",(0,s.jsx)(t.p,{children:"Cado Host binaries are available for:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"Microsoft Windows"}),": Versions 7, 8.1, 10, 11, and Windows Server 2012 R2 and above. Windows releases are signed with an EV certificate."]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"Linux"}),": Debian (9+), Ubuntu (16.04+), Fedora (29+), RHEL (7+), openSUSE (15+), SUSE Enterprise (SLES 12 SP2+), and Alpine (3.10+)."]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"macOS"})," (Intel and ARM): Version 10.13+."]}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"For older operating systems, we recommend alternative tools:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"Linux"}),": Use ",(0,s.jsx)(t.a,{href:"https://github.com/tclahr/uac",children:"UAC"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"Windows"}),": Use ",(0,s.jsx)(t.a,{href:"https://github.com/cado-security/Cado-Batch",children:"Cado Batch"})," (for Windows 2003+)."]}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},92366:(e,t,o)=>{o.d(t,{A:()=>s});const s=o.p+"assets/images/cado-host-dfd-9a06225a628d6fc165244bd27617de33.png"},28453:(e,t,o)=>{o.d(t,{R:()=>a,x:()=>r});var s=o(96540);const i={},n=s.createContext(i);function a(e){const t=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5624],{36434:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>n,metadata:()=>r,toc:()=>l});var s=o(74848),i=o(28453);const n={title:"What is Cado Host",hide_title:!0,sidebar_position:1},a="What is Cado Host",r={id:"cado/discovery-import/cado-host/intro",title:"What is Cado Host",description:"Cado Host is a tool for acquiring forensic artifacts from target systems and storing them in cloud storage. It enables quick triage investigations by collecting essential data, which is stored in a zip file that can be automatically uploaded to Amazon AWS, Microsoft Azure, or Google Cloud Storage. Cado Host also supports local file storage, making it usable in air-gapped environments where cloud access is unavailable. Once the artifacts are collected, they can be imported, processed, and analyzed using the Cado platform.",source:"@site/docs/cado/discovery-import/cado-host/intro.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/intro",permalink:"/cado/discovery-import/cado-host/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/intro.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"What is Cado Host",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Kubernetes Engine",permalink:"/cado/discovery-import/gcp/kubernetes-engine"},next:{title:"Deploy",permalink:"/cado/discovery-import/cado-host/deploy"}},d={},l=[];function c(e){const t={a:"a",h1:"h1",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"what-is-cado-host",children:"What is Cado Host"}),"\n",(0,s.jsx)(t.p,{children:"Cado Host is a tool for acquiring forensic artifacts from target systems and storing them in cloud storage. It enables quick triage investigations by collecting essential data, which is stored in a zip file that can be automatically uploaded to Amazon AWS, Microsoft Azure, or Google Cloud Storage. Cado Host also supports local file storage, making it usable in air-gapped environments where cloud access is unavailable. Once the artifacts are collected, they can be imported, processed, and analyzed using the Cado platform."}),"\n",(0,s.jsx)(t.h1,{id:"data-collected",children:"Data Collected"}),"\n",(0,s.jsx)(t.p,{children:"Cado Host collects the following data from a target system:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"Files from key forensic artifact locations."}),"\n",(0,s.jsx)(t.li,{children:"Open files."}),"\n",(0,s.jsx)(t.li,{children:"Metadata on running processes and network connections."}),"\n",(0,s.jsx)(t.li,{children:"Memory (optional)."}),"\n"]}),"\n",(0,s.jsxs)(t.p,{children:["For more details, see ",(0,s.jsx)(t.a,{href:"/cado/discovery-import/cado-host/intro",children:"Collected Artifacts"}),"."]}),"\n",(0,s.jsx)(t.h1,{id:"use-cases-and-integrations",children:"Use Cases and Integrations"}),"\n",(0,s.jsx)(t.p,{children:"Cado Host integrates with the Cado platform to collect data from:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"AWS EC2 instances via SSM."}),"\n",(0,s.jsx)(t.li,{children:"Kubernetes systems like ECS, EKS, GKE, and AKS."}),"\n",(0,s.jsx)(t.li,{children:"XDR systems such as CrowdStrike and SentinelOne."}),"\n"]}),"\n",(0,s.jsx)(t.h1,{id:"high-level-data-flow",children:"High-Level Data Flow"}),"\n",(0,s.jsx)(t.p,{children:"The diagram below illustrates the high-level data flow for Cado Host with AWS. The process is similar for Azure and Google Cloud Storage, differing only in the cloud storage provider."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Cado Host Dataflow",src:o(92366).A+"",width:"1726",height:"1018"})}),"\n",(0,s.jsx)(t.h1,{id:"supported-operating-systems",children:"Supported Operating Systems"}),"\n",(0,s.jsx)(t.p,{children:"Cado Host binaries are available for:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"Microsoft Windows"}),": Versions 7, 8.1, 10, 11, and Windows Server 2012 R2 and above. Windows releases are signed with an EV certificate."]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"Linux"}),": Debian (9+), Ubuntu (16.04+), Fedora (29+), RHEL (7+), openSUSE (15+), SUSE Enterprise (SLES 12 SP2+), and Alpine (3.10+)."]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"macOS"})," (Intel and ARM): Version 10.13+."]}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"For older operating systems, we recommend alternative tools:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"Linux"}),": Use ",(0,s.jsx)(t.a,{href:"https://github.com/tclahr/uac",children:"UAC"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.strong,{children:"Windows"}),": Use ",(0,s.jsx)(t.a,{href:"https://github.com/cado-security/Cado-Batch",children:"Cado Batch"})," (for Windows 2003+)."]}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},92366:(e,t,o)=>{o.d(t,{A:()=>s});const s=o.p+"assets/images/cado-host-dfd-9a06225a628d6fc165244bd27617de33.png"},28453:(e,t,o)=>{o.d(t,{R:()=>a,x:()=>r});var s=o(96540);const i={},n=s.createContext(i);function a(e){const t=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/67fb56d0.604029d4.js b/assets/js/67fb56d0.b148101c.js similarity index 99% rename from assets/js/67fb56d0.604029d4.js rename to assets/js/67fb56d0.b148101c.js index 833314639..23520781b 100644 --- a/assets/js/67fb56d0.604029d4.js +++ b/assets/js/67fb56d0.b148101c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5247],{29553:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var t=i(74848),s=i(28453);const r={title:"Tines",hide_title:!0,sidebar_position:4},o="How to integrate with Tines",a={id:"cado/integrations/soar/tines",title:"Tines",description:"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API.",source:"@site/docs/cado/integrations/soar/tines.md",sourceDirName:"cado/integrations/soar",slug:"/cado/integrations/soar/tines",permalink:"/cado/integrations/soar/tines",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/soar/tines.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Tines",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Webhooks",permalink:"/cado/integrations/webhooks"},next:{title:"Splunk SOAR",permalink:"/cado/integrations/soar/splunk-soar"}},l={},c=[{value:"Getting Started with Tines",id:"getting-started-with-tines",level:2},{value:"Contents",id:"contents",level:3},{value:"Creating and Storing an API Access Key",id:"creating-and-storing-an-api-access-key",level:3},{value:"Adding your Platform Base URL",id:"adding-your-platform-base-url",level:3},{value:"Adding Default Values",id:"adding-default-values",level:3},{value:"Testing your Settings",id:"testing-your-settings",level:3},{value:"List of Actions",id:"list-of-actions",level:2},{value:"Contents",id:"contents-1",level:3},{value:"List EC2 Instances",id:"list-ec2-instances",level:3},{value:"Changing the Default URL",id:"changing-the-default-url",level:4},{value:"Changing the Payload Parameters",id:"changing-the-payload-parameters",level:4},{value:"List S3 Buckets",id:"list-s3-buckets",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-1",level:4},{value:"List Projects",id:"list-projects",level:3},{value:"List Project Pipelines",id:"list-project-pipelines",level:3},{value:"Changing the Payload Parameters",id:"changing-the-payload-parameters-1",level:4},{value:"Create a Project",id:"create-a-project",level:3},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters-",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value",level:4},{value:"Retrieve a Pipeline",id:"retrieve-a-pipeline",level:3},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--1",level:4},{value:"Acquire a Disk Image From EC2",id:"acquire-a-disk-image-from-ec2",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-2",level:4},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--2",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value-1",level:4},{value:"Acquire a Disk Image From S3",id:"acquire-a-disk-image-from-s3",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-3",level:4},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--3",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value-2",level:4},{value:"Creating a Story: Acquiring an EC2 Instance",id:"creating-a-story-acquiring-an-ec2-instance",level:2},{value:"Contents",id:"contents-2",level:3},{value:"Creating the Form",id:"creating-the-form",level:3},{value:"Action: Creating the Project",id:"action-creating-the-project",level:3},{value:"Action: Triggering a EC2 Acquisition",id:"action-triggering-a-ec2-acquisition",level:3},{value:"Action: Looping over Pipeline Status",id:"action-looping-over-pipeline-status",level:3},{value:"Action: Sending an Email",id:"action-sending-an-email",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-integrate-with-tines",children:"How to integrate with Tines"}),"\n",(0,t.jsx)(n.p,{children:"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API."}),"\n",(0,t.jsxs)(n.p,{children:["By using the Cado integration with Tines, we're allowing security analysts to quickly automate Incident Response and allow them to quickly respond to attacks for further investigation in the Cado platform. The Tines and Cado integration is easy to use, just search for ",(0,t.jsx)(n.strong,{children:"Cado Security"})," in the Public Templates repository, choose, and then drag and drop."]}),"\n",(0,t.jsxs)(n.p,{children:["Fore more information, see our blog on ",(0,t.jsx)(n.a,{href:"https://www.cadosecurity.com/automate-incident-response-with-the-new-tines-and-cado-response-integration/",children:"Automating Incident Response with Tines and Cado"}),"."]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["If you're confused by the terminology mentioned here, or have never used Tines before, please consider checking out the ",(0,t.jsx)(n.a,{href:"https://hub.tines.com/docs/quickstart",children:"Tines documentation"}),"."]})}),"\n",(0,t.jsx)(n.h2,{id:"getting-started-with-tines",children:"Getting Started with Tines"}),"\n",(0,t.jsx)(n.p,{children:"Before properly getting started please see the following for general instructions on setting up the Cado platform for integrating with third-party tools:"}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})}),"\n",(0,t.jsx)(n.h3,{id:"contents",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#adding-your-platform-base-url",children:"Adding your Platform Base URL"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#adding-default-values",children:"Adding Default Values"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#testing-your-settings",children:"Testing your Settings"})})}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"}),"\n",(0,t.jsx)(n.p,{children:"Cado allows you to create an API Access Key that allows third-party services to authenticate and interact with a Cado instance; you'll need to create one in order to use Tines with Cado."}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["Please see ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"})})," to learn how to create the API Access Key."]})}),"\n",(0,t.jsxs)(n.p,{children:["In order to add the Secret Key to Tines, you'll need to open your Tines Dashboard, and go to the ",(0,t.jsx)(n.strong,{children:"Credentials"})," page. Add a new ",(0,t.jsx)(n.strong,{children:"Text Credential"})," and name it ",(0,t.jsx)(n.code,{children:"CadoResponse_APIKey"}),"."]}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"It's important to name all credentials and resources mentioned in the tutorial as given, or else the Actions we provide won't be able to interact with the Cado API."})}),"\n",(0,t.jsx)(n.h3,{id:"adding-your-platform-base-url",children:"Adding your Platform Base URL"}),"\n",(0,t.jsxs)(n.p,{children:["To tell Tines the Platform Base URL of a Cado instance, you'll need to add it as a Resource. In order to do this, you'll need to open your Tines Dashboard, and go to the ",(0,t.jsx)(n.strong,{children:"Resources"})," page. Click the ",(0,t.jsx)(n.strong,{children:"New Resource"})," button and name it ",(0,t.jsx)(n.code,{children:"Cadoresponse_URL"})," and paste the Platform Base URL into the builder."]}),"\n",(0,t.jsx)(n.h3,{id:"adding-default-values",children:"Adding Default Values"}),"\n",(0,t.jsx)(n.p,{children:"The actions we provide allow you to set default fallback values, in case a form doesn't get filled in properly, or if an analyst misconfigures an action. To add these values, simply create three Resources with the following names:"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Resource Name"}),(0,t.jsx)(n.th,{children:"Type"}),(0,t.jsx)(n.th,{children:"Example"}),(0,t.jsx)(n.th,{children:"Description"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_Project_ID"})}),(0,t.jsx)(n.td,{children:"Integer"}),(0,t.jsx)(n.td,{children:"1"}),(0,t.jsx)(n.td,{children:"A numerical value that denotes a project in Cado."})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_Region"})}),(0,t.jsx)(n.td,{children:"String"}),(0,t.jsx)(n.td,{children:"us-east-1"}),(0,t.jsx)(n.td,{children:"A valid name of an AWS region."})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_S3_Bucket"})}),(0,t.jsx)(n.td,{children:"String"}),(0,t.jsx)(n.td,{children:"bucket_name"}),(0,t.jsx)(n.td,{children:"A name of a valid and accessible S3 bucket."})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"testing-your-settings",children:"Testing your Settings"}),"\n",(0,t.jsx)(n.p,{children:"To make sure you've done all the following steps correctly, please follow along with the following test procedure:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Create a new story in Tines through the Tines Dashboard."}),"\n",(0,t.jsxs)(n.li,{children:["Drag the ",(0,t.jsx)(n.strong,{children:"List Cado Projects"})," HTTP Request template from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar."]}),"\n",(0,t.jsxs)(n.li,{children:["Click the new action and click ",(0,t.jsx)(n.strong,{children:"Run"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Check the ",(0,t.jsx)(n.strong,{children:"Action Events"})," for a ",(0,t.jsx)(n.code,{children:"200 OK"})," HTTP code."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"If the following was successful, then you've correctly setup Tines to interact with the Cado API."}),"\n",(0,t.jsx)(n.h2,{id:"list-of-actions",children:"List of Actions"}),"\n",(0,t.jsxs)(n.p,{children:["Actions are the basic actions that can be chained together in ",(0,t.jsx)(n.em,{children:"Stories"}),", which are playbooks that can be run to perform a specific task or workflow."]}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsxs)(n.p,{children:["All the list actions are available in the Tines Public Templates repository. Just search for ",(0,t.jsx)(n.strong,{children:"Cado Security"}),", choose the action and drag and drop."]})}),"\n",(0,t.jsx)(n.h3,{id:"contents-1",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#retrieve-a-pipeline",children:"Retrieve a Pipeline"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"})})}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Actions for the Cado API",src:i(55734).A+"",width:"395",height:"1400"})}),"\n",(0,t.jsx)(n.h3,{id:"list-ec2-instances",children:"List EC2 Instances"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List EC2 Instances in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the EC2 instances in an AWS region."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/ec2"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters",children:"Changing the Payload Parameters"}),"\n",(0,t.jsxs)(n.p,{children:["You'll also need to adjust the ",(0,t.jsx)(n.code,{children:"region"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the valid AWS region you want to see instances listed in."]}),"\n",(0,t.jsx)(n.h3,{id:"list-s3-buckets",children:"List S3 Buckets"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List S3 Buckets in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the S3 buckets in an AWS account."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-1",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/s3"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List Cado Projects"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the projects in Cado."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects"})]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"list-project-pipelines",children:"List Project Pipelines"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List Pipelines for a Cado Project"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the pipelines for a given project in Cado."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/tasks/pipelines"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters-1",children:"Changing the Payload Parameters"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"project_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Cado Project ID."]}),"\n",(0,t.jsx)(n.h3,{id:"create-a-project",children:"Create a Project"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Create a new Project in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to create a new project in Cado."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{.RESOURCE.cadoresponse_url}}/api/v2/projects"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters-",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Payload"})," section you need to change the ",(0,t.jsx)(n.code,{children:"caseName"})," parameter to the name of the project you desire. You can also change the ",(0,t.jsx)(n.code,{children:"description"})," parameter to add a description to your project, or remove it if you don't need one. If you don't add the ",(0,t.jsx)(n.code,{children:"caseName"})," parameter, the action will default to the current UNIX timestamp as the project name. All projects created through Tines will include the ",(0,t.jsx)(n.code,{children:"_TinesProject"})," suffix."]}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Project ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .create_a_new_project_in_cado_response.body.id}}",\n "regexp": "\\\\d*",\n "to": "created_project_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_project_id.created_project_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_project_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h3,{id:"retrieve-a-pipeline",children:"Retrieve a Pipeline"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Get Details for a Pipeline in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will retrieve the details of a specific pipeline, including all subtasks."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/tasks/pipelines"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--1",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"project_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Cado Project ID."]}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"pipeline_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Pipeline ID (see ",(0,t.jsx)(n.strong,{children:"Acquisition"})," for more on how to retrieve a Pipeline ID)"]}),"\n",(0,t.jsx)(n.h3,{id:"acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Trigger an EC2 Disk Acquisition in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will trigger a disk image acquisition task in Cado for a specified EC2 instance."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-2",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/ec2"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--2",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"instance_id"})," and ",(0,t.jsx)(n.code,{children:"region"})," parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the appropriate values of the EC2 instance you want to acquire."]}),"\n",(0,t.jsxs)(n.p,{children:["You can include the following optional parameter ",(0,t.jsx)(n.code,{children:"bucket"})," in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to change which S3 bucket the disk image is uploaded to."]}),"\n",(0,t.jsxs)(n.p,{children:["Likewise, you can also provide the following optional parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to change the way Cado will acquire the disk image. These are the options and their default values:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:' "compress": true,\n "include_disks": true,\n "include_hash": false,\n "include_logs": true,\n "include_screenshot": true,\n'})}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value-1",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_ec2_disk_acquisition_in_cado_response.body.pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_pipeline_id.created_pipeline_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_pipeline_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h3,{id:"acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Template Name: `Trigger an S3 Disk Acquisition in Cado"}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will trigger a disk image acquisition task in Cado from a file in a S3 Bucket."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-3",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/s3"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--3",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"bucket"})," and ",(0,t.jsx)(n.code,{children:"file_name"})," parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the appropriate values of the file in the S3 bucket you want to acquire and process."]}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value-2",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_s3_disk_acquisition_in_cado_response.body.pipelines[0].pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_pipeline_id.created_pipeline_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_pipeline_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h2,{id:"creating-a-story-acquiring-an-ec2-instance",children:"Creating a Story: Acquiring an EC2 Instance"}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"If you have a good grasp of the basics of Tines, feel free to skip this section."})}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Example Story for Acquiring an EC2 Instance",src:i(77928).A+"",width:"433",height:"650"})}),"\n",(0,t.jsx)(n.p,{children:"This section covers a quick tutorial in creating a basic workflow (or story in Tines terms) that:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Allows users to specify details in a form"}),"\n",(0,t.jsx)(n.li,{children:"Creates a new Project"}),"\n",(0,t.jsx)(n.li,{children:"Triggers an EC2 Disk Acquisition"}),"\n",(0,t.jsx)(n.li,{children:"Loops over a pipeline until it has been terminated"}),"\n",(0,t.jsx)(n.li,{children:"Emails the user a success message"}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["You can download the finished story example here: ** ",(0,t.jsx)(n.a,{href:"https://cado-public.s3.amazonaws.com/integrations/cado-response-tines-story.json",children:"Cado Basic Story: Create a Project and Acquire EC2 Disk >"})," **"]})}),"\n",(0,t.jsx)(n.h3,{id:"contents-2",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"creating-the-form",children:"Creating the Form"}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Example Form for Acquiring an EC2 Instance",src:i(43781).A+"",width:"351",height:"697"})}),"\n",(0,t.jsxs)(n.p,{children:["To create a form in Tines, head to the story editor and click the ",(0,t.jsx)(n.strong,{children:"Form"})," tab. Using the sidebar, add 4 text fields:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["One for the new Project Name. Name this field ",(0,t.jsx)(n.code,{children:"Project Name"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One for the EC2 Instance ID. Name this field ",(0,t.jsx)(n.code,{children:"EC2 Instance ID"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One for the EC2 Instance Region. Name this field ",(0,t.jsx)(n.code,{children:"EC2 Instance Region"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One fort the email address of the user. Name this field ",(0,t.jsx)(n.code,{children:"Email Address"})," and make it required."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsx)(n.p,{children:"We'll use these values throughout the rest of this tutorial, so make sure the names match as above."})}),"\n",(0,t.jsxs)(n.p,{children:["Go back to the ",(0,t.jsx)(n.strong,{children:"Story"})," tab inside the story editor and drag a new ",(0,t.jsx)(n.strong,{children:"Webhook"})," action to the story. Change its name to ",(0,t.jsx)(n.code,{children:"EC2 Webhook"}),". After this, go back into the ",(0,t.jsx)(n.strong,{children:"Form"})," tab and change the ",(0,t.jsx)(n.strong,{children:"Receiving Action"})," in the sidebar to ",(0,t.jsx)(n.code,{children:"EC2 Webhook"}),". This will allow your story to retrieve values from the form."]}),"\n",(0,t.jsx)(n.h3,{id:"action-creating-the-project",children:"Action: Creating the Project"}),"\n",(0,t.jsxs)(n.p,{children:["Return to the ",(0,t.jsx)(n.strong,{children:"Story"})," tab inside the story editor, and drag a ",(0,t.jsx)(n.strong,{children:"Create a new Project in Cado"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"EC2 Webhook"})," action to it."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "caseName": "{{.ec2_webhook.body.project_name | default: \\"now\\" | date: \\"%s\\" | append: \\"_TinesProject\\" }}",\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will retrieve the project name from the form, and will send it to the Cado API. You can optionally add the ",(0,t.jsx)(n.code,{children:"description"})," parameter to the ",(0,t.jsx)(n.strong,{children:"Payload"})," to give your new project a description."]}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Project ID in the response body. In order to retrieve this value, we need to use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," which allow us to modify, extract and process responses and data from events. Drag an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action and name it ",(0,t.jsx)(n.code,{children:"Get Project ID"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Create a new Project in Cado"})," action to it. Then modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .create_a_new_project_in_cado_response.body.id}}",\n "regexp": "\\\\d*",\n "to": "created_project_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON will extract the Project ID from the previous response, and will store it in the ",(0,t.jsx)(n.code,{children:"{{ .get_project_id.created_project_id | first }}"})," variable."]}),"\n",(0,t.jsx)(n.h3,{id:"action-triggering-a-ec2-acquisition",children:"Action: Triggering a EC2 Acquisition"}),"\n",(0,t.jsxs)(n.p,{children:["Drag a ",(0,t.jsx)(n.strong,{children:"Trigger an EC2 Disk Acquisition in Cado"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Project ID"})," action."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"URL"})," to the following: ",(0,t.jsx)(n.code,{children:"{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{.get_project_id.created_project_id | first }}/imports/ec2"})," to use the Project ID that was generated earlier on in the workflow."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "compress": "true",\n "include_disks": "true",\n "include_hash": "false",\n "include_logs": "true",\n "include_screenshot": "true",\n "instance_id": "{{.ec2_webhook.body.ec2_instance_id}}",\n "bucket": "{{ .bucket | default: .RESOURCE.cadoresponse_default_s3_bucket }}",\n "region": "{{.ec2_webhook.body.ec2_instance_region}}"\n}\n'})}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsx)(n.p,{children:"Change BUCKET_NAME into the code into an appropriate S3 bucket!"})}),"\n",(0,t.jsx)(n.p,{children:"This JSON code will tell Cado to acquire the disk from the EC2 instance described in the form, using the default acquisition settings."}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. In order to retrieve this value, drag an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action and name it ",(0,t.jsx)(n.code,{children:"Get Pipeline ID"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Trigger an EC2 Disk Acquisition in Cado"})," action to it. Then modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_ec2_disk_acquisition_in_cado_response.body.pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON will extract the Pipeline ID from the previous response, and will store it in the ",(0,t.jsx)(n.code,{children:"{{ .get_pipeline_id.created_pipeline_id | first }}"})," variable."]}),"\n",(0,t.jsx)(n.h3,{id:"action-looping-over-pipeline-status",children:"Action: Looping over Pipeline Status"}),"\n",(0,t.jsxs)(n.p,{children:["This is the most complicated part of this example, as it requires a loop, which we can achieve by using two ",(0,t.jsx)(n.strong,{children:"Trigger"})," actions. First, drag a ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Pipeline ID"})," action."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "project_id": "{{.get_project_id.created_project_id | first }}",\n "pipeline_id": "{{ .get_new_pipeline_id.created_pipeline_id | first }}"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"This JSON code will retrieve the new Project and Pipeline ID and will tell Cado which Pipeline we need to retrieve."}),"\n",(0,t.jsxs)(n.p,{children:["In order to create a loop, we need to drag two ",(0,t.jsx)(n.strong,{children:"Trigger"})," actions to the story. Name one ",(0,t.jsx)(n.code,{children:"Check if Pipeline is Terminated"}),", and the other ",(0,t.jsx)(n.code,{children:"Check if Pipeline isn't Terminated"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado"})," action for each of them."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"})," action, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "rules": [\n {\n "type": "regex",\n "value": "true",\n "path": "{{ .get_details_for_a_pipeline_in_cado_response.body[0].terminated }}"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will check if the pipeline has the ",(0,t.jsx)(n.code,{children:"terminated"})," flag set to ",(0,t.jsx)(n.code,{children:"true"}),". Meaning the pipeline has finished."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline isn't Terminated"})," action, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "rules": [\n {\n "type": "regex",\n "value": "false",\n "path": "{{ .get_details_for_a_pipeline_in_cado_response.body[0].terminated }}"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will check if the pipeline has the ",(0,t.jsx)(n.code,{children:"terminated"})," flag set to ",(0,t.jsx)(n.code,{children:"false"}),". Meaning the pipeline hasn't finished."]}),"\n",(0,t.jsxs)(n.p,{children:["Once you have done that, we can re-trigger the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado"})," by dragging an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action to the story and making a connection from the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline isn't Terminated"})," action to it. Then you can modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "delay",\n "seconds": 60\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This will stop execution for 60 seconds, and by creating a connection from it back to the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado"})," action, we can effectively create a looping function. However, every good loop must have an exit condition, which is the role of ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"}),"."]}),"\n",(0,t.jsx)(n.h3,{id:"action-sending-an-email",children:"Action: Sending an Email"}),"\n",(0,t.jsxs)(n.p,{children:["Once the Pipeline has finished, we'll want to email the user saying the pipeline has finished. To do this, drag an ",(0,t.jsx)(n.strong,{children:"Email"})," action from the sidebar to the story and make a connection from the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"})," action. Once done, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "recipients": "{{.ec2_webhook.body.email_address}}",\n "subject": "Tines: EC2 Acquisition is finished",\n "body": "Pipeline has finished!"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"This will send an email address to the email address given to the form, notifying the user the pipeline has finished."}),"\n",(0,t.jsxs)(n.p,{children:["You've now made the example workflow, to test it out, click on the ",(0,t.jsx)(n.strong,{children:"Form"})," tab in the story editor and submit. Once done, you'll need to manually emit the form response in the ",(0,t.jsx)(n.strong,{children:"EC2 Webhook"})," action, by clicking and going to the ",(0,t.jsx)(n.strong,{children:"Events"})," tab in the right-hand sidebar, and clicking ",(0,t.jsx)(n.strong,{children:"emit"})," on the most recent held event."]})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},55734:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/tines-actions-5174c3c023f735b4b45782747ac4af44.png"},43781:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/tines-form-47a5eecdbda685957aa11d9f64a5df92.png"},77928:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/tines-story-de36b629830df72c430b4b1a77f23516.png"},28453:(e,n,i)=>{i.d(n,{R:()=>o,x:()=>a});var t=i(96540);const s={},r=t.createContext(s);function o(e){const n=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),t.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5247],{29553:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var t=i(74848),s=i(28453);const r={title:"Tines",hide_title:!0,sidebar_position:4},o="How to integrate with Tines",a={id:"cado/integrations/soar/tines",title:"Tines",description:"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API.",source:"@site/docs/cado/integrations/soar/tines.md",sourceDirName:"cado/integrations/soar",slug:"/cado/integrations/soar/tines",permalink:"/cado/integrations/soar/tines",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/soar/tines.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Tines",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Webhooks",permalink:"/cado/integrations/webhooks"},next:{title:"Splunk SOAR",permalink:"/cado/integrations/soar/splunk-soar"}},l={},c=[{value:"Getting Started with Tines",id:"getting-started-with-tines",level:2},{value:"Contents",id:"contents",level:3},{value:"Creating and Storing an API Access Key",id:"creating-and-storing-an-api-access-key",level:3},{value:"Adding your Platform Base URL",id:"adding-your-platform-base-url",level:3},{value:"Adding Default Values",id:"adding-default-values",level:3},{value:"Testing your Settings",id:"testing-your-settings",level:3},{value:"List of Actions",id:"list-of-actions",level:2},{value:"Contents",id:"contents-1",level:3},{value:"List EC2 Instances",id:"list-ec2-instances",level:3},{value:"Changing the Default URL",id:"changing-the-default-url",level:4},{value:"Changing the Payload Parameters",id:"changing-the-payload-parameters",level:4},{value:"List S3 Buckets",id:"list-s3-buckets",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-1",level:4},{value:"List Projects",id:"list-projects",level:3},{value:"List Project Pipelines",id:"list-project-pipelines",level:3},{value:"Changing the Payload Parameters",id:"changing-the-payload-parameters-1",level:4},{value:"Create a Project",id:"create-a-project",level:3},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters-",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value",level:4},{value:"Retrieve a Pipeline",id:"retrieve-a-pipeline",level:3},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--1",level:4},{value:"Acquire a Disk Image From EC2",id:"acquire-a-disk-image-from-ec2",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-2",level:4},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--2",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value-1",level:4},{value:"Acquire a Disk Image From S3",id:"acquire-a-disk-image-from-s3",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-3",level:4},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--3",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value-2",level:4},{value:"Creating a Story: Acquiring an EC2 Instance",id:"creating-a-story-acquiring-an-ec2-instance",level:2},{value:"Contents",id:"contents-2",level:3},{value:"Creating the Form",id:"creating-the-form",level:3},{value:"Action: Creating the Project",id:"action-creating-the-project",level:3},{value:"Action: Triggering a EC2 Acquisition",id:"action-triggering-a-ec2-acquisition",level:3},{value:"Action: Looping over Pipeline Status",id:"action-looping-over-pipeline-status",level:3},{value:"Action: Sending an Email",id:"action-sending-an-email",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-integrate-with-tines",children:"How to integrate with Tines"}),"\n",(0,t.jsx)(n.p,{children:"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API."}),"\n",(0,t.jsxs)(n.p,{children:["By using the Cado integration with Tines, we're allowing security analysts to quickly automate Incident Response and allow them to quickly respond to attacks for further investigation in the Cado platform. The Tines and Cado integration is easy to use, just search for ",(0,t.jsx)(n.strong,{children:"Cado Security"})," in the Public Templates repository, choose, and then drag and drop."]}),"\n",(0,t.jsxs)(n.p,{children:["Fore more information, see our blog on ",(0,t.jsx)(n.a,{href:"https://www.cadosecurity.com/automate-incident-response-with-the-new-tines-and-cado-response-integration/",children:"Automating Incident Response with Tines and Cado"}),"."]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["If you're confused by the terminology mentioned here, or have never used Tines before, please consider checking out the ",(0,t.jsx)(n.a,{href:"https://hub.tines.com/docs/quickstart",children:"Tines documentation"}),"."]})}),"\n",(0,t.jsx)(n.h2,{id:"getting-started-with-tines",children:"Getting Started with Tines"}),"\n",(0,t.jsx)(n.p,{children:"Before properly getting started please see the following for general instructions on setting up the Cado platform for integrating with third-party tools:"}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})}),"\n",(0,t.jsx)(n.h3,{id:"contents",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#adding-your-platform-base-url",children:"Adding your Platform Base URL"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#adding-default-values",children:"Adding Default Values"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#testing-your-settings",children:"Testing your Settings"})})}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"}),"\n",(0,t.jsx)(n.p,{children:"Cado allows you to create an API Access Key that allows third-party services to authenticate and interact with a Cado instance; you'll need to create one in order to use Tines with Cado."}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["Please see ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"})})," to learn how to create the API Access Key."]})}),"\n",(0,t.jsxs)(n.p,{children:["In order to add the Secret Key to Tines, you'll need to open your Tines Dashboard, and go to the ",(0,t.jsx)(n.strong,{children:"Credentials"})," page. Add a new ",(0,t.jsx)(n.strong,{children:"Text Credential"})," and name it ",(0,t.jsx)(n.code,{children:"CadoResponse_APIKey"}),"."]}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"It's important to name all credentials and resources mentioned in the tutorial as given, or else the Actions we provide won't be able to interact with the Cado API."})}),"\n",(0,t.jsx)(n.h3,{id:"adding-your-platform-base-url",children:"Adding your Platform Base URL"}),"\n",(0,t.jsxs)(n.p,{children:["To tell Tines the Platform Base URL of a Cado instance, you'll need to add it as a Resource. In order to do this, you'll need to open your Tines Dashboard, and go to the ",(0,t.jsx)(n.strong,{children:"Resources"})," page. Click the ",(0,t.jsx)(n.strong,{children:"New Resource"})," button and name it ",(0,t.jsx)(n.code,{children:"Cadoresponse_URL"})," and paste the Platform Base URL into the builder."]}),"\n",(0,t.jsx)(n.h3,{id:"adding-default-values",children:"Adding Default Values"}),"\n",(0,t.jsx)(n.p,{children:"The actions we provide allow you to set default fallback values, in case a form doesn't get filled in properly, or if an analyst misconfigures an action. To add these values, simply create three Resources with the following names:"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Resource Name"}),(0,t.jsx)(n.th,{children:"Type"}),(0,t.jsx)(n.th,{children:"Example"}),(0,t.jsx)(n.th,{children:"Description"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_Project_ID"})}),(0,t.jsx)(n.td,{children:"Integer"}),(0,t.jsx)(n.td,{children:"1"}),(0,t.jsx)(n.td,{children:"A numerical value that denotes a project in Cado."})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_Region"})}),(0,t.jsx)(n.td,{children:"String"}),(0,t.jsx)(n.td,{children:"us-east-1"}),(0,t.jsx)(n.td,{children:"A valid name of an AWS region."})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_S3_Bucket"})}),(0,t.jsx)(n.td,{children:"String"}),(0,t.jsx)(n.td,{children:"bucket_name"}),(0,t.jsx)(n.td,{children:"A name of a valid and accessible S3 bucket."})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"testing-your-settings",children:"Testing your Settings"}),"\n",(0,t.jsx)(n.p,{children:"To make sure you've done all the following steps correctly, please follow along with the following test procedure:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Create a new story in Tines through the Tines Dashboard."}),"\n",(0,t.jsxs)(n.li,{children:["Drag the ",(0,t.jsx)(n.strong,{children:"List Cado Projects"})," HTTP Request template from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar."]}),"\n",(0,t.jsxs)(n.li,{children:["Click the new action and click ",(0,t.jsx)(n.strong,{children:"Run"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Check the ",(0,t.jsx)(n.strong,{children:"Action Events"})," for a ",(0,t.jsx)(n.code,{children:"200 OK"})," HTTP code."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"If the following was successful, then you've correctly setup Tines to interact with the Cado API."}),"\n",(0,t.jsx)(n.h2,{id:"list-of-actions",children:"List of Actions"}),"\n",(0,t.jsxs)(n.p,{children:["Actions are the basic actions that can be chained together in ",(0,t.jsx)(n.em,{children:"Stories"}),", which are playbooks that can be run to perform a specific task or workflow."]}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsxs)(n.p,{children:["All the list actions are available in the Tines Public Templates repository. Just search for ",(0,t.jsx)(n.strong,{children:"Cado Security"}),", choose the action and drag and drop."]})}),"\n",(0,t.jsx)(n.h3,{id:"contents-1",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#retrieve-a-pipeline",children:"Retrieve a Pipeline"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"})})}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Actions for the Cado API",src:i(55734).A+"",width:"395",height:"1400"})}),"\n",(0,t.jsx)(n.h3,{id:"list-ec2-instances",children:"List EC2 Instances"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List EC2 Instances in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the EC2 instances in an AWS region."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/ec2"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters",children:"Changing the Payload Parameters"}),"\n",(0,t.jsxs)(n.p,{children:["You'll also need to adjust the ",(0,t.jsx)(n.code,{children:"region"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the valid AWS region you want to see instances listed in."]}),"\n",(0,t.jsx)(n.h3,{id:"list-s3-buckets",children:"List S3 Buckets"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List S3 Buckets in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the S3 buckets in an AWS account."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-1",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/s3"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List Cado Projects"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the projects in Cado."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects"})]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"list-project-pipelines",children:"List Project Pipelines"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List Pipelines for a Cado Project"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the pipelines for a given project in Cado."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/tasks/pipelines"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters-1",children:"Changing the Payload Parameters"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"project_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Cado Project ID."]}),"\n",(0,t.jsx)(n.h3,{id:"create-a-project",children:"Create a Project"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Create a new Project in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to create a new project in Cado."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{.RESOURCE.cadoresponse_url}}/api/v2/projects"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters-",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Payload"})," section you need to change the ",(0,t.jsx)(n.code,{children:"caseName"})," parameter to the name of the project you desire. You can also change the ",(0,t.jsx)(n.code,{children:"description"})," parameter to add a description to your project, or remove it if you don't need one. If you don't add the ",(0,t.jsx)(n.code,{children:"caseName"})," parameter, the action will default to the current UNIX timestamp as the project name. All projects created through Tines will include the ",(0,t.jsx)(n.code,{children:"_TinesProject"})," suffix."]}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Project ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .create_a_new_project_in_cado_response.body.id}}",\n "regexp": "\\\\d*",\n "to": "created_project_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_project_id.created_project_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_project_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h3,{id:"retrieve-a-pipeline",children:"Retrieve a Pipeline"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Get Details for a Pipeline in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will retrieve the details of a specific pipeline, including all subtasks."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/tasks/pipelines"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--1",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"project_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Cado Project ID."]}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"pipeline_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Pipeline ID (see ",(0,t.jsx)(n.strong,{children:"Acquisition"})," for more on how to retrieve a Pipeline ID)"]}),"\n",(0,t.jsx)(n.h3,{id:"acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Trigger an EC2 Disk Acquisition in Cado"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will trigger a disk image acquisition task in Cado for a specified EC2 instance."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-2",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/ec2"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--2",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"instance_id"})," and ",(0,t.jsx)(n.code,{children:"region"})," parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the appropriate values of the EC2 instance you want to acquire."]}),"\n",(0,t.jsxs)(n.p,{children:["You can include the following optional parameter ",(0,t.jsx)(n.code,{children:"bucket"})," in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to change which S3 bucket the disk image is uploaded to."]}),"\n",(0,t.jsxs)(n.p,{children:["Likewise, you can also provide the following optional parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to change the way Cado will acquire the disk image. These are the options and their default values:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:' "compress": true,\n "include_disks": true,\n "include_hash": false,\n "include_logs": true,\n "include_screenshot": true,\n'})}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value-1",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_ec2_disk_acquisition_in_cado_response.body.pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_pipeline_id.created_pipeline_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_pipeline_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h3,{id:"acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Template Name: `Trigger an S3 Disk Acquisition in Cado"}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will trigger a disk image acquisition task in Cado from a file in a S3 Bucket."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-3",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/s3"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--3",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"bucket"})," and ",(0,t.jsx)(n.code,{children:"file_name"})," parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the appropriate values of the file in the S3 bucket you want to acquire and process."]}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value-2",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_s3_disk_acquisition_in_cado_response.body.pipelines[0].pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_pipeline_id.created_pipeline_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_pipeline_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h2,{id:"creating-a-story-acquiring-an-ec2-instance",children:"Creating a Story: Acquiring an EC2 Instance"}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"If you have a good grasp of the basics of Tines, feel free to skip this section."})}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Example Story for Acquiring an EC2 Instance",src:i(77928).A+"",width:"433",height:"650"})}),"\n",(0,t.jsx)(n.p,{children:"This section covers a quick tutorial in creating a basic workflow (or story in Tines terms) that:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Allows users to specify details in a form"}),"\n",(0,t.jsx)(n.li,{children:"Creates a new Project"}),"\n",(0,t.jsx)(n.li,{children:"Triggers an EC2 Disk Acquisition"}),"\n",(0,t.jsx)(n.li,{children:"Loops over a pipeline until it has been terminated"}),"\n",(0,t.jsx)(n.li,{children:"Emails the user a success message"}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["You can download the finished story example here: ** ",(0,t.jsx)(n.a,{href:"https://cado-public.s3.amazonaws.com/integrations/cado-response-tines-story.json",children:"Cado Basic Story: Create a Project and Acquire EC2 Disk >"})," **"]})}),"\n",(0,t.jsx)(n.h3,{id:"contents-2",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"creating-the-form",children:"Creating the Form"}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Example Form for Acquiring an EC2 Instance",src:i(43781).A+"",width:"351",height:"697"})}),"\n",(0,t.jsxs)(n.p,{children:["To create a form in Tines, head to the story editor and click the ",(0,t.jsx)(n.strong,{children:"Form"})," tab. Using the sidebar, add 4 text fields:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["One for the new Project Name. Name this field ",(0,t.jsx)(n.code,{children:"Project Name"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One for the EC2 Instance ID. Name this field ",(0,t.jsx)(n.code,{children:"EC2 Instance ID"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One for the EC2 Instance Region. Name this field ",(0,t.jsx)(n.code,{children:"EC2 Instance Region"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One fort the email address of the user. Name this field ",(0,t.jsx)(n.code,{children:"Email Address"})," and make it required."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsx)(n.p,{children:"We'll use these values throughout the rest of this tutorial, so make sure the names match as above."})}),"\n",(0,t.jsxs)(n.p,{children:["Go back to the ",(0,t.jsx)(n.strong,{children:"Story"})," tab inside the story editor and drag a new ",(0,t.jsx)(n.strong,{children:"Webhook"})," action to the story. Change its name to ",(0,t.jsx)(n.code,{children:"EC2 Webhook"}),". After this, go back into the ",(0,t.jsx)(n.strong,{children:"Form"})," tab and change the ",(0,t.jsx)(n.strong,{children:"Receiving Action"})," in the sidebar to ",(0,t.jsx)(n.code,{children:"EC2 Webhook"}),". This will allow your story to retrieve values from the form."]}),"\n",(0,t.jsx)(n.h3,{id:"action-creating-the-project",children:"Action: Creating the Project"}),"\n",(0,t.jsxs)(n.p,{children:["Return to the ",(0,t.jsx)(n.strong,{children:"Story"})," tab inside the story editor, and drag a ",(0,t.jsx)(n.strong,{children:"Create a new Project in Cado"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"EC2 Webhook"})," action to it."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "caseName": "{{.ec2_webhook.body.project_name | default: \\"now\\" | date: \\"%s\\" | append: \\"_TinesProject\\" }}",\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will retrieve the project name from the form, and will send it to the Cado API. You can optionally add the ",(0,t.jsx)(n.code,{children:"description"})," parameter to the ",(0,t.jsx)(n.strong,{children:"Payload"})," to give your new project a description."]}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Project ID in the response body. In order to retrieve this value, we need to use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," which allow us to modify, extract and process responses and data from events. Drag an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action and name it ",(0,t.jsx)(n.code,{children:"Get Project ID"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Create a new Project in Cado"})," action to it. Then modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .create_a_new_project_in_cado_response.body.id}}",\n "regexp": "\\\\d*",\n "to": "created_project_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON will extract the Project ID from the previous response, and will store it in the ",(0,t.jsx)(n.code,{children:"{{ .get_project_id.created_project_id | first }}"})," variable."]}),"\n",(0,t.jsx)(n.h3,{id:"action-triggering-a-ec2-acquisition",children:"Action: Triggering a EC2 Acquisition"}),"\n",(0,t.jsxs)(n.p,{children:["Drag a ",(0,t.jsx)(n.strong,{children:"Trigger an EC2 Disk Acquisition in Cado"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Project ID"})," action."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"URL"})," to the following: ",(0,t.jsx)(n.code,{children:"{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{.get_project_id.created_project_id | first }}/imports/ec2"})," to use the Project ID that was generated earlier on in the workflow."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "compress": "true",\n "include_disks": "true",\n "include_hash": "false",\n "include_logs": "true",\n "include_screenshot": "true",\n "instance_id": "{{.ec2_webhook.body.ec2_instance_id}}",\n "bucket": "{{ .bucket | default: .RESOURCE.cadoresponse_default_s3_bucket }}",\n "region": "{{.ec2_webhook.body.ec2_instance_region}}"\n}\n'})}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsx)(n.p,{children:"Change BUCKET_NAME into the code into an appropriate S3 bucket!"})}),"\n",(0,t.jsx)(n.p,{children:"This JSON code will tell Cado to acquire the disk from the EC2 instance described in the form, using the default acquisition settings."}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. In order to retrieve this value, drag an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action and name it ",(0,t.jsx)(n.code,{children:"Get Pipeline ID"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Trigger an EC2 Disk Acquisition in Cado"})," action to it. Then modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_ec2_disk_acquisition_in_cado_response.body.pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON will extract the Pipeline ID from the previous response, and will store it in the ",(0,t.jsx)(n.code,{children:"{{ .get_pipeline_id.created_pipeline_id | first }}"})," variable."]}),"\n",(0,t.jsx)(n.h3,{id:"action-looping-over-pipeline-status",children:"Action: Looping over Pipeline Status"}),"\n",(0,t.jsxs)(n.p,{children:["This is the most complicated part of this example, as it requires a loop, which we can achieve by using two ",(0,t.jsx)(n.strong,{children:"Trigger"})," actions. First, drag a ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Pipeline ID"})," action."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "project_id": "{{.get_project_id.created_project_id | first }}",\n "pipeline_id": "{{ .get_new_pipeline_id.created_pipeline_id | first }}"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"This JSON code will retrieve the new Project and Pipeline ID and will tell Cado which Pipeline we need to retrieve."}),"\n",(0,t.jsxs)(n.p,{children:["In order to create a loop, we need to drag two ",(0,t.jsx)(n.strong,{children:"Trigger"})," actions to the story. Name one ",(0,t.jsx)(n.code,{children:"Check if Pipeline is Terminated"}),", and the other ",(0,t.jsx)(n.code,{children:"Check if Pipeline isn't Terminated"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado"})," action for each of them."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"})," action, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "rules": [\n {\n "type": "regex",\n "value": "true",\n "path": "{{ .get_details_for_a_pipeline_in_cado_response.body[0].terminated }}"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will check if the pipeline has the ",(0,t.jsx)(n.code,{children:"terminated"})," flag set to ",(0,t.jsx)(n.code,{children:"true"}),". Meaning the pipeline has finished."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline isn't Terminated"})," action, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "rules": [\n {\n "type": "regex",\n "value": "false",\n "path": "{{ .get_details_for_a_pipeline_in_cado_response.body[0].terminated }}"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will check if the pipeline has the ",(0,t.jsx)(n.code,{children:"terminated"})," flag set to ",(0,t.jsx)(n.code,{children:"false"}),". Meaning the pipeline hasn't finished."]}),"\n",(0,t.jsxs)(n.p,{children:["Once you have done that, we can re-trigger the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado"})," by dragging an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action to the story and making a connection from the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline isn't Terminated"})," action to it. Then you can modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "delay",\n "seconds": 60\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This will stop execution for 60 seconds, and by creating a connection from it back to the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado"})," action, we can effectively create a looping function. However, every good loop must have an exit condition, which is the role of ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"}),"."]}),"\n",(0,t.jsx)(n.h3,{id:"action-sending-an-email",children:"Action: Sending an Email"}),"\n",(0,t.jsxs)(n.p,{children:["Once the Pipeline has finished, we'll want to email the user saying the pipeline has finished. To do this, drag an ",(0,t.jsx)(n.strong,{children:"Email"})," action from the sidebar to the story and make a connection from the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"})," action. Once done, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "recipients": "{{.ec2_webhook.body.email_address}}",\n "subject": "Tines: EC2 Acquisition is finished",\n "body": "Pipeline has finished!"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"This will send an email address to the email address given to the form, notifying the user the pipeline has finished."}),"\n",(0,t.jsxs)(n.p,{children:["You've now made the example workflow, to test it out, click on the ",(0,t.jsx)(n.strong,{children:"Form"})," tab in the story editor and submit. Once done, you'll need to manually emit the form response in the ",(0,t.jsx)(n.strong,{children:"EC2 Webhook"})," action, by clicking and going to the ",(0,t.jsx)(n.strong,{children:"Events"})," tab in the right-hand sidebar, and clicking ",(0,t.jsx)(n.strong,{children:"emit"})," on the most recent held event."]})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},55734:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/tines-actions-5174c3c023f735b4b45782747ac4af44.png"},43781:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/tines-form-47a5eecdbda685957aa11d9f64a5df92.png"},77928:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/tines-story-de36b629830df72c430b4b1a77f23516.png"},28453:(e,n,i)=>{i.d(n,{R:()=>o,x:()=>a});var t=i(96540);const s={},r=t.createContext(s);function o(e){const n=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),t.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/69701c38.db3ee26b.js b/assets/js/69701c38.b2cf24a7.js similarity index 98% rename from assets/js/69701c38.db3ee26b.js rename to assets/js/69701c38.b2cf24a7.js index 8fb59f09e..96b147bc0 100644 --- a/assets/js/69701c38.db3ee26b.js +++ b/assets/js/69701c38.b2cf24a7.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4976],{40435:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>r,contentTitle:()=>s,default:()=>h,frontMatter:()=>a,metadata:()=>c,toc:()=>d});var i=o(74848),n=o(28453);const a={title:"Tanium",hide_title:!0,sidebar_position:4},s="How to Process Tanium Live Response Collections",c={id:"cado/integrations/xdr/tanium",title:"Tanium",description:"The Cado platform can process Tanium Live Response collections, including the trace database.",source:"@site/docs/cado/integrations/xdr/tanium.md",sourceDirName:"cado/integrations/xdr",slug:"/cado/integrations/xdr/tanium",permalink:"/cado/integrations/xdr/tanium",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/xdr/tanium.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Tanium",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Microsoft Defender XDR",permalink:"/cado/integrations/xdr/defender"},next:{title:"Getting started example",permalink:"/cado/investigate/ctf-tutorial"}},r={},d=[{value:"Collecting a Live Response Package with Tanium",id:"collecting-a-live-response-package-with-tanium",level:2},{value:"Processing in Cado",id:"processing-in-cado",level:2},{value:"Overview",id:"overview",level:2},{value:"Getting the Cado Host Collection Script",id:"getting-the-cado-host-collection-script",level:2},{value:"Adding the Cado Host Collection Script to Tanium",id:"adding-the-cado-host-collection-script-to-tanium",level:2},{value:"Overview",id:"overview-1",level:2}];function l(e){const t={a:"a",code:"code",h1:"h1",h2:"h2",img:"img",p:"p",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-process-tanium-live-response-collections",children:"How to Process Tanium Live Response Collections"}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform can process Tanium Live Response collections, including the trace database."}),"\n",(0,i.jsx)(t.h2,{id:"collecting-a-live-response-package-with-tanium",children:"Collecting a Live Response Package with Tanium"}),"\n",(0,i.jsxs)(t.p,{children:["Follow the ",(0,i.jsx)(t.a,{href:"https://help.tanium.com/bundle/ug_threat_response_cloud/page/threat_response/collect_data.html",children:"Tanium documentation"})," to collect a Live Response package from a system and store it in either Azure Storage or AWS S3 Storage."]}),"\n",(0,i.jsx)(t.h2,{id:"processing-in-cado",children:"Processing in Cado"}),"\n",(0,i.jsxs)(t.p,{children:["To process the Tanium Live Response package, import the collected package into the Cado platform from S3 or Azure Storage. For more details on how the data is presented in Cado, refer to our ",(0,i.jsx)(t.a,{href:"https://www.cadosecurity.com/blog/investigating-tanium-live-response-collections-in-the-cado-platform",children:"blog"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"overview",children:"Overview"}),"\n",(0,i.jsxs)(t.p,{children:["Here\u2019s a high-level overview of the process:\n",(0,i.jsx)(t.img,{alt:"Tanium Cado",src:o(64347).A+"",width:"1520",height:"694"})]}),"\n",(0,i.jsxs)(t.p,{children:["For more information, visit ",(0,i.jsx)(t.a,{href:"https://www.cadosecurity.com/blog/investigating-tanium-live-response-collections-in-the-cado-platform",children:"this page"}),"."]}),"\n",(0,i.jsx)(t.h1,{id:"collecting-cado-host-data-with-tanium",children:"Collecting Cado Host Data with Tanium"}),"\n",(0,i.jsxs)(t.p,{children:["Tanium can be used to deploy the Cado Host collection script to endpoints as a ",(0,i.jsx)(t.a,{href:"https://help.tanium.com/bundle/ug_console_cloud/page/platform_user/authoring_packages.html",children:"Tanium Package"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"getting-the-cado-host-collection-script",children:"Getting the Cado Host Collection Script"}),"\n",(0,i.jsxs)(t.p,{children:["You can download the Cado Host collection script directly from the Cado platform by navigating to ",(0,i.jsx)(t.code,{children:"Project > Import > Cado Host"}),"."]}),"\n",(0,i.jsx)(t.p,{children:"By default, the script is generated with a pre-signed URL to upload the collected data to cloud storage. The pre-signed URL is valid for 12 hours, so the script must be run within that time."}),"\n",(0,i.jsxs)(t.p,{children:["For AWS deployments, you can use long-term access keys and secrets to upload data to S3 using the ",(0,i.jsx)(t.code,{children:"--access_key"})," and ",(0,i.jsx)(t.code,{children:"--secret-key"})," options. This eliminates the need for time-limited pre-signed URLs, but ensure that the keys are stored securely and have write-only access to the S3 bucket."]}),"\n",(0,i.jsx)(t.h2,{id:"adding-the-cado-host-collection-script-to-tanium",children:"Adding the Cado Host Collection Script to Tanium"}),"\n",(0,i.jsxs)(t.p,{children:["For guidance on creating packages in Tanium, refer to the ",(0,i.jsx)(t.a,{href:"https://help.tanium.com/bundle/ug_console_cloud/page/platform_user/authoring_packages.html",children:"Tanium documentation"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"overview-1",children:"Overview"}),"\n",(0,i.jsxs)(t.p,{children:["Here\u2019s a high-level overview of the process:\n",(0,i.jsx)(t.img,{alt:"Tanium Cado Host",src:o(44840).A+"",width:"1198",height:"718"})]})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},44840:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/tanium-cado-host-690a42cc9408e0914a3bcbca808801cc.png"},64347:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/tanium-cado-3a06711b48accd226eb0ae12f2abab93.png"},28453:(e,t,o)=>{o.d(t,{R:()=>s,x:()=>c});var i=o(96540);const n={},a=i.createContext(n);function s(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:s(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4976],{40435:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>r,contentTitle:()=>s,default:()=>h,frontMatter:()=>a,metadata:()=>c,toc:()=>d});var i=o(74848),n=o(28453);const a={title:"Tanium",hide_title:!0,sidebar_position:4},s="How to Process Tanium Live Response Collections",c={id:"cado/integrations/xdr/tanium",title:"Tanium",description:"The Cado platform can process Tanium Live Response collections, including the trace database.",source:"@site/docs/cado/integrations/xdr/tanium.md",sourceDirName:"cado/integrations/xdr",slug:"/cado/integrations/xdr/tanium",permalink:"/cado/integrations/xdr/tanium",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/xdr/tanium.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Tanium",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Microsoft Defender XDR",permalink:"/cado/integrations/xdr/defender"},next:{title:"Getting started example",permalink:"/cado/investigate/ctf-tutorial"}},r={},d=[{value:"Collecting a Live Response Package with Tanium",id:"collecting-a-live-response-package-with-tanium",level:2},{value:"Processing in Cado",id:"processing-in-cado",level:2},{value:"Overview",id:"overview",level:2},{value:"Getting the Cado Host Collection Script",id:"getting-the-cado-host-collection-script",level:2},{value:"Adding the Cado Host Collection Script to Tanium",id:"adding-the-cado-host-collection-script-to-tanium",level:2},{value:"Overview",id:"overview-1",level:2}];function l(e){const t={a:"a",code:"code",h1:"h1",h2:"h2",img:"img",p:"p",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-process-tanium-live-response-collections",children:"How to Process Tanium Live Response Collections"}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform can process Tanium Live Response collections, including the trace database."}),"\n",(0,i.jsx)(t.h2,{id:"collecting-a-live-response-package-with-tanium",children:"Collecting a Live Response Package with Tanium"}),"\n",(0,i.jsxs)(t.p,{children:["Follow the ",(0,i.jsx)(t.a,{href:"https://help.tanium.com/bundle/ug_threat_response_cloud/page/threat_response/collect_data.html",children:"Tanium documentation"})," to collect a Live Response package from a system and store it in either Azure Storage or AWS S3 Storage."]}),"\n",(0,i.jsx)(t.h2,{id:"processing-in-cado",children:"Processing in Cado"}),"\n",(0,i.jsxs)(t.p,{children:["To process the Tanium Live Response package, import the collected package into the Cado platform from S3 or Azure Storage. For more details on how the data is presented in Cado, refer to our ",(0,i.jsx)(t.a,{href:"https://www.cadosecurity.com/blog/investigating-tanium-live-response-collections-in-the-cado-platform",children:"blog"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"overview",children:"Overview"}),"\n",(0,i.jsxs)(t.p,{children:["Here\u2019s a high-level overview of the process:\n",(0,i.jsx)(t.img,{alt:"Tanium Cado",src:o(64347).A+"",width:"1520",height:"694"})]}),"\n",(0,i.jsxs)(t.p,{children:["For more information, visit ",(0,i.jsx)(t.a,{href:"https://www.cadosecurity.com/blog/investigating-tanium-live-response-collections-in-the-cado-platform",children:"this page"}),"."]}),"\n",(0,i.jsx)(t.h1,{id:"collecting-cado-host-data-with-tanium",children:"Collecting Cado Host Data with Tanium"}),"\n",(0,i.jsxs)(t.p,{children:["Tanium can be used to deploy the Cado Host collection script to endpoints as a ",(0,i.jsx)(t.a,{href:"https://help.tanium.com/bundle/ug_console_cloud/page/platform_user/authoring_packages.html",children:"Tanium Package"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"getting-the-cado-host-collection-script",children:"Getting the Cado Host Collection Script"}),"\n",(0,i.jsxs)(t.p,{children:["You can download the Cado Host collection script directly from the Cado platform by navigating to ",(0,i.jsx)(t.code,{children:"Project > Import > Cado Host"}),"."]}),"\n",(0,i.jsx)(t.p,{children:"By default, the script is generated with a pre-signed URL to upload the collected data to cloud storage. The pre-signed URL is valid for 12 hours, so the script must be run within that time."}),"\n",(0,i.jsxs)(t.p,{children:["For AWS deployments, you can use long-term access keys and secrets to upload data to S3 using the ",(0,i.jsx)(t.code,{children:"--access_key"})," and ",(0,i.jsx)(t.code,{children:"--secret-key"})," options. This eliminates the need for time-limited pre-signed URLs, but ensure that the keys are stored securely and have write-only access to the S3 bucket."]}),"\n",(0,i.jsx)(t.h2,{id:"adding-the-cado-host-collection-script-to-tanium",children:"Adding the Cado Host Collection Script to Tanium"}),"\n",(0,i.jsxs)(t.p,{children:["For guidance on creating packages in Tanium, refer to the ",(0,i.jsx)(t.a,{href:"https://help.tanium.com/bundle/ug_console_cloud/page/platform_user/authoring_packages.html",children:"Tanium documentation"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"overview-1",children:"Overview"}),"\n",(0,i.jsxs)(t.p,{children:["Here\u2019s a high-level overview of the process:\n",(0,i.jsx)(t.img,{alt:"Tanium Cado Host",src:o(44840).A+"",width:"1198",height:"718"})]})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},44840:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/tanium-cado-host-690a42cc9408e0914a3bcbca808801cc.png"},64347:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/tanium-cado-3a06711b48accd226eb0ae12f2abab93.png"},28453:(e,t,o)=>{o.d(t,{R:()=>s,x:()=>c});var i=o(96540);const n={},a=i.createContext(n);function s(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:s(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6e336265.64f288a0.js b/assets/js/6e336265.b4812a35.js similarity index 98% rename from assets/js/6e336265.64f288a0.js rename to assets/js/6e336265.b4812a35.js index dd014c0fe..ee9e394bd 100644 --- a/assets/js/6e336265.64f288a0.js +++ b/assets/js/6e336265.b4812a35.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9193],{3251:(t,o,e)=>{e.r(o),e.d(o,{assets:()=>c,contentTitle:()=>n,default:()=>p,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var r=e(74848),i=e(28453);const s={title:"Import data",hide_title:!0,sidebar_position:1},n="Importing Data into the Cado Platform",a={id:"cado/discovery-import/intro",title:"Import data",description:"The Cado platform offers several ways to import data. Once you select the data you want to import, the platform will automatically process it according to the configured Processing Settings. For more information on how processing works, refer to our Processing Settings Guide.",source:"@site/docs/cado/discovery-import/intro.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/intro",permalink:"/cado/discovery-import/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/intro.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Import data",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Tagging Cado resources",permalink:"/cado/deploy/tag"},next:{title:"Import from cloud",permalink:"/cado/discovery-import/import-from-cloud"}},c={},d=[{value:"Steps to Import Data",id:"steps-to-import-data",level:2},{value:"Import Options",id:"import-options",level:2},{value:"Importing from Cloud Services",id:"importing-from-cloud-services",level:3},{value:"Importing from Cado Host",id:"importing-from-cado-host",level:3},{value:"Importing from a URL",id:"importing-from-a-url",level:3}];function l(t){const o={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"importing-data-into-the-cado-platform",children:"Importing Data into the Cado Platform"}),"\n",(0,r.jsxs)(o.p,{children:["The Cado platform offers several ways to import data. Once you select the data you want to import, the platform will automatically process it according to the configured ",(0,r.jsx)(o.strong,{children:"Processing Settings"}),". For more information on how processing works, refer to our ",(0,r.jsx)(o.a,{href:"/cado/manage/workers#processing",children:"Processing Settings Guide"}),"."]}),"\n",(0,r.jsx)(o.h2,{id:"steps-to-import-data",children:"Steps to Import Data"}),"\n",(0,r.jsxs)(o.ol,{children:["\n",(0,r.jsxs)(o.li,{children:["Select the appropriate ",(0,r.jsx)(o.strong,{children:"Investigation"}),"."]}),"\n",(0,r.jsxs)(o.li,{children:["Click the ",(0,r.jsx)(o.strong,{children:"Import"})," button to start."]}),"\n"]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import Button",src:e(34577).A+"",width:"351",height:"138"})}),"\n",(0,r.jsxs)(o.ol,{start:"3",children:["\n",(0,r.jsx)(o.li,{children:"Follow the on-screen instructions to choose your evidence source and complete the import process."}),"\n"]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import Data",src:e(51822).A+"",width:"842",height:"242"})}),"\n",(0,r.jsx)(o.h2,{id:"import-options",children:"Import Options"}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-cloud-services",children:"Importing from Cloud Services"}),"\n",(0,r.jsx)(o.p,{children:"You can import evidence from cloud platforms such as AWS, Azure, and GCP. Ensure that the correct credentials are added to the system and that your role is granted access to use these credentials."}),"\n",(0,r.jsxs)(o.p,{children:["For a step-by-step guide, visit our ",(0,r.jsx)(o.a,{href:"/cado/discovery-import/import-from-cloud",children:"Cloud Import Documentation"}),"."]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-cado-host",children:"Importing from Cado Host"}),"\n",(0,r.jsxs)(o.p,{children:["The Cado platform can use ",(0,r.jsx)(o.strong,{children:"Cado Host"})," to acquire forensic artifacts from on-premises systems and analyze them in the cloud. Additionally, Cado Host can upload evidence, like previously collected disk images."]}),"\n",(0,r.jsxs)(o.p,{children:["To learn more about using Cado Host, see the ",(0,r.jsx)(o.a,{href:"/cado/discovery-import/cado-host/intro",children:"Cado Host Documentation"}),"."]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-a-url",children:"Importing from a URL"}),"\n",(0,r.jsxs)(o.p,{children:["If you\u2019ve stored forensic artifacts at a URL, you can import them directly into the platform. Ensure that the file types are supported by checking the list of compatible ",(0,r.jsx)(o.a,{href:"/cado/discovery-import/data-types/filetypes",children:"file types"}),"."]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"On-Premises URL",src:e(51253).A+"",width:"953",height:"181"})})]})}function p(t={}){const{wrapper:o}={...(0,i.R)(),...t.components};return o?(0,r.jsx)(o,{...t,children:(0,r.jsx)(l,{...t})}):l(t)}},34577:(t,o,e)=>{e.d(o,{A:()=>r});const r=e.p+"assets/images/import-button-798e13611cef2958b7fd5bbfc5c3ff91.png"},51822:(t,o,e)=>{e.d(o,{A:()=>r});const r=e.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},51253:(t,o,e)=>{e.d(o,{A:()=>r});const r=e.p+"assets/images/on-premises-url-5f43b688a1a7f0eb65001e51adb5744c.png"},28453:(t,o,e)=>{e.d(o,{R:()=>n,x:()=>a});var r=e(96540);const i={},s=r.createContext(i);function n(t){const o=r.useContext(s);return r.useMemo((function(){return"function"==typeof t?t(o):{...o,...t}}),[o,t])}function a(t){let o;return o=t.disableParentContext?"function"==typeof t.components?t.components(i):t.components||i:n(t.components),r.createElement(s.Provider,{value:o},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9193],{3251:(t,o,e)=>{e.r(o),e.d(o,{assets:()=>c,contentTitle:()=>n,default:()=>p,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var r=e(74848),i=e(28453);const s={title:"Import data",hide_title:!0,sidebar_position:1},n="Importing Data into the Cado Platform",a={id:"cado/discovery-import/intro",title:"Import data",description:"The Cado platform offers several ways to import data. Once you select the data you want to import, the platform will automatically process it according to the configured Processing Settings. For more information on how processing works, refer to our Processing Settings Guide.",source:"@site/docs/cado/discovery-import/intro.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/intro",permalink:"/cado/discovery-import/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/intro.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Import data",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Tagging Cado resources",permalink:"/cado/deploy/tag"},next:{title:"Import from cloud",permalink:"/cado/discovery-import/import-from-cloud"}},c={},d=[{value:"Steps to Import Data",id:"steps-to-import-data",level:2},{value:"Import Options",id:"import-options",level:2},{value:"Importing from Cloud Services",id:"importing-from-cloud-services",level:3},{value:"Importing from Cado Host",id:"importing-from-cado-host",level:3},{value:"Importing from a URL",id:"importing-from-a-url",level:3}];function l(t){const o={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"importing-data-into-the-cado-platform",children:"Importing Data into the Cado Platform"}),"\n",(0,r.jsxs)(o.p,{children:["The Cado platform offers several ways to import data. Once you select the data you want to import, the platform will automatically process it according to the configured ",(0,r.jsx)(o.strong,{children:"Processing Settings"}),". For more information on how processing works, refer to our ",(0,r.jsx)(o.a,{href:"/cado/manage/workers#processing",children:"Processing Settings Guide"}),"."]}),"\n",(0,r.jsx)(o.h2,{id:"steps-to-import-data",children:"Steps to Import Data"}),"\n",(0,r.jsxs)(o.ol,{children:["\n",(0,r.jsxs)(o.li,{children:["Select the appropriate ",(0,r.jsx)(o.strong,{children:"Investigation"}),"."]}),"\n",(0,r.jsxs)(o.li,{children:["Click the ",(0,r.jsx)(o.strong,{children:"Import"})," button to start."]}),"\n"]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import Button",src:e(34577).A+"",width:"351",height:"138"})}),"\n",(0,r.jsxs)(o.ol,{start:"3",children:["\n",(0,r.jsx)(o.li,{children:"Follow the on-screen instructions to choose your evidence source and complete the import process."}),"\n"]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import Data",src:e(51822).A+"",width:"842",height:"242"})}),"\n",(0,r.jsx)(o.h2,{id:"import-options",children:"Import Options"}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-cloud-services",children:"Importing from Cloud Services"}),"\n",(0,r.jsx)(o.p,{children:"You can import evidence from cloud platforms such as AWS, Azure, and GCP. Ensure that the correct credentials are added to the system and that your role is granted access to use these credentials."}),"\n",(0,r.jsxs)(o.p,{children:["For a step-by-step guide, visit our ",(0,r.jsx)(o.a,{href:"/cado/discovery-import/import-from-cloud",children:"Cloud Import Documentation"}),"."]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-cado-host",children:"Importing from Cado Host"}),"\n",(0,r.jsxs)(o.p,{children:["The Cado platform can use ",(0,r.jsx)(o.strong,{children:"Cado Host"})," to acquire forensic artifacts from on-premises systems and analyze them in the cloud. Additionally, Cado Host can upload evidence, like previously collected disk images."]}),"\n",(0,r.jsxs)(o.p,{children:["To learn more about using Cado Host, see the ",(0,r.jsx)(o.a,{href:"/cado/discovery-import/cado-host/intro",children:"Cado Host Documentation"}),"."]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-a-url",children:"Importing from a URL"}),"\n",(0,r.jsxs)(o.p,{children:["If you\u2019ve stored forensic artifacts at a URL, you can import them directly into the platform. Ensure that the file types are supported by checking the list of compatible ",(0,r.jsx)(o.a,{href:"/cado/discovery-import/data-types/filetypes",children:"file types"}),"."]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"On-Premises URL",src:e(51253).A+"",width:"953",height:"181"})})]})}function p(t={}){const{wrapper:o}={...(0,i.R)(),...t.components};return o?(0,r.jsx)(o,{...t,children:(0,r.jsx)(l,{...t})}):l(t)}},34577:(t,o,e)=>{e.d(o,{A:()=>r});const r=e.p+"assets/images/import-button-798e13611cef2958b7fd5bbfc5c3ff91.png"},51822:(t,o,e)=>{e.d(o,{A:()=>r});const r=e.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},51253:(t,o,e)=>{e.d(o,{A:()=>r});const r=e.p+"assets/images/on-premises-url-5f43b688a1a7f0eb65001e51adb5744c.png"},28453:(t,o,e)=>{e.d(o,{R:()=>n,x:()=>a});var r=e(96540);const i={},s=r.createContext(i);function n(t){const o=r.useContext(s);return r.useMemo((function(){return"function"==typeof t?t(o):{...o,...t}}),[o,t])}function a(t){let o;return o=t.disableParentContext?"function"==typeof t.components?t.components(i):t.components||i:n(t.components),r.createElement(s.Provider,{value:o},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/6f23eecf.8349bbd2.js b/assets/js/6f23eecf.58fd01d4.js similarity index 98% rename from assets/js/6f23eecf.8349bbd2.js rename to assets/js/6f23eecf.58fd01d4.js index 01302f48b..0c5d931ac 100644 --- a/assets/js/6f23eecf.8349bbd2.js +++ b/assets/js/6f23eecf.58fd01d4.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8367],{67918:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>g,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var t=i(74848),s=i(28453);const o={title:"Managing investigations",hide_title:!0,sidebar_position:13},a="How to Manage Investigations",r={id:"cado/discovery-import/investigations",title:"Managing investigations",description:"Cado organizes evidence items into groups called Investigations, which were previously referred to as projects.",source:"@site/docs/cado/discovery-import/investigations.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/investigations",permalink:"/cado/discovery-import/investigations",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/investigations.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:13,frontMatter:{title:"Managing investigations",hide_title:!0,sidebar_position:13},sidebar:"tutorialSidebar",previous:{title:"Cloud import sources",permalink:"/cado/discovery-import/data-types/import-types"},next:{title:"API overview",permalink:"/cado/integrations/api-overview"}},l={},c=[{value:"Creating an Investigation",id:"creating-an-investigation",level:2},{value:"Deleting an Investigation",id:"deleting-an-investigation",level:2},{value:"Updating an Investigation",id:"updating-an-investigation",level:2},{value:"Investigation Processing",id:"investigation-processing",level:2}];function d(e){const n={admonition:"admonition",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-manage-investigations",children:"How to Manage Investigations"}),"\n",(0,t.jsxs)(n.p,{children:["Cado organizes evidence items into groups called ",(0,t.jsx)(n.strong,{children:"Investigations"}),", which were previously referred to as projects."]}),"\n",(0,t.jsx)(n.h2,{id:"creating-an-investigation",children:"Creating an Investigation"}),"\n",(0,t.jsx)(n.p,{children:"To create a new investigation:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigations"})," in the main menu."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Create Investigation"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Enter a unique name for the investigation."}),"\n",(0,t.jsx)(n.li,{children:"Optionally, grant access to other users and provide a description."}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Create"})," to finalize."]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"deleting-an-investigation",children:"Deleting an Investigation"}),"\n",(0,t.jsx)(n.p,{children:"If you want to delete old investigations to free up disk space, follow these steps:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigations"})," and select the \u22ee menu next to the investigation you want to delete."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigation Settings"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Scroll to the bottom of the page to the ",(0,t.jsx)(n.strong,{children:"Delete"})," section."]}),"\n",(0,t.jsxs)(n.li,{children:["Enter ",(0,t.jsx)(n.strong,{children:"permanently delete"})," in the text box."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Delete Investigation"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsxs)(n.p,{children:["You can check available disk space by clicking the ",(0,t.jsx)(n.strong,{children:"Platform"})," menu button."]})}),"\n",(0,t.jsx)(n.h2,{id:"updating-an-investigation",children:"Updating an Investigation"}),"\n",(0,t.jsx)(n.p,{children:"You can modify an investigation's name and description:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigations"})," and select the investigation you want to update."]}),"\n",(0,t.jsxs)(n.li,{children:["Click the \u22ee menu next to the investigation and select ",(0,t.jsx)(n.strong,{children:"Investigation Settings"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Make your changes and click ",(0,t.jsx)(n.strong,{children:"Save Changes"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"investigation-processing",children:"Investigation Processing"}),"\n",(0,t.jsxs)(n.p,{children:["The ",(0,t.jsx)(n.strong,{children:"Processing"})," page provides a high-level overview of the processing status of evidence items. Evidence goes through several stages of analysis, and some data, such as file listings, may be available before the full processing is complete."]}),"\n",(0,t.jsx)(n.p,{children:"To view the processing status of an investigation:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigations"})," and select the investigation you want to review."]}),"\n",(0,t.jsxs)(n.li,{children:["Navigate to the ",(0,t.jsx)(n.strong,{children:"Automated Investigation"})," or ",(0,t.jsx)(n.strong,{children:"Evidence"})," tab and click the \u22ee menu."]}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"View Processing Pipeline"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Processing",src:i(90776).A+"",width:"3296",height:"776"})}),"\n",(0,t.jsx)(n.p,{children:"You can expand individual evidence items to see their detailed processing status."})]})}function g(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},90776:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/processing-9b2e95b51d86b607da98c41a9ceeed16.png"},28453:(e,n,i)=>{i.d(n,{R:()=>a,x:()=>r});var t=i(96540);const s={},o=t.createContext(s);function a(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8367],{67918:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>g,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var t=i(74848),s=i(28453);const o={title:"Managing investigations",hide_title:!0,sidebar_position:13},a="How to Manage Investigations",r={id:"cado/discovery-import/investigations",title:"Managing investigations",description:"Cado organizes evidence items into groups called Investigations, which were previously referred to as projects.",source:"@site/docs/cado/discovery-import/investigations.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/investigations",permalink:"/cado/discovery-import/investigations",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/investigations.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:13,frontMatter:{title:"Managing investigations",hide_title:!0,sidebar_position:13},sidebar:"tutorialSidebar",previous:{title:"Cloud import sources",permalink:"/cado/discovery-import/data-types/import-types"},next:{title:"API overview",permalink:"/cado/integrations/api-overview"}},l={},c=[{value:"Creating an Investigation",id:"creating-an-investigation",level:2},{value:"Deleting an Investigation",id:"deleting-an-investigation",level:2},{value:"Updating an Investigation",id:"updating-an-investigation",level:2},{value:"Investigation Processing",id:"investigation-processing",level:2}];function d(e){const n={admonition:"admonition",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-manage-investigations",children:"How to Manage Investigations"}),"\n",(0,t.jsxs)(n.p,{children:["Cado organizes evidence items into groups called ",(0,t.jsx)(n.strong,{children:"Investigations"}),", which were previously referred to as projects."]}),"\n",(0,t.jsx)(n.h2,{id:"creating-an-investigation",children:"Creating an Investigation"}),"\n",(0,t.jsx)(n.p,{children:"To create a new investigation:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigations"})," in the main menu."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Create Investigation"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Enter a unique name for the investigation."}),"\n",(0,t.jsx)(n.li,{children:"Optionally, grant access to other users and provide a description."}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Create"})," to finalize."]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"deleting-an-investigation",children:"Deleting an Investigation"}),"\n",(0,t.jsx)(n.p,{children:"If you want to delete old investigations to free up disk space, follow these steps:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigations"})," and select the \u22ee menu next to the investigation you want to delete."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigation Settings"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Scroll to the bottom of the page to the ",(0,t.jsx)(n.strong,{children:"Delete"})," section."]}),"\n",(0,t.jsxs)(n.li,{children:["Enter ",(0,t.jsx)(n.strong,{children:"permanently delete"})," in the text box."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Delete Investigation"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsxs)(n.p,{children:["You can check available disk space by clicking the ",(0,t.jsx)(n.strong,{children:"Platform"})," menu button."]})}),"\n",(0,t.jsx)(n.h2,{id:"updating-an-investigation",children:"Updating an Investigation"}),"\n",(0,t.jsx)(n.p,{children:"You can modify an investigation's name and description:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigations"})," and select the investigation you want to update."]}),"\n",(0,t.jsxs)(n.li,{children:["Click the \u22ee menu next to the investigation and select ",(0,t.jsx)(n.strong,{children:"Investigation Settings"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Make your changes and click ",(0,t.jsx)(n.strong,{children:"Save Changes"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"investigation-processing",children:"Investigation Processing"}),"\n",(0,t.jsxs)(n.p,{children:["The ",(0,t.jsx)(n.strong,{children:"Processing"})," page provides a high-level overview of the processing status of evidence items. Evidence goes through several stages of analysis, and some data, such as file listings, may be available before the full processing is complete."]}),"\n",(0,t.jsx)(n.p,{children:"To view the processing status of an investigation:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Investigations"})," and select the investigation you want to review."]}),"\n",(0,t.jsxs)(n.li,{children:["Navigate to the ",(0,t.jsx)(n.strong,{children:"Automated Investigation"})," or ",(0,t.jsx)(n.strong,{children:"Evidence"})," tab and click the \u22ee menu."]}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"View Processing Pipeline"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Processing",src:i(90776).A+"",width:"3296",height:"776"})}),"\n",(0,t.jsx)(n.p,{children:"You can expand individual evidence items to see their detailed processing status."})]})}function g(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},90776:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/processing-9b2e95b51d86b607da98c41a9ceeed16.png"},28453:(e,n,i)=>{i.d(n,{R:()=>a,x:()=>r});var t=i(96540);const s={},o=t.createContext(s);function a(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6fe3c7a2.92489a36.js b/assets/js/6fe3c7a2.977d8241.js similarity index 98% rename from assets/js/6fe3c7a2.92489a36.js rename to assets/js/6fe3c7a2.977d8241.js index 1ed1fd9f7..41a84baf1 100644 --- a/assets/js/6fe3c7a2.92489a36.js +++ b/assets/js/6fe3c7a2.977d8241.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2948],{39036:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>d,contentTitle:()=>t,default:()=>a,frontMatter:()=>o,metadata:()=>c,toc:()=>l});var i=s(74848),n=s(28453);const o={title:"Endpoint access",hide_title:!0,sidebar_position:3},t="What Azure Endpoints Does the Cado Platform Require Access To?",c={id:"cado/deploy/azure/endpoints",title:"Endpoint access",description:"The Cado platform requires access to the following Azure endpoints:",source:"@site/docs/cado/deploy/azure/endpoints.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/endpoints",permalink:"/cado/deploy/azure/endpoints",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/endpoints.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Endpoint access",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Platform encryption in Azure",permalink:"/cado/deploy/azure/data-encryption-overview"},next:{title:"Architecture in Azure",permalink:"/cado/deploy/azure/azure-architecture"}},d={},l=[{value:"Azure Resource Manager",id:"azure-resource-manager",level:3},{value:"Storage Service",id:"storage-service",level:3},{value:"Networking Service",id:"networking-service",level:3},{value:"Monitor / Activity Logs",id:"monitor--activity-logs",level:3},{value:"Kubernetes",id:"kubernetes",level:3},{value:"Identity",id:"identity",level:3},{value:"Compute",id:"compute",level:3}];function u(e){const r={code:"code",h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(r.h1,{id:"what-azure-endpoints-does-the-cado-platform-require-access-to",children:"What Azure Endpoints Does the Cado Platform Require Access To?"}),"\n",(0,i.jsx)(r.p,{children:"The Cado platform requires access to the following Azure endpoints:"}),"\n",(0,i.jsx)(r.h3,{id:"azure-resource-manager",children:"Azure Resource Manager"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsxs)(r.li,{children:[(0,i.jsx)(r.strong,{children:"Provider APIs"}),": ",(0,i.jsx)(r.code,{children:"https://management.azure.com/"})]}),"\n",(0,i.jsxs)(r.li,{children:[(0,i.jsx)(r.strong,{children:"Classic Deployment Model"}),": ",(0,i.jsx)(r.code,{children:"https://management.core.windows.net/"})]}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"storage-service",children:"Storage Service"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.Storage/storageAccounts"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"{account_name}.blob.core.windows.net/{container}?restype=container&comp=list"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"{account_name}.blob.core.windows.net/{container}/{blob}"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"networking-service",children:"Networking Service"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkInterfaces"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"monitor--activity-logs",children:"Monitor / Activity Logs"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.Insights/eventtypes/management/values"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"kubernetes",children:"Kubernetes"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ContainerService/managedClusters/{resourceName}/listClusterAdminCredential"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourcegroups"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.ContainerService/managedClusters"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"identity",children:"Identity"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"compute",children:"Compute"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.Compute/disks"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/snapshots/"})}),"\n"]})]})}function a(e={}){const{wrapper:r}={...(0,n.R)(),...e.components};return r?(0,i.jsx)(r,{...e,children:(0,i.jsx)(u,{...e})}):u(e)}},28453:(e,r,s)=>{s.d(r,{R:()=>t,x:()=>c});var i=s(96540);const n={},o=i.createContext(n);function t(e){const r=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function c(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:t(e.components),i.createElement(o.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2948],{39036:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>d,contentTitle:()=>t,default:()=>a,frontMatter:()=>o,metadata:()=>c,toc:()=>l});var i=s(74848),n=s(28453);const o={title:"Endpoint access",hide_title:!0,sidebar_position:3},t="What Azure Endpoints Does the Cado Platform Require Access To?",c={id:"cado/deploy/azure/endpoints",title:"Endpoint access",description:"The Cado platform requires access to the following Azure endpoints:",source:"@site/docs/cado/deploy/azure/endpoints.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/endpoints",permalink:"/cado/deploy/azure/endpoints",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/endpoints.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Endpoint access",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Platform encryption in Azure",permalink:"/cado/deploy/azure/data-encryption-overview"},next:{title:"Architecture in Azure",permalink:"/cado/deploy/azure/azure-architecture"}},d={},l=[{value:"Azure Resource Manager",id:"azure-resource-manager",level:3},{value:"Storage Service",id:"storage-service",level:3},{value:"Networking Service",id:"networking-service",level:3},{value:"Monitor / Activity Logs",id:"monitor--activity-logs",level:3},{value:"Kubernetes",id:"kubernetes",level:3},{value:"Identity",id:"identity",level:3},{value:"Compute",id:"compute",level:3}];function u(e){const r={code:"code",h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(r.h1,{id:"what-azure-endpoints-does-the-cado-platform-require-access-to",children:"What Azure Endpoints Does the Cado Platform Require Access To?"}),"\n",(0,i.jsx)(r.p,{children:"The Cado platform requires access to the following Azure endpoints:"}),"\n",(0,i.jsx)(r.h3,{id:"azure-resource-manager",children:"Azure Resource Manager"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsxs)(r.li,{children:[(0,i.jsx)(r.strong,{children:"Provider APIs"}),": ",(0,i.jsx)(r.code,{children:"https://management.azure.com/"})]}),"\n",(0,i.jsxs)(r.li,{children:[(0,i.jsx)(r.strong,{children:"Classic Deployment Model"}),": ",(0,i.jsx)(r.code,{children:"https://management.core.windows.net/"})]}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"storage-service",children:"Storage Service"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.Storage/storageAccounts"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"{account_name}.blob.core.windows.net/{container}?restype=container&comp=list"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"{account_name}.blob.core.windows.net/{container}/{blob}"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"networking-service",children:"Networking Service"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkInterfaces"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"monitor--activity-logs",children:"Monitor / Activity Logs"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.Insights/eventtypes/management/values"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"kubernetes",children:"Kubernetes"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ContainerService/managedClusters/{resourceName}/listClusterAdminCredential"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourcegroups"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.ContainerService/managedClusters"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"identity",children:"Identity"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments"})}),"\n"]}),"\n",(0,i.jsx)(r.h3,{id:"compute",children:"Compute"}),"\n",(0,i.jsxs)(r.ul,{children:["\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/providers/Microsoft.Compute/disks"})}),"\n",(0,i.jsx)(r.li,{children:(0,i.jsx)(r.code,{children:"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/snapshots/"})}),"\n"]})]})}function a(e={}){const{wrapper:r}={...(0,n.R)(),...e.components};return r?(0,i.jsx)(r,{...e,children:(0,i.jsx)(u,{...e})}):u(e)}},28453:(e,r,s)=>{s.d(r,{R:()=>t,x:()=>c});var i=s(96540);const n={},o=i.createContext(n);function t(e){const r=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function c(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:t(e.components),i.createElement(o.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7003eebb.d0c2bd2c.js b/assets/js/7003eebb.78c56baa.js similarity index 98% rename from assets/js/7003eebb.d0c2bd2c.js rename to assets/js/7003eebb.78c56baa.js index 568b22b8e..18e2fc92c 100644 --- a/assets/js/7003eebb.d0c2bd2c.js +++ b/assets/js/7003eebb.78c56baa.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8771],{36614:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var n=i(74848),s=i(28453);const o={title:"Adding detections",hide_title:!0,sidebar_position:9},a="How to Add Additional Detections to the Cado Platform",r={id:"cado/investigate/detections",title:"Adding detections",description:"The Cado platform allows you to integrate with various systems and incorporate custom Indicators of Compromise (IOCs). You can configure these settings by navigating to Settings > General Settings > Detection.",source:"@site/docs/cado/investigate/detections.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/detections",permalink:"/cado/investigate/detections",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/detections.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:9,frontMatter:{title:"Adding detections",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Response actions",permalink:"/cado/investigate/response-actions"},next:{title:"AI Investigator",permalink:"/cado/investigate/ai investigator"}},l={},d=[{value:"VirusTotal API Key",id:"virustotal-api-key",level:3},{value:"Yara Rules",id:"yara-rules",level:3},{value:"Indicators of Compromise (IOCs)",id:"indicators-of-compromise-iocs",level:3}];function c(e){const t={code:"code",h1:"h1",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-add-additional-detections-to-the-cado-platform",children:"How to Add Additional Detections to the Cado Platform"}),"\n",(0,n.jsxs)(t.p,{children:["The Cado platform allows you to integrate with various systems and incorporate custom Indicators of Compromise (IOCs). You can configure these settings by navigating to ",(0,n.jsx)(t.strong,{children:"Settings > General Settings > Detection"}),"."]}),"\n",(0,n.jsx)(t.h3,{id:"virustotal-api-key",children:"VirusTotal API Key"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"VirusTotal API Key"})," is used to enhance the analysis of already detected files by comparing their file-hash with the VirusTotal database. It does not perform file detection on its own but supplements Cado\u2019s existing detections. When a file with a detection is processed, Cado will perform a VirusTotal lookup based on the file\u2019s hash."]}),"\n",(0,n.jsx)(t.p,{children:"Key points to note:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"If the VirusTotal lookup fails, it will not be retried."}),"\n",(0,n.jsx)(t.li,{children:"Cado caches API lookups to avoid redundant queries. If the same file is encountered again, only the first lookup will occur."}),"\n",(0,n.jsx)(t.li,{children:"Typically, Cado will only perform a small number of VirusTotal lookups for any system being processed. However, systems with many malicious files may hit the VirusTotal API key's subscription limit."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Possible workarounds if limits are reached:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Create specific API keys with limited usage."}),"\n",(0,n.jsx)(t.li,{children:"Use a separate free VirusTotal API key (outside of an Enterprise license)."}),"\n",(0,n.jsx)(t.li,{children:"Disable VirusTotal integration for alarms or detections and rely on other detection methods like Yara rules and IOCs."}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"yara-rules",children:"Yara Rules"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Yara Rules"})," field allows you to apply your own Yara rules in addition to the built-in rules provided by Cado. When a rule matches, it will trigger a detection:"]}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["A match will generate a ",(0,n.jsx)(t.code,{children:"Malicious"})," detection by default."]}),"\n",(0,n.jsxs)(t.li,{children:['If the Yara rule name starts with "suspicious", it will trigger a ',(0,n.jsx)(t.code,{children:"Suspicious"})," detection."]}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"indicators-of-compromise-iocs",children:"Indicators of Compromise (IOCs)"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Indicators of Compromise"})," field enables you to match IOCs against file contents or events, such as network logs. You can enter one indicator per line, using any keyword, such as:"]}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Filename"}),"\n",(0,n.jsx)(t.li,{children:"IP address"}),"\n",(0,n.jsx)(t.li,{children:"Domain name"}),"\n",(0,n.jsx)(t.li,{children:"SHA256 file hash (for matching against files)"}),"\n"]}),"\n",(0,n.jsxs)(t.p,{children:["You can also add a description for an indicator by using a semicolon (",(0,n.jsx)(t.code,{children:";"}),"). For example, to label a domain as suspicious, you can enter:"]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:"Domain.com;A bad domain\n"})}),"\n",(0,n.jsx)(t.p,{children:"Additionally, you can upload a MISP-formatted JSON file containing indicators for bulk input."})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},28453:(e,t,i)=>{i.d(t,{R:()=>a,x:()=>r});var n=i(96540);const s={},o=n.createContext(s);function a(e){const t=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8771],{36614:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var n=i(74848),s=i(28453);const o={title:"Adding detections",hide_title:!0,sidebar_position:9},a="How to Add Additional Detections to the Cado Platform",r={id:"cado/investigate/detections",title:"Adding detections",description:"The Cado platform allows you to integrate with various systems and incorporate custom Indicators of Compromise (IOCs). You can configure these settings by navigating to Settings > General Settings > Detection.",source:"@site/docs/cado/investigate/detections.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/detections",permalink:"/cado/investigate/detections",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/detections.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:9,frontMatter:{title:"Adding detections",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Response actions",permalink:"/cado/investigate/response-actions"},next:{title:"AI Investigator",permalink:"/cado/investigate/ai investigator"}},l={},d=[{value:"VirusTotal API Key",id:"virustotal-api-key",level:3},{value:"Yara Rules",id:"yara-rules",level:3},{value:"Indicators of Compromise (IOCs)",id:"indicators-of-compromise-iocs",level:3}];function c(e){const t={code:"code",h1:"h1",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-add-additional-detections-to-the-cado-platform",children:"How to Add Additional Detections to the Cado Platform"}),"\n",(0,n.jsxs)(t.p,{children:["The Cado platform allows you to integrate with various systems and incorporate custom Indicators of Compromise (IOCs). You can configure these settings by navigating to ",(0,n.jsx)(t.strong,{children:"Settings > General Settings > Detection"}),"."]}),"\n",(0,n.jsx)(t.h3,{id:"virustotal-api-key",children:"VirusTotal API Key"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"VirusTotal API Key"})," is used to enhance the analysis of already detected files by comparing their file-hash with the VirusTotal database. It does not perform file detection on its own but supplements Cado\u2019s existing detections. When a file with a detection is processed, Cado will perform a VirusTotal lookup based on the file\u2019s hash."]}),"\n",(0,n.jsx)(t.p,{children:"Key points to note:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"If the VirusTotal lookup fails, it will not be retried."}),"\n",(0,n.jsx)(t.li,{children:"Cado caches API lookups to avoid redundant queries. If the same file is encountered again, only the first lookup will occur."}),"\n",(0,n.jsx)(t.li,{children:"Typically, Cado will only perform a small number of VirusTotal lookups for any system being processed. However, systems with many malicious files may hit the VirusTotal API key's subscription limit."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Possible workarounds if limits are reached:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Create specific API keys with limited usage."}),"\n",(0,n.jsx)(t.li,{children:"Use a separate free VirusTotal API key (outside of an Enterprise license)."}),"\n",(0,n.jsx)(t.li,{children:"Disable VirusTotal integration for alarms or detections and rely on other detection methods like Yara rules and IOCs."}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"yara-rules",children:"Yara Rules"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Yara Rules"})," field allows you to apply your own Yara rules in addition to the built-in rules provided by Cado. When a rule matches, it will trigger a detection:"]}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["A match will generate a ",(0,n.jsx)(t.code,{children:"Malicious"})," detection by default."]}),"\n",(0,n.jsxs)(t.li,{children:['If the Yara rule name starts with "suspicious", it will trigger a ',(0,n.jsx)(t.code,{children:"Suspicious"})," detection."]}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"indicators-of-compromise-iocs",children:"Indicators of Compromise (IOCs)"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Indicators of Compromise"})," field enables you to match IOCs against file contents or events, such as network logs. You can enter one indicator per line, using any keyword, such as:"]}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Filename"}),"\n",(0,n.jsx)(t.li,{children:"IP address"}),"\n",(0,n.jsx)(t.li,{children:"Domain name"}),"\n",(0,n.jsx)(t.li,{children:"SHA256 file hash (for matching against files)"}),"\n"]}),"\n",(0,n.jsxs)(t.p,{children:["You can also add a description for an indicator by using a semicolon (",(0,n.jsx)(t.code,{children:";"}),"). For example, to label a domain as suspicious, you can enter:"]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:"Domain.com;A bad domain\n"})}),"\n",(0,n.jsx)(t.p,{children:"Additionally, you can upload a MISP-formatted JSON file containing indicators for bulk input."})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},28453:(e,t,i)=>{i.d(t,{R:()=>a,x:()=>r});var n=i(96540);const s={},o=n.createContext(s);function a(e){const t=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7144146f.29b49f4f.js b/assets/js/7144146f.c9d8605d.js similarity index 99% rename from assets/js/7144146f.29b49f4f.js rename to assets/js/7144146f.c9d8605d.js index a602cd83d..b0febb698 100644 --- a/assets/js/7144146f.29b49f4f.js +++ b/assets/js/7144146f.c9d8605d.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1580],{36349:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>a});var o=n(74848),t=n(28453);const i={title:"Script operation",hide_title:!0,sidebar_position:8},r="How does the Cado Host deployment script operate?",c={id:"cado/discovery-import/cado-host/script-operation",title:"Script operation",description:"The Cado Host script is used to download, execute, and clean up the Cado Host binary from a system.",source:"@site/docs/cado/discovery-import/cado-host/script-operation.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/script-operation",permalink:"/cado/discovery-import/cado-host/script-operation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/script-operation.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"Script operation",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Upload single file",permalink:"/cado/discovery-import/cado-host/manual-upload"},next:{title:"Security",permalink:"/cado/discovery-import/cado-host/security"}},d={},a=[{value:"Summary of Key Steps:",id:"summary-of-key-steps",level:3},{value:"Script Breakdown",id:"script-breakdown",level:3},{value:"Description of the Encoded JSON Object:",id:"description-of-the-encoded-json-object",level:3}];function l(e){const s={br:"br",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-does-the-cado-host-deployment-script-operate",children:"How does the Cado Host deployment script operate?"}),"\n",(0,o.jsx)(s.p,{children:"The Cado Host script is used to download, execute, and clean up the Cado Host binary from a system.\nBelow is a breakdown of how the script works for Linux - the script is similiar in function for Windows and MacOS."}),"\n",(0,o.jsx)(s.h3,{id:"summary-of-key-steps",children:"Summary of Key Steps:"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Directory creation"}),": A temporary directory is created for storing the Cado Host binary."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Download handling"}),": The script checks if either ",(0,o.jsx)(s.code,{children:"curl"})," or ",(0,o.jsx)(s.code,{children:"wget"})," is installed and uses one to download the Cado Host binary."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Download verification"}),": After downloading, the script verifies that the binary exists."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Execution of Cado Host"}),": The binary is given executable permissions and run with specific options."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Clean-up"}),": After running, the script removes the temporary directory to clean up."]}),"\n"]}),"\n",(0,o.jsx)(s.h3,{id:"script-breakdown",children:"Script Breakdown"}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"mkdir -p /tmp/cado-host-67c03a16\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Creates a temporary directory"}),":",(0,o.jsx)(s.br,{}),"\n","The script starts by creating a directory named ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16"}),". This directory is used to store the downloaded Cado Host binary. The ",(0,o.jsx)(s.code,{children:"-p"})," option ensures no error is thrown if the directory already exists.\nThe end of the directory is a random identifier to avoid conflicts."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"if command -v curl > /dev/null\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Checks for ",(0,o.jsx)(s.code,{children:"curl"})," availability"]}),":",(0,o.jsx)(s.br,{}),"\n","The script checks whether the ",(0,o.jsx)(s.code,{children:"curl"})," command is available on the system by verifying if it can return a version without error. This is done by checking if the command exists (",(0,o.jsx)(s.code,{children:"command -v curl"}),"), and if it does, the script proceeds to use ",(0,o.jsx)(s.code,{children:"curl"})," for downloading."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"then sudo curl -s https://cado-public.s3-accelerate.amazonaws.com/cado-host/$version/linux/cado-host --output /tmp/cado-host-67c03a16/cado-host\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Downloads Cado Host using ",(0,o.jsx)(s.code,{children:"curl"})]}),":",(0,o.jsx)(s.br,{}),"\n","If ",(0,o.jsx)(s.code,{children:"curl"})," is available, it silently (",(0,o.jsx)(s.code,{children:"-s"}),") downloads the Cado Host binary from the provided URL and stores it in the newly created directory. The file is saved as ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16/cado-host"}),"."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"elif command -v wget > /dev/null\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Checks for ",(0,o.jsx)(s.code,{children:"wget"})," availability"]}),":",(0,o.jsx)(s.br,{}),"\n","If ",(0,o.jsx)(s.code,{children:"curl"})," is not found, the script checks if ",(0,o.jsx)(s.code,{children:"wget"})," is installed on the system."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"then sudo wget -q --output-document /tmp/cado-host-67c03a16/cado-host https://cado-public.s3-accelerate.amazonaws.com/cado-host/$version/linux/cado-host\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Downloads Cado Host using ",(0,o.jsx)(s.code,{children:"wget"})]}),":",(0,o.jsx)(s.br,{}),"\n","If ",(0,o.jsx)(s.code,{children:"wget"})," is available, it silently (",(0,o.jsx)(s.code,{children:"-q"}),") downloads the Cado Host binary from the same URL, storing it in the ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16/"})," directory."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:'else echo "Cado Host requires curl or wget for unattended mode."; exit 1;\n'})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Handles missing ",(0,o.jsx)(s.code,{children:"curl"})," and ",(0,o.jsx)(s.code,{children:"wget"})]}),":",(0,o.jsx)(s.br,{}),"\n","If neither ",(0,o.jsx)(s.code,{children:"curl"})," nor ",(0,o.jsx)(s.code,{children:"wget"})," is available on the system, the script outputs an error message, and the script exits with a status code of ",(0,o.jsx)(s.code,{children:"1"}),", indicating failure."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"fi\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"End of conditional block"}),":",(0,o.jsx)(s.br,{}),"\n","This marks the end of the block that checks for ",(0,o.jsx)(s.code,{children:"curl"})," or ",(0,o.jsx)(s.code,{children:"wget"}),"."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:'if [ ! -f /tmp/cado-host-67c03a16/cado-host ]; then\n echo "Cado Host failed to download, check if the machine has an active network connection."; exit 1;\nfi\n'})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Validates the download"}),":",(0,o.jsx)(s.br,{}),"\n","This step checks if the Cado Host binary was successfully downloaded. If the binary is not found in the ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16/"})," directory, the script prints an error message about network issues and exits."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"cd /tmp/cado-host-67c03a16/\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Changes the working directory"}),":",(0,o.jsx)(s.br,{}),"\n","The script changes the current working directory to ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16/"}),", where the downloaded binary resides."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"sudo chmod +x ./cado-host\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Makes the binary executable"}),":",(0,o.jsx)(s.br,{}),"\n","The script changes the permissions of the ",(0,o.jsx)(s.code,{children:"cado-host"})," binary to make it executable using the ",(0,o.jsx)(s.code,{children:"chmod +x"})," command."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:'sudo ./cado-host --presigned_data $pre-signed-data --skip_linux_memory || echo "Cado Host has failed. For troubleshooting steps, pass the --verbose and --no_cleanup flags, or visit https://docs.cadosecurity.com/cado-host/deploy#considerations, or contact support@cadosecurity.com."\n'})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Runs the Cado Host binary and removes the collected archive"}),":",(0,o.jsx)(s.br,{}),"\n","The script executes the ",(0,o.jsx)(s.code,{children:"cado-host"})," binary with two options: ",(0,o.jsx)(s.code,{children:"--presigned_data"})," and ",(0,o.jsx)(s.code,{children:"--skip_linux_memory"}),", which skips memory data collection on Linux.",(0,o.jsx)(s.br,{}),"\n","If the execution fails, it displays an error message with troubleshooting instructions."]}),"\n"]}),"\n",(0,o.jsx)(s.p,{children:"Note the --no_cleanup flag is not passed, so the script will clean up after the binary has run by deleting the collected archive.\nIf this flag is passed, or pre-signed data is not given to Cado Host, the script will not delete the collected archive."}),"\n",(0,o.jsx)(s.p,{children:"The pre-signed data is a JSON object that contains information required to upload data to a cloud storage provider. An example of this JSON object is as follows:"}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'{\n "url": "https://s3.us-west-2.amazonaws.com/my-cado-bucket",\n "fields": {\n "key": "cado-collector/project-401/cado-host/2024/10/11/${filename}",\n "x-amz-algorithm": "AWS4-HMAC-SHA256",\n "x-amz-credential": "AAA/us-west-2/s3/aws4_request",\n "x-amz-date": "20241011T163440Z",\n "x-amz-security-token": "AAA"\n },\n "policy": "AAA"\n },\n "bucket": "my-cado-bucket",\n "folder": "cado-collector/project-401/cado-host/2024/10/11",\n "provider": "aws"\n}\n'})}),"\n",(0,o.jsx)(s.h3,{id:"description-of-the-encoded-json-object",children:"Description of the Encoded JSON Object:"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"URL"}),": This points to an Amazon S3 URL where data might be uploaded or stored."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Fields"}),":","\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"key"}),": Represents the path or key where the file will be stored, with a placeholder for ",(0,o.jsx)(s.code,{children:"${filename}"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"x-amz-algorithm"}),": Specifies the AWS signature algorithm being used, ",(0,o.jsx)(s.code,{children:"AWS4-HMAC-SHA256"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"x-amz-credential"}),": Contains the AWS credential used to sign the request, including the access key and date information."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"x-amz-date"}),": The timestamp of when the request was made, formatted as ",(0,o.jsx)(s.code,{children:"20241011T163440Z"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"x-amz-security-token"}),": This is a temporary security token used for authentication."]}),"\n"]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Policy"}),": The ",(0,o.jsx)(s.code,{children:"policy"})," field contains a base64-encoded policy document such as this, to securely scope the upload operation:"]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{children:'{"expiration": "2024-10-12T16:34:40Z", "conditions": [["starts-with", "$key", "cado-collector/project-401/cado-host/2024/10/11"], {"bucket": "my-cado-bucket"}, ["starts-with", "$key", "cado-collector/project-401/cado-host/2024/10/11/"], {"x-amz-algorithm": "AWS4-HMAC-SHA256"}, {"x-amz-credential": "AAA"}, {"x-amz-date": "20241011T163440Z"}, {"x-amz-security-token": "AAA"}]}\n'})}),"\n",(0,o.jsxs)(s.ol,{start:"4",children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Bucket"}),": Specifies the S3 bucket name, ",(0,o.jsx)(s.code,{children:"my-cado-bucket"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Folder"}),": The folder path within the bucket where the file is being stored."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Provider"}),": The cloud provider for this storage operation, which is ",(0,o.jsx)(s.code,{children:"AWS"})," in this case."]}),"\n"]}),"\n",(0,o.jsx)(s.p,{children:"This JSON is part of a typical AWS S3 presigned URL setup, often used to allow file uploads to S3 with specified credentials and conditions."}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"sudo rm -r /tmp/cado-host-67c03a16\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Cleans up temporary files"}),":",(0,o.jsx)(s.br,{}),"\n","Once the binary has run, the script removes the temporary directory ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16"})," and its contents to clean up any residual files."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"exit 0\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Exits the script"}),":",(0,o.jsx)(s.br,{}),"\n","Finally, the script exits with a status code of ",(0,o.jsx)(s.code,{children:"0"}),", indicating successful completion."]}),"\n"]})]})}function h(e={}){const{wrapper:s}={...(0,t.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},28453:(e,s,n)=>{n.d(s,{R:()=>r,x:()=>c});var o=n(96540);const t={},i=o.createContext(t);function r(e){const s=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:r(e.components),o.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1580],{36349:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>a});var o=n(74848),t=n(28453);const i={title:"Script operation",hide_title:!0,sidebar_position:8},r="How does the Cado Host deployment script operate?",c={id:"cado/discovery-import/cado-host/script-operation",title:"Script operation",description:"The Cado Host script is used to download, execute, and clean up the Cado Host binary from a system.",source:"@site/docs/cado/discovery-import/cado-host/script-operation.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/script-operation",permalink:"/cado/discovery-import/cado-host/script-operation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/script-operation.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"Script operation",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Upload single file",permalink:"/cado/discovery-import/cado-host/manual-upload"},next:{title:"Security",permalink:"/cado/discovery-import/cado-host/security"}},d={},a=[{value:"Summary of Key Steps:",id:"summary-of-key-steps",level:3},{value:"Script Breakdown",id:"script-breakdown",level:3},{value:"Description of the Encoded JSON Object:",id:"description-of-the-encoded-json-object",level:3}];function l(e){const s={br:"br",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-does-the-cado-host-deployment-script-operate",children:"How does the Cado Host deployment script operate?"}),"\n",(0,o.jsx)(s.p,{children:"The Cado Host script is used to download, execute, and clean up the Cado Host binary from a system.\nBelow is a breakdown of how the script works for Linux - the script is similiar in function for Windows and MacOS."}),"\n",(0,o.jsx)(s.h3,{id:"summary-of-key-steps",children:"Summary of Key Steps:"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Directory creation"}),": A temporary directory is created for storing the Cado Host binary."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Download handling"}),": The script checks if either ",(0,o.jsx)(s.code,{children:"curl"})," or ",(0,o.jsx)(s.code,{children:"wget"})," is installed and uses one to download the Cado Host binary."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Download verification"}),": After downloading, the script verifies that the binary exists."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Execution of Cado Host"}),": The binary is given executable permissions and run with specific options."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Clean-up"}),": After running, the script removes the temporary directory to clean up."]}),"\n"]}),"\n",(0,o.jsx)(s.h3,{id:"script-breakdown",children:"Script Breakdown"}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"mkdir -p /tmp/cado-host-67c03a16\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Creates a temporary directory"}),":",(0,o.jsx)(s.br,{}),"\n","The script starts by creating a directory named ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16"}),". This directory is used to store the downloaded Cado Host binary. The ",(0,o.jsx)(s.code,{children:"-p"})," option ensures no error is thrown if the directory already exists.\nThe end of the directory is a random identifier to avoid conflicts."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"if command -v curl > /dev/null\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Checks for ",(0,o.jsx)(s.code,{children:"curl"})," availability"]}),":",(0,o.jsx)(s.br,{}),"\n","The script checks whether the ",(0,o.jsx)(s.code,{children:"curl"})," command is available on the system by verifying if it can return a version without error. This is done by checking if the command exists (",(0,o.jsx)(s.code,{children:"command -v curl"}),"), and if it does, the script proceeds to use ",(0,o.jsx)(s.code,{children:"curl"})," for downloading."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"then sudo curl -s https://cado-public.s3-accelerate.amazonaws.com/cado-host/$version/linux/cado-host --output /tmp/cado-host-67c03a16/cado-host\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Downloads Cado Host using ",(0,o.jsx)(s.code,{children:"curl"})]}),":",(0,o.jsx)(s.br,{}),"\n","If ",(0,o.jsx)(s.code,{children:"curl"})," is available, it silently (",(0,o.jsx)(s.code,{children:"-s"}),") downloads the Cado Host binary from the provided URL and stores it in the newly created directory. The file is saved as ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16/cado-host"}),"."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"elif command -v wget > /dev/null\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Checks for ",(0,o.jsx)(s.code,{children:"wget"})," availability"]}),":",(0,o.jsx)(s.br,{}),"\n","If ",(0,o.jsx)(s.code,{children:"curl"})," is not found, the script checks if ",(0,o.jsx)(s.code,{children:"wget"})," is installed on the system."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"then sudo wget -q --output-document /tmp/cado-host-67c03a16/cado-host https://cado-public.s3-accelerate.amazonaws.com/cado-host/$version/linux/cado-host\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Downloads Cado Host using ",(0,o.jsx)(s.code,{children:"wget"})]}),":",(0,o.jsx)(s.br,{}),"\n","If ",(0,o.jsx)(s.code,{children:"wget"})," is available, it silently (",(0,o.jsx)(s.code,{children:"-q"}),") downloads the Cado Host binary from the same URL, storing it in the ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16/"})," directory."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:'else echo "Cado Host requires curl or wget for unattended mode."; exit 1;\n'})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsxs)(s.strong,{children:["Handles missing ",(0,o.jsx)(s.code,{children:"curl"})," and ",(0,o.jsx)(s.code,{children:"wget"})]}),":",(0,o.jsx)(s.br,{}),"\n","If neither ",(0,o.jsx)(s.code,{children:"curl"})," nor ",(0,o.jsx)(s.code,{children:"wget"})," is available on the system, the script outputs an error message, and the script exits with a status code of ",(0,o.jsx)(s.code,{children:"1"}),", indicating failure."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"fi\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"End of conditional block"}),":",(0,o.jsx)(s.br,{}),"\n","This marks the end of the block that checks for ",(0,o.jsx)(s.code,{children:"curl"})," or ",(0,o.jsx)(s.code,{children:"wget"}),"."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:'if [ ! -f /tmp/cado-host-67c03a16/cado-host ]; then\n echo "Cado Host failed to download, check if the machine has an active network connection."; exit 1;\nfi\n'})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Validates the download"}),":",(0,o.jsx)(s.br,{}),"\n","This step checks if the Cado Host binary was successfully downloaded. If the binary is not found in the ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16/"})," directory, the script prints an error message about network issues and exits."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"cd /tmp/cado-host-67c03a16/\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Changes the working directory"}),":",(0,o.jsx)(s.br,{}),"\n","The script changes the current working directory to ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16/"}),", where the downloaded binary resides."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"sudo chmod +x ./cado-host\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Makes the binary executable"}),":",(0,o.jsx)(s.br,{}),"\n","The script changes the permissions of the ",(0,o.jsx)(s.code,{children:"cado-host"})," binary to make it executable using the ",(0,o.jsx)(s.code,{children:"chmod +x"})," command."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:'sudo ./cado-host --presigned_data $pre-signed-data --skip_linux_memory || echo "Cado Host has failed. For troubleshooting steps, pass the --verbose and --no_cleanup flags, or visit https://docs.cadosecurity.com/cado-host/deploy#considerations, or contact support@cadosecurity.com."\n'})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Runs the Cado Host binary and removes the collected archive"}),":",(0,o.jsx)(s.br,{}),"\n","The script executes the ",(0,o.jsx)(s.code,{children:"cado-host"})," binary with two options: ",(0,o.jsx)(s.code,{children:"--presigned_data"})," and ",(0,o.jsx)(s.code,{children:"--skip_linux_memory"}),", which skips memory data collection on Linux.",(0,o.jsx)(s.br,{}),"\n","If the execution fails, it displays an error message with troubleshooting instructions."]}),"\n"]}),"\n",(0,o.jsx)(s.p,{children:"Note the --no_cleanup flag is not passed, so the script will clean up after the binary has run by deleting the collected archive.\nIf this flag is passed, or pre-signed data is not given to Cado Host, the script will not delete the collected archive."}),"\n",(0,o.jsx)(s.p,{children:"The pre-signed data is a JSON object that contains information required to upload data to a cloud storage provider. An example of this JSON object is as follows:"}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'{\n "url": "https://s3.us-west-2.amazonaws.com/my-cado-bucket",\n "fields": {\n "key": "cado-collector/project-401/cado-host/2024/10/11/${filename}",\n "x-amz-algorithm": "AWS4-HMAC-SHA256",\n "x-amz-credential": "AAA/us-west-2/s3/aws4_request",\n "x-amz-date": "20241011T163440Z",\n "x-amz-security-token": "AAA"\n },\n "policy": "AAA"\n },\n "bucket": "my-cado-bucket",\n "folder": "cado-collector/project-401/cado-host/2024/10/11",\n "provider": "aws"\n}\n'})}),"\n",(0,o.jsx)(s.h3,{id:"description-of-the-encoded-json-object",children:"Description of the Encoded JSON Object:"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"URL"}),": This points to an Amazon S3 URL where data might be uploaded or stored."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Fields"}),":","\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"key"}),": Represents the path or key where the file will be stored, with a placeholder for ",(0,o.jsx)(s.code,{children:"${filename}"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"x-amz-algorithm"}),": Specifies the AWS signature algorithm being used, ",(0,o.jsx)(s.code,{children:"AWS4-HMAC-SHA256"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"x-amz-credential"}),": Contains the AWS credential used to sign the request, including the access key and date information."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"x-amz-date"}),": The timestamp of when the request was made, formatted as ",(0,o.jsx)(s.code,{children:"20241011T163440Z"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.code,{children:"x-amz-security-token"}),": This is a temporary security token used for authentication."]}),"\n"]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Policy"}),": The ",(0,o.jsx)(s.code,{children:"policy"})," field contains a base64-encoded policy document such as this, to securely scope the upload operation:"]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{children:'{"expiration": "2024-10-12T16:34:40Z", "conditions": [["starts-with", "$key", "cado-collector/project-401/cado-host/2024/10/11"], {"bucket": "my-cado-bucket"}, ["starts-with", "$key", "cado-collector/project-401/cado-host/2024/10/11/"], {"x-amz-algorithm": "AWS4-HMAC-SHA256"}, {"x-amz-credential": "AAA"}, {"x-amz-date": "20241011T163440Z"}, {"x-amz-security-token": "AAA"}]}\n'})}),"\n",(0,o.jsxs)(s.ol,{start:"4",children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Bucket"}),": Specifies the S3 bucket name, ",(0,o.jsx)(s.code,{children:"my-cado-bucket"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Folder"}),": The folder path within the bucket where the file is being stored."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Provider"}),": The cloud provider for this storage operation, which is ",(0,o.jsx)(s.code,{children:"AWS"})," in this case."]}),"\n"]}),"\n",(0,o.jsx)(s.p,{children:"This JSON is part of a typical AWS S3 presigned URL setup, often used to allow file uploads to S3 with specified credentials and conditions."}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"sudo rm -r /tmp/cado-host-67c03a16\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Cleans up temporary files"}),":",(0,o.jsx)(s.br,{}),"\n","Once the binary has run, the script removes the temporary directory ",(0,o.jsx)(s.code,{children:"/tmp/cado-host-67c03a16"})," and its contents to clean up any residual files."]}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"exit 0\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Exits the script"}),":",(0,o.jsx)(s.br,{}),"\n","Finally, the script exits with a status code of ",(0,o.jsx)(s.code,{children:"0"}),", indicating successful completion."]}),"\n"]})]})}function h(e={}){const{wrapper:s}={...(0,t.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},28453:(e,s,n)=>{n.d(s,{R:()=>r,x:()=>c});var o=n(96540);const t={},i=o.createContext(t);function r(e){const s=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:r(e.components),o.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/771b2727.b39afff2.js b/assets/js/771b2727.4275a3b8.js similarity index 97% rename from assets/js/771b2727.b39afff2.js rename to assets/js/771b2727.4275a3b8.js index 06ebe13c9..723352f42 100644 --- a/assets/js/771b2727.b39afff2.js +++ b/assets/js/771b2727.4275a3b8.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7096],{48565:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>i,default:()=>p,frontMatter:()=>s,metadata:()=>r,toc:()=>l});var t=n(74848),c=n(28453);const s={title:"Endpoint access",hide_title:!0,sidebar_position:3},i="What GCP Endpoints Does the Cado Platform Require Access To?",r={id:"cado/deploy/gcp/endpoints",title:"Endpoint access",description:"The Cado platform requires access to the following GCP endpoints:",source:"@site/docs/cado/deploy/gcp/endpoints.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/endpoints",permalink:"/cado/deploy/gcp/endpoints",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/endpoints.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Endpoint access",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Set-up GCP for collection of data",permalink:"/cado/deploy/gcp/gcp-settings"},next:{title:"Automated Setup of GCP for data collection",permalink:"/cado/deploy/gcp/gcp-auto-setup"}},d={},l=[{value:"GCP Provider APIs",id:"gcp-provider-apis",level:3},{value:"OAuth",id:"oauth",level:3},{value:"Cloud Build Service",id:"cloud-build-service",level:3},{value:"Storage",id:"storage",level:3},{value:"Compute",id:"compute",level:3},{value:"GCP Resource Manager",id:"gcp-resource-manager",level:3},{value:"Google Kubernetes Engine",id:"google-kubernetes-engine",level:3}];function a(e){const o={a:"a",code:"code",h1:"h1",h3:"h3",li:"li",p:"p",ul:"ul",...(0,c.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"what-gcp-endpoints-does-the-cado-platform-require-access-to",children:"What GCP Endpoints Does the Cado Platform Require Access To?"}),"\n",(0,t.jsx)(o.p,{children:"The Cado platform requires access to the following GCP endpoints:"}),"\n",(0,t.jsx)(o.h3,{id:"gcp-provider-apis",children:"GCP Provider APIs"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"https://cloudresourcemanager.googleapis.com"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"oauth",children:"OAuth"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/v1/{name=projects/*/serviceAccounts/*}:generateAccessToken"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"cloud-build-service",children:"Cloud Build Service"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/v1/projects/{projectId}/builds"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"storage",children:"Storage"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/storage/v1/b"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/storage/v1/b/{bucket}/o"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"compute",children:"Compute"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/compute/v1/projects/{project}/zones/{zone}/instances"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/compute/v1/projects/{project}/global/images"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/compute/v1/projects/{project}/zones/{zone}/disks/{disk}"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/compute/v1/projects/{project}/global/operations/{operation}"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"gcp-resource-manager",children:"GCP Resource Manager"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"cloudresourcemanager.googleapis.com/v3/projects:search"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"google-kubernetes-engine",children:"Google Kubernetes Engine"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["Please see the ",(0,t.jsx)(o.a,{href:"/cado/discovery-import/gcp/kubernetes-engine",children:"GKE documentation"}),"."]}),"\n"]})]})}function p(e={}){const{wrapper:o}={...(0,c.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(a,{...e})}):a(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>i,x:()=>r});var t=n(96540);const c={},s=t.createContext(c);function i(e){const o=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:i(e.components),t.createElement(s.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7096],{48565:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>i,default:()=>p,frontMatter:()=>s,metadata:()=>r,toc:()=>l});var t=n(74848),c=n(28453);const s={title:"Endpoint access",hide_title:!0,sidebar_position:3},i="What GCP Endpoints Does the Cado Platform Require Access To?",r={id:"cado/deploy/gcp/endpoints",title:"Endpoint access",description:"The Cado platform requires access to the following GCP endpoints:",source:"@site/docs/cado/deploy/gcp/endpoints.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/endpoints",permalink:"/cado/deploy/gcp/endpoints",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/endpoints.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Endpoint access",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Set-up GCP for collection of data",permalink:"/cado/deploy/gcp/gcp-settings"},next:{title:"Automated Setup of GCP for data collection",permalink:"/cado/deploy/gcp/gcp-auto-setup"}},d={},l=[{value:"GCP Provider APIs",id:"gcp-provider-apis",level:3},{value:"OAuth",id:"oauth",level:3},{value:"Cloud Build Service",id:"cloud-build-service",level:3},{value:"Storage",id:"storage",level:3},{value:"Compute",id:"compute",level:3},{value:"GCP Resource Manager",id:"gcp-resource-manager",level:3},{value:"Google Kubernetes Engine",id:"google-kubernetes-engine",level:3}];function a(e){const o={a:"a",code:"code",h1:"h1",h3:"h3",li:"li",p:"p",ul:"ul",...(0,c.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"what-gcp-endpoints-does-the-cado-platform-require-access-to",children:"What GCP Endpoints Does the Cado Platform Require Access To?"}),"\n",(0,t.jsx)(o.p,{children:"The Cado platform requires access to the following GCP endpoints:"}),"\n",(0,t.jsx)(o.h3,{id:"gcp-provider-apis",children:"GCP Provider APIs"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"https://cloudresourcemanager.googleapis.com"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"oauth",children:"OAuth"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/v1/{name=projects/*/serviceAccounts/*}:generateAccessToken"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"cloud-build-service",children:"Cloud Build Service"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/v1/projects/{projectId}/builds"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"storage",children:"Storage"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/storage/v1/b"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/storage/v1/b/{bucket}/o"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"compute",children:"Compute"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/compute/v1/projects/{project}/zones/{zone}/instances"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/compute/v1/projects/{project}/global/images"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/compute/v1/projects/{project}/zones/{zone}/disks/{disk}"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"/compute/v1/projects/{project}/global/operations/{operation}"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"gcp-resource-manager",children:"GCP Resource Manager"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.code,{children:"cloudresourcemanager.googleapis.com/v3/projects:search"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"google-kubernetes-engine",children:"Google Kubernetes Engine"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["Please see the ",(0,t.jsx)(o.a,{href:"/cado/discovery-import/gcp/kubernetes-engine",children:"GKE documentation"}),"."]}),"\n"]})]})}function p(e={}){const{wrapper:o}={...(0,c.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(a,{...e})}):a(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>i,x:()=>r});var t=n(96540);const c={},s=t.createContext(c);function i(e){const o=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:i(e.components),t.createElement(s.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/77bfca5f.f97a6a83.js b/assets/js/77bfca5f.5ad03ede.js similarity index 97% rename from assets/js/77bfca5f.f97a6a83.js rename to assets/js/77bfca5f.5ad03ede.js index 76054b3d8..45a888fe3 100644 --- a/assets/js/77bfca5f.f97a6a83.js +++ b/assets/js/77bfca5f.5ad03ede.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9992],{85122:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var r=s(74848),n=s(28453);const i={title:"AWS credentials",hide_title:!0,sidebar_position:3},o="How to Create Secure Credentials for AWS",c={id:"cado/discovery-import/cado-host/aws-credentials",title:"AWS credentials",description:"We now recommend using the automatically created temporary credentials generated by Cado. For more details, see our documentation here.",source:"@site/docs/cado/discovery-import/cado-host/aws-credentials.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/aws-credentials",permalink:"/cado/discovery-import/cado-host/aws-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/aws-credentials.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"AWS credentials",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Collected artifacts",permalink:"/cado/discovery-import/cado-host/artifacts"},next:{title:"Google Cloud credentials",permalink:"/cado/discovery-import/cado-host/google-credentials"}},a={},l=[{value:"Step 1: Create an S3 Bucket",id:"step-1-create-an-s3-bucket",level:2},{value:"Step 2: Create an AWS User with Limited Access",id:"step-2-create-an-aws-user-with-limited-access",level:2},{value:"Creating the Policy",id:"creating-the-policy",level:3},{value:"Creating the User",id:"creating-the-user",level:3},{value:"Ready to Go",id:"ready-to-go",level:2}];function d(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.admonition,{type:"warning",children:(0,r.jsxs)(t.p,{children:["We now recommend using the automatically created temporary credentials generated by Cado. For more details, see our documentation ",(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"deploy#deploy-through-cado-response-platform",children:"here"})}),"."]})}),"\n",(0,r.jsx)(t.h1,{id:"how-to-create-secure-credentials-for-aws",children:"How to Create Secure Credentials for AWS"}),"\n",(0,r.jsx)(t.p,{children:"Below are the steps to create AWS credentials with write-only access to an S3 bucket."}),"\n",(0,r.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/OW6fwaUNVXU",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,r.jsx)(t.h2,{id:"step-1-create-an-s3-bucket",children:"Step 1: Create an S3 Bucket"}),"\n",(0,r.jsxs)(t.p,{children:["If you haven't created an S3 bucket yet, follow the instructions to ",(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"https://docs.aws.amazon.com/quickstarts/latest/s3backup/step-1-create-bucket.html",children:"Create a new S3 bucket"})}),". Ensure that ",(0,r.jsx)(t.strong,{children:"public access is not enabled"})," to maintain security."]}),"\n",(0,r.jsx)(t.h2,{id:"step-2-create-an-aws-user-with-limited-access",children:"Step 2: Create an AWS User with Limited Access"}),"\n",(0,r.jsx)(t.p,{children:"Next, we'll create a policy with write-only access to the S3 bucket. This ensures that even if an attacker compromises the credentials, they won't have full access."}),"\n",(0,r.jsx)(t.h3,{id:"creating-the-policy",children:"Creating the Policy"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Go to the ",(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"https://console.aws.amazon.com/iam/home#/policies",children:"Access Management Policies"})})," page."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Create Policy"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Under ",(0,r.jsx)(t.strong,{children:"Service"}),", select ",(0,r.jsx)(t.strong,{children:"S3"})," and under ",(0,r.jsx)(t.strong,{children:"Actions"}),", choose ",(0,r.jsx)(t.strong,{children:"Write -> PutObject"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Specific Resources"}),", then under ",(0,r.jsx)(t.strong,{children:"Bucket"}),", click ",(0,r.jsx)(t.strong,{children:"Add ARN"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Enter the name of your S3 bucket and click ",(0,r.jsx)(t.strong,{children:"Add"}),"."]}),"\n",(0,r.jsx)(t.li,{children:"Follow the prompts to create the policy."}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"creating-the-user",children:"Creating the User"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Go to the ",(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"https://console.aws.amazon.com/iam/home#/users",children:"IAM User Page"})})," and click ",(0,r.jsx)(t.strong,{children:"Add User"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Create a new user with ",(0,r.jsx)(t.strong,{children:"Programmatic access"}),"."]}),"\n",(0,r.jsx)(t.li,{children:"Assign the write-only policy you just created to the user."}),"\n",(0,r.jsxs)(t.li,{children:["Follow the steps to create the user and retrieve the ",(0,r.jsx)(t.strong,{children:"Access Key"})," and ",(0,r.jsx)(t.strong,{children:"Secret Key"}),"."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"ready-to-go",children:"Ready to Go"}),"\n",(0,r.jsx)(t.p,{children:"Once completed, you will have:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Access Key"})]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Secret Key"})]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"S3 Bucket Name"})]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"With these credentials, you'll be ready to securely upload data to your AWS S3 bucket."})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>o,x:()=>c});var r=s(96540);const n={},i=r.createContext(n);function o(e){const t=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),r.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9992],{85122:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var r=s(74848),n=s(28453);const i={title:"AWS credentials",hide_title:!0,sidebar_position:3},o="How to Create Secure Credentials for AWS",c={id:"cado/discovery-import/cado-host/aws-credentials",title:"AWS credentials",description:"We now recommend using the automatically created temporary credentials generated by Cado. For more details, see our documentation here.",source:"@site/docs/cado/discovery-import/cado-host/aws-credentials.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/aws-credentials",permalink:"/cado/discovery-import/cado-host/aws-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/aws-credentials.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"AWS credentials",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Collected artifacts",permalink:"/cado/discovery-import/cado-host/artifacts"},next:{title:"Google Cloud credentials",permalink:"/cado/discovery-import/cado-host/google-credentials"}},a={},l=[{value:"Step 1: Create an S3 Bucket",id:"step-1-create-an-s3-bucket",level:2},{value:"Step 2: Create an AWS User with Limited Access",id:"step-2-create-an-aws-user-with-limited-access",level:2},{value:"Creating the Policy",id:"creating-the-policy",level:3},{value:"Creating the User",id:"creating-the-user",level:3},{value:"Ready to Go",id:"ready-to-go",level:2}];function d(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.admonition,{type:"warning",children:(0,r.jsxs)(t.p,{children:["We now recommend using the automatically created temporary credentials generated by Cado. For more details, see our documentation ",(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"deploy#deploy-through-cado-response-platform",children:"here"})}),"."]})}),"\n",(0,r.jsx)(t.h1,{id:"how-to-create-secure-credentials-for-aws",children:"How to Create Secure Credentials for AWS"}),"\n",(0,r.jsx)(t.p,{children:"Below are the steps to create AWS credentials with write-only access to an S3 bucket."}),"\n",(0,r.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/OW6fwaUNVXU",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,r.jsx)(t.h2,{id:"step-1-create-an-s3-bucket",children:"Step 1: Create an S3 Bucket"}),"\n",(0,r.jsxs)(t.p,{children:["If you haven't created an S3 bucket yet, follow the instructions to ",(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"https://docs.aws.amazon.com/quickstarts/latest/s3backup/step-1-create-bucket.html",children:"Create a new S3 bucket"})}),". Ensure that ",(0,r.jsx)(t.strong,{children:"public access is not enabled"})," to maintain security."]}),"\n",(0,r.jsx)(t.h2,{id:"step-2-create-an-aws-user-with-limited-access",children:"Step 2: Create an AWS User with Limited Access"}),"\n",(0,r.jsx)(t.p,{children:"Next, we'll create a policy with write-only access to the S3 bucket. This ensures that even if an attacker compromises the credentials, they won't have full access."}),"\n",(0,r.jsx)(t.h3,{id:"creating-the-policy",children:"Creating the Policy"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Go to the ",(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"https://console.aws.amazon.com/iam/home#/policies",children:"Access Management Policies"})})," page."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Create Policy"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Under ",(0,r.jsx)(t.strong,{children:"Service"}),", select ",(0,r.jsx)(t.strong,{children:"S3"})," and under ",(0,r.jsx)(t.strong,{children:"Actions"}),", choose ",(0,r.jsx)(t.strong,{children:"Write -> PutObject"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Specific Resources"}),", then under ",(0,r.jsx)(t.strong,{children:"Bucket"}),", click ",(0,r.jsx)(t.strong,{children:"Add ARN"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Enter the name of your S3 bucket and click ",(0,r.jsx)(t.strong,{children:"Add"}),"."]}),"\n",(0,r.jsx)(t.li,{children:"Follow the prompts to create the policy."}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"creating-the-user",children:"Creating the User"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Go to the ",(0,r.jsx)(t.strong,{children:(0,r.jsx)(t.a,{href:"https://console.aws.amazon.com/iam/home#/users",children:"IAM User Page"})})," and click ",(0,r.jsx)(t.strong,{children:"Add User"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Create a new user with ",(0,r.jsx)(t.strong,{children:"Programmatic access"}),"."]}),"\n",(0,r.jsx)(t.li,{children:"Assign the write-only policy you just created to the user."}),"\n",(0,r.jsxs)(t.li,{children:["Follow the steps to create the user and retrieve the ",(0,r.jsx)(t.strong,{children:"Access Key"})," and ",(0,r.jsx)(t.strong,{children:"Secret Key"}),"."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"ready-to-go",children:"Ready to Go"}),"\n",(0,r.jsx)(t.p,{children:"Once completed, you will have:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Access Key"})]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Secret Key"})]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"S3 Bucket Name"})]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"With these credentials, you'll be ready to securely upload data to your AWS S3 bucket."})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>o,x:()=>c});var r=s(96540);const n={},i=r.createContext(n);function o(e){const t=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),r.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7ac66fa8.41ab4227.js b/assets/js/7ac66fa8.e4f09492.js similarity index 99% rename from assets/js/7ac66fa8.41ab4227.js rename to assets/js/7ac66fa8.e4f09492.js index 1b442d769..ed40eee67 100644 --- a/assets/js/7ac66fa8.41ab4227.js +++ b/assets/js/7ac66fa8.e4f09492.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[395],{14177:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>a,metadata:()=>o,toc:()=>d});var i=s(74848),n=s(28453);const a={title:"EC2 and EBS",hide_title:!0,sidebar_position:1},r="How to Import AWS EC2 and EBS Data into Cado",o={id:"cado/discovery-import/aws/aws-ec2",title:"EC2 and EBS",description:"Cado supports acquiring data from EC2 instances. Start by selecting the region, which will populate a list of available EC2 instances. You can filter this list by instance ID, name, state, or public IP address. Once you\u2019ve found the instance you want to acquire, select it.",source:"@site/docs/cado/discovery-import/aws/aws-ec2.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-ec2",permalink:"/cado/discovery-import/aws/aws-ec2",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-ec2.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"EC2 and EBS",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Automating collection from detections",permalink:"/cado/discovery-import/automation"},next:{title:"S3",permalink:"/cado/discovery-import/aws/aws-s3"}},c={},d=[{value:"Capture Options",id:"capture-options",level:2},{value:"Volume Capture",id:"volume-capture",level:3},{value:"Triage Capture",id:"triage-capture",level:3},{value:"Triage Capture with SSM Port Forwarding (Linux Only)",id:"triage-capture-with-ssm-port-forwarding-linux-only",level:4},{value:"Run Command",id:"run-command",level:3},{value:"Creating a Saved Script",id:"creating-a-saved-script",level:4},{value:"Running the Script",id:"running-the-script",level:4},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function l(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-aws-ec2-and-ebs-data-into-cado",children:"How to Import AWS EC2 and EBS Data into Cado"}),"\n",(0,i.jsx)(t.p,{children:"Cado supports acquiring data from EC2 instances. Start by selecting the region, which will populate a list of available EC2 instances. You can filter this list by instance ID, name, state, or public IP address. Once you\u2019ve found the instance you want to acquire, select it."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Import",src:s(39155).A+"",width:"1782",height:"682"})}),"\n",(0,i.jsxs)(t.p,{children:["Click ",(0,i.jsx)(t.strong,{children:"Continue"})," to proceed."]}),"\n",(0,i.jsx)(t.h2,{id:"capture-options",children:"Capture Options"}),"\n",(0,i.jsx)(t.h3,{id:"volume-capture",children:"Volume Capture"}),"\n",(0,i.jsxs)(t.p,{children:["To acquire the full EBS volume, select ",(0,i.jsx)(t.strong,{children:"Full Acquisition"})," under ",(0,i.jsx)(t.strong,{children:"Acquisition Type"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["The Cado platform supports the option to skip processing of the EBS volume. Select ",(0,i.jsx)(t.strong,{children:"Skip Processing"})," under ",(0,i.jsx)(t.strong,{children:"Processing Options"})," to activate this option. If you decide you want to process the volume at a later date, this can be achieved by selecting ",(0,i.jsx)(t.strong,{children:"Process Evidence"})," on the relevant evidence item in the Evidence tab."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Skip Processing",src:s(62253).A+"",width:"1424",height:"1666"})}),"\n",(0,i.jsx)(t.h3,{id:"triage-capture",children:"Triage Capture"}),"\n",(0,i.jsxs)(t.p,{children:["For a faster triage collection on an EC2 instance, use ",(0,i.jsx)(t.strong,{children:"Triage Acquisition"})," via Cado Host. This requires that AWS Systems Manager (SSM) be enabled on the target instance and also supports memory collection on Linux systems."]}),"\n",(0,i.jsxs)(t.p,{children:["For more details about what Cado Host collects, refer to the ",(0,i.jsx)(t.a,{href:"/cado/discovery-import/cado-host/intro",children:"Collected Artifacts Documentation"}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Triage Acquisition",src:s(18908).A+"",width:"2147",height:"703"})}),"\n",(0,i.jsxs)(t.p,{children:["Click ",(0,i.jsx)(t.strong,{children:"Continue"}),", review your selections, and click ",(0,i.jsx)(t.strong,{children:"Start Import"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"triage-capture-with-ssm-port-forwarding-linux-only",children:"Triage Capture with SSM Port Forwarding (Linux Only)"}),"\n",(0,i.jsxs)(t.p,{children:["When using ",(0,i.jsx)(t.strong,{children:"Triage Acquisition"})," for a Linux EC2 instance, you can enable the ",(0,i.jsx)(t.strong,{children:"SSM Port Forwarding"})," option. This is useful for instances with restricted network access, where downloading the Cado Host binary directly is not possible. The SSM Port Forwarding feature transfers the binary to the instance and retrieves the triage capture. To support transfering of files over the SSM port forwarding, we require Python 3.8+ to be installed on the instance."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Triage Acquisition Port Forwarding",src:s(15780).A+"",width:"2557",height:"836"})}),"\n",(0,i.jsx)(t.h3,{id:"run-command",children:"Run Command"}),"\n",(0,i.jsxs)(t.p,{children:["Cado allows you to execute scripts on target systems using the ",(0,i.jsx)(t.strong,{children:"Run Command"})," feature in the import wizard. This requires the ",(0,i.jsx)(t.a,{href:"https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-ec2.html",children:"AWS Systems Manager Agent (SSM)"})," to be installed on the instance and admin privileges. To support transfering of files over the SSM port forwarding, we require Python 3.8+ to be installed on the instance."]}),"\n",(0,i.jsxs)(t.p,{children:["To use this feature, you must create a script in ",(0,i.jsx)(t.strong,{children:"/settings/scripts"}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.em,{children:"Note: This feature is in Beta. To enable it, go to Settings > Experiments > Run Action."})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Run Command",src:s(66203).A+"",width:"1487",height:"702"})}),"\n",(0,i.jsx)(t.h4,{id:"creating-a-saved-script",children:"Creating a Saved Script"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Go to ",(0,i.jsx)(t.strong,{children:"/settings/scripts"})," and click ",(0,i.jsx)(t.strong,{children:"Create Script"}),"."]}),"\n",(0,i.jsx)(t.li,{children:"Choose whether the script will run on Linux or Windows (reduced functionality for Windows). For this example, we\u2019ll choose Linux."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script",src:s(87872).A+"",width:"3260",height:"858"})}),"\n",(0,i.jsxs)(t.ol,{start:"3",children:["\n",(0,i.jsxs)(t.li,{children:["In Step 1, provide a ",(0,i.jsx)(t.strong,{children:"Name"})," and ",(0,i.jsx)(t.strong,{children:"Description"})," for the script."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Step 1",src:s(65993).A+"",width:"3804",height:"1082"})}),"\n",(0,i.jsxs)(t.ol,{start:"4",children:["\n",(0,i.jsx)(t.li,{children:"In Step 2, provide the location of the input file (valid S3 URI), which will be downloaded onto the target system. This step is not available for Windows scripts."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Step 2",src:s(25910).A+"",width:"3768",height:"952"})}),"\n",(0,i.jsxs)(t.ol,{start:"5",children:["\n",(0,i.jsx)(t.li,{children:"In Step 3, specify the location of the output file on the target system that will be uploaded to your Cado S3 bucket. This step is not available for Windows scripts."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Step 3",src:s(39199).A+"",width:"3782",height:"950"})}),"\n",(0,i.jsxs)(t.ol,{start:"6",children:["\n",(0,i.jsxs)(t.li,{children:["In Step 4, paste the script that will run on the target system. The input and output files can be referenced as ",(0,i.jsx)(t.code,{children:"${INPUT}"})," and ",(0,i.jsx)(t.code,{children:"${OUTPUT}"})," respectively. Windows scripts do not require these variables."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Example script:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-bash",children:'mkdir -p /tmp/cado-volexity\ncp ${INPUT} /tmp/cado-volexity/surge-collect\nchmod 755 /tmp/cado-volexity/surge-collect\nmkdir -p /tmp/cado-volexity/out\n/tmp/cado-volexity/surge-collect example /tmp/cado-volexity/out\ntar -cvzf /tmp/cado-volexity/out.tar.gz /tmp/cado-volexity/out\ncp "/tmp/cado-volexity/out.tar.gz" ${OUTPUT}\nrm -rf /tmp/cado-volexity\n'})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Step 4",src:s(85988).A+"",width:"1571",height:"591"})}),"\n",(0,i.jsxs)(t.ol,{start:"7",children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Continue"})," and you\u2019ll see your script listed in the scripts table."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Table",src:s(39885).A+"",width:"3856",height:"704"})}),"\n",(0,i.jsx)(t.h4,{id:"running-the-script",children:"Running the Script"}),"\n",(0,i.jsxs)(t.p,{children:["Use the Import Wizard to select an EC2 instance with the SSM agent installed. Choose ",(0,i.jsx)(t.strong,{children:"Run Command"})," as the action type, and you\u2019ll see the script created earlier. Complete the import as usual."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Run Command - Selecting Saved Script",src:s(82106).A+"",width:"2557",height:"766"})}),"\n",(0,i.jsx)(t.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,i.jsx)(t.p,{children:"Below are diagrams illustrating how EC2 disk acquisitions work:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 Disk Acquisition",src:s(50256).A+"",width:"1962",height:"1044"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 Role Acquisition",src:s(59654).A+"",width:"1910",height:"970"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EBS Direct Acquisition",src:s(1055).A+"",width:"960",height:"540"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 SSM Acquisition",src:s(13667).A+"",width:"1674",height:"1056"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 Tunnel Acquisition",src:s(70408).A+"",width:"960",height:"540"})})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},66203:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand1-6a682e02432fcd47b25e0df8167cf22a.png"},87872:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand2-b11e4dc54efaca6f07ebc1e92cb869ff.png"},65993:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand3-0e82deea582dd231aac3dce8b07a8311.png"},25910:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand4-35fa40b42dafc5e3ae7f4d6edaf8e9ff.png"},39199:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand5-8309b0a6ecfa58beffcf97bc2c28a2c8.png"},85988:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand6-f3c3ccfbf5847bd5a1c06fb278687fef.png"},39885:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand7-3fe3e4fe0b44a67e3d0db7cb22f6c481.png"},82106:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand8-59785809f6dbe0694417240d98e31f84.png"},15780:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-triage-acquisition-ssm-port-forwarding-16af8a0f2d00fee383617dd415da8583.png"},18908:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-triage-acquisition-3b87b8970bc1d3973b5784024932f807.png"},39155:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-90029871d7a092c458840a666b860193.png"},1055:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/ebs-direct-f3e737af2354a1b8c3efc0c7a3338d77.png"},62253:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/ec2-import-skip-processing-d988f01069949af232c14573c555451e.png"},13667:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/ec2-ssm-ebcc0f7f19f1db4f515746730c8122a5.png"},70408:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/ec2-tunnel-3cd7cd18d8b884a790da5bc53ab7eb15.png"},50256:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/import-aws-ec2-cross-fee34afcec26120f770d5c825457027b.png"},59654:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/import-aws-ec2-role-a151df6f8ad1929241a34ac5d60e8f3a.png"},28453:(e,t,s)=>{s.d(t,{R:()=>r,x:()=>o});var i=s(96540);const n={},a=i.createContext(n);function r(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[395],{14177:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>a,metadata:()=>o,toc:()=>d});var i=s(74848),n=s(28453);const a={title:"EC2 and EBS",hide_title:!0,sidebar_position:1},r="How to Import AWS EC2 and EBS Data into Cado",o={id:"cado/discovery-import/aws/aws-ec2",title:"EC2 and EBS",description:"Cado supports acquiring data from EC2 instances. Start by selecting the region, which will populate a list of available EC2 instances. You can filter this list by instance ID, name, state, or public IP address. Once you\u2019ve found the instance you want to acquire, select it.",source:"@site/docs/cado/discovery-import/aws/aws-ec2.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-ec2",permalink:"/cado/discovery-import/aws/aws-ec2",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-ec2.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"EC2 and EBS",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Automating collection from detections",permalink:"/cado/discovery-import/automation"},next:{title:"S3",permalink:"/cado/discovery-import/aws/aws-s3"}},c={},d=[{value:"Capture Options",id:"capture-options",level:2},{value:"Volume Capture",id:"volume-capture",level:3},{value:"Triage Capture",id:"triage-capture",level:3},{value:"Triage Capture with SSM Port Forwarding (Linux Only)",id:"triage-capture-with-ssm-port-forwarding-linux-only",level:4},{value:"Run Command",id:"run-command",level:3},{value:"Creating a Saved Script",id:"creating-a-saved-script",level:4},{value:"Running the Script",id:"running-the-script",level:4},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function l(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-aws-ec2-and-ebs-data-into-cado",children:"How to Import AWS EC2 and EBS Data into Cado"}),"\n",(0,i.jsx)(t.p,{children:"Cado supports acquiring data from EC2 instances. Start by selecting the region, which will populate a list of available EC2 instances. You can filter this list by instance ID, name, state, or public IP address. Once you\u2019ve found the instance you want to acquire, select it."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Import",src:s(39155).A+"",width:"1782",height:"682"})}),"\n",(0,i.jsxs)(t.p,{children:["Click ",(0,i.jsx)(t.strong,{children:"Continue"})," to proceed."]}),"\n",(0,i.jsx)(t.h2,{id:"capture-options",children:"Capture Options"}),"\n",(0,i.jsx)(t.h3,{id:"volume-capture",children:"Volume Capture"}),"\n",(0,i.jsxs)(t.p,{children:["To acquire the full EBS volume, select ",(0,i.jsx)(t.strong,{children:"Full Acquisition"})," under ",(0,i.jsx)(t.strong,{children:"Acquisition Type"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["The Cado platform supports the option to skip processing of the EBS volume. Select ",(0,i.jsx)(t.strong,{children:"Skip Processing"})," under ",(0,i.jsx)(t.strong,{children:"Processing Options"})," to activate this option. If you decide you want to process the volume at a later date, this can be achieved by selecting ",(0,i.jsx)(t.strong,{children:"Process Evidence"})," on the relevant evidence item in the Evidence tab."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Skip Processing",src:s(62253).A+"",width:"1424",height:"1666"})}),"\n",(0,i.jsx)(t.h3,{id:"triage-capture",children:"Triage Capture"}),"\n",(0,i.jsxs)(t.p,{children:["For a faster triage collection on an EC2 instance, use ",(0,i.jsx)(t.strong,{children:"Triage Acquisition"})," via Cado Host. This requires that AWS Systems Manager (SSM) be enabled on the target instance and also supports memory collection on Linux systems."]}),"\n",(0,i.jsxs)(t.p,{children:["For more details about what Cado Host collects, refer to the ",(0,i.jsx)(t.a,{href:"/cado/discovery-import/cado-host/intro",children:"Collected Artifacts Documentation"}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Triage Acquisition",src:s(18908).A+"",width:"2147",height:"703"})}),"\n",(0,i.jsxs)(t.p,{children:["Click ",(0,i.jsx)(t.strong,{children:"Continue"}),", review your selections, and click ",(0,i.jsx)(t.strong,{children:"Start Import"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"triage-capture-with-ssm-port-forwarding-linux-only",children:"Triage Capture with SSM Port Forwarding (Linux Only)"}),"\n",(0,i.jsxs)(t.p,{children:["When using ",(0,i.jsx)(t.strong,{children:"Triage Acquisition"})," for a Linux EC2 instance, you can enable the ",(0,i.jsx)(t.strong,{children:"SSM Port Forwarding"})," option. This is useful for instances with restricted network access, where downloading the Cado Host binary directly is not possible. The SSM Port Forwarding feature transfers the binary to the instance and retrieves the triage capture. To support transfering of files over the SSM port forwarding, we require Python 3.8+ to be installed on the instance."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Triage Acquisition Port Forwarding",src:s(15780).A+"",width:"2557",height:"836"})}),"\n",(0,i.jsx)(t.h3,{id:"run-command",children:"Run Command"}),"\n",(0,i.jsxs)(t.p,{children:["Cado allows you to execute scripts on target systems using the ",(0,i.jsx)(t.strong,{children:"Run Command"})," feature in the import wizard. This requires the ",(0,i.jsx)(t.a,{href:"https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-ec2.html",children:"AWS Systems Manager Agent (SSM)"})," to be installed on the instance and admin privileges. To support transfering of files over the SSM port forwarding, we require Python 3.8+ to be installed on the instance."]}),"\n",(0,i.jsxs)(t.p,{children:["To use this feature, you must create a script in ",(0,i.jsx)(t.strong,{children:"/settings/scripts"}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.em,{children:"Note: This feature is in Beta. To enable it, go to Settings > Experiments > Run Action."})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Run Command",src:s(66203).A+"",width:"1487",height:"702"})}),"\n",(0,i.jsx)(t.h4,{id:"creating-a-saved-script",children:"Creating a Saved Script"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Go to ",(0,i.jsx)(t.strong,{children:"/settings/scripts"})," and click ",(0,i.jsx)(t.strong,{children:"Create Script"}),"."]}),"\n",(0,i.jsx)(t.li,{children:"Choose whether the script will run on Linux or Windows (reduced functionality for Windows). For this example, we\u2019ll choose Linux."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script",src:s(87872).A+"",width:"3260",height:"858"})}),"\n",(0,i.jsxs)(t.ol,{start:"3",children:["\n",(0,i.jsxs)(t.li,{children:["In Step 1, provide a ",(0,i.jsx)(t.strong,{children:"Name"})," and ",(0,i.jsx)(t.strong,{children:"Description"})," for the script."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Step 1",src:s(65993).A+"",width:"3804",height:"1082"})}),"\n",(0,i.jsxs)(t.ol,{start:"4",children:["\n",(0,i.jsx)(t.li,{children:"In Step 2, provide the location of the input file (valid S3 URI), which will be downloaded onto the target system. This step is not available for Windows scripts."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Step 2",src:s(25910).A+"",width:"3768",height:"952"})}),"\n",(0,i.jsxs)(t.ol,{start:"5",children:["\n",(0,i.jsx)(t.li,{children:"In Step 3, specify the location of the output file on the target system that will be uploaded to your Cado S3 bucket. This step is not available for Windows scripts."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Step 3",src:s(39199).A+"",width:"3782",height:"950"})}),"\n",(0,i.jsxs)(t.ol,{start:"6",children:["\n",(0,i.jsxs)(t.li,{children:["In Step 4, paste the script that will run on the target system. The input and output files can be referenced as ",(0,i.jsx)(t.code,{children:"${INPUT}"})," and ",(0,i.jsx)(t.code,{children:"${OUTPUT}"})," respectively. Windows scripts do not require these variables."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Example script:"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-bash",children:'mkdir -p /tmp/cado-volexity\ncp ${INPUT} /tmp/cado-volexity/surge-collect\nchmod 755 /tmp/cado-volexity/surge-collect\nmkdir -p /tmp/cado-volexity/out\n/tmp/cado-volexity/surge-collect example /tmp/cado-volexity/out\ntar -cvzf /tmp/cado-volexity/out.tar.gz /tmp/cado-volexity/out\ncp "/tmp/cado-volexity/out.tar.gz" ${OUTPUT}\nrm -rf /tmp/cado-volexity\n'})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Step 4",src:s(85988).A+"",width:"1571",height:"591"})}),"\n",(0,i.jsxs)(t.ol,{start:"7",children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Continue"})," and you\u2019ll see your script listed in the scripts table."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Saved Script - Table",src:s(39885).A+"",width:"3856",height:"704"})}),"\n",(0,i.jsx)(t.h4,{id:"running-the-script",children:"Running the Script"}),"\n",(0,i.jsxs)(t.p,{children:["Use the Import Wizard to select an EC2 instance with the SSM agent installed. Choose ",(0,i.jsx)(t.strong,{children:"Run Command"})," as the action type, and you\u2019ll see the script created earlier. Complete the import as usual."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS EC2 Run Command - Selecting Saved Script",src:s(82106).A+"",width:"2557",height:"766"})}),"\n",(0,i.jsx)(t.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,i.jsx)(t.p,{children:"Below are diagrams illustrating how EC2 disk acquisitions work:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 Disk Acquisition",src:s(50256).A+"",width:"1962",height:"1044"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 Role Acquisition",src:s(59654).A+"",width:"1910",height:"970"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EBS Direct Acquisition",src:s(1055).A+"",width:"960",height:"540"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 SSM Acquisition",src:s(13667).A+"",width:"1674",height:"1056"})}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 Tunnel Acquisition",src:s(70408).A+"",width:"960",height:"540"})})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},66203:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand1-6a682e02432fcd47b25e0df8167cf22a.png"},87872:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand2-b11e4dc54efaca6f07ebc1e92cb869ff.png"},65993:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand3-0e82deea582dd231aac3dce8b07a8311.png"},25910:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand4-35fa40b42dafc5e3ae7f4d6edaf8e9ff.png"},39199:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand5-8309b0a6ecfa58beffcf97bc2c28a2c8.png"},85988:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand6-f3c3ccfbf5847bd5a1c06fb278687fef.png"},39885:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand7-3fe3e4fe0b44a67e3d0db7cb22f6c481.png"},82106:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-runcommand8-59785809f6dbe0694417240d98e31f84.png"},15780:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-triage-acquisition-ssm-port-forwarding-16af8a0f2d00fee383617dd415da8583.png"},18908:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-triage-acquisition-3b87b8970bc1d3973b5784024932f807.png"},39155:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/aws-ec2-90029871d7a092c458840a666b860193.png"},1055:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/ebs-direct-f3e737af2354a1b8c3efc0c7a3338d77.png"},62253:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/ec2-import-skip-processing-d988f01069949af232c14573c555451e.png"},13667:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/ec2-ssm-ebcc0f7f19f1db4f515746730c8122a5.png"},70408:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/ec2-tunnel-3cd7cd18d8b884a790da5bc53ab7eb15.png"},50256:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/import-aws-ec2-cross-fee34afcec26120f770d5c825457027b.png"},59654:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/import-aws-ec2-role-a151df6f8ad1929241a34ac5d60e8f3a.png"},28453:(e,t,s)=>{s.d(t,{R:()=>r,x:()=>o});var i=s(96540);const n={},a=i.createContext(n);function r(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7b974b4c.83611d88.js b/assets/js/7b974b4c.f82847aa.js similarity index 97% rename from assets/js/7b974b4c.83611d88.js rename to assets/js/7b974b4c.f82847aa.js index 53772a783..85d50cdc6 100644 --- a/assets/js/7b974b4c.83611d88.js +++ b/assets/js/7b974b4c.f82847aa.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3225],{25385:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>s,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>c,toc:()=>d});var i=r(74848),o=r(28453);const n={title:"Architecture in Azure",hide_title:!0,sidebar_position:5},a="What is the Cado architecture in Azure?",c={id:"cado/deploy/azure/azure-architecture",title:"Architecture in Azure",description:"Deployment of the Cado platform is performed within your Azure cloud environment via a Terraform Script. When the platform is deployed, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes.",source:"@site/docs/cado/deploy/azure/azure-architecture.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-architecture",permalink:"/cado/deploy/azure/azure-architecture",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-architecture.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"Architecture in Azure",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Endpoint access",permalink:"/cado/deploy/azure/endpoints"},next:{title:"IAM permissions description",permalink:"/cado/deploy/azure/iam-description"}},s={},d=[];function u(e){const t={h1:"h1",img:"img",p:"p",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"what-is-the-cado-architecture-in-azure",children:"What is the Cado architecture in Azure?"}),"\n",(0,i.jsx)(t.p,{children:"Deployment of the Cado platform is performed within your Azure cloud environment via a Terraform Script. When the platform is deployed, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.img,{alt:"Azure Architecture",src:r(29034).A+"",width:"1368",height:"734"}),"\nThis diagram is a simplified architecture, with options for alternate network access.\nFor a diagram of how cross-cloud imports from Azure into AWS work, please see below:"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Azure Imports",src:r(24933).A+"",width:"1948",height:"912"})})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(u,{...e})}):u(e)}},29034:(e,t,r)=>{r.d(t,{A:()=>i});const i=r.p+"assets/images/azure-architecture-7505d496d193b98efaaa4a50c25d9f45.png"},24933:(e,t,r)=>{r.d(t,{A:()=>i});const i=r.p+"assets/images/azure-imports-28cc37a015043a3c20e4785cab6b7fa2.png"},28453:(e,t,r)=>{r.d(t,{R:()=>a,x:()=>c});var i=r(96540);const o={},n=i.createContext(o);function a(e){const t=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),i.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3225],{25385:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>s,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>c,toc:()=>d});var i=r(74848),o=r(28453);const n={title:"Architecture in Azure",hide_title:!0,sidebar_position:5},a="What is the Cado architecture in Azure?",c={id:"cado/deploy/azure/azure-architecture",title:"Architecture in Azure",description:"Deployment of the Cado platform is performed within your Azure cloud environment via a Terraform Script. When the platform is deployed, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes.",source:"@site/docs/cado/deploy/azure/azure-architecture.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-architecture",permalink:"/cado/deploy/azure/azure-architecture",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-architecture.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"Architecture in Azure",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Endpoint access",permalink:"/cado/deploy/azure/endpoints"},next:{title:"IAM permissions description",permalink:"/cado/deploy/azure/iam-description"}},s={},d=[];function u(e){const t={h1:"h1",img:"img",p:"p",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"what-is-the-cado-architecture-in-azure",children:"What is the Cado architecture in Azure?"}),"\n",(0,i.jsx)(t.p,{children:"Deployment of the Cado platform is performed within your Azure cloud environment via a Terraform Script. When the platform is deployed, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.img,{alt:"Azure Architecture",src:r(29034).A+"",width:"1368",height:"734"}),"\nThis diagram is a simplified architecture, with options for alternate network access.\nFor a diagram of how cross-cloud imports from Azure into AWS work, please see below:"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Azure Imports",src:r(24933).A+"",width:"1948",height:"912"})})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(u,{...e})}):u(e)}},29034:(e,t,r)=>{r.d(t,{A:()=>i});const i=r.p+"assets/images/azure-architecture-7505d496d193b98efaaa4a50c25d9f45.png"},24933:(e,t,r)=>{r.d(t,{A:()=>i});const i=r.p+"assets/images/azure-imports-28cc37a015043a3c20e4785cab6b7fa2.png"},28453:(e,t,r)=>{r.d(t,{R:()=>a,x:()=>c});var i=r(96540);const o={},n=i.createContext(o);function a(e){const t=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),i.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7c637bf6.83f88d10.js b/assets/js/7c637bf6.62988dee.js similarity index 98% rename from assets/js/7c637bf6.83f88d10.js rename to assets/js/7c637bf6.62988dee.js index 8e43196c1..b965b94dc 100644 --- a/assets/js/7c637bf6.83f88d10.js +++ b/assets/js/7c637bf6.62988dee.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7839],{73481:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var r=t(74848),s=t(28453);const i={title:"NFS",hide_title:!0,sidebar_position:8},o="NFS",a={id:"cado/deploy/azure/azure-nfs",title:"NFS",description:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis.",source:"@site/docs/cado/deploy/azure/azure-nfs.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-nfs",permalink:"/cado/deploy/azure/azure-nfs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-nfs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"NFS",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Workers",permalink:"/cado/deploy/azure/azure-workers"},next:{title:"Secret Manager",permalink:"/cado/deploy/azure/azure-secret-manager"}},l={},d=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function c(e){const n={br:"br",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.h1,{id:"nfs",children:"NFS"}),"\n",(0,r.jsx)(n.p,{children:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis."}),"\n",(0,r.jsx)(n.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"A storage account configured in the resource group (Can be the same as used to deploy)"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"A File Share created inside this storage account"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"There are no particular requirements on this fileshare, although we recommend a minimum size of 2 Terabytes."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(n.h3,{id:"steps",children:"Steps"}),"\n",(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:(0,r.jsx)(n.strong,{children:"Create an NFS"})}),"\n",(0,r.jsxs)(n.p,{children:["a. Navigate to your storage account in the UI.",(0,r.jsx)(n.br,{}),"\n","b. Open ",(0,r.jsx)(n.strong,{children:"Datastorage > File Shares"})," in the sidebar.",(0,r.jsx)(n.br,{}),"\n","c. Press ",(0,r.jsx)(n.strong,{children:"Create"}),".",(0,r.jsx)(n.br,{}),"\n","d. Configure the File Share, choosing a memorable name and sensible size."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Mount in the UI (",(0,r.jsx)(n.strong,{children:"Settings"})," > ",(0,r.jsx)(n.strong,{children:"Advanced"})," > ",(0,r.jsx)(n.strong,{children:"NFS"})," >) using the Storage account name and the File Share name."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:(0,r.jsx)(n.img,{alt:"Azure NFS",src:t(1408).A+"",width:"1600",height:"445"})})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},1408:(e,n,t)=>{t.d(n,{A:()=>r});const r=t.p+"assets/images/nfs-azure-f79eff0a1e3541e404f4af932b9db984.png"},28453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>a});var r=t(96540);const s={},i=r.createContext(s);function o(e){const n=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),r.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7839],{73481:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var r=t(74848),s=t(28453);const i={title:"NFS",hide_title:!0,sidebar_position:8},o="NFS",a={id:"cado/deploy/azure/azure-nfs",title:"NFS",description:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis.",source:"@site/docs/cado/deploy/azure/azure-nfs.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-nfs",permalink:"/cado/deploy/azure/azure-nfs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-nfs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"NFS",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Workers",permalink:"/cado/deploy/azure/azure-workers"},next:{title:"Secret Manager",permalink:"/cado/deploy/azure/azure-secret-manager"}},l={},d=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function c(e){const n={br:"br",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.h1,{id:"nfs",children:"NFS"}),"\n",(0,r.jsx)(n.p,{children:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis."}),"\n",(0,r.jsx)(n.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"A storage account configured in the resource group (Can be the same as used to deploy)"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"A File Share created inside this storage account"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"There are no particular requirements on this fileshare, although we recommend a minimum size of 2 Terabytes."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(n.h3,{id:"steps",children:"Steps"}),"\n",(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:(0,r.jsx)(n.strong,{children:"Create an NFS"})}),"\n",(0,r.jsxs)(n.p,{children:["a. Navigate to your storage account in the UI.",(0,r.jsx)(n.br,{}),"\n","b. Open ",(0,r.jsx)(n.strong,{children:"Datastorage > File Shares"})," in the sidebar.",(0,r.jsx)(n.br,{}),"\n","c. Press ",(0,r.jsx)(n.strong,{children:"Create"}),".",(0,r.jsx)(n.br,{}),"\n","d. Configure the File Share, choosing a memorable name and sensible size."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Mount in the UI (",(0,r.jsx)(n.strong,{children:"Settings"})," > ",(0,r.jsx)(n.strong,{children:"Advanced"})," > ",(0,r.jsx)(n.strong,{children:"NFS"})," >) using the Storage account name and the File Share name."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:(0,r.jsx)(n.img,{alt:"Azure NFS",src:t(1408).A+"",width:"1600",height:"445"})})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},1408:(e,n,t)=>{t.d(n,{A:()=>r});const r=t.p+"assets/images/nfs-azure-f79eff0a1e3541e404f4af932b9db984.png"},28453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>a});var r=t(96540);const s={},i=r.createContext(s);function o(e){const n=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),r.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7cafbe3b.415ff47c.js b/assets/js/7cafbe3b.f83d8f6f.js similarity index 99% rename from assets/js/7cafbe3b.415ff47c.js rename to assets/js/7cafbe3b.f83d8f6f.js index 1a5d389ab..42c4f95d2 100644 --- a/assets/js/7cafbe3b.415ff47c.js +++ b/assets/js/7cafbe3b.f83d8f6f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[800],{94322:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>l,toc:()=>a});var i=o(74848),n=o(28453);const s={title:"Deploy with Cloudformation",hide_title:!0,sidebar_position:1},r="How to deploy with Cloudformation",l={id:"cado/deploy/aws/cloudformation",title:"Deploy with Cloudformation",description:"Quick Start",source:"@site/docs/cado/deploy/aws/cloudformation.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/cloudformation",permalink:"/cado/deploy/aws/cloudformation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/cloudformation.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Deploy with Cloudformation",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"What is Cado",permalink:"/cado/intro"},next:{title:"Deploy with Terraform",permalink:"/cado/deploy/aws/terraform"}},d={},a=[{value:"Quick Start",id:"quick-start",level:2},{value:"AWS CloudFormation Template Overview",id:"aws-cloudformation-template-overview",level:2},{value:"Available CloudFormation Templates",id:"available-cloudformation-templates",level:3},{value:"Steps for Deployment",id:"steps-for-deployment",level:3},{value:"Parameters Overview:",id:"parameters-overview",level:4},{value:"Deployment Time",id:"deployment-time",level:3}];function c(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-deploy-with-cloudformation",children:"How to deploy with Cloudformation"}),"\n",(0,i.jsx)(t.h2,{id:"quick-start",children:"Quick Start"}),"\n",(0,i.jsxs)(t.p,{children:["To quickly deploy the Cado platform via AWS CloudFormation with default options, click ",(0,i.jsx)(t.a,{href:"https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?templateURL=https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationPublic.yaml",children:"here"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"aws-cloudformation-template-overview",children:"AWS CloudFormation Template Overview"}),"\n",(0,i.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/aMQOitmPLeE",title:"Deploying with Cloudformation",frameborder:"0",allowfullscreen:!0}),"\n",(0,i.jsx)(t.p,{children:"Deploying Cado in AWS is simple using our CloudFormation Template (CFT), which walks you through configuring the platform stack."}),"\n",(0,i.jsxs)(t.p,{children:["If you're working with the Cado Sales team or using a free trial, you will receive a link to the CloudFormation Template to begin deployment. If you haven't received it yet, contact ",(0,i.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]}),"\n",(0,i.jsx)(t.h3,{id:"available-cloudformation-templates",children:"Available CloudFormation Templates"}),"\n",(0,i.jsx)(t.p,{children:"Several CloudFormation templates are available, depending on your deployment requirements:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsxs)(t.strong,{children:[(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationPublic.yaml",children:"DeployCloudFormationPublic.yaml"}),":"]})," Creates an EC2 instance with an IAM role. This template deploys with a public IP address for direct access."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsxs)(t.strong,{children:[(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationPrivate.yaml",children:"DeployCloudFormationPrivate.yaml"}),":"]})," Deploys an EC2 instance behind a load balancer without a public IP. Access is via the ALB."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsxs)(t.strong,{children:[(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationCustomVPC.yaml",children:"DeployCloudFormationCustomVPC.yaml"}),":"]})," Deploys into an existing VPC. Use ",(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationCustomVPCNetworking.yaml",children:"DeployCloudFormationCustomVPCNetworking.yaml"})," for creating the necessary networking within this VPC."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsxs)(t.strong,{children:[(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationGovCloud.yaml",children:"DeployCloudFormationGovCloud.yaml"}),":"]})," For deploying into AWS GovCloud. Like the private template, it includes a load balancer and no public IP."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"For a High Availability (HA) deployment, contact Cado for the appropriate template."}),"\n",(0,i.jsx)(t.h3,{id:"steps-for-deployment",children:"Steps for Deployment"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"After receiving the CloudFormation template link, click it to open the AWS CloudFormation Management Console."}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["In ",(0,i.jsx)(t.strong,{children:"Step 1 (Specify template)"}),", leave the default settings (",(0,i.jsx)(t.strong,{children:"Template is ready"})," and ",(0,i.jsx)(t.strong,{children:"Amazon S3 URL"}),") unchanged. Click ",(0,i.jsx)(t.strong,{children:"Next"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["In ",(0,i.jsx)(t.strong,{children:"Step 2 (Specify stack details)"}),", name your stack (e.g., ",(0,i.jsx)(t.code,{children:"CadoResponse"}),") and enter the following parameters:"]}),"\n",(0,i.jsx)(t.h4,{id:"parameters-overview",children:"Parameters Overview:"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Parameter Name"}),(0,i.jsx)(t.th,{children:"Value"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Instance type for Cado EC2 Server"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"t3a.xlarge"})}),(0,i.jsx)(t.td,{children:"Recommended minimum instance size for enterprise use."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Key pair for Cado EC2 Server"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(choose your keypair)"})}),(0,i.jsx)(t.td,{children:"Used for SSH access. Not required for standard use, but useful for support if needed."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Allowed source IP for SSH"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(enter IP range)"})}),(0,i.jsx)(t.td,{children:"Specify IP addresses or ranges for SSH access (CIDR format). Follow the least privilege principle."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Allowed source IP for HTTPS"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(enter IP range)"})}),(0,i.jsx)(t.td,{children:"Specify IP addresses or ranges for HTTPS access (CIDR format)."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"VPC CIDR"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(enter IP range)"})}),(0,i.jsx)(t.td,{children:"Define the CIDR block for the VPC Subnet."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"EFSArchive"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"AFTER_30_DAYS"})}),(0,i.jsx)(t.td,{children:"Move data to infrequent access storage after 30 days."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"InstanceVolumeSize"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"1000"})}),(0,i.jsx)(t.td,{children:"Specify required EC2 volume size in GB."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"S3ArchiveTime"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"30"})}),(0,i.jsx)(t.td,{children:"Move S3 data to Glacier after 30 days of inactivity."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"S3GlacierDelete"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"365"})}),(0,i.jsx)(t.td,{children:"Delete Glacier storage data after 365 days."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"AvailabilityZoneA"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(choose your AZ)"})}),(0,i.jsx)(t.td,{children:"The primary subnet's availability zone."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"AvailabilityZoneB"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(choose your AZ)"})}),(0,i.jsx)(t.td,{children:"The secondary subnet's availability zone."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"FeatureFlagPlatformUpgrade"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"True"})}),(0,i.jsx)(t.td,{children:"Enables automatic platform upgrades."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CertificateARN"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(enter ARN)"})}),(0,i.jsxs)(t.td,{children:["The ARN of the certificate for the Application Load Balancer (if FeatureFlagDeployWithALB is ",(0,i.jsx)(t.code,{children:"True"}),")."]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Proxy"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(URL format)"})}),(0,i.jsx)(t.td,{children:"Optional proxy URL for outbound connections."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"ProxyCertUrl"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(URL)"})}),(0,i.jsx)(t.td,{children:"Optional URL to download the proxy certificate."})]})]})]}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsxs)(t.p,{children:["We recommend setting ",(0,i.jsx)(t.strong,{children:"InstanceVolumeSize"})," to at least 500GB. The instance should be sized to about 20% of the data you plan to store. For example, for 5TB of data, allocate 1000GB of disk space. You can delete old investigations to free up space."]})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Click ",(0,i.jsx)(t.strong,{children:"Next"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["In ",(0,i.jsx)(t.strong,{children:"Step 3 (Configure stack options)"}),", unless you need custom settings, click ",(0,i.jsx)(t.strong,{children:"Next"}),". For custom settings, contact Cado Security."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Step 3",src:o(28262).A+"",width:"242",height:"315"})}),"\n",(0,i.jsx)(t.admonition,{type:"info",children:(0,i.jsxs)(t.p,{children:["For more information on stack options, refer to the ",(0,i.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-add-tags.html",children:"AWS Documentation"}),"."]})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Review your configuration and click ",(0,i.jsx)(t.strong,{children:"Create Stack"}),"."]}),"\n",(0,i.jsx)(t.admonition,{type:"info",children:(0,i.jsx)(t.p,{children:'Ensure to check the box for "I acknowledge that AWS CloudFormation might create IAM resources" if an IAM role was not applied in Step 3. The IAM policy created by the CloudFormation template follows the principle of least privilege, restricting access to only the necessary resources and actions.'})}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"deployment-time",children:"Deployment Time"}),"\n",(0,i.jsx)(t.p,{children:"Deployment takes approximately 15 minutes, with an additional 10 minutes for the stack to complete installation and updates."}),"\n",(0,i.jsxs)(t.p,{children:["Once the stack status shows ",(0,i.jsx)(t.code,{children:"CREATE_COMPLETE"}),", the deployment is finished, and you can ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/deploy/logging-in",children:"log into Cado"})}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Creation Complete",src:o(75681).A+"",width:"449",height:"92"})}),"\n",(0,i.jsx)(t.p,{children:'After deployment, you can import test data from the "Help" menu to verify that everything is functioning correctly.'})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},28262:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/cft-step3-54b4069a1b5f8a55273902a48d5ebca5.png"},75681:(e,t,o)=>{o.d(t,{A:()=>i});const i="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcEAAABcCAYAAAAWNA7BAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAByMSURBVHhe7d0LWBTl/gfwryJCKKwXQEhQcKlQLuIqQhwpMFM7djQ9WWlaVpqpdTypiZlWpnk5aWnl/XLIC6amZubxGlgUghc0lcu/WJWLYUDhLraxAvp/35lZGJbdETkuetzf53nGnZl33pl3Zn3myzszu9uk5Pffr5/LzUdYUGcQQggh9uBURhbCw0LRVJomhBBC7I7UE8xFz9NXpVmEEELI3e1oaHPWEwyTQjAvDz1/NEI3rKdUTAghhNydVJuP4mhXJ4R37SpdDr3eRHghhBBC7IKUe3RPkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdotCkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdotCkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdut/LwSNxchMyUCxUZomhBBCGqiRQlAP7f7VmDV+OEaO4EMc5m9LZ3MboDQFS4d9gtRSabpBMrBRaIc0THkfa+N34WSRVEwIIcQu2D4EjSxwXnwE/d8/AafY5zBh/KuY8FIUfMrLcfs6c0aUJafAtx9rC2/PkO5wyt6CCQMm4sAlaRFCCCF3PZuHYOaGmZhV+DS27l2BaUP7IzIqCpGxgzBiZBQ8pGVg1ENflIOTmfnQ/yHNk2PlBZkZKNBbj02jPh+Z1upb4RvE2sLbE9UfI+YvwOsP7MLSrzOkUpHV9Va3SW8xzI1sfzK1xTBWSjPkKo3QF2Qgs4DVtVQuYMsI67Cw/j+Koc3MQbGF49GQ40AIIfZK/GX53Hz0PF1ug1+Wz8Daxwbg8HPJ2DDMV5pXW/H+OAyacQLqBzyBqiJoU4yIWbUDc/uJEWlM/xSjxy5EgQ/rPToXoRiecEpxw+i0FfibF1vgjxxse+cFTD/qgcgOQEFyPnymrsSaCRo4CWuwJB3LOw4Bdl7AOI00i6159/hwzAvag5QJQWy9rAf7xitYluMLNWta8f/lQzNHbFdx0tuYMCoJiPZl2yhHgcfL2PpRf+CrVxC1Q4WhxhPIcWDtLPoZqeW9sTRhAfr6iFsxardg1gtxONKW7Q/ykVrgi0kr/83awVvL2zUWRVNfRtGuLdB7erLtpkDfbQG2rnqaLW9EZvwrGL00v/p4FfRagqQbtJcQQkgN4ZflQ50RHhZq456gUYfiTCDAUyXNqMsj5j2kHDuEDRsTsGEze53ji227UlgkcezE/tZCOP/jEJJ2iuX73u0PN6FMlLl5KqaXjMG+xB1sHTuQ9MMMeMSPxVIWpjdDn7IFG/ZoMDI6QJjO3DAVy3zfw74DbLusbbs+7I/DM7Ygk7Usddt6+Czbga28zXybLACroybJCX1XHhLLDnyD1Y8lYsLifdL9T7Y/U+JQPEban53JSJrpgQ1jP0FqdXOLWYB2x7wD4jHZ99lb8NifhJPCZdoMfPtOPkaurTleQgAy1ttLCCHEGtuGoE4P/qyJq5s8tsw4if01o14PfnXPTSVbNvcsDmf2x8BYMZgEKpUsBDNwZHs6+g6MhbqZNMunP54aUozlqeJlTWG9skEejR8O9sN9HcWh+7SziN24BONCeXvYendloF9oMEtHqZ5nALoVnYX2khs8/DyQun0LDmstPdrjiZpdcENMn6eBbawen8xMwVfptffHp9/TGFj0KVJOSzMYt3t9a/axjSfrAZp4wD02B0ls2ycvyfdEqb3SIoQQQuqwbQh6euI+9qLNzxenLSnYh+l9w9H/+Vcw4aXhGDl7n1TA/MZ6XfzVFHB1GHGVd3WaOYuTAic4ubCXnHzWp0rHupBQdK8eptZ68GXSzgv4OfcCUpYNgkeLAERqTJdsxfUeXjMRE8azdvFh9i7oo7tD7eWEyEk7MLfrz5j/TCii+k7E2mMKz7k68LbloIBvt9wo9szk++PkDN5P1haKfV9lvhj68R4MrdqHSREPIHbU+9it5WGo1F6xJiGEkLps/GBMADqPBA4cSpcub5orxoFFryB/5Gbx8iC/xDezv1TGtPVAJPQ8O6xgPaNo9lJZLk4KjDAa2EuALyvVYBwLOR504iDdRzTjMWAK3vT/FPPiM6SeorjemFdXiG2qHsagCy9u5ouYiUuw79j/YVecJ756ciEOW8lB4x869sdAsBhGwv4w8odhjOVgS0DtXc97d25BGDrn30jSnsbSR/Ix6dX1LFhv0F5CCCEW2TgE3RAz/C102zMHk1jPJLNIvBzJL1EWa/OF+2RGecBV6lHwiyxNOgYjRpOCbV+mQC8EhxHFGWdRIBRyvnhwUCwObNiFk6ZqBV9iwwoPjIsU75XVjy/+9upbwL9mYqPQVfNFUIwGGzdsQaY83H6X2l/95KUTPPxkly4FZ5FhqqTPwbbNq9FlRBTUfLpjFAbG7sOG7TWfkSz4aj3Wer6KqFBphiIW8Kbj1cwNah9PaUK5vYQQcqfR/qrDa5vT0HVeItq8dUgY+Difx8sai41DkOkyBhsSZyBIuxCDwkMR3NEPwSGhGDRuHwszDzw8YgyMM/ogdvAQxPaeigzWe6wRhJc+WYGAPRPRXe2H+8IHYN7PKja3hs/Q97CaBeWEEOn+3l8+BWbFY0KU9WdDLeryHN6dCsz/1xYhZLuMXoLV6iSMZusV2sbWHTtpLytjwTY6nLWlD0YO64Oo3qvhu2wMYmRJmLl+CKJ4W0L6YC3ew7zRpidVfYVenCZ1LLrzcr7OT4B3PnsNkfVprj4FHz3K6j00BCMHRyN4ag4mvf+c0Nuz3l5CCLmzLD54FuEfH8P602W4oL+GqmsQBj7O5/EyvkxjsPFHJMzwzwPyromDG9xaiLMEwnwnuLlZTwLee2QLWP/Yg7RuJxe2jNV7iA1grc1/sPlVtbdXzD8i8Vowtua+im68XqVZHRm+P0a2N0r7bI1Yl23b0vGw1l5CCLkD8HB7J7F+T+zN6u2Ffz4aLE3dOo33EQlzTuzEzE7cdU7OwnzlMLB4wpeT1n1LA5Cz1uYWN9ger6cQQnx/GhKAnFjXyvGw1l5CCLnN+GXO9w7X/5F1vqytL402bgje7Vr4IjL6BmFNCCF2anFitnDZU+7Fnvfi8PgewsDH5fiyvI4tUQjeQh6PvIUNG8V7dIQQQmr77kLt73Pkobf2qS54uFMrYeDj5kFoXudWoxAkhBDSKPKv1O4GPtejduBx5vPM69xqFIKEEELsFoUgIYSQRuHbsnbkrD/+izRWw3yeeZ1bjUKQEEJIo3jIr/Zj6+uO/oKXtmbi23OXhYGP83ly5nVuNQpBQgghjeKfvQPhYJY6PPRilh0XBvMA5MvyOrZEIUgIIaRRqNup8HZM/b/Vny/L69gShSAhhJBGw78Bhn8TjHmPUI6X2erbYsxRCBJCCGlUPNyO/SMcz4W6ws+tqRB6fODjfB4va4wA5Br3u0MJIYSQ20z+3aG2D8GqCpRcSIe2pAL3uAciVO0uFXCsTGulTLGeqKIoG1m/qdC5szccpXkWVelQ+NMZ5OkdofIJRGB782vMFdDlZSMXHRDa4QbXn3VaZGcXQuekQgd1CLxdpflcWR6yM/Msl9VhZZusrXmsrYVW28qwNpw+XyJNSNqwY8TXo1Rmrj7bggGFWWdQcW8E6q6C1T+VB5fAELjLftdYl5eGQmcNAp3y6rZF4IJ7q+tIx+F3/iOQLmjlH8i2o/huikqycVpbgj+d3KEOCYS7gzSfU3ofGlpGCLlryEPQYWpc3LulOj1W/1qJN0PaS4vcKlrsiXsbu0rZGeqPQpzatRHbdfejXxAPNAOyN8RhbpIOrk2u4PzhBGzK90Z0Vx5oSvVYzQsHsGn5Iqze8j1SLqkQ/dD97PRpRVUhEv/1JuJ/doBzZSHOfJmAxKYaRHfiZzgWtKe2YPXHq7B+9xGkNVVjENu+NYZjizBp+Rlca26ALuc7rF9/HB4P9YIPP5kX7cHcaRuRc48DKi79iF3xSXDo+TD86zzdq7DNsu+xdOoqZF4DynU/I/mzBPzY9mFE+sp/OZ/57UccOpaNouIiNlxAyq59SLtHg36d2yiXydVzW7qURZjxyTdA8ECEmn6+sFomvn5zBwwxsfCXvQEXvpqFHYYIRKu01W3JPLwbh/Iq0PxqKZs2otV9LLiq0rFp+iysTdbiSpMKXGHHLTH9GrqF+8Nsj2sxZCxH3NzvUOZ2DYZz3yP+82wERIfDnWen0vvQ0DJCyF1l/tmLGNOuGdp7tbN1CDrD58En8OhfNAgNDcdfvC9i6+cX8cDfNHAv/BKLP3PEiDmvo193DbpHuiN35Q7oevRBgKtCPZQg67tstOo7FoPan0FigQ8eVQjBilP/xsLTYZg+/XlEdQ1HZIgB+5emodWjEfBudgEnDl9B6LBXEX5tD9IQrhiC/FfdH3+8D8JCWbvCg+B4fAd+aB6FaH9HpCcswmnNZMx8ug9Cw3oh2GEflh1zZfvmA3knhUWE9W1eVyH4rwMRreH7HYXg5kewKRWIib4fzgbWS8nRwcVDBUc3f1bOl9Hg3qID+BYDMG2EBi78Dq9SmXwdStsSGsOwYPhw7UWoWurQqqulEGR/VOzKhmvf2iFYcno3slxjER0WUt2WVr/sRsEDr2LCEw+zaRaATjqkfToXB/3HYcG0kWxZthw7bjFmAZi9YQz2N5NvOw+JH2+B4/B5GNc/AqE9euHevDXYUhqG3ve5KLwP7fBjg8rM3z9CyP86eQja+MEYF7jILilVGCuADt4syNj5+LwWhZ1DEGg6eTpr0ENTghNZ/PKZ9Xpg/4YOHIqIDuxELkwry8vRwjE0BN6mM5m3Bg+2PoOs83xCjehnBiDQ0xHNhUJljq7y64EGVJYDHdvxVmmRc8YFoUHC78cLvNmJX3XsDCsxp7BNZxVcZGdcvt+OPt7gWzWc2YbFH21DNr9qKClhvbQPjmnwxvjY2pcDGUtltdahsC0B70GvTULHUcMRaYvLgmXpSD3tjn79WEBLs+qlTIvsi2p0rf6P44gQFraFp85Ap/g+NLSMEHI3s3EIyhjSsXWzFtED2UmZTxrYmdidnYjFUsYRLvzS0zUWeHJm9W5WhdEA7zby8HLBPfyk/l9+J2vJoQTsdh2AfsLnOA2oKFPx3anh5AJVhdm+3AzWC/v31y4YzEKCc4mYjBXLJ0NjOmAXEjB3dTZ0v6Zjx940lFRJ8zkrZXXWYWK2La7k0HJ8rR6NZ4NuKqLqj70vf6ADvNtK07XokL13DTZtWoP9WUDWIdO4TqqngkoWzI4u7M8hto8Viu9DQ8sIIXezxglB3qtYshwnuj2Pp0Jv4qR6s/XKzmA/O1nyE2b1SbOBClNq1rNpUxIKpfkcvyc1dyvw1MtP1OmB3RIs+DfN/5JtYBz6yS9Byrfl+wTmfLwQH84Yjs4FCZixLo2FgESpzLy9lral/Qxzk0Pwxt9t+00NPLYqLeaMCuqHh2Iw6/FH+gMdIsXx6AB5ShFCyH+vEULQgOyE+fjaZxzmjKy59KVSsX5dTh5qnh3UQccmWriYlrBcT5GjOzoGhSBEGjq2ZX/Nq1TQ5uZJC3A6lBS5wFHpyQvGxadmPSFBHWq2z3pNiz8tweNzZqJ3dUCp0MqzEHnyb/xhO1PoyrYjTdabEPxrkPvX9zC9j8L9SQd+yZj1pN3ViI4ORIX80p1SmZzFbZUgcev3MOjTsHj6FMTFLcJOdviSV0/B0u8tPelZgYpavWrWH6vPz3+1ZD0vfhlS/tbIOLqw9rN9ULH3qQVbVtgffjCFennILRKX4ww69sdOC7bPiu9DQ8sIIXczG4cgfwL0TazCcMwZXjvIHEMiEFGYhrSL0oyiJHyTpUZkEP9r33o9Rc7eCAyLQKg08Ptu3uER8E5LQ7p0L81wOgnJzTTo7idOW6PqULOe0DA1O00y/AnCd9LR/e1psgDk1NDEuCM1hYWHMG3A6cPpcOwVwUpuAg+lf81GqmZa3QDkD7Vk5YnrrzCgovryZwUK81g/tbMaHYRJhTL5Oqxuyx3RE1kv8v2ZeGcGH0ajPyvWDJuJFyLML0irEaApwf796dJ+M4V7sC/dHd2DFAKcc+6FRx4DErdvg1Yn6w6aXYJUqSMQ0Eqa4Jwj0COqBMmpUqyz/UhO1CI0gv8/UXofGlpGCLmb2fZzgiUsNN74sk4vpPeU1Xg2iJ1qMtZg1pJ0VLR2hKHUEZFjpmFUODvR3qCeScmhtxGXGoEFMwYo3i8sSZyNGZ8Xsl4h+wP/ijcGx01GP7/a0cqfQvwA47CW9TqtEZZJlCZM1E+I2+eh8tFsbM3j/RHWq+3QF9PHD0UHhQSvs82M5XhpYbo4Xs0bz37wHiK1izBpLfDy4slQp8/HjPV5cGzNeip/sm211ODlN8ZB05rt3/fWywxpNevQnLe+rd61Dibbrzlvo3Bw7WNfrfR7xH+QgNQrbL+dDNDpXBAyajImRNUOQb6vO7zNerdVJTi97WOsTiyEQco+x6ChWDClr/hHhzX8Eu47y5FcwXqHRh0cezyP6aN6QcUv9Sq9Dw0tI4TcVRr3w/I3UmWAgZ0B+eUvR1vcXzNhPSRDOb/MxsLBhtupMOhY/8sFLsK1u1uM9/BMba+qEB8u4pc+zbelWMYGG+y/sN9s3Q17HytQUcZ6sPyJ1XofNqmOI9tH57qVlN6HhpYRQu4O8hBsvKdDrZHuX9k0ADl+suT3eGy8HeFelq1OoPK2OziK98ksbUuxTHq9xUz38Bp2fB2Fj5/c3GGT6lgIQE7pfWhoGSHk7nP7Q5AQQgi5TSgECSGE2C0KQUIIIXaLQpAQQojdohAkhBBitygECSGE2K1GDcFTF4/gvf3j8fjKzghb4CQMfJzP42WEEEJIY2q0EORBN2J9L2xNX4kLv/+EymuVwsDH+TxexpchhBBCGkujhODYLY8JQce9GDkFW0al4eTUP4WBj/N5HF+GL0sIIYQ0Bpt/bRrv3fFw822txqInNqOLV3eppLbMSycw+cthyC/V4inNWLzdb5lUYl2Z9giySsvZmDPc/buhU1tnNi+JzRPL0dIPnX384dpSmi6/hOyzWdBLkyIvdO7RGaafpzNePIkff2uFrqH+cOIzSrNwVHtJKKutFToFd4PTRdn2JG7eDyKw/Q1+poKx1H7BtXKU/HQEmb+Xw7m5l7Add9nq6rSxGqt39ghKWovbF5YrvCwW8fV06gz3WseiFO1l+y66jHPHT8p+3YPj++oP/Vnz+SK+v/7IqtmWSetu6KmWf/s1IYTcfvKvTXOYGhf3bqlOj9W/VuLNkPbSIrcGv883e98EYXzNsP1WA5DzaHkvND5R2HZqNTIKTyCqU194uflKpWauHMGq5ZGYfvZnoOoeGH9Pxq5MR/QIuw+5BwIw75wPWhsvozg3Ae8nTkV21VOI9WNn/+LdmLNjJS41ZXUuX0KxMDjCJ+g+uAkrvozDnwdg3I9X0KXLQHTiX55cdBwHM84Iy57KHontv0rrvnwZLn7dUPqtbHvSOnUuIejSTiEEFdrvwstWPIoPCprBq7IcxYU7MP/QMpS1fArdvZoJ1S+nvYbB366GW9uXEeYhzBLlrseU7UNx0nEC+qtbisudKsB9fD1FB7Hx4Bh89+cQPKpuLR2LI+gYHc3+DJA7iW2fvY4fqtiK9aZjxPfVC8UnkvATn85PQFx2FtpdbwK9tL/eF96o2ZZ0HIrhh7AObFuEEHIHmX/2Isa0a4b2Xu1s2xM09QL55c5JsQukubWVlV/GgkOTENfnQ7g6t8KHSXFYl7pQoTd4Gd+tCcKqll9g7TMPmvWEWPB+7oD4thex+FHp1H5qLmK+ccaKyZMQWLgZ/4w/j1FvTkeYWFrbbzvxDisP7ZSAb5y3Ydlj/lKBqM66GUvzlCm133KZke3DS/sL8fLoT/BQW6Dk4JOIOX0BgfdMxorxw6Rf0CjH0fXBiNf5oXngRqE9wnK/TcZZti5B7jqMTziJZ8az9RisHQsWwvMWof2oLzDA2q8hsfYEp/jjcPW2pTbJt0UIIXeoRvsC7aMXkoTXfoFDhVceeHww4eMvJDyCL898xno7rwvzTMua6tahO4Lk4gcxLLpuAFqk8kKnq+UsIm7s4tG1yA8cjL+HjUd5ThJMP3V4Sym130qZU9gwDGuxDMmZssuN7d/CK82mIOGotGfnE1gATseo+xUuP7bzRycUokz80TxCCLF7Ng3BgsvnhNf7PUOrA48PpjDk49m/nsIDnl0xrc9H1ctyprp1GC6jGJ3RXuE3W/W/HcHR40ls2IvN+2fiasBjrIbJOixc0gcvSsPmTGk2ziM1pxwDurDen38sBlxbhoPZUtENnDo1onp9L8bvtXjfrJpS+4UyDdrXuSrtj/asy1VcLo9yL/R5aDKOpiXg4jXWg/xmLgIjhqOT+TtayY61jg+XkP3NWnzd8q8IUzh2oiNY+XnNMVqYbOmeqAW5b9QchyXLUM/DRwght02jfUSCu379uhB6pjA0BWD8s4nCpdD6K8fVq9KoBfrL6cg8n4g9yY8juf0hbBzaTdazGoaXR32BJdIwJECanb0Tmyv/CnUbHhitofZxxtcZJ6VCZWFdPqle35K/xyr+wK9Iqf2lYB1XM1aWDxyPf6jmYvP2ZVh1dTaG97RwH/Li+5gY/yQbRmBz2d+x7rkXceM7vw/i+QE1x2hseD0v9bLeafVxGPUiAqXZhBByp7JpCPq06iS8/lR0Wgg5HnY89Hj4WQtAvixnqltHay/4IAmZVjqKnI96AkYNnY3psbNRlLMT2bVC5R64qVrBVRqcmotzszMSUFL5H3wsBMaT+DjvMkpy9uLUNbFcUfPW1etzdb3BU6FK7W/nhy5NLZRdy0JmsRe6eJiHkTN6Rs9G2S/pGNC75v5cLR0/wLqJh4Rh1jOD0UnxJ9trOLvWHKMb7VK1ZrI6qvpWIoSQ28emIdjTL1Z43Z+9TXiVB6G1HqBpWVPdOpxj8XigM+K/W4ds+UcTal0qFDmFTcLUtksxZ+8NenTXTiL1ghdee0oMC2F4fTdec1mK747XXe9/Ran9TR/EQ/eLZeeuSPNZL/Dc3kWIbzoZD4lXimvzH4ZZE7/AMOp2EULITbNpCA4MHim88qc9+ecAOVMQWgpAvgxfljPVtSRw0NdY3DYRU1c5IHieOMSst3QvjvWUBqxB559mYvt5aRZmYoRURxzm4tjxHYhvPgSRHaVFBP6IDOiGHT8dgVGaY82h4+1l63PAPw8q30NTar9Y9h+M+yQAI5b0wYgFLTAuV4PFIyYh8Ja/W3WPxSlh/k7ExcvnP4k9hUKBsvO9ZHXY8Dl9FR4h5M72P/1hec6ou4yrTjdxya6RCO2Sxms417lMaLX9V8tR9ifrHTqwMtMH3AkhhPzX5B+RsHkIcvyr0H44d0AY558Z5B+DMD0Fyu8B8kugph7gXzr1xcqn9wrj/7tOYvOSN3BQmqoxBFMnjqcHRggh5DZq9BDkTD1CJTfTAySEEEIaotE+LC/Hw23jc98LQefX5n40a9pMGPg4n8fLKAAJIYQ0pkbrCRJCCCF3gtvSEySEEELuNBSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixWxSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixWxSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixW7V+RYIQQgixB9U/qvtbaen1/IsXcfYnLYpKSlBVVSUtQgghhNxdHJo2hYe7O0IeCEDXoCA00en1169WVODP8nJcrajE9evXpUUJIYSQu0uTJk3Q3LEZ7nF2hnubNmiiLyuj1COEEGJ3XFu2xP8DaKcy/UdYKwQAAAAASUVORK5CYII="},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>l});var i=o(96540);const n={},s=i.createContext(n);function r(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[800],{94322:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>l,toc:()=>a});var i=o(74848),n=o(28453);const s={title:"Deploy with Cloudformation",hide_title:!0,sidebar_position:1},r="How to deploy with Cloudformation",l={id:"cado/deploy/aws/cloudformation",title:"Deploy with Cloudformation",description:"Quick Start",source:"@site/docs/cado/deploy/aws/cloudformation.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/cloudformation",permalink:"/cado/deploy/aws/cloudformation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/cloudformation.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Deploy with Cloudformation",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"What is Cado",permalink:"/cado/intro"},next:{title:"Deploy with Terraform",permalink:"/cado/deploy/aws/terraform"}},d={},a=[{value:"Quick Start",id:"quick-start",level:2},{value:"AWS CloudFormation Template Overview",id:"aws-cloudformation-template-overview",level:2},{value:"Available CloudFormation Templates",id:"available-cloudformation-templates",level:3},{value:"Steps for Deployment",id:"steps-for-deployment",level:3},{value:"Parameters Overview:",id:"parameters-overview",level:4},{value:"Deployment Time",id:"deployment-time",level:3}];function c(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-deploy-with-cloudformation",children:"How to deploy with Cloudformation"}),"\n",(0,i.jsx)(t.h2,{id:"quick-start",children:"Quick Start"}),"\n",(0,i.jsxs)(t.p,{children:["To quickly deploy the Cado platform via AWS CloudFormation with default options, click ",(0,i.jsx)(t.a,{href:"https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?templateURL=https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationPublic.yaml",children:"here"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"aws-cloudformation-template-overview",children:"AWS CloudFormation Template Overview"}),"\n",(0,i.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/aMQOitmPLeE",title:"Deploying with Cloudformation",frameborder:"0",allowfullscreen:!0}),"\n",(0,i.jsx)(t.p,{children:"Deploying Cado in AWS is simple using our CloudFormation Template (CFT), which walks you through configuring the platform stack."}),"\n",(0,i.jsxs)(t.p,{children:["If you're working with the Cado Sales team or using a free trial, you will receive a link to the CloudFormation Template to begin deployment. If you haven't received it yet, contact ",(0,i.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]}),"\n",(0,i.jsx)(t.h3,{id:"available-cloudformation-templates",children:"Available CloudFormation Templates"}),"\n",(0,i.jsx)(t.p,{children:"Several CloudFormation templates are available, depending on your deployment requirements:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsxs)(t.strong,{children:[(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationPublic.yaml",children:"DeployCloudFormationPublic.yaml"}),":"]})," Creates an EC2 instance with an IAM role. This template deploys with a public IP address for direct access."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsxs)(t.strong,{children:[(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationPrivate.yaml",children:"DeployCloudFormationPrivate.yaml"}),":"]})," Deploys an EC2 instance behind a load balancer without a public IP. Access is via the ALB."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsxs)(t.strong,{children:[(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationCustomVPC.yaml",children:"DeployCloudFormationCustomVPC.yaml"}),":"]})," Deploys into an existing VPC. Use ",(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationCustomVPCNetworking.yaml",children:"DeployCloudFormationCustomVPCNetworking.yaml"})," for creating the necessary networking within this VPC."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsxs)(t.strong,{children:[(0,i.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation_v2/DeployCloudFormationGovCloud.yaml",children:"DeployCloudFormationGovCloud.yaml"}),":"]})," For deploying into AWS GovCloud. Like the private template, it includes a load balancer and no public IP."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"For a High Availability (HA) deployment, contact Cado for the appropriate template."}),"\n",(0,i.jsx)(t.h3,{id:"steps-for-deployment",children:"Steps for Deployment"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"After receiving the CloudFormation template link, click it to open the AWS CloudFormation Management Console."}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["In ",(0,i.jsx)(t.strong,{children:"Step 1 (Specify template)"}),", leave the default settings (",(0,i.jsx)(t.strong,{children:"Template is ready"})," and ",(0,i.jsx)(t.strong,{children:"Amazon S3 URL"}),") unchanged. Click ",(0,i.jsx)(t.strong,{children:"Next"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["In ",(0,i.jsx)(t.strong,{children:"Step 2 (Specify stack details)"}),", name your stack (e.g., ",(0,i.jsx)(t.code,{children:"CadoResponse"}),") and enter the following parameters:"]}),"\n",(0,i.jsx)(t.h4,{id:"parameters-overview",children:"Parameters Overview:"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Parameter Name"}),(0,i.jsx)(t.th,{children:"Value"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Instance type for Cado EC2 Server"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"t3a.xlarge"})}),(0,i.jsx)(t.td,{children:"Recommended minimum instance size for enterprise use."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Key pair for Cado EC2 Server"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(choose your keypair)"})}),(0,i.jsx)(t.td,{children:"Used for SSH access. Not required for standard use, but useful for support if needed."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Allowed source IP for SSH"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(enter IP range)"})}),(0,i.jsx)(t.td,{children:"Specify IP addresses or ranges for SSH access (CIDR format). Follow the least privilege principle."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Allowed source IP for HTTPS"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(enter IP range)"})}),(0,i.jsx)(t.td,{children:"Specify IP addresses or ranges for HTTPS access (CIDR format)."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"VPC CIDR"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(enter IP range)"})}),(0,i.jsx)(t.td,{children:"Define the CIDR block for the VPC Subnet."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"EFSArchive"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"AFTER_30_DAYS"})}),(0,i.jsx)(t.td,{children:"Move data to infrequent access storage after 30 days."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"InstanceVolumeSize"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"1000"})}),(0,i.jsx)(t.td,{children:"Specify required EC2 volume size in GB."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"S3ArchiveTime"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"30"})}),(0,i.jsx)(t.td,{children:"Move S3 data to Glacier after 30 days of inactivity."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"S3GlacierDelete"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"365"})}),(0,i.jsx)(t.td,{children:"Delete Glacier storage data after 365 days."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"AvailabilityZoneA"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(choose your AZ)"})}),(0,i.jsx)(t.td,{children:"The primary subnet's availability zone."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"AvailabilityZoneB"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(choose your AZ)"})}),(0,i.jsx)(t.td,{children:"The secondary subnet's availability zone."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"FeatureFlagPlatformUpgrade"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"True"})}),(0,i.jsx)(t.td,{children:"Enables automatic platform upgrades."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CertificateARN"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(enter ARN)"})}),(0,i.jsxs)(t.td,{children:["The ARN of the certificate for the Application Load Balancer (if FeatureFlagDeployWithALB is ",(0,i.jsx)(t.code,{children:"True"}),")."]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Proxy"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(URL format)"})}),(0,i.jsx)(t.td,{children:"Optional proxy URL for outbound connections."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"ProxyCertUrl"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.em,{children:"(URL)"})}),(0,i.jsx)(t.td,{children:"Optional URL to download the proxy certificate."})]})]})]}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsxs)(t.p,{children:["We recommend setting ",(0,i.jsx)(t.strong,{children:"InstanceVolumeSize"})," to at least 500GB. The instance should be sized to about 20% of the data you plan to store. For example, for 5TB of data, allocate 1000GB of disk space. You can delete old investigations to free up space."]})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Click ",(0,i.jsx)(t.strong,{children:"Next"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["In ",(0,i.jsx)(t.strong,{children:"Step 3 (Configure stack options)"}),", unless you need custom settings, click ",(0,i.jsx)(t.strong,{children:"Next"}),". For custom settings, contact Cado Security."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Step 3",src:o(28262).A+"",width:"242",height:"315"})}),"\n",(0,i.jsx)(t.admonition,{type:"info",children:(0,i.jsxs)(t.p,{children:["For more information on stack options, refer to the ",(0,i.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-add-tags.html",children:"AWS Documentation"}),"."]})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Review your configuration and click ",(0,i.jsx)(t.strong,{children:"Create Stack"}),"."]}),"\n",(0,i.jsx)(t.admonition,{type:"info",children:(0,i.jsx)(t.p,{children:'Ensure to check the box for "I acknowledge that AWS CloudFormation might create IAM resources" if an IAM role was not applied in Step 3. The IAM policy created by the CloudFormation template follows the principle of least privilege, restricting access to only the necessary resources and actions.'})}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"deployment-time",children:"Deployment Time"}),"\n",(0,i.jsx)(t.p,{children:"Deployment takes approximately 15 minutes, with an additional 10 minutes for the stack to complete installation and updates."}),"\n",(0,i.jsxs)(t.p,{children:["Once the stack status shows ",(0,i.jsx)(t.code,{children:"CREATE_COMPLETE"}),", the deployment is finished, and you can ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/deploy/logging-in",children:"log into Cado"})}),"."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Creation Complete",src:o(75681).A+"",width:"449",height:"92"})}),"\n",(0,i.jsx)(t.p,{children:'After deployment, you can import test data from the "Help" menu to verify that everything is functioning correctly.'})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},28262:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/cft-step3-54b4069a1b5f8a55273902a48d5ebca5.png"},75681:(e,t,o)=>{o.d(t,{A:()=>i});const i="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcEAAABcCAYAAAAWNA7BAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAByMSURBVHhe7d0LWBTl/gfwryJCKKwXQEhQcKlQLuIqQhwpMFM7djQ9WWlaVpqpdTypiZlWpnk5aWnl/XLIC6amZubxGlgUghc0lcu/WJWLYUDhLraxAvp/35lZGJbdETkuetzf53nGnZl33pl3Zn3myzszu9uk5Pffr5/LzUdYUGcQQggh9uBURhbCw0LRVJomhBBC7I7UE8xFz9NXpVmEEELI3e1oaHPWEwyTQjAvDz1/NEI3rKdUTAghhNydVJuP4mhXJ4R37SpdDr3eRHghhBBC7IKUe3RPkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdotCkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdotCkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdut/LwSNxchMyUCxUZomhBBCGqiRQlAP7f7VmDV+OEaO4EMc5m9LZ3MboDQFS4d9gtRSabpBMrBRaIc0THkfa+N34WSRVEwIIcQu2D4EjSxwXnwE/d8/AafY5zBh/KuY8FIUfMrLcfs6c0aUJafAtx9rC2/PkO5wyt6CCQMm4sAlaRFCCCF3PZuHYOaGmZhV+DS27l2BaUP7IzIqCpGxgzBiZBQ8pGVg1ENflIOTmfnQ/yHNk2PlBZkZKNBbj02jPh+Z1upb4RvE2sLbE9UfI+YvwOsP7MLSrzOkUpHV9Va3SW8xzI1sfzK1xTBWSjPkKo3QF2Qgs4DVtVQuYMsI67Cw/j+Koc3MQbGF49GQ40AIIfZK/GX53Hz0PF1ug1+Wz8Daxwbg8HPJ2DDMV5pXW/H+OAyacQLqBzyBqiJoU4yIWbUDc/uJEWlM/xSjxy5EgQ/rPToXoRiecEpxw+i0FfibF1vgjxxse+cFTD/qgcgOQEFyPnymrsSaCRo4CWuwJB3LOw4Bdl7AOI00i6159/hwzAvag5QJQWy9rAf7xitYluMLNWta8f/lQzNHbFdx0tuYMCoJiPZl2yhHgcfL2PpRf+CrVxC1Q4WhxhPIcWDtLPoZqeW9sTRhAfr6iFsxardg1gtxONKW7Q/ykVrgi0kr/83awVvL2zUWRVNfRtGuLdB7erLtpkDfbQG2rnqaLW9EZvwrGL00v/p4FfRagqQbtJcQQkgN4ZflQ50RHhZq456gUYfiTCDAUyXNqMsj5j2kHDuEDRsTsGEze53ji227UlgkcezE/tZCOP/jEJJ2iuX73u0PN6FMlLl5KqaXjMG+xB1sHTuQ9MMMeMSPxVIWpjdDn7IFG/ZoMDI6QJjO3DAVy3zfw74DbLusbbs+7I/DM7Ygk7Usddt6+Czbga28zXybLACroybJCX1XHhLLDnyD1Y8lYsLifdL9T7Y/U+JQPEban53JSJrpgQ1jP0FqdXOLWYB2x7wD4jHZ99lb8NifhJPCZdoMfPtOPkaurTleQgAy1ttLCCHEGtuGoE4P/qyJq5s8tsw4if01o14PfnXPTSVbNvcsDmf2x8BYMZgEKpUsBDNwZHs6+g6MhbqZNMunP54aUozlqeJlTWG9skEejR8O9sN9HcWh+7SziN24BONCeXvYendloF9oMEtHqZ5nALoVnYX2khs8/DyQun0LDmstPdrjiZpdcENMn6eBbawen8xMwVfptffHp9/TGFj0KVJOSzMYt3t9a/axjSfrAZp4wD02B0ls2ycvyfdEqb3SIoQQQuqwbQh6euI+9qLNzxenLSnYh+l9w9H/+Vcw4aXhGDl7n1TA/MZ6XfzVFHB1GHGVd3WaOYuTAic4ubCXnHzWp0rHupBQdK8eptZ68GXSzgv4OfcCUpYNgkeLAERqTJdsxfUeXjMRE8azdvFh9i7oo7tD7eWEyEk7MLfrz5j/TCii+k7E2mMKz7k68LbloIBvt9wo9szk++PkDN5P1haKfV9lvhj68R4MrdqHSREPIHbU+9it5WGo1F6xJiGEkLps/GBMADqPBA4cSpcub5orxoFFryB/5Gbx8iC/xDezv1TGtPVAJPQ8O6xgPaNo9lJZLk4KjDAa2EuALyvVYBwLOR504iDdRzTjMWAK3vT/FPPiM6SeorjemFdXiG2qHsagCy9u5ouYiUuw79j/YVecJ756ciEOW8lB4x869sdAsBhGwv4w8odhjOVgS0DtXc97d25BGDrn30jSnsbSR/Ix6dX1LFhv0F5CCCEW2TgE3RAz/C102zMHk1jPJLNIvBzJL1EWa/OF+2RGecBV6lHwiyxNOgYjRpOCbV+mQC8EhxHFGWdRIBRyvnhwUCwObNiFk6ZqBV9iwwoPjIsU75XVjy/+9upbwL9mYqPQVfNFUIwGGzdsQaY83H6X2l/95KUTPPxkly4FZ5FhqqTPwbbNq9FlRBTUfLpjFAbG7sOG7TWfkSz4aj3Wer6KqFBphiIW8Kbj1cwNah9PaUK5vYQQcqfR/qrDa5vT0HVeItq8dUgY+Difx8sai41DkOkyBhsSZyBIuxCDwkMR3NEPwSGhGDRuHwszDzw8YgyMM/ogdvAQxPaeigzWe6wRhJc+WYGAPRPRXe2H+8IHYN7PKja3hs/Q97CaBeWEEOn+3l8+BWbFY0KU9WdDLeryHN6dCsz/1xYhZLuMXoLV6iSMZusV2sbWHTtpLytjwTY6nLWlD0YO64Oo3qvhu2wMYmRJmLl+CKJ4W0L6YC3ew7zRpidVfYVenCZ1LLrzcr7OT4B3PnsNkfVprj4FHz3K6j00BCMHRyN4ag4mvf+c0Nuz3l5CCLmzLD54FuEfH8P602W4oL+GqmsQBj7O5/EyvkxjsPFHJMzwzwPyromDG9xaiLMEwnwnuLlZTwLee2QLWP/Yg7RuJxe2jNV7iA1grc1/sPlVtbdXzD8i8Vowtua+im68XqVZHRm+P0a2N0r7bI1Yl23b0vGw1l5CCLkD8HB7J7F+T+zN6u2Ffz4aLE3dOo33EQlzTuzEzE7cdU7OwnzlMLB4wpeT1n1LA5Cz1uYWN9ger6cQQnx/GhKAnFjXyvGw1l5CCLnN+GXO9w7X/5F1vqytL402bgje7Vr4IjL6BmFNCCF2anFitnDZU+7Fnvfi8PgewsDH5fiyvI4tUQjeQh6PvIUNG8V7dIQQQmr77kLt73Pkobf2qS54uFMrYeDj5kFoXudWoxAkhBDSKPKv1O4GPtejduBx5vPM69xqFIKEEELsFoUgIYSQRuHbsnbkrD/+izRWw3yeeZ1bjUKQEEJIo3jIr/Zj6+uO/oKXtmbi23OXhYGP83ly5nVuNQpBQgghjeKfvQPhYJY6PPRilh0XBvMA5MvyOrZEIUgIIaRRqNup8HZM/b/Vny/L69gShSAhhJBGw78Bhn8TjHmPUI6X2erbYsxRCBJCCGlUPNyO/SMcz4W6ws+tqRB6fODjfB4va4wA5Br3u0MJIYSQ20z+3aG2D8GqCpRcSIe2pAL3uAciVO0uFXCsTGulTLGeqKIoG1m/qdC5szccpXkWVelQ+NMZ5OkdofIJRGB782vMFdDlZSMXHRDa4QbXn3VaZGcXQuekQgd1CLxdpflcWR6yM/Msl9VhZZusrXmsrYVW28qwNpw+XyJNSNqwY8TXo1Rmrj7bggGFWWdQcW8E6q6C1T+VB5fAELjLftdYl5eGQmcNAp3y6rZF4IJ7q+tIx+F3/iOQLmjlH8i2o/huikqycVpbgj+d3KEOCYS7gzSfU3ofGlpGCLlryEPQYWpc3LulOj1W/1qJN0PaS4vcKlrsiXsbu0rZGeqPQpzatRHbdfejXxAPNAOyN8RhbpIOrk2u4PzhBGzK90Z0Vx5oSvVYzQsHsGn5Iqze8j1SLqkQ/dD97PRpRVUhEv/1JuJ/doBzZSHOfJmAxKYaRHfiZzgWtKe2YPXHq7B+9xGkNVVjENu+NYZjizBp+Rlca26ALuc7rF9/HB4P9YIPP5kX7cHcaRuRc48DKi79iF3xSXDo+TD86zzdq7DNsu+xdOoqZF4DynU/I/mzBPzY9mFE+sp/OZ/57UccOpaNouIiNlxAyq59SLtHg36d2yiXydVzW7qURZjxyTdA8ECEmn6+sFomvn5zBwwxsfCXvQEXvpqFHYYIRKu01W3JPLwbh/Iq0PxqKZs2otV9LLiq0rFp+iysTdbiSpMKXGHHLTH9GrqF+8Nsj2sxZCxH3NzvUOZ2DYZz3yP+82wERIfDnWen0vvQ0DJCyF1l/tmLGNOuGdp7tbN1CDrD58En8OhfNAgNDcdfvC9i6+cX8cDfNHAv/BKLP3PEiDmvo193DbpHuiN35Q7oevRBgKtCPZQg67tstOo7FoPan0FigQ8eVQjBilP/xsLTYZg+/XlEdQ1HZIgB+5emodWjEfBudgEnDl9B6LBXEX5tD9IQrhiC/FfdH3+8D8JCWbvCg+B4fAd+aB6FaH9HpCcswmnNZMx8ug9Cw3oh2GEflh1zZfvmA3knhUWE9W1eVyH4rwMRreH7HYXg5kewKRWIib4fzgbWS8nRwcVDBUc3f1bOl9Hg3qID+BYDMG2EBi78Dq9SmXwdStsSGsOwYPhw7UWoWurQqqulEGR/VOzKhmvf2iFYcno3slxjER0WUt2WVr/sRsEDr2LCEw+zaRaATjqkfToXB/3HYcG0kWxZthw7bjFmAZi9YQz2N5NvOw+JH2+B4/B5GNc/AqE9euHevDXYUhqG3ve5KLwP7fBjg8rM3z9CyP86eQja+MEYF7jILilVGCuADt4syNj5+LwWhZ1DEGg6eTpr0ENTghNZ/PKZ9Xpg/4YOHIqIDuxELkwry8vRwjE0BN6mM5m3Bg+2PoOs83xCjehnBiDQ0xHNhUJljq7y64EGVJYDHdvxVmmRc8YFoUHC78cLvNmJX3XsDCsxp7BNZxVcZGdcvt+OPt7gWzWc2YbFH21DNr9qKClhvbQPjmnwxvjY2pcDGUtltdahsC0B70GvTULHUcMRaYvLgmXpSD3tjn79WEBLs+qlTIvsi2p0rf6P44gQFraFp85Ap/g+NLSMEHI3s3EIyhjSsXWzFtED2UmZTxrYmdidnYjFUsYRLvzS0zUWeHJm9W5WhdEA7zby8HLBPfyk/l9+J2vJoQTsdh2AfsLnOA2oKFPx3anh5AJVhdm+3AzWC/v31y4YzEKCc4mYjBXLJ0NjOmAXEjB3dTZ0v6Zjx940lFRJ8zkrZXXWYWK2La7k0HJ8rR6NZ4NuKqLqj70vf6ADvNtK07XokL13DTZtWoP9WUDWIdO4TqqngkoWzI4u7M8hto8Viu9DQ8sIIXezxglB3qtYshwnuj2Pp0Jv4qR6s/XKzmA/O1nyE2b1SbOBClNq1rNpUxIKpfkcvyc1dyvw1MtP1OmB3RIs+DfN/5JtYBz6yS9Byrfl+wTmfLwQH84Yjs4FCZixLo2FgESpzLy9lral/Qxzk0Pwxt9t+00NPLYqLeaMCuqHh2Iw6/FH+gMdIsXx6AB5ShFCyH+vEULQgOyE+fjaZxzmjKy59KVSsX5dTh5qnh3UQccmWriYlrBcT5GjOzoGhSBEGjq2ZX/Nq1TQ5uZJC3A6lBS5wFHpyQvGxadmPSFBHWq2z3pNiz8tweNzZqJ3dUCp0MqzEHnyb/xhO1PoyrYjTdabEPxrkPvX9zC9j8L9SQd+yZj1pN3ViI4ORIX80p1SmZzFbZUgcev3MOjTsHj6FMTFLcJOdviSV0/B0u8tPelZgYpavWrWH6vPz3+1ZD0vfhlS/tbIOLqw9rN9ULH3qQVbVtgffjCFennILRKX4ww69sdOC7bPiu9DQ8sIIXczG4cgfwL0TazCcMwZXjvIHEMiEFGYhrSL0oyiJHyTpUZkEP9r33o9Rc7eCAyLQKg08Ptu3uER8E5LQ7p0L81wOgnJzTTo7idOW6PqULOe0DA1O00y/AnCd9LR/e1psgDk1NDEuCM1hYWHMG3A6cPpcOwVwUpuAg+lf81GqmZa3QDkD7Vk5YnrrzCgovryZwUK81g/tbMaHYRJhTL5Oqxuyx3RE1kv8v2ZeGcGH0ajPyvWDJuJFyLML0irEaApwf796dJ+M4V7sC/dHd2DFAKcc+6FRx4DErdvg1Yn6w6aXYJUqSMQ0Eqa4Jwj0COqBMmpUqyz/UhO1CI0gv8/UXofGlpGCLmb2fZzgiUsNN74sk4vpPeU1Xg2iJ1qMtZg1pJ0VLR2hKHUEZFjpmFUODvR3qCeScmhtxGXGoEFMwYo3i8sSZyNGZ8Xsl4h+wP/ijcGx01GP7/a0cqfQvwA47CW9TqtEZZJlCZM1E+I2+eh8tFsbM3j/RHWq+3QF9PHD0UHhQSvs82M5XhpYbo4Xs0bz37wHiK1izBpLfDy4slQp8/HjPV5cGzNeip/sm211ODlN8ZB05rt3/fWywxpNevQnLe+rd61Dibbrzlvo3Bw7WNfrfR7xH+QgNQrbL+dDNDpXBAyajImRNUOQb6vO7zNerdVJTi97WOsTiyEQco+x6ChWDClr/hHhzX8Eu47y5FcwXqHRh0cezyP6aN6QcUv9Sq9Dw0tI4TcVRr3w/I3UmWAgZ0B+eUvR1vcXzNhPSRDOb/MxsLBhtupMOhY/8sFLsK1u1uM9/BMba+qEB8u4pc+zbelWMYGG+y/sN9s3Q17HytQUcZ6sPyJ1XofNqmOI9tH57qVlN6HhpYRQu4O8hBsvKdDrZHuX9k0ADl+suT3eGy8HeFelq1OoPK2OziK98ksbUuxTHq9xUz38Bp2fB2Fj5/c3GGT6lgIQE7pfWhoGSHk7nP7Q5AQQgi5TSgECSGE2C0KQUIIIXaLQpAQQojdohAkhBBitygECSGE2K1GDcFTF4/gvf3j8fjKzghb4CQMfJzP42WEEEJIY2q0EORBN2J9L2xNX4kLv/+EymuVwsDH+TxexpchhBBCGkujhODYLY8JQce9GDkFW0al4eTUP4WBj/N5HF+GL0sIIYQ0Bpt/bRrv3fFw822txqInNqOLV3eppLbMSycw+cthyC/V4inNWLzdb5lUYl2Z9giySsvZmDPc/buhU1tnNi+JzRPL0dIPnX384dpSmi6/hOyzWdBLkyIvdO7RGaafpzNePIkff2uFrqH+cOIzSrNwVHtJKKutFToFd4PTRdn2JG7eDyKw/Q1+poKx1H7BtXKU/HQEmb+Xw7m5l7Add9nq6rSxGqt39ghKWovbF5YrvCwW8fV06gz3WseiFO1l+y66jHPHT8p+3YPj++oP/Vnz+SK+v/7IqtmWSetu6KmWf/s1IYTcfvKvTXOYGhf3bqlOj9W/VuLNkPbSIrcGv883e98EYXzNsP1WA5DzaHkvND5R2HZqNTIKTyCqU194uflKpWauHMGq5ZGYfvZnoOoeGH9Pxq5MR/QIuw+5BwIw75wPWhsvozg3Ae8nTkV21VOI9WNn/+LdmLNjJS41ZXUuX0KxMDjCJ+g+uAkrvozDnwdg3I9X0KXLQHTiX55cdBwHM84Iy57KHontv0rrvnwZLn7dUPqtbHvSOnUuIejSTiEEFdrvwstWPIoPCprBq7IcxYU7MP/QMpS1fArdvZoJ1S+nvYbB366GW9uXEeYhzBLlrseU7UNx0nEC+qtbisudKsB9fD1FB7Hx4Bh89+cQPKpuLR2LI+gYHc3+DJA7iW2fvY4fqtiK9aZjxPfVC8UnkvATn85PQFx2FtpdbwK9tL/eF96o2ZZ0HIrhh7AObFuEEHIHmX/2Isa0a4b2Xu1s2xM09QL55c5JsQukubWVlV/GgkOTENfnQ7g6t8KHSXFYl7pQoTd4Gd+tCcKqll9g7TMPmvWEWPB+7oD4thex+FHp1H5qLmK+ccaKyZMQWLgZ/4w/j1FvTkeYWFrbbzvxDisP7ZSAb5y3Ydlj/lKBqM66GUvzlCm133KZke3DS/sL8fLoT/BQW6Dk4JOIOX0BgfdMxorxw6Rf0CjH0fXBiNf5oXngRqE9wnK/TcZZti5B7jqMTziJZ8az9RisHQsWwvMWof2oLzDA2q8hsfYEp/jjcPW2pTbJt0UIIXeoRvsC7aMXkoTXfoFDhVceeHww4eMvJDyCL898xno7rwvzTMua6tahO4Lk4gcxLLpuAFqk8kKnq+UsIm7s4tG1yA8cjL+HjUd5ThJMP3V4Sym130qZU9gwDGuxDMmZssuN7d/CK82mIOGotGfnE1gATseo+xUuP7bzRycUokz80TxCCLF7Ng3BgsvnhNf7PUOrA48PpjDk49m/nsIDnl0xrc9H1ctyprp1GC6jGJ3RXuE3W/W/HcHR40ls2IvN+2fiasBjrIbJOixc0gcvSsPmTGk2ziM1pxwDurDen38sBlxbhoPZUtENnDo1onp9L8bvtXjfrJpS+4UyDdrXuSrtj/asy1VcLo9yL/R5aDKOpiXg4jXWg/xmLgIjhqOT+TtayY61jg+XkP3NWnzd8q8IUzh2oiNY+XnNMVqYbOmeqAW5b9QchyXLUM/DRwght02jfUSCu379uhB6pjA0BWD8s4nCpdD6K8fVq9KoBfrL6cg8n4g9yY8juf0hbBzaTdazGoaXR32BJdIwJECanb0Tmyv/CnUbHhitofZxxtcZJ6VCZWFdPqle35K/xyr+wK9Iqf2lYB1XM1aWDxyPf6jmYvP2ZVh1dTaG97RwH/Li+5gY/yQbRmBz2d+x7rkXceM7vw/i+QE1x2hseD0v9bLeafVxGPUiAqXZhBByp7JpCPq06iS8/lR0Wgg5HnY89Hj4WQtAvixnqltHay/4IAmZVjqKnI96AkYNnY3psbNRlLMT2bVC5R64qVrBVRqcmotzszMSUFL5H3wsBMaT+DjvMkpy9uLUNbFcUfPW1etzdb3BU6FK7W/nhy5NLZRdy0JmsRe6eJiHkTN6Rs9G2S/pGNC75v5cLR0/wLqJh4Rh1jOD0UnxJ9trOLvWHKMb7VK1ZrI6qvpWIoSQ28emIdjTL1Z43Z+9TXiVB6G1HqBpWVPdOpxj8XigM+K/W4ds+UcTal0qFDmFTcLUtksxZ+8NenTXTiL1ghdee0oMC2F4fTdec1mK747XXe9/Ran9TR/EQ/eLZeeuSPNZL/Dc3kWIbzoZD4lXimvzH4ZZE7/AMOp2EULITbNpCA4MHim88qc9+ecAOVMQWgpAvgxfljPVtSRw0NdY3DYRU1c5IHieOMSst3QvjvWUBqxB559mYvt5aRZmYoRURxzm4tjxHYhvPgSRHaVFBP6IDOiGHT8dgVGaY82h4+1l63PAPw8q30NTar9Y9h+M+yQAI5b0wYgFLTAuV4PFIyYh8Ja/W3WPxSlh/k7ExcvnP4k9hUKBsvO9ZHXY8Dl9FR4h5M72P/1hec6ou4yrTjdxya6RCO2Sxms417lMaLX9V8tR9ifrHTqwMtMH3AkhhPzX5B+RsHkIcvyr0H44d0AY558Z5B+DMD0Fyu8B8kugph7gXzr1xcqn9wrj/7tOYvOSN3BQmqoxBFMnjqcHRggh5DZq9BDkTD1CJTfTAySEEEIaotE+LC/Hw23jc98LQefX5n40a9pMGPg4n8fLKAAJIYQ0pkbrCRJCCCF3gtvSEySEEELuNBSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixWxSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixWxSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixW7V+RYIQQgixB9U/qvtbaen1/IsXcfYnLYpKSlBVVSUtQgghhNxdHJo2hYe7O0IeCEDXoCA00en1169WVODP8nJcrajE9evXpUUJIYSQu0uTJk3Q3LEZ7nF2hnubNmiiLyuj1COEEGJ3XFu2xP8DaKcy/UdYKwQAAAAASUVORK5CYII="},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>l});var i=o(96540);const n={},s=i.createContext(n);function r(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7cf0e382.1cdccaef.js b/assets/js/7cf0e382.6deaf6b2.js similarity index 99% rename from assets/js/7cf0e382.1cdccaef.js rename to assets/js/7cf0e382.6deaf6b2.js index ca8c653be..c6d141de4 100644 --- a/assets/js/7cf0e382.1cdccaef.js +++ b/assets/js/7cf0e382.6deaf6b2.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4690],{60252:(e,s,r)=>{r.r(s),r.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>n,metadata:()=>d,toc:()=>l});var i=r(74848),t=r(28453);const n={title:"IAM permissions description",hide_title:!0,sidebar_position:4},o="What IAM permissions does Cado use?",d={id:"cado/deploy/aws/iam/iam-description",title:"IAM permissions description",description:"The Cado platform requires specific IAM permissions to operate effectively, depending on the tasks you need it to perform. Below is a clear breakdown of the different permission groups and their purposes:",source:"@site/docs/cado/deploy/aws/iam/iam-description.md",sourceDirName:"cado/deploy/aws/iam",slug:"/cado/deploy/aws/iam/iam-description",permalink:"/cado/deploy/aws/iam/iam-description",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/iam/iam-description.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"IAM permissions description",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Workers",permalink:"/cado/deploy/aws/aws-workers"},next:{title:"KMS support",permalink:"/cado/deploy/aws/iam/aws-kms"}},c={},l=[{value:"Customizing the Cado Cross-Account Policy",id:"customizing-the-cado-cross-account-policy",level:2},{value:"Using an Existing IAM Role",id:"using-an-existing-iam-role",level:2}];function a(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"what-iam-permissions-does-cado-use",children:"What IAM permissions does Cado use?"}),"\n",(0,i.jsx)(s.p,{children:"The Cado platform requires specific IAM permissions to operate effectively, depending on the tasks you need it to perform. Below is a clear breakdown of the different permission groups and their purposes:"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:(0,i.jsx)(s.strong,{children:"Permission Group"})}),(0,i.jsx)(s.th,{children:(0,i.jsx)(s.strong,{children:"Purpose"})})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Core Platform and Worker Operations"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForStartup"}),(0,i.jsx)(s.td,{children:"Essential for core platform operation and starting/stopping workers."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForStartup2"}),(0,i.jsx)(s.td,{children:"Additional permissions for core platform and worker management."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"EC2 and Core Platform Permissions"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEC2ImportAndCorePlatform"}),(0,i.jsx)(s.td,{children:"Required to start/stop workers and acquire EC2 volumes."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Health Checks"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredToCheckPolicy"}),(0,i.jsx)(s.td,{children:"Needed for health checks to ensure safe operation of the core platform."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Health Check Operations"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForHealthChecks"}),(0,i.jsx)(s.td,{children:"Needed for performing health checks to ensure core platform safety."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Native Updates with ALB"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Cross-Account Operations"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForCrossAccountAccess"}),(0,i.jsx)(s.td,{children:"Required for cross-account operations between AWS accounts."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Accessing Cado S3 Bucket"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredToAccessCadoS3Bucket"}),(0,i.jsx)(s.td,{children:"Allows access to the Cado S3 bucket for storing and retrieving forensic data."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"S3 Bucket and Forensic Preservation"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForAcquireToS3"}),(0,i.jsx)(s.td,{children:'Permissions for forensic preservation to S3 buckets and maintaining the chain of custody (can be scoped to "CadoS3BucketAlt").'})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"S3 Readiness Checks"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForS3Readiness"}),(0,i.jsx)(s.td,{children:"Ensures the platform is ready by verifying safe S3 operations."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Memory Forensics via SSM"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForMemoryForensics"}),(0,i.jsx)(s.td,{children:"Enables triage acquisitions that include memory acquisition using SSM."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"KMS Encrypted EC2 Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForKmsEncryptedEc2Import"}),(0,i.jsx)(s.td,{children:"Allows acquisition of KMS-encrypted EBS volumes for EC2 systems."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForCrossAccountDefaultKmsEncryptedEc2Import"}),(0,i.jsx)(s.td,{children:"Needed to acquire KMS-encrypted EBS volumes from other AWS accounts."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Temporary KMS Resource Operations"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForOperationsOnTemporaryKMSResourcesduringDefaultEncryptedEc2Import"}),(0,i.jsx)(s.td,{children:"Required to handle temporary KMS resources by generating keys for re-encryption during encrypted EC2 volume acquisitions."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Lambda Function Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForLambdaImport"}),(0,i.jsx)(s.td,{children:"Permissions for importing Lambda functions, CloudWatch logs, and container images if applicable."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"ECS Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEcsImport"}),(0,i.jsxs)(s.td,{children:["Allows importing ECS clusters, services, and tasks. ",(0,i.jsx)(s.strong,{children:"ExecuteCommand"})," is needed to run commands on ECS tasks."]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"EKS Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEKSImport"}),(0,i.jsx)(s.td,{children:"Required for acquiring EKS clusters."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"EC2 and AMI Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEc2ImportAndAmiImport"}),(0,i.jsx)(s.td,{children:"Permissions for acquiring EC2 instances, volumes, snapshots, CloudTrail logs, IAM roles, policies, and SSM documents."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEc2ImportAndAmiImport2"}),(0,i.jsx)(s.td,{children:"Scoped permissions for handling copied volumes created by Cado during EC2 and AMI imports."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"EC2 Isolation"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForResponseActionIsolateEc2"}),(0,i.jsx)(s.td,{children:"Required to isolate EC2 instances (optional if isolation is not needed)."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"AMI Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForAmiImports"}),(0,i.jsx)(s.td,{children:"Permissions scoped to the Cado copy of the AMI during import."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForNativeUpdatesWithALB"}),(0,i.jsx)(s.td,{children:"Required for performing native updates using an Application Load Balancer (ALB), optional if ALB is not used."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"GuardDuty Monitoring"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForGuardDutyMonitoring"}),(0,i.jsx)(s.td,{children:"Needed for GuardDuty monitoring, optional if not using GuardDuty automation."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Automated Error Reporting"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForAutomatedErrorReporting"}),(0,i.jsx)(s.td,{children:"Allows automated error logs to be sent to Cado (optional if logs are shared manually)."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"One-Time KMS Key Creation"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForFirstTimeKMSDefaultencryptedImportCanBeDeletedAfter"}),(0,i.jsx)(s.td,{children:"Used once to create a Cado-specific KMS key for default encrypted EBS volumes, can be deleted afterward."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"AWS Organizations Account Discovery"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForAWSOrganizationsDiscoverAccounts"}),(0,i.jsx)(s.td,{children:"Required to discover accounts in AWS Organizations, optional if AWS Organizations is not being used."})]})]})]}),"\n",(0,i.jsx)(s.h2,{id:"customizing-the-cado-cross-account-policy",children:"Customizing the Cado Cross-Account Policy"}),"\n",(0,i.jsx)(s.p,{children:"The Cado Cross-Account Policy includes permissions to acquire various AWS resources. You can customize it by removing permissions that are not needed for your use case:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"EC2 permissions"})," are required to acquire EC2 systems."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"KMS permissions"})," are needed for acquiring KMS-encrypted volumes."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"SSM permissions"})," are necessary for triage captures."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"S3 permissions"})," allow importing from S3 buckets in other accounts."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"CloudTrail permissions"})," enable importing CloudTrail logs from other accounts."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"ECS permissions"})," are required to import ECS containers."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"EC2 de-register permissions"})," are needed for importing AMI images cross-account."]}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["If you modify the ",(0,i.jsx)(s.strong,{children:"Maximum session duration"}),", note that the minimum currently supported by Cado is 1 hour."]}),"\n",(0,i.jsx)(s.h2,{id:"using-an-existing-iam-role",children:"Using an Existing IAM Role"}),"\n",(0,i.jsxs)(s.p,{children:["If you prefer using an existing IAM role with proper resource access, update the trust relationship with the following JSON, replacing ",(0,i.jsx)(s.code,{children:"111111111111"})," with the ID of your primary AWS account:"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-json",children:'{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Effect": "Allow",\n "Principal": {\n "AWS": "111111111111"\n },\n "Action": "sts:AssumeRole",\n "Condition": {}\n }\n ]\n}\n'})}),"\n",(0,i.jsxs)(s.p,{children:["You can further restrict this by specifying a specific Cado role rather than trusting the entire account. For more details, see the AWS documentation on ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html",children:"IAM policy elements"}),"."]})]})}function h(e={}){const{wrapper:s}={...(0,t.R)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},28453:(e,s,r)=>{r.d(s,{R:()=>o,x:()=>d});var i=r(96540);const t={},n=i.createContext(t);function o(e){const s=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function d(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),i.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4690],{60252:(e,s,r)=>{r.r(s),r.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>n,metadata:()=>d,toc:()=>l});var i=r(74848),t=r(28453);const n={title:"IAM permissions description",hide_title:!0,sidebar_position:4},o="What IAM permissions does Cado use?",d={id:"cado/deploy/aws/iam/iam-description",title:"IAM permissions description",description:"The Cado platform requires specific IAM permissions to operate effectively, depending on the tasks you need it to perform. Below is a clear breakdown of the different permission groups and their purposes:",source:"@site/docs/cado/deploy/aws/iam/iam-description.md",sourceDirName:"cado/deploy/aws/iam",slug:"/cado/deploy/aws/iam/iam-description",permalink:"/cado/deploy/aws/iam/iam-description",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/iam/iam-description.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"IAM permissions description",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Workers",permalink:"/cado/deploy/aws/aws-workers"},next:{title:"KMS support",permalink:"/cado/deploy/aws/iam/aws-kms"}},c={},l=[{value:"Customizing the Cado Cross-Account Policy",id:"customizing-the-cado-cross-account-policy",level:2},{value:"Using an Existing IAM Role",id:"using-an-existing-iam-role",level:2}];function a(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"what-iam-permissions-does-cado-use",children:"What IAM permissions does Cado use?"}),"\n",(0,i.jsx)(s.p,{children:"The Cado platform requires specific IAM permissions to operate effectively, depending on the tasks you need it to perform. Below is a clear breakdown of the different permission groups and their purposes:"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:(0,i.jsx)(s.strong,{children:"Permission Group"})}),(0,i.jsx)(s.th,{children:(0,i.jsx)(s.strong,{children:"Purpose"})})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Core Platform and Worker Operations"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForStartup"}),(0,i.jsx)(s.td,{children:"Essential for core platform operation and starting/stopping workers."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForStartup2"}),(0,i.jsx)(s.td,{children:"Additional permissions for core platform and worker management."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"EC2 and Core Platform Permissions"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEC2ImportAndCorePlatform"}),(0,i.jsx)(s.td,{children:"Required to start/stop workers and acquire EC2 volumes."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Health Checks"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredToCheckPolicy"}),(0,i.jsx)(s.td,{children:"Needed for health checks to ensure safe operation of the core platform."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Health Check Operations"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForHealthChecks"}),(0,i.jsx)(s.td,{children:"Needed for performing health checks to ensure core platform safety."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Native Updates with ALB"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Cross-Account Operations"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForCrossAccountAccess"}),(0,i.jsx)(s.td,{children:"Required for cross-account operations between AWS accounts."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Accessing Cado S3 Bucket"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredToAccessCadoS3Bucket"}),(0,i.jsx)(s.td,{children:"Allows access to the Cado S3 bucket for storing and retrieving forensic data."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"S3 Bucket and Forensic Preservation"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForAcquireToS3"}),(0,i.jsx)(s.td,{children:'Permissions for forensic preservation to S3 buckets and maintaining the chain of custody (can be scoped to "CadoS3BucketAlt").'})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"S3 Readiness Checks"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForS3Readiness"}),(0,i.jsx)(s.td,{children:"Ensures the platform is ready by verifying safe S3 operations."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Memory Forensics via SSM"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForMemoryForensics"}),(0,i.jsx)(s.td,{children:"Enables triage acquisitions that include memory acquisition using SSM."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"KMS Encrypted EC2 Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForKmsEncryptedEc2Import"}),(0,i.jsx)(s.td,{children:"Allows acquisition of KMS-encrypted EBS volumes for EC2 systems."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForCrossAccountDefaultKmsEncryptedEc2Import"}),(0,i.jsx)(s.td,{children:"Needed to acquire KMS-encrypted EBS volumes from other AWS accounts."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Temporary KMS Resource Operations"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForOperationsOnTemporaryKMSResourcesduringDefaultEncryptedEc2Import"}),(0,i.jsx)(s.td,{children:"Required to handle temporary KMS resources by generating keys for re-encryption during encrypted EC2 volume acquisitions."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Lambda Function Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForLambdaImport"}),(0,i.jsx)(s.td,{children:"Permissions for importing Lambda functions, CloudWatch logs, and container images if applicable."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"ECS Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEcsImport"}),(0,i.jsxs)(s.td,{children:["Allows importing ECS clusters, services, and tasks. ",(0,i.jsx)(s.strong,{children:"ExecuteCommand"})," is needed to run commands on ECS tasks."]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"EKS Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEKSImport"}),(0,i.jsx)(s.td,{children:"Required for acquiring EKS clusters."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"EC2 and AMI Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEc2ImportAndAmiImport"}),(0,i.jsx)(s.td,{children:"Permissions for acquiring EC2 instances, volumes, snapshots, CloudTrail logs, IAM roles, policies, and SSM documents."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForEc2ImportAndAmiImport2"}),(0,i.jsx)(s.td,{children:"Scoped permissions for handling copied volumes created by Cado during EC2 and AMI imports."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"EC2 Isolation"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForResponseActionIsolateEc2"}),(0,i.jsx)(s.td,{children:"Required to isolate EC2 instances (optional if isolation is not needed)."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"AMI Imports"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForAmiImports"}),(0,i.jsx)(s.td,{children:"Permissions scoped to the Cado copy of the AMI during import."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForNativeUpdatesWithALB"}),(0,i.jsx)(s.td,{children:"Required for performing native updates using an Application Load Balancer (ALB), optional if ALB is not used."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"GuardDuty Monitoring"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForGuardDutyMonitoring"}),(0,i.jsx)(s.td,{children:"Needed for GuardDuty monitoring, optional if not using GuardDuty automation."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Automated Error Reporting"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForAutomatedErrorReporting"}),(0,i.jsx)(s.td,{children:"Allows automated error logs to be sent to Cado (optional if logs are shared manually)."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"One-Time KMS Key Creation"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForFirstTimeKMSDefaultencryptedImportCanBeDeletedAfter"}),(0,i.jsx)(s.td,{children:"Used once to create a Cado-specific KMS key for default encrypted EBS volumes, can be deleted afterward."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"AWS Organizations Account Discovery"})}),(0,i.jsx)(s.td,{})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"RequiredForAWSOrganizationsDiscoverAccounts"}),(0,i.jsx)(s.td,{children:"Required to discover accounts in AWS Organizations, optional if AWS Organizations is not being used."})]})]})]}),"\n",(0,i.jsx)(s.h2,{id:"customizing-the-cado-cross-account-policy",children:"Customizing the Cado Cross-Account Policy"}),"\n",(0,i.jsx)(s.p,{children:"The Cado Cross-Account Policy includes permissions to acquire various AWS resources. You can customize it by removing permissions that are not needed for your use case:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"EC2 permissions"})," are required to acquire EC2 systems."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"KMS permissions"})," are needed for acquiring KMS-encrypted volumes."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"SSM permissions"})," are necessary for triage captures."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"S3 permissions"})," allow importing from S3 buckets in other accounts."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"CloudTrail permissions"})," enable importing CloudTrail logs from other accounts."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"ECS permissions"})," are required to import ECS containers."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"EC2 de-register permissions"})," are needed for importing AMI images cross-account."]}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["If you modify the ",(0,i.jsx)(s.strong,{children:"Maximum session duration"}),", note that the minimum currently supported by Cado is 1 hour."]}),"\n",(0,i.jsx)(s.h2,{id:"using-an-existing-iam-role",children:"Using an Existing IAM Role"}),"\n",(0,i.jsxs)(s.p,{children:["If you prefer using an existing IAM role with proper resource access, update the trust relationship with the following JSON, replacing ",(0,i.jsx)(s.code,{children:"111111111111"})," with the ID of your primary AWS account:"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-json",children:'{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Effect": "Allow",\n "Principal": {\n "AWS": "111111111111"\n },\n "Action": "sts:AssumeRole",\n "Condition": {}\n }\n ]\n}\n'})}),"\n",(0,i.jsxs)(s.p,{children:["You can further restrict this by specifying a specific Cado role rather than trusting the entire account. For more details, see the AWS documentation on ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html",children:"IAM policy elements"}),"."]})]})}function h(e={}){const{wrapper:s}={...(0,t.R)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},28453:(e,s,r)=>{r.d(s,{R:()=>o,x:()=>d});var i=r(96540);const t={},n=i.createContext(t);function o(e){const s=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function d(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),i.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/81e2ac17.131f09a5.js b/assets/js/81e2ac17.cffcb112.js similarity index 98% rename from assets/js/81e2ac17.131f09a5.js rename to assets/js/81e2ac17.cffcb112.js index 7577fc16f..bdcab3819 100644 --- a/assets/js/81e2ac17.131f09a5.js +++ b/assets/js/81e2ac17.cffcb112.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3707],{7674:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>t,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var i=s(74848),o=s(28453);const r={title:"EKS",hide_title:!0,sidebar_position:5},t="How to Import Data from AWS EKS",a={id:"cado/discovery-import/aws/aws-eks",title:"EKS",description:"The Cado platform enables the collection of key logs and forensic artifacts from containers running in an AWS EKS cluster. There are three main options when acquiring data from EKS:",source:"@site/docs/cado/discovery-import/aws/aws-eks.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-eks",permalink:"/cado/discovery-import/aws/aws-eks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-eks.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"EKS",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"ECS",permalink:"/cado/discovery-import/aws/aws-ecs"},next:{title:"Lambda",permalink:"/cado/discovery-import/aws/aws-lambda"}},c={},l=[{value:"Import Steps",id:"import-steps",level:2},{value:"Known Limitations",id:"known-limitations",level:2},{value:"Configuring the Cluster RBAC for Use with Cado",id:"configuring-the-cluster-rbac-for-use-with-cado",level:2},{value:"RBAC ClusterRole and ClusterRoleBinding",id:"rbac-clusterrole-and-clusterrolebinding",level:3},{value:"Linking AWS IAM to Your Cluster RBAC",id:"linking-aws-iam-to-your-cluster-rbac",level:2},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-import-data-from-aws-eks",children:"How to Import Data from AWS EKS"}),"\n",(0,i.jsx)(n.p,{children:"The Cado platform enables the collection of key logs and forensic artifacts from containers running in an AWS EKS cluster. There are three main options when acquiring data from EKS:"}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"EKS Options",src:s(74679).A+"",width:"1674",height:"732"})}),"\n",(0,i.jsx)(n.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Go to ",(0,i.jsx)(n.strong,{children:"Import > Cloud"}),"."]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Cado Import Screen showing the AWS EKS options",src:s(43913).A+"",width:"1522",height:"363"})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Follow the prompts to select your ",(0,i.jsx)(n.strong,{children:"Cluster"}),", ",(0,i.jsx)(n.strong,{children:"Pod"}),", and ",(0,i.jsx)(n.strong,{children:"Container"}),"."]}),"\n",(0,i.jsx)(n.admonition,{type:"tip",children:(0,i.jsx)(n.p,{children:"When choosing the role in the UI, make sure to select the role configured for the account where your EKS cluster resides."})}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Cado Import Screen showing the available AWS EKS Clusters",src:s(21930).A+"",width:"1842",height:"563"})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.p,{children:"Cado will automatically collect key logs and forensic artifacts from the selected container to facilitate your investigation. The import and processing typically take a few minutes to complete."}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Cado showing the confirmation screen of a successful AWS EKS container capture",src:s(60787).A+"",width:"1795",height:"698"})}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"known-limitations",children:"Known Limitations"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Cado can acquire artifacts from containers built with ",(0,i.jsx)(n.strong,{children:"distroless containers"})," and ",(0,i.jsx)(n.strong,{children:"private clusters"})," using Cado Host only. Containers with the ",(0,i.jsx)(n.code,{children:"gcr.io/distroless"})," image tag will be hidden. For more details, see [Kubernetes Deployments]."]}),"\n",(0,i.jsxs)(n.li,{children:["Cado will hide pods running under the following namespaces, which are generally system-level namespaces running a distroless environment:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"kube-system"}),", ",(0,i.jsx)(n.code,{children:"kube-public"}),", ",(0,i.jsx)(n.code,{children:"kube-node-lease"})]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"gke-gmp-system"}),", ",(0,i.jsx)(n.code,{children:"aks-command"})]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"gmp-system"}),", ",(0,i.jsx)(n.code,{children:"calico-system"}),", ",(0,i.jsx)(n.code,{children:"tigera-operator"})]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"configuring-the-cluster-rbac-for-use-with-cado",children:"Configuring the Cluster RBAC for Use with Cado"}),"\n",(0,i.jsx)(n.p,{children:"To acquire artifacts from a container, the following Kubernetes permissions must be enabled for each cluster:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"pods"})," - ",(0,i.jsx)(n.code,{children:"get"}),", ",(0,i.jsx)(n.code,{children:"list"})]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"pods/exec"})," - ",(0,i.jsx)(n.code,{children:"create"}),", ",(0,i.jsx)(n.code,{children:"get"})]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"rbac-clusterrole-and-clusterrolebinding",children:"RBAC ClusterRole and ClusterRoleBinding"}),"\n",(0,i.jsx)(n.p,{children:"We recommend adding the following ClusterRole and ClusterRoleBinding to your cluster\u2019s RBAC configuration with the permissions listed above."}),"\n",(0,i.jsxs)(n.p,{children:["For instructions on managing role maps, refer to ",(0,i.jsx)(n.a,{href:"https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html",children:"this AWS guide"}),"."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cado-eks-cluster-role\nrules:\n- apiGroups: [""]\n resources: ["pods"]\n verbs: ["get", "list"]\n- apiGroups: [""]\n resources: ["pods/exec"]\n verbs: ["create", "get"]\n'})}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cado-eks-cluster-role-binding\nsubjects:\n- kind: Group\n name: cado\n apiGroup: rbac.authorization.k8s.io\nroleRef:\n kind: ClusterRole\n name: cado-eks-cluster-role\n apiGroup: rbac.authorization.k8s.io\n"})}),"\n",(0,i.jsx)(n.h2,{id:"linking-aws-iam-to-your-cluster-rbac",children:"Linking AWS IAM to Your Cluster RBAC"}),"\n",(0,i.jsx)(n.admonition,{type:"info",children:(0,i.jsxs)(n.p,{children:["Use the role ARN added in the ",(0,i.jsx)(n.a,{href:"/cado/deploy/cross/cross-account-creation#step-2-add-target-aws-role-arn-to-the-cado-platform",children:"Cross Account Creation"})," that corresponds to the AWS Account ID where the cluster resides."]})}),"\n",(0,i.jsxs)(n.p,{children:["You need to add the appropriate Cado IAM role to your EKS RBAC configuration. Without this, you will encounter an error stating: ",(0,i.jsx)(n.code,{children:"This role is not configured to authorize with this EKS cluster"}),"."]}),"\n",(0,i.jsxs)(n.p,{children:["Refer to ",(0,i.jsx)(n.a,{href:"https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/",children:"this AWS guide"})," for instructions on adding your role to the EKS RBAC. If you have ",(0,i.jsx)(n.code,{children:"eksctl"})," configured, you can run the following command:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"eksctl create iamidentitymapping --cluster= --region= --arn= --group=\n"})}),"\n",(0,i.jsxs)(n.p,{children:["If you added the ClusterRole and ClusterRoleBindings as shown above, the group will be ",(0,i.jsx)(n.code,{children:"cado"}),":"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"eksctl create iamidentitymapping --cluster= --region= --arn= --group=cado\n"})}),"\n",(0,i.jsx)(n.p,{children:"Ensure the following IAM permissions are attached to your IAM role:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'\t"eks:ListClusters",\n\t"eks:DescribeCluster",\n'})}),"\n",(0,i.jsx)(n.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,i.jsx)(n.p,{children:"Below is a diagram illustrating how EKS acquisitions operate:"}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"EKS Data Flow",src:s(19733).A+"",width:"1858",height:"1108"})})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},19733:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/eks-collection-bea8d7a273645ff8b0db0648f377f4df.png"},74679:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/eks-options-c8ae61eb3df024a44ad4155fdcc299b3.png"},21930:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/eks2-61bad122854ee7bda7589ab4d9c32e68.png"},60787:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},43913:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/import-cloud-focus-2430bd09657ad2f5e88391377ba1dc53.png"},28453:(e,n,s)=>{s.d(n,{R:()=>t,x:()=>a});var i=s(96540);const o={},r=i.createContext(o);function t(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:t(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3707],{7674:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>t,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var i=s(74848),o=s(28453);const r={title:"EKS",hide_title:!0,sidebar_position:5},t="How to Import Data from AWS EKS",a={id:"cado/discovery-import/aws/aws-eks",title:"EKS",description:"The Cado platform enables the collection of key logs and forensic artifacts from containers running in an AWS EKS cluster. There are three main options when acquiring data from EKS:",source:"@site/docs/cado/discovery-import/aws/aws-eks.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-eks",permalink:"/cado/discovery-import/aws/aws-eks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-eks.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"EKS",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"ECS",permalink:"/cado/discovery-import/aws/aws-ecs"},next:{title:"Lambda",permalink:"/cado/discovery-import/aws/aws-lambda"}},c={},l=[{value:"Import Steps",id:"import-steps",level:2},{value:"Known Limitations",id:"known-limitations",level:2},{value:"Configuring the Cluster RBAC for Use with Cado",id:"configuring-the-cluster-rbac-for-use-with-cado",level:2},{value:"RBAC ClusterRole and ClusterRoleBinding",id:"rbac-clusterrole-and-clusterrolebinding",level:3},{value:"Linking AWS IAM to Your Cluster RBAC",id:"linking-aws-iam-to-your-cluster-rbac",level:2},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-import-data-from-aws-eks",children:"How to Import Data from AWS EKS"}),"\n",(0,i.jsx)(n.p,{children:"The Cado platform enables the collection of key logs and forensic artifacts from containers running in an AWS EKS cluster. There are three main options when acquiring data from EKS:"}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"EKS Options",src:s(74679).A+"",width:"1674",height:"732"})}),"\n",(0,i.jsx)(n.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Go to ",(0,i.jsx)(n.strong,{children:"Import > Cloud"}),"."]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Cado Import Screen showing the AWS EKS options",src:s(43913).A+"",width:"1522",height:"363"})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Follow the prompts to select your ",(0,i.jsx)(n.strong,{children:"Cluster"}),", ",(0,i.jsx)(n.strong,{children:"Pod"}),", and ",(0,i.jsx)(n.strong,{children:"Container"}),"."]}),"\n",(0,i.jsx)(n.admonition,{type:"tip",children:(0,i.jsx)(n.p,{children:"When choosing the role in the UI, make sure to select the role configured for the account where your EKS cluster resides."})}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Cado Import Screen showing the available AWS EKS Clusters",src:s(21930).A+"",width:"1842",height:"563"})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.p,{children:"Cado will automatically collect key logs and forensic artifacts from the selected container to facilitate your investigation. The import and processing typically take a few minutes to complete."}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Cado showing the confirmation screen of a successful AWS EKS container capture",src:s(60787).A+"",width:"1795",height:"698"})}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"known-limitations",children:"Known Limitations"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Cado can acquire artifacts from containers built with ",(0,i.jsx)(n.strong,{children:"distroless containers"})," and ",(0,i.jsx)(n.strong,{children:"private clusters"})," using Cado Host only. Containers with the ",(0,i.jsx)(n.code,{children:"gcr.io/distroless"})," image tag will be hidden. For more details, see [Kubernetes Deployments]."]}),"\n",(0,i.jsxs)(n.li,{children:["Cado will hide pods running under the following namespaces, which are generally system-level namespaces running a distroless environment:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"kube-system"}),", ",(0,i.jsx)(n.code,{children:"kube-public"}),", ",(0,i.jsx)(n.code,{children:"kube-node-lease"})]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"gke-gmp-system"}),", ",(0,i.jsx)(n.code,{children:"aks-command"})]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"gmp-system"}),", ",(0,i.jsx)(n.code,{children:"calico-system"}),", ",(0,i.jsx)(n.code,{children:"tigera-operator"})]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"configuring-the-cluster-rbac-for-use-with-cado",children:"Configuring the Cluster RBAC for Use with Cado"}),"\n",(0,i.jsx)(n.p,{children:"To acquire artifacts from a container, the following Kubernetes permissions must be enabled for each cluster:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"pods"})," - ",(0,i.jsx)(n.code,{children:"get"}),", ",(0,i.jsx)(n.code,{children:"list"})]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"pods/exec"})," - ",(0,i.jsx)(n.code,{children:"create"}),", ",(0,i.jsx)(n.code,{children:"get"})]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"rbac-clusterrole-and-clusterrolebinding",children:"RBAC ClusterRole and ClusterRoleBinding"}),"\n",(0,i.jsx)(n.p,{children:"We recommend adding the following ClusterRole and ClusterRoleBinding to your cluster\u2019s RBAC configuration with the permissions listed above."}),"\n",(0,i.jsxs)(n.p,{children:["For instructions on managing role maps, refer to ",(0,i.jsx)(n.a,{href:"https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html",children:"this AWS guide"}),"."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cado-eks-cluster-role\nrules:\n- apiGroups: [""]\n resources: ["pods"]\n verbs: ["get", "list"]\n- apiGroups: [""]\n resources: ["pods/exec"]\n verbs: ["create", "get"]\n'})}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cado-eks-cluster-role-binding\nsubjects:\n- kind: Group\n name: cado\n apiGroup: rbac.authorization.k8s.io\nroleRef:\n kind: ClusterRole\n name: cado-eks-cluster-role\n apiGroup: rbac.authorization.k8s.io\n"})}),"\n",(0,i.jsx)(n.h2,{id:"linking-aws-iam-to-your-cluster-rbac",children:"Linking AWS IAM to Your Cluster RBAC"}),"\n",(0,i.jsx)(n.admonition,{type:"info",children:(0,i.jsxs)(n.p,{children:["Use the role ARN added in the ",(0,i.jsx)(n.a,{href:"/cado/deploy/cross/cross-account-creation#step-2-add-target-aws-role-arn-to-the-cado-platform",children:"Cross Account Creation"})," that corresponds to the AWS Account ID where the cluster resides."]})}),"\n",(0,i.jsxs)(n.p,{children:["You need to add the appropriate Cado IAM role to your EKS RBAC configuration. Without this, you will encounter an error stating: ",(0,i.jsx)(n.code,{children:"This role is not configured to authorize with this EKS cluster"}),"."]}),"\n",(0,i.jsxs)(n.p,{children:["Refer to ",(0,i.jsx)(n.a,{href:"https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/",children:"this AWS guide"})," for instructions on adding your role to the EKS RBAC. If you have ",(0,i.jsx)(n.code,{children:"eksctl"})," configured, you can run the following command:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"eksctl create iamidentitymapping --cluster= --region= --arn= --group=\n"})}),"\n",(0,i.jsxs)(n.p,{children:["If you added the ClusterRole and ClusterRoleBindings as shown above, the group will be ",(0,i.jsx)(n.code,{children:"cado"}),":"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"eksctl create iamidentitymapping --cluster= --region= --arn= --group=cado\n"})}),"\n",(0,i.jsx)(n.p,{children:"Ensure the following IAM permissions are attached to your IAM role:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'\t"eks:ListClusters",\n\t"eks:DescribeCluster",\n'})}),"\n",(0,i.jsx)(n.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,i.jsx)(n.p,{children:"Below is a diagram illustrating how EKS acquisitions operate:"}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"EKS Data Flow",src:s(19733).A+"",width:"1858",height:"1108"})})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},19733:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/eks-collection-bea8d7a273645ff8b0db0648f377f4df.png"},74679:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/eks-options-c8ae61eb3df024a44ad4155fdcc299b3.png"},21930:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/eks2-61bad122854ee7bda7589ab4d9c32e68.png"},60787:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},43913:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/import-cloud-focus-2430bd09657ad2f5e88391377ba1dc53.png"},28453:(e,n,s)=>{s.d(n,{R:()=>t,x:()=>a});var i=s(96540);const o={},r=i.createContext(o);function t(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:t(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/81f0cd88.cc1dc80b.js b/assets/js/81f0cd88.f1321618.js similarity index 99% rename from assets/js/81f0cd88.cc1dc80b.js rename to assets/js/81f0cd88.f1321618.js index fbe075fc3..baf984293 100644 --- a/assets/js/81f0cd88.cc1dc80b.js +++ b/assets/js/81f0cd88.f1321618.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9793],{17728:(n,e,i)=>{i.r(e),i.d(e,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>c,toc:()=>l});var t=i(74848),s=i(28453);const o={title:"Ping SAML",hide_title:!0,sidebar_position:4},r="How to Set Up the Ping SAML Integration",c={id:"cado/manage/users-authentication/sso/ping_saml",title:"Ping SAML",description:"If you encounter issues, please contact support@cadosecurity.com with detailed information about your configuration.",source:"@site/docs/cado/manage/users-authentication/sso/ping_saml.md",sourceDirName:"cado/manage/users-authentication/sso",slug:"/cado/manage/users-authentication/sso/ping_saml",permalink:"/cado/manage/users-authentication/sso/ping_saml",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/sso/ping_saml.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Ping SAML",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Okta SAML",permalink:"/cado/manage/users-authentication/sso/okta_saml"},next:{title:"Worker management",permalink:"/cado/manage/workers"}},d={},l=[{value:"Setting up Ping SSO",id:"setting-up-ping-sso",level:3}];function a(n){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...n.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"how-to-set-up-the-ping-saml-integration",children:"How to Set Up the Ping SAML Integration"}),"\n",(0,t.jsx)(e.admonition,{type:"warning",children:(0,t.jsxs)(e.p,{children:["If you encounter issues, please contact ",(0,t.jsx)(e.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," with detailed information about your configuration."]})}),"\n",(0,t.jsxs)(e.p,{children:["You can enable the Ping SAML Integration beta in the Cado platform by going to ",(0,t.jsx)(e.code,{children:"Settings > SSO > Ping SAML"}),"."]}),"\n",(0,t.jsx)(e.h3,{id:"setting-up-ping-sso",children:"Setting up Ping SSO"}),"\n",(0,t.jsxs)(e.ol,{children:["\n",(0,t.jsxs)(e.li,{children:["Open the Ping admin dashboard and navigate to ",(0,t.jsx)(e.code,{children:"Connections > Applications"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Name your application and select ",(0,t.jsx)(e.strong,{children:"SAML Application"})," as the application type."]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Configure Application"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Then click ",(0,t.jsx)(e.strong,{children:"Manually Enter"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Add an ACS URL, which is the URL you use to access Cado in the browser, followed by ",(0,t.jsx)(e.code,{children:"/api/v2/auth/saml/ping"}),". For example: ",(0,t.jsx)(e.code,{children:"https://my.cado.instance/api/v2/auth/saml/ping"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Add an Entity ID, typically the instance URL of your application (e.g., ",(0,t.jsx)(e.code,{children:"https://my.cado.instance"}),")."]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Save"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["(Optional) Choose who has access to the application:","\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["Go to ",(0,t.jsx)(e.code,{children:"Identities > Groups"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Add a new group (e.g., ",(0,t.jsx)(e.code,{children:"CadoAdmin"}),")."]}),"\n",(0,t.jsxs)(e.li,{children:["If you name a group ",(0,t.jsx)(e.code,{children:"CadoAdmin"}),", users in that group will be granted admin access in Cado."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(e.admonition,{type:"tip",children:(0,t.jsxs)(e.p,{children:["For non-admin users, create a group with a different name (e.g., ",(0,t.jsx)(e.code,{children:"CadoNonAdmin"}),"). Users in this group will have Normal User access in Cado."]})}),"\n",(0,t.jsxs)(e.ol,{start:"9",children:["\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Go back to the application you created and click ",(0,t.jsx)(e.strong,{children:"Attribute Mappings"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Add an email attribute:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"Attributes"})," field, enter ",(0,t.jsx)(e.code,{children:"emailAttrStatement"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"PingOne Mappings"})," field, select ",(0,t.jsx)(e.strong,{children:"Email Address"}),"."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Add a Group attribute:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"Attributes"})," field, enter ",(0,t.jsx)(e.code,{children:"groupAttrStatement"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"PingOne Mappings"})," field, select ",(0,t.jsx)(e.strong,{children:"Group Names"}),"."]}),"\n"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Ping Attribute Statement",src:i(68374).A+"",width:"935",height:"279"})}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.strong,{children:"Save"})," after configuring the attributes."]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Configure SSO in Cado:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsx)(e.li,{children:"Log in to your Cado instance as an admin."}),"\n",(0,t.jsxs)(e.li,{children:["Go to ",(0,t.jsx)(e.code,{children:"Settings > SSO > Ping SAML"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Enabled"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Fill in the fields as follows:","\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["Enter the ",(0,t.jsx)(e.code,{children:"Issuer ID"})," from the Ping application ",(0,t.jsx)(e.strong,{children:"Configuration"})," tab into the ",(0,t.jsx)(e.code,{children:"Ping SAML App IdP entity ID"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the ",(0,t.jsx)(e.code,{children:"Single Signon Service"})," value from the ",(0,t.jsx)(e.strong,{children:"Configuration"})," tab into the ",(0,t.jsx)(e.code,{children:"Ping SAML App IdP SSO URL"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Download the signing certificate and enter the text between ",(0,t.jsx)(e.code,{children:"-----BEGIN CERTIFICATE-----"})," and ",(0,t.jsx)(e.code,{children:"-----END CERTIFICATE-----"})," into the ",(0,t.jsx)(e.code,{children:"Ping SAML App x509 Cert"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact URL you provided in step 6 into the ",(0,t.jsx)(e.code,{children:"Ping SAML App SP entity ID"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact URL from step 5 into the ",(0,t.jsx)(e.code,{children:"Ping SAML App SP ACS URL"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the admin group name from step 8 into the ",(0,t.jsx)(e.code,{children:"Admin Group Name"})," field."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["(Optional) Test the configuration by clicking ",(0,t.jsx)(e.strong,{children:"Test new settings"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.strong,{children:"Update"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Log out and log back in using Ping SAML."}),"\n"]}),"\n"]})]})}function h(n={}){const{wrapper:e}={...(0,s.R)(),...n.components};return e?(0,t.jsx)(e,{...n,children:(0,t.jsx)(a,{...n})}):a(n)}},68374:(n,e,i)=>{i.d(e,{A:()=>t});const t=i.p+"assets/images/ping-attribute-statement-62c7ddc0f711cb0904db75b7c9e94f75.png"},28453:(n,e,i)=>{i.d(e,{R:()=>r,x:()=>c});var t=i(96540);const s={},o=t.createContext(s);function r(n){const e=t.useContext(o);return t.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function c(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(s):n.components||s:r(n.components),t.createElement(o.Provider,{value:e},n.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9793],{17728:(n,e,i)=>{i.r(e),i.d(e,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>c,toc:()=>l});var t=i(74848),s=i(28453);const o={title:"Ping SAML",hide_title:!0,sidebar_position:4},r="How to Set Up the Ping SAML Integration",c={id:"cado/manage/users-authentication/sso/ping_saml",title:"Ping SAML",description:"If you encounter issues, please contact support@cadosecurity.com with detailed information about your configuration.",source:"@site/docs/cado/manage/users-authentication/sso/ping_saml.md",sourceDirName:"cado/manage/users-authentication/sso",slug:"/cado/manage/users-authentication/sso/ping_saml",permalink:"/cado/manage/users-authentication/sso/ping_saml",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/sso/ping_saml.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Ping SAML",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Okta SAML",permalink:"/cado/manage/users-authentication/sso/okta_saml"},next:{title:"Worker management",permalink:"/cado/manage/workers"}},d={},l=[{value:"Setting up Ping SSO",id:"setting-up-ping-sso",level:3}];function a(n){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...n.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"how-to-set-up-the-ping-saml-integration",children:"How to Set Up the Ping SAML Integration"}),"\n",(0,t.jsx)(e.admonition,{type:"warning",children:(0,t.jsxs)(e.p,{children:["If you encounter issues, please contact ",(0,t.jsx)(e.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," with detailed information about your configuration."]})}),"\n",(0,t.jsxs)(e.p,{children:["You can enable the Ping SAML Integration beta in the Cado platform by going to ",(0,t.jsx)(e.code,{children:"Settings > SSO > Ping SAML"}),"."]}),"\n",(0,t.jsx)(e.h3,{id:"setting-up-ping-sso",children:"Setting up Ping SSO"}),"\n",(0,t.jsxs)(e.ol,{children:["\n",(0,t.jsxs)(e.li,{children:["Open the Ping admin dashboard and navigate to ",(0,t.jsx)(e.code,{children:"Connections > Applications"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Name your application and select ",(0,t.jsx)(e.strong,{children:"SAML Application"})," as the application type."]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Configure Application"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Then click ",(0,t.jsx)(e.strong,{children:"Manually Enter"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Add an ACS URL, which is the URL you use to access Cado in the browser, followed by ",(0,t.jsx)(e.code,{children:"/api/v2/auth/saml/ping"}),". For example: ",(0,t.jsx)(e.code,{children:"https://my.cado.instance/api/v2/auth/saml/ping"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Add an Entity ID, typically the instance URL of your application (e.g., ",(0,t.jsx)(e.code,{children:"https://my.cado.instance"}),")."]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Save"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["(Optional) Choose who has access to the application:","\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["Go to ",(0,t.jsx)(e.code,{children:"Identities > Groups"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Add a new group (e.g., ",(0,t.jsx)(e.code,{children:"CadoAdmin"}),")."]}),"\n",(0,t.jsxs)(e.li,{children:["If you name a group ",(0,t.jsx)(e.code,{children:"CadoAdmin"}),", users in that group will be granted admin access in Cado."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(e.admonition,{type:"tip",children:(0,t.jsxs)(e.p,{children:["For non-admin users, create a group with a different name (e.g., ",(0,t.jsx)(e.code,{children:"CadoNonAdmin"}),"). Users in this group will have Normal User access in Cado."]})}),"\n",(0,t.jsxs)(e.ol,{start:"9",children:["\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Go back to the application you created and click ",(0,t.jsx)(e.strong,{children:"Attribute Mappings"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Add an email attribute:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"Attributes"})," field, enter ",(0,t.jsx)(e.code,{children:"emailAttrStatement"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"PingOne Mappings"})," field, select ",(0,t.jsx)(e.strong,{children:"Email Address"}),"."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Add a Group attribute:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"Attributes"})," field, enter ",(0,t.jsx)(e.code,{children:"groupAttrStatement"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"PingOne Mappings"})," field, select ",(0,t.jsx)(e.strong,{children:"Group Names"}),"."]}),"\n"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Ping Attribute Statement",src:i(68374).A+"",width:"935",height:"279"})}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.strong,{children:"Save"})," after configuring the attributes."]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Configure SSO in Cado:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsx)(e.li,{children:"Log in to your Cado instance as an admin."}),"\n",(0,t.jsxs)(e.li,{children:["Go to ",(0,t.jsx)(e.code,{children:"Settings > SSO > Ping SAML"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Enabled"}),"."]}),"\n",(0,t.jsxs)(e.li,{children:["Fill in the fields as follows:","\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["Enter the ",(0,t.jsx)(e.code,{children:"Issuer ID"})," from the Ping application ",(0,t.jsx)(e.strong,{children:"Configuration"})," tab into the ",(0,t.jsx)(e.code,{children:"Ping SAML App IdP entity ID"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the ",(0,t.jsx)(e.code,{children:"Single Signon Service"})," value from the ",(0,t.jsx)(e.strong,{children:"Configuration"})," tab into the ",(0,t.jsx)(e.code,{children:"Ping SAML App IdP SSO URL"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Download the signing certificate and enter the text between ",(0,t.jsx)(e.code,{children:"-----BEGIN CERTIFICATE-----"})," and ",(0,t.jsx)(e.code,{children:"-----END CERTIFICATE-----"})," into the ",(0,t.jsx)(e.code,{children:"Ping SAML App x509 Cert"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact URL you provided in step 6 into the ",(0,t.jsx)(e.code,{children:"Ping SAML App SP entity ID"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact URL from step 5 into the ",(0,t.jsx)(e.code,{children:"Ping SAML App SP ACS URL"})," field."]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the admin group name from step 8 into the ",(0,t.jsx)(e.code,{children:"Admin Group Name"})," field."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["(Optional) Test the configuration by clicking ",(0,t.jsx)(e.strong,{children:"Test new settings"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.strong,{children:"Update"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Log out and log back in using Ping SAML."}),"\n"]}),"\n"]})]})}function h(n={}){const{wrapper:e}={...(0,s.R)(),...n.components};return e?(0,t.jsx)(e,{...n,children:(0,t.jsx)(a,{...n})}):a(n)}},68374:(n,e,i)=>{i.d(e,{A:()=>t});const t=i.p+"assets/images/ping-attribute-statement-62c7ddc0f711cb0904db75b7c9e94f75.png"},28453:(n,e,i)=>{i.d(e,{R:()=>r,x:()=>c});var t=i(96540);const s={},o=t.createContext(s);function r(n){const e=t.useContext(o);return t.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function c(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(s):n.components||s:r(n.components),t.createElement(o.Provider,{value:e},n.children)}}}]); \ No newline at end of file diff --git a/assets/js/8278bf4b.20884d82.js b/assets/js/8278bf4b.abfe97f9.js similarity index 97% rename from assets/js/8278bf4b.20884d82.js rename to assets/js/8278bf4b.abfe97f9.js index 9c61e906b..721a5ecbc 100644 --- a/assets/js/8278bf4b.20884d82.js +++ b/assets/js/8278bf4b.abfe97f9.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6750],{83701:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>i,default:()=>p,frontMatter:()=>n,metadata:()=>c,toc:()=>l});var s=t(74848),r=t(28453);const n={title:"Google Cloud Storage",hide_title:!0,sidebar_position:2},i="How to Import from Google Cloud Storage",c={id:"cado/discovery-import/gcp/storage",title:"Google Cloud Storage",description:"The Cado platform supports the acquisition of data from Google Cloud Platform (GCP) Storage Buckets. The two main use cases for this are:",source:"@site/docs/cado/discovery-import/gcp/storage.md",sourceDirName:"cado/discovery-import/gcp",slug:"/cado/discovery-import/gcp/storage",permalink:"/cado/discovery-import/gcp/storage",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/gcp/storage.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Google Cloud Storage",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Google Compute Engine",permalink:"/cado/discovery-import/gcp/engine-instance"},next:{title:"Google Cloud Kubernetes Engine",permalink:"/cado/discovery-import/gcp/kubernetes-engine"}},a={},l=[{value:"Steps to Import Data",id:"steps-to-import-data",level:3},{value:"Uploading On-Premise Evidence to GCP Storage for Import",id:"uploading-on-premise-evidence-to-gcp-storage-for-import",level:2}];function d(e){const o={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(o.h1,{id:"how-to-import-from-google-cloud-storage",children:"How to Import from Google Cloud Storage"}),"\n",(0,s.jsx)(o.p,{children:"The Cado platform supports the acquisition of data from Google Cloud Platform (GCP) Storage Buckets. The two main use cases for this are:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Analyzing disk images or zip files"})," uploaded to a GCP Storage Bucket as part of an investigation."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Analyzing the contents of a GCP Storage Bucket"})," for any uploaded content that could be related to an incident."]}),"\n"]}),"\n",(0,s.jsx)(o.h3,{id:"steps-to-import-data",children:"Steps to Import Data"}),"\n",(0,s.jsxs)(o.ol,{children:["\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.strong,{children:"Select the Investigation"}),": Choose the investigation you are working on."]}),"\n"]}),"\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.strong,{children:"Select the Bucket"}),": Choose the GCP Storage Bucket you wish to analyze."]}),"\n"]}),"\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.strong,{children:"Select Objects to Import"}),": Select the specific files or objects from the bucket to import into Cado."]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Import GCP Storage",src:t(15656).A+"",width:"1796",height:"758"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(o.h2,{id:"uploading-on-premise-evidence-to-gcp-storage-for-import",children:"Uploading On-Premise Evidence to GCP Storage for Import"}),"\n",(0,s.jsx)(o.p,{children:"You can upload data to GCP Storage using the following methods:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"GCP Console"}),": If you have access to the ",(0,s.jsx)(o.a,{href:"https://console.cloud.google.com/",children:"GCP Console"}),", you can upload data directly from your web browser."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Desktop GUI Tools"}),": Alternatively, you can use a tool like ",(0,s.jsx)(o.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," with ",(0,s.jsx)(o.a,{href:"https://docs.duck.sh/protocols/googlecloudstorage/",children:"oAuth 2.0 Access"})," to upload files from your desktop. Cyberduck supports features such as resuming failed uploads."]}),"\n"]}),"\n",(0,s.jsxs)(o.p,{children:["We recommend scoping access by assigning the associated role ",(0,s.jsx)(o.strong,{children:(0,s.jsx)(o.a,{href:"https://stackoverflow.com/questions/57147765/gcp-write-only-access-to-bucket-gcs",children:"write-only"})})," permissions for enhanced security."]}),"\n",(0,s.jsx)(o.h1,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"GCS Import",src:t(20370).A+"",width:"960",height:"540"})})]})}function p(e={}){const{wrapper:o}={...(0,r.R)(),...e.components};return o?(0,s.jsx)(o,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},20370:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gcs_import-b5028366bc7b1c444c99d6509016f4ef.png"},15656:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/google-cloud-storage-4e82160612df4ceacb5b5934df3de5ba.png"},28453:(e,o,t)=>{t.d(o,{R:()=>i,x:()=>c});var s=t(96540);const r={},n=s.createContext(r);function i(e){const o=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),s.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6750],{83701:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>i,default:()=>p,frontMatter:()=>n,metadata:()=>c,toc:()=>l});var s=t(74848),r=t(28453);const n={title:"Google Cloud Storage",hide_title:!0,sidebar_position:2},i="How to Import from Google Cloud Storage",c={id:"cado/discovery-import/gcp/storage",title:"Google Cloud Storage",description:"The Cado platform supports the acquisition of data from Google Cloud Platform (GCP) Storage Buckets. The two main use cases for this are:",source:"@site/docs/cado/discovery-import/gcp/storage.md",sourceDirName:"cado/discovery-import/gcp",slug:"/cado/discovery-import/gcp/storage",permalink:"/cado/discovery-import/gcp/storage",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/gcp/storage.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Google Cloud Storage",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Google Compute Engine",permalink:"/cado/discovery-import/gcp/engine-instance"},next:{title:"Google Cloud Kubernetes Engine",permalink:"/cado/discovery-import/gcp/kubernetes-engine"}},a={},l=[{value:"Steps to Import Data",id:"steps-to-import-data",level:3},{value:"Uploading On-Premise Evidence to GCP Storage for Import",id:"uploading-on-premise-evidence-to-gcp-storage-for-import",level:2}];function d(e){const o={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(o.h1,{id:"how-to-import-from-google-cloud-storage",children:"How to Import from Google Cloud Storage"}),"\n",(0,s.jsx)(o.p,{children:"The Cado platform supports the acquisition of data from Google Cloud Platform (GCP) Storage Buckets. The two main use cases for this are:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Analyzing disk images or zip files"})," uploaded to a GCP Storage Bucket as part of an investigation."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Analyzing the contents of a GCP Storage Bucket"})," for any uploaded content that could be related to an incident."]}),"\n"]}),"\n",(0,s.jsx)(o.h3,{id:"steps-to-import-data",children:"Steps to Import Data"}),"\n",(0,s.jsxs)(o.ol,{children:["\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.strong,{children:"Select the Investigation"}),": Choose the investigation you are working on."]}),"\n"]}),"\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.strong,{children:"Select the Bucket"}),": Choose the GCP Storage Bucket you wish to analyze."]}),"\n"]}),"\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.strong,{children:"Select Objects to Import"}),": Select the specific files or objects from the bucket to import into Cado."]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Import GCP Storage",src:t(15656).A+"",width:"1796",height:"758"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(o.h2,{id:"uploading-on-premise-evidence-to-gcp-storage-for-import",children:"Uploading On-Premise Evidence to GCP Storage for Import"}),"\n",(0,s.jsx)(o.p,{children:"You can upload data to GCP Storage using the following methods:"}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"GCP Console"}),": If you have access to the ",(0,s.jsx)(o.a,{href:"https://console.cloud.google.com/",children:"GCP Console"}),", you can upload data directly from your web browser."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Desktop GUI Tools"}),": Alternatively, you can use a tool like ",(0,s.jsx)(o.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," with ",(0,s.jsx)(o.a,{href:"https://docs.duck.sh/protocols/googlecloudstorage/",children:"oAuth 2.0 Access"})," to upload files from your desktop. Cyberduck supports features such as resuming failed uploads."]}),"\n"]}),"\n",(0,s.jsxs)(o.p,{children:["We recommend scoping access by assigning the associated role ",(0,s.jsx)(o.strong,{children:(0,s.jsx)(o.a,{href:"https://stackoverflow.com/questions/57147765/gcp-write-only-access-to-bucket-gcs",children:"write-only"})})," permissions for enhanced security."]}),"\n",(0,s.jsx)(o.h1,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"GCS Import",src:t(20370).A+"",width:"960",height:"540"})})]})}function p(e={}){const{wrapper:o}={...(0,r.R)(),...e.components};return o?(0,s.jsx)(o,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},20370:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gcs_import-b5028366bc7b1c444c99d6509016f4ef.png"},15656:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/google-cloud-storage-4e82160612df4ceacb5b5934df3de5ba.png"},28453:(e,o,t)=>{t.d(o,{R:()=>i,x:()=>c});var s=t(96540);const r={},n=s.createContext(r);function i(e){const o=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),s.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/82887747.32692129.js b/assets/js/82887747.dda4fca9.js similarity index 97% rename from assets/js/82887747.32692129.js rename to assets/js/82887747.dda4fca9.js index 1733e645a..aa15b6d1d 100644 --- a/assets/js/82887747.32692129.js +++ b/assets/js/82887747.dda4fca9.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5140],{19725:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>s,contentTitle:()=>c,default:()=>u,frontMatter:()=>a,metadata:()=>i,toc:()=>d});var n=o(74848),r=o(28453);const a={title:"Platform Encryption in GCP",hide_title:!0,sidebar_position:5},c="What encryption does the Cado platform use in GCP?",i={id:"cado/deploy/gcp/data-encryption-overview",title:"Platform Encryption in GCP",description:"The Cloud Storage Bucket is configured to encrypt data at rest using GCP KMS and if using Cado Host to upload triage captures.",source:"@site/docs/cado/deploy/gcp/data-encryption-overview.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/data-encryption-overview",permalink:"/cado/deploy/gcp/data-encryption-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/data-encryption-overview.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"Platform Encryption in GCP",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Automated Setup of GCP for data collection",permalink:"/cado/deploy/gcp/gcp-auto-setup"},next:{title:"Cross-Project setup",permalink:"/cado/deploy/gcp/gcp-cross-project"}},s={},d=[];function p(t){const e={a:"a",h1:"h1",p:"p",...(0,r.R)(),...t.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{id:"what-encryption-does-the-cado-platform-use-in-gcp",children:"What encryption does the Cado platform use in GCP?"}),"\n",(0,n.jsxs)(e.p,{children:["The Cloud Storage Bucket is configured to encrypt data at rest using ",(0,n.jsx)(e.a,{href:"https://cloud.google.com/security/products/security-key-management",children:"GCP KMS"})," and if using Cado Host to upload triage captures.\nData is then encrypted using TLS by the GCP API client.\nSecrets are stored using ",(0,n.jsx)(e.a,{href:"https://cloud.google.com/security/products/secret-manager",children:"Google Cloud Secrets Manager"}),"."]})]})}function u(t={}){const{wrapper:e}={...(0,r.R)(),...t.components};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(p,{...t})}):p(t)}},28453:(t,e,o)=>{o.d(e,{R:()=>c,x:()=>i});var n=o(96540);const r={},a=n.createContext(r);function c(t){const e=n.useContext(a);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function i(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(r):t.components||r:c(t.components),n.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5140],{19725:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>s,contentTitle:()=>c,default:()=>u,frontMatter:()=>a,metadata:()=>i,toc:()=>d});var n=o(74848),r=o(28453);const a={title:"Platform Encryption in GCP",hide_title:!0,sidebar_position:5},c="What encryption does the Cado platform use in GCP?",i={id:"cado/deploy/gcp/data-encryption-overview",title:"Platform Encryption in GCP",description:"The Cloud Storage Bucket is configured to encrypt data at rest using GCP KMS and if using Cado Host to upload triage captures.",source:"@site/docs/cado/deploy/gcp/data-encryption-overview.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/data-encryption-overview",permalink:"/cado/deploy/gcp/data-encryption-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/data-encryption-overview.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"Platform Encryption in GCP",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Automated Setup of GCP for data collection",permalink:"/cado/deploy/gcp/gcp-auto-setup"},next:{title:"Cross-Project setup",permalink:"/cado/deploy/gcp/gcp-cross-project"}},s={},d=[];function p(t){const e={a:"a",h1:"h1",p:"p",...(0,r.R)(),...t.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{id:"what-encryption-does-the-cado-platform-use-in-gcp",children:"What encryption does the Cado platform use in GCP?"}),"\n",(0,n.jsxs)(e.p,{children:["The Cloud Storage Bucket is configured to encrypt data at rest using ",(0,n.jsx)(e.a,{href:"https://cloud.google.com/security/products/security-key-management",children:"GCP KMS"})," and if using Cado Host to upload triage captures.\nData is then encrypted using TLS by the GCP API client.\nSecrets are stored using ",(0,n.jsx)(e.a,{href:"https://cloud.google.com/security/products/secret-manager",children:"Google Cloud Secrets Manager"}),"."]})]})}function u(t={}){const{wrapper:e}={...(0,r.R)(),...t.components};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(p,{...t})}):p(t)}},28453:(t,e,o)=>{o.d(e,{R:()=>c,x:()=>i});var n=o(96540);const r={},a=n.createContext(r);function c(t){const e=n.useContext(a);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function i(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(r):t.components||r:c(t.components),n.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/884420b0.ee96f51e.js b/assets/js/884420b0.1dbf31fb.js similarity index 95% rename from assets/js/884420b0.ee96f51e.js rename to assets/js/884420b0.1dbf31fb.js index 1a50ed4f4..56b82f062 100644 --- a/assets/js/884420b0.ee96f51e.js +++ b/assets/js/884420b0.1dbf31fb.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6119],{41073:(t,e,i)=>{i.r(e),i.d(e,{assets:()=>s,contentTitle:()=>n,default:()=>h,frontMatter:()=>c,metadata:()=>a,toc:()=>d});var o=i(74848),r=i(28453);const c={title:"Architecture in GCP",hide_title:!0,sidebar_position:8},n="What is the Cado architecture in GCP?",a={id:"cado/deploy/gcp/gcp-architecture",title:"Architecture in GCP",description:"You can deploy the Cado platform within your GCP cloud environment via a Terraform Script. When you deploy the platform, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes.",source:"@site/docs/cado/deploy/gcp/gcp-architecture.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-architecture",permalink:"/cado/deploy/gcp/gcp-architecture",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-architecture.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"Architecture in GCP",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"IAM permissions description",permalink:"/cado/deploy/gcp/iam-description"},next:{title:"NFS",permalink:"/cado/deploy/gcp/gcp-nfs"}},s={},d=[];function p(t){const e={h1:"h1",img:"img",p:"p",...(0,r.R)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{id:"what-is-the-cado-architecture-in-gcp",children:"What is the Cado architecture in GCP?"}),"\n",(0,o.jsx)(e.p,{children:"You can deploy the Cado platform within your GCP cloud environment via a Terraform Script. When you deploy the platform, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,o.jsxs)(e.p,{children:[(0,o.jsx)(e.img,{alt:"GCP Architecture",src:i(77067).A+"",width:"834",height:"443"}),"\nThis diagram is a simplified architecture, with options for alternate network access."]}),"\n",(0,o.jsx)(e.p,{children:"For a diagram of how cross-cloud imports from GCP into AWS work, please see below:"}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"GCP Imports",src:i(79266).A+"",width:"1982",height:"930"})})]})}function h(t={}){const{wrapper:e}={...(0,r.R)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(p,{...t})}):p(t)}},77067:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/gcp-architecture-a7e92d0bccf2491946eb52af9610745b.png"},79266:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/gcp-imports-72c2a49df0ee23aa7f846e6c131fab20.png"},28453:(t,e,i)=>{i.d(e,{R:()=>n,x:()=>a});var o=i(96540);const r={},c=o.createContext(r);function n(t){const e=o.useContext(c);return o.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function a(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(r):t.components||r:n(t.components),o.createElement(c.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6119],{41073:(t,e,i)=>{i.r(e),i.d(e,{assets:()=>s,contentTitle:()=>n,default:()=>h,frontMatter:()=>c,metadata:()=>a,toc:()=>d});var o=i(74848),r=i(28453);const c={title:"Architecture in GCP",hide_title:!0,sidebar_position:8},n="What is the Cado architecture in GCP?",a={id:"cado/deploy/gcp/gcp-architecture",title:"Architecture in GCP",description:"You can deploy the Cado platform within your GCP cloud environment via a Terraform Script. When you deploy the platform, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes.",source:"@site/docs/cado/deploy/gcp/gcp-architecture.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-architecture",permalink:"/cado/deploy/gcp/gcp-architecture",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-architecture.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"Architecture in GCP",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"IAM permissions description",permalink:"/cado/deploy/gcp/iam-description"},next:{title:"NFS",permalink:"/cado/deploy/gcp/gcp-nfs"}},s={},d=[];function p(t){const e={h1:"h1",img:"img",p:"p",...(0,r.R)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{id:"what-is-the-cado-architecture-in-gcp",children:"What is the Cado architecture in GCP?"}),"\n",(0,o.jsx)(e.p,{children:"You can deploy the Cado platform within your GCP cloud environment via a Terraform Script. When you deploy the platform, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,o.jsxs)(e.p,{children:[(0,o.jsx)(e.img,{alt:"GCP Architecture",src:i(77067).A+"",width:"834",height:"443"}),"\nThis diagram is a simplified architecture, with options for alternate network access."]}),"\n",(0,o.jsx)(e.p,{children:"For a diagram of how cross-cloud imports from GCP into AWS work, please see below:"}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"GCP Imports",src:i(79266).A+"",width:"1982",height:"930"})})]})}function h(t={}){const{wrapper:e}={...(0,r.R)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(p,{...t})}):p(t)}},77067:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/gcp-architecture-a7e92d0bccf2491946eb52af9610745b.png"},79266:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/gcp-imports-72c2a49df0ee23aa7f846e6c131fab20.png"},28453:(t,e,i)=>{i.d(e,{R:()=>n,x:()=>a});var o=i(96540);const r={},c=o.createContext(r);function n(t){const e=o.useContext(c);return o.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function a(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(r):t.components||r:n(t.components),o.createElement(c.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/8890cc05.5231ffc4.js b/assets/js/8890cc05.2893cd9d.js similarity index 97% rename from assets/js/8890cc05.5231ffc4.js rename to assets/js/8890cc05.2893cd9d.js index a05dc70f9..baec9466c 100644 --- a/assets/js/8890cc05.5231ffc4.js +++ b/assets/js/8890cc05.2893cd9d.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[555],{62017:(e,s,o)=>{o.r(s),o.d(s,{assets:()=>c,contentTitle:()=>n,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var t=o(74848),i=o(28453);const r={title:"S3",hide_title:!0,sidebar_position:2},n="How to Import Data from S3",a={id:"cado/discovery-import/aws/aws-s3",title:"S3",description:"The Cado platform supports acquiring data from AWS S3 buckets. The two primary use cases for S3 data acquisition are:",source:"@site/docs/cado/discovery-import/aws/aws-s3.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-s3",permalink:"/cado/discovery-import/aws/aws-s3",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-s3.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"S3",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"EC2 and EBS",permalink:"/cado/discovery-import/aws/aws-ec2"},next:{title:"AMI, EBS Snapshot and Volume",permalink:"/cado/discovery-import/aws/aws-ami"}},c={},d=[{value:"Steps to Import from S3",id:"steps-to-import-from-s3",level:3},{value:"Uploading On-Premise Evidence to S3 for Import",id:"uploading-on-premise-evidence-to-s3-for-import",level:2},{value:"Recommendations for Using Access Keys",id:"recommendations-for-using-access-keys",level:3},{value:"Using Cado Host for Upload",id:"using-cado-host-for-upload",level:3},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function l(e){const s={a:"a",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"how-to-import-data-from-s3",children:"How to Import Data from S3"}),"\n",(0,t.jsx)(s.p,{children:"The Cado platform supports acquiring data from AWS S3 buckets. The two primary use cases for S3 data acquisition are:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Analyzing disk images or zip files uploaded to an S3 bucket as part of an investigation."}),"\n",(0,t.jsx)(s.li,{children:"Analyzing the contents of an S3 bucket for any uploaded files that may be part of an incident."}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"steps-to-import-from-s3",children:"Steps to Import from S3"}),"\n",(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Select or Search for the S3 Bucket"}),(0,t.jsx)(s.br,{}),"\n","Choose the bucket you need, navigate through the objects, and select the files you want to import."]}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Click the ",(0,t.jsx)(s.strong,{children:"'Import objects'"})," button."]}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Confirm the Details"})," and click ",(0,t.jsx)(s.strong,{children:"Start Import"})," to begin the acquisition process."]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Import S3 Bucket",src:o(25459).A+"",width:"1792",height:"717"})}),"\n",(0,t.jsx)(s.h2,{id:"uploading-on-premise-evidence-to-s3-for-import",children:"Uploading On-Premise Evidence to S3 for Import"}),"\n",(0,t.jsxs)(s.p,{children:["If you have access to the AWS Console, you can upload data directly from your web browser. Alternatively, you can create an ",(0,t.jsx)(s.a,{href:"https://aws.amazon.com/blogs/security/wheres-my-secret-access-key/",children:"AWS Access and Secret Key"})," and use a desktop GUI tool like ",(0,t.jsx)(s.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," to upload files, with features like resuming failed uploads."]}),"\n",(0,t.jsx)(s.h3,{id:"recommendations-for-using-access-keys",children:"Recommendations for Using Access Keys"}),"\n",(0,t.jsx)(s.p,{children:"If you create access keys for uploading data to S3, we recommend the following:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Scope the access by giving the associated role ",(0,t.jsx)(s.strong,{children:"write-only"})," access to a single S3 bucket. For more details, see ",(0,t.jsx)(s.a,{href:"https://stackoverflow.com/questions/15076645/amazon-s3-write-only-access",children:"Write-Only Access"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Use ",(0,t.jsx)(s.strong,{children:"temporary credentials"})," when possible. Learn more about this in ",(0,t.jsx)(s.a,{href:"https://docs.cyberduck.io/protocols/s3/",children:"Cyberduck\u2019s S3 documentation"}),"."]}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"using-cado-host-for-upload",children:"Using Cado Host for Upload"}),"\n",(0,t.jsxs)(s.p,{children:["If you don\u2019t have direct access to AWS, you can use Cado Host with the ",(0,t.jsx)(s.code,{children:"--single_file_unzipped"})," parameter. Cado will generate the necessary credentials when you go to ",(0,t.jsx)(s.strong,{children:"Import > Cado Host"}),"."]}),"\n",(0,t.jsx)(s.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,t.jsx)(s.p,{children:"The following diagram shows how S3 acquisitions work:"}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"S3 Data Flow",src:o(65558).A+"",width:"990",height:"918"})})]})}function h(e={}){const{wrapper:s}={...(0,i.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},25459:(e,s,o)=>{o.d(s,{A:()=>t});const t=o.p+"assets/images/aws-s3-c3bf146f7f2bb323a692f608e9adb13b.png"},65558:(e,s,o)=>{o.d(s,{A:()=>t});const t=o.p+"assets/images/s3-imports-1c26d86c49e1614c158b365ba386b5ba.png"},28453:(e,s,o)=>{o.d(s,{R:()=>n,x:()=>a});var t=o(96540);const i={},r=t.createContext(i);function n(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[555],{62017:(e,s,o)=>{o.r(s),o.d(s,{assets:()=>c,contentTitle:()=>n,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var t=o(74848),i=o(28453);const r={title:"S3",hide_title:!0,sidebar_position:2},n="How to Import Data from S3",a={id:"cado/discovery-import/aws/aws-s3",title:"S3",description:"The Cado platform supports acquiring data from AWS S3 buckets. The two primary use cases for S3 data acquisition are:",source:"@site/docs/cado/discovery-import/aws/aws-s3.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-s3",permalink:"/cado/discovery-import/aws/aws-s3",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-s3.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"S3",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"EC2 and EBS",permalink:"/cado/discovery-import/aws/aws-ec2"},next:{title:"AMI, EBS Snapshot and Volume",permalink:"/cado/discovery-import/aws/aws-ami"}},c={},d=[{value:"Steps to Import from S3",id:"steps-to-import-from-s3",level:3},{value:"Uploading On-Premise Evidence to S3 for Import",id:"uploading-on-premise-evidence-to-s3-for-import",level:2},{value:"Recommendations for Using Access Keys",id:"recommendations-for-using-access-keys",level:3},{value:"Using Cado Host for Upload",id:"using-cado-host-for-upload",level:3},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function l(e){const s={a:"a",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"how-to-import-data-from-s3",children:"How to Import Data from S3"}),"\n",(0,t.jsx)(s.p,{children:"The Cado platform supports acquiring data from AWS S3 buckets. The two primary use cases for S3 data acquisition are:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Analyzing disk images or zip files uploaded to an S3 bucket as part of an investigation."}),"\n",(0,t.jsx)(s.li,{children:"Analyzing the contents of an S3 bucket for any uploaded files that may be part of an incident."}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"steps-to-import-from-s3",children:"Steps to Import from S3"}),"\n",(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Select or Search for the S3 Bucket"}),(0,t.jsx)(s.br,{}),"\n","Choose the bucket you need, navigate through the objects, and select the files you want to import."]}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Click the ",(0,t.jsx)(s.strong,{children:"'Import objects'"})," button."]}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:[(0,t.jsx)(s.strong,{children:"Confirm the Details"})," and click ",(0,t.jsx)(s.strong,{children:"Start Import"})," to begin the acquisition process."]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Import S3 Bucket",src:o(25459).A+"",width:"1792",height:"717"})}),"\n",(0,t.jsx)(s.h2,{id:"uploading-on-premise-evidence-to-s3-for-import",children:"Uploading On-Premise Evidence to S3 for Import"}),"\n",(0,t.jsxs)(s.p,{children:["If you have access to the AWS Console, you can upload data directly from your web browser. Alternatively, you can create an ",(0,t.jsx)(s.a,{href:"https://aws.amazon.com/blogs/security/wheres-my-secret-access-key/",children:"AWS Access and Secret Key"})," and use a desktop GUI tool like ",(0,t.jsx)(s.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," to upload files, with features like resuming failed uploads."]}),"\n",(0,t.jsx)(s.h3,{id:"recommendations-for-using-access-keys",children:"Recommendations for Using Access Keys"}),"\n",(0,t.jsx)(s.p,{children:"If you create access keys for uploading data to S3, we recommend the following:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Scope the access by giving the associated role ",(0,t.jsx)(s.strong,{children:"write-only"})," access to a single S3 bucket. For more details, see ",(0,t.jsx)(s.a,{href:"https://stackoverflow.com/questions/15076645/amazon-s3-write-only-access",children:"Write-Only Access"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Use ",(0,t.jsx)(s.strong,{children:"temporary credentials"})," when possible. Learn more about this in ",(0,t.jsx)(s.a,{href:"https://docs.cyberduck.io/protocols/s3/",children:"Cyberduck\u2019s S3 documentation"}),"."]}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"using-cado-host-for-upload",children:"Using Cado Host for Upload"}),"\n",(0,t.jsxs)(s.p,{children:["If you don\u2019t have direct access to AWS, you can use Cado Host with the ",(0,t.jsx)(s.code,{children:"--single_file_unzipped"})," parameter. Cado will generate the necessary credentials when you go to ",(0,t.jsx)(s.strong,{children:"Import > Cado Host"}),"."]}),"\n",(0,t.jsx)(s.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,t.jsx)(s.p,{children:"The following diagram shows how S3 acquisitions work:"}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"S3 Data Flow",src:o(65558).A+"",width:"990",height:"918"})})]})}function h(e={}){const{wrapper:s}={...(0,i.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},25459:(e,s,o)=>{o.d(s,{A:()=>t});const t=o.p+"assets/images/aws-s3-c3bf146f7f2bb323a692f608e9adb13b.png"},65558:(e,s,o)=>{o.d(s,{A:()=>t});const t=o.p+"assets/images/s3-imports-1c26d86c49e1614c158b365ba386b5ba.png"},28453:(e,s,o)=>{o.d(s,{R:()=>n,x:()=>a});var t=o(96540);const i={},r=t.createContext(i);function n(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/88a5faba.01634176.js b/assets/js/88a5faba.14d816a0.js similarity index 95% rename from assets/js/88a5faba.01634176.js rename to assets/js/88a5faba.14d816a0.js index 6fa051863..c6f6b7860 100644 --- a/assets/js/88a5faba.01634176.js +++ b/assets/js/88a5faba.14d816a0.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2305],{21964:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>i,contentTitle:()=>c,default:()=>p,frontMatter:()=>a,metadata:()=>o,toc:()=>l});var r=n(74848),s=n(28453);const a={title:"Secret Manager",hide_title:!0,sidebar_position:10},c="Secret Manager",o={id:"cado/deploy/gcp/gcp-secret-manager",title:"Secret Manager",description:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in GCP Secret Manager.",source:"@site/docs/cado/deploy/gcp/gcp-secret-manager.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-secret-manager",permalink:"/cado/deploy/gcp/gcp-secret-manager",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-secret-manager.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:10,frontMatter:{title:"Secret Manager",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"NFS",permalink:"/cado/deploy/gcp/gcp-nfs"},next:{title:"Bucket",permalink:"/cado/deploy/gcp/gcp-bucket"}},i={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function d(e){const t={code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"secret-manager",children:"Secret Manager"}),"\n",(0,r.jsx)(t.p,{children:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in GCP Secret Manager."}),"\n",(0,r.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Ability to update IAM role"}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsx)(t.li,{children:"Add the necessary permissions by adding the following to your IAM Role:"}),"\n"]}),"\n",(0,r.jsx)(t.pre,{children:(0,r.jsx)(t.code,{className:"language-json",children:' "secretmanager.secrets.create"\n "secretmanager.versions.access"\n "secretmanager.versions.add"\n'})}),"\n",(0,r.jsxs)(t.ol,{start:"2",children:["\n",(0,r.jsxs)(t.li,{children:["Enable in the UI: ",(0,r.jsx)(t.strong,{children:"Settings"})," > ",(0,r.jsx)(t.strong,{children:"Advanced"})," > ",(0,r.jsx)(t.strong,{children:"Secret Management"})," > ",(0,r.jsx)(t.strong,{children:"Turn on Secrets Manager"})]}),"\n"]})]})}function p(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>c,x:()=>o});var r=n(96540);const s={},a=r.createContext(s);function c(e){const t=r.useContext(a);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),r.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2305],{21964:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>i,contentTitle:()=>c,default:()=>p,frontMatter:()=>a,metadata:()=>o,toc:()=>l});var r=n(74848),s=n(28453);const a={title:"Secret Manager",hide_title:!0,sidebar_position:10},c="Secret Manager",o={id:"cado/deploy/gcp/gcp-secret-manager",title:"Secret Manager",description:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in GCP Secret Manager.",source:"@site/docs/cado/deploy/gcp/gcp-secret-manager.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-secret-manager",permalink:"/cado/deploy/gcp/gcp-secret-manager",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-secret-manager.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:10,frontMatter:{title:"Secret Manager",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"NFS",permalink:"/cado/deploy/gcp/gcp-nfs"},next:{title:"Bucket",permalink:"/cado/deploy/gcp/gcp-bucket"}},i={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function d(e){const t={code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"secret-manager",children:"Secret Manager"}),"\n",(0,r.jsx)(t.p,{children:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in GCP Secret Manager."}),"\n",(0,r.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Ability to update IAM role"}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsx)(t.li,{children:"Add the necessary permissions by adding the following to your IAM Role:"}),"\n"]}),"\n",(0,r.jsx)(t.pre,{children:(0,r.jsx)(t.code,{className:"language-json",children:' "secretmanager.secrets.create"\n "secretmanager.versions.access"\n "secretmanager.versions.add"\n'})}),"\n",(0,r.jsxs)(t.ol,{start:"2",children:["\n",(0,r.jsxs)(t.li,{children:["Enable in the UI: ",(0,r.jsx)(t.strong,{children:"Settings"})," > ",(0,r.jsx)(t.strong,{children:"Advanced"})," > ",(0,r.jsx)(t.strong,{children:"Secret Management"})," > ",(0,r.jsx)(t.strong,{children:"Turn on Secrets Manager"})]}),"\n"]})]})}function p(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>c,x:()=>o});var r=n(96540);const s={},a=r.createContext(s);function c(e){const t=r.useContext(a);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),r.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/89389604.02a6cf32.js b/assets/js/89389604.49352fad.js similarity index 97% rename from assets/js/89389604.02a6cf32.js rename to assets/js/89389604.49352fad.js index 3362b7496..00aa8e4d2 100644 --- a/assets/js/89389604.02a6cf32.js +++ b/assets/js/89389604.49352fad.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1554],{75964:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>l,default:()=>p,frontMatter:()=>s,metadata:()=>a,toc:()=>r});var o=n(74848),i=n(28453);const s={title:"Get and apply a license",hide_title:!0,sidebar_position:7},l="How to get and apply a license",a={id:"cado/deploy/licenses",title:"Get and apply a license",description:"In order to use the Cado platform, you must upload a valid license.",source:"@site/docs/cado/deploy/licenses.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/licenses",permalink:"/cado/deploy/licenses",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/licenses.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"Get and apply a license",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Log in",permalink:"/cado/deploy/logging-in"},next:{title:"Ports and network encryption",permalink:"/cado/deploy/ports"}},c={},r=[];function d(e){const t={a:"a",h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"how-to-get-and-apply-a-license",children:"How to get and apply a license"}),"\n",(0,o.jsx)(t.p,{children:"In order to use the Cado platform, you must upload a valid license."}),"\n",(0,o.jsx)(t.p,{children:"If you have received a license file from your Sales representative, you can upload it by:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Logging into your Cado instance"}),"\n",(0,o.jsxs)(t.li,{children:["Navigate to ",(0,o.jsx)(t.strong,{children:"Settings"})]}),"\n",(0,o.jsxs)(t.li,{children:["Click the ",(0,o.jsx)(t.strong,{children:"License"})," tab"]}),"\n",(0,o.jsxs)(t.li,{children:["Click ",(0,o.jsx)(t.strong,{children:"Select file"}),", choose the new license file"]}),"\n",(0,o.jsxs)(t.li,{children:["Click ",(0,o.jsx)(t.strong,{children:"Upload"})]}),"\n"]}),"\n",(0,o.jsxs)(t.p,{children:["If you do not have a license, please contact ",(0,o.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})]}),"\n",(0,o.jsxs)(t.p,{children:["We also have a free edition of the Cado platform, ",(0,o.jsx)(t.a,{href:"/cado/community-intro",children:"Cado Community Edition"}),", which provides a community license."]})]})}function p(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>l,x:()=>a});var o=n(96540);const i={},s=o.createContext(i);function l(e){const t=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:l(e.components),o.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1554],{75964:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>l,default:()=>p,frontMatter:()=>s,metadata:()=>a,toc:()=>r});var o=n(74848),i=n(28453);const s={title:"Get and apply a license",hide_title:!0,sidebar_position:7},l="How to get and apply a license",a={id:"cado/deploy/licenses",title:"Get and apply a license",description:"In order to use the Cado platform, you must upload a valid license.",source:"@site/docs/cado/deploy/licenses.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/licenses",permalink:"/cado/deploy/licenses",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/licenses.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"Get and apply a license",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Log in",permalink:"/cado/deploy/logging-in"},next:{title:"Ports and network encryption",permalink:"/cado/deploy/ports"}},c={},r=[];function d(e){const t={a:"a",h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"how-to-get-and-apply-a-license",children:"How to get and apply a license"}),"\n",(0,o.jsx)(t.p,{children:"In order to use the Cado platform, you must upload a valid license."}),"\n",(0,o.jsx)(t.p,{children:"If you have received a license file from your Sales representative, you can upload it by:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Logging into your Cado instance"}),"\n",(0,o.jsxs)(t.li,{children:["Navigate to ",(0,o.jsx)(t.strong,{children:"Settings"})]}),"\n",(0,o.jsxs)(t.li,{children:["Click the ",(0,o.jsx)(t.strong,{children:"License"})," tab"]}),"\n",(0,o.jsxs)(t.li,{children:["Click ",(0,o.jsx)(t.strong,{children:"Select file"}),", choose the new license file"]}),"\n",(0,o.jsxs)(t.li,{children:["Click ",(0,o.jsx)(t.strong,{children:"Upload"})]}),"\n"]}),"\n",(0,o.jsxs)(t.p,{children:["If you do not have a license, please contact ",(0,o.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})]}),"\n",(0,o.jsxs)(t.p,{children:["We also have a free edition of the Cado platform, ",(0,o.jsx)(t.a,{href:"/cado/community-intro",children:"Cado Community Edition"}),", which provides a community license."]})]})}function p(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>l,x:()=>a});var o=n(96540);const i={},s=o.createContext(i);function l(e){const t=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:l(e.components),o.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/8a582a55.c6c7e551.js b/assets/js/8a582a55.3c5fa2ed.js similarity index 99% rename from assets/js/8a582a55.c6c7e551.js rename to assets/js/8a582a55.3c5fa2ed.js index 036b7077b..84e1e574b 100644 --- a/assets/js/8a582a55.c6c7e551.js +++ b/assets/js/8a582a55.3c5fa2ed.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[664],{23659:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>d,contentTitle:()=>a,default:()=>m,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var t=s(74848),i=s(28453);const o={},a="How to Tighten IAM Permissions for SSM in AWS",r={id:"cado/deploy/aws/iam/ssm",title:"How to Tighten IAM Permissions for SSM in AWS",description:"The Cado platform leverages AWS Systems Manager (SSM) to perform live captures of AWS EC2 systems. This provides a faster alternative to full disk acquisitions and allows the collection of process memory. Additionally, Cado uses SSM for executing commands on SSM-enabled systems during investigations. However, the default IAM permissions might be too broad for environments with stricter security requirements, as it grants the platform permission to execute any command on all SSM-enabled systems.",source:"@site/docs/cado/deploy/aws/iam/ssm.md",sourceDirName:"cado/deploy/aws/iam",slug:"/cado/deploy/aws/iam/ssm",permalink:"/cado/deploy/aws/iam/ssm",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/iam/ssm.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",frontMatter:{},sidebar:"tutorialSidebar",previous:{title:"Reduce KMS permissions",permalink:"/cado/deploy/aws/iam/tighten-kms"},next:{title:"Add a load balancer and HTTPS",permalink:"/cado/deploy/aws/networking/aws-load-balancer"}},d={},c=[{value:"Default Permissions",id:"default-permissions",level:2},{value:"Restricting SSM Permissions",id:"restricting-ssm-permissions",level:2},{value:"Example Policy with Tag Conditions",id:"example-policy-with-tag-conditions",level:3},{value:"Adding Tags to EC2 Instances",id:"adding-tags-to-ec2-instances",level:3},{value:"Error Handling",id:"error-handling",level:3}];function l(e){const n={code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",p:"p",pre:"pre",strong:"strong",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-tighten-iam-permissions-for-ssm-in-aws",children:"How to Tighten IAM Permissions for SSM in AWS"}),"\n",(0,t.jsx)(n.p,{children:"The Cado platform leverages AWS Systems Manager (SSM) to perform live captures of AWS EC2 systems. This provides a faster alternative to full disk acquisitions and allows the collection of process memory. Additionally, Cado uses SSM for executing commands on SSM-enabled systems during investigations. However, the default IAM permissions might be too broad for environments with stricter security requirements, as it grants the platform permission to execute any command on all SSM-enabled systems."}),"\n",(0,t.jsx)(n.h2,{id:"default-permissions",children:"Default Permissions"}),"\n",(0,t.jsx)(n.p,{children:"The default permissions grant wide access to execute commands on any EC2 instance:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "Sid": "RequiredForTriageAndRunCommand",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation",\n "ssm:StartSession",\n "ssm:TerminateSession"\n ],\n "Resource": [\n "arn:aws:ec2:*:*:instance/*",\n "arn:aws:ssm:*::document/AWS-RunShellScript",\n "arn:aws:ssm:*::document/AWS-RunPowerShellScript"\n ]\n}\n'})}),"\n",(0,t.jsx)(n.h2,{id:"restricting-ssm-permissions",children:"Restricting SSM Permissions"}),"\n",(0,t.jsxs)(n.p,{children:["To tighten these permissions, you can restrict SSM commands to only target specific EC2 instances by using ",(0,t.jsx)(n.strong,{children:"Tag Conditions"}),". This method ensures that only instances with a designated tag can be accessed via SSM."]}),"\n",(0,t.jsx)(n.h3,{id:"example-policy-with-tag-conditions",children:"Example Policy with Tag Conditions"}),"\n",(0,t.jsxs)(n.p,{children:["Here\u2019s an example IAM policy that limits SSM commands to EC2 instances tagged with ",(0,t.jsx)(n.code,{children:"CadoResponseSSMEnabled: True"}),":"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "Sid": "RequiredForTriageAndRunCommandTagged",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation",\n "ssm:StartSession",\n "ssm:TerminateSession"\n ],\n "Resource": [\n "arn:aws:ec2:*:*:instance/*"\n ],\n "Condition": {\n "StringLike": {\n "ssm:resourceTag/CadoResponseSSMEnabled": [\n "True"\n ]\n }\n }\n},\n{\n "Sid": "RequiredForTriageAndRunCommandRun",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation",\n "ssm:StartSession",\n "ssm:TerminateSession"\n ],\n "Resource": [\n "arn:aws:ssm:*::document/AWS-RunShellScript",\n "arn:aws:ssm:*::document/AWS-RunPowerShellScript"\n ]\n}\n'})}),"\n",(0,t.jsx)(n.h3,{id:"adding-tags-to-ec2-instances",children:"Adding Tags to EC2 Instances"}),"\n",(0,t.jsxs)(n.p,{children:["To implement this, add the tag ",(0,t.jsx)(n.code,{children:"CadoResponseSSMEnabled: True"})," to the EC2 instances you want to allow access via SSM. You can manage tags in the AWS Management Console:"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"IAM Tagging",src:s(21139).A+"",width:"1662",height:"822"})}),"\n",(0,t.jsx)(n.h3,{id:"error-handling",children:"Error Handling"}),"\n",(0,t.jsx)(n.p,{children:"If an EC2 instance you are trying to access via SSM does not have the required tag, you will encounter the following error:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{children:"An error occurred (AccessDeniedException) when calling the SendCommand operation: User: xxx is not authorized to perform: ssm:SendCommand on resource: i-xxx because no identity-based policy allows the ssm:SendCommand action.\n"})}),"\n",(0,t.jsxs)(n.p,{children:["This error indicates that the required tag (",(0,t.jsx)(n.code,{children:"CadoResponseSSMEnabled: True"}),") is missing from the instance."]})]})}function m(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},21139:(e,n,s)=>{s.d(n,{A:()=>t});const t=s.p+"assets/images/ssm_tag-dc33a08e7afa2c85a1ba6b9cb4c8492b.png"},28453:(e,n,s)=>{s.d(n,{R:()=>a,x:()=>r});var t=s(96540);const i={},o=t.createContext(i);function a(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[664],{23659:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>d,contentTitle:()=>a,default:()=>m,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var t=s(74848),i=s(28453);const o={},a="How to Tighten IAM Permissions for SSM in AWS",r={id:"cado/deploy/aws/iam/ssm",title:"How to Tighten IAM Permissions for SSM in AWS",description:"The Cado platform leverages AWS Systems Manager (SSM) to perform live captures of AWS EC2 systems. This provides a faster alternative to full disk acquisitions and allows the collection of process memory. Additionally, Cado uses SSM for executing commands on SSM-enabled systems during investigations. However, the default IAM permissions might be too broad for environments with stricter security requirements, as it grants the platform permission to execute any command on all SSM-enabled systems.",source:"@site/docs/cado/deploy/aws/iam/ssm.md",sourceDirName:"cado/deploy/aws/iam",slug:"/cado/deploy/aws/iam/ssm",permalink:"/cado/deploy/aws/iam/ssm",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/iam/ssm.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",frontMatter:{},sidebar:"tutorialSidebar",previous:{title:"Reduce KMS permissions",permalink:"/cado/deploy/aws/iam/tighten-kms"},next:{title:"Add a load balancer and HTTPS",permalink:"/cado/deploy/aws/networking/aws-load-balancer"}},d={},c=[{value:"Default Permissions",id:"default-permissions",level:2},{value:"Restricting SSM Permissions",id:"restricting-ssm-permissions",level:2},{value:"Example Policy with Tag Conditions",id:"example-policy-with-tag-conditions",level:3},{value:"Adding Tags to EC2 Instances",id:"adding-tags-to-ec2-instances",level:3},{value:"Error Handling",id:"error-handling",level:3}];function l(e){const n={code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",p:"p",pre:"pre",strong:"strong",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-tighten-iam-permissions-for-ssm-in-aws",children:"How to Tighten IAM Permissions for SSM in AWS"}),"\n",(0,t.jsx)(n.p,{children:"The Cado platform leverages AWS Systems Manager (SSM) to perform live captures of AWS EC2 systems. This provides a faster alternative to full disk acquisitions and allows the collection of process memory. Additionally, Cado uses SSM for executing commands on SSM-enabled systems during investigations. However, the default IAM permissions might be too broad for environments with stricter security requirements, as it grants the platform permission to execute any command on all SSM-enabled systems."}),"\n",(0,t.jsx)(n.h2,{id:"default-permissions",children:"Default Permissions"}),"\n",(0,t.jsx)(n.p,{children:"The default permissions grant wide access to execute commands on any EC2 instance:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "Sid": "RequiredForTriageAndRunCommand",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation",\n "ssm:StartSession",\n "ssm:TerminateSession"\n ],\n "Resource": [\n "arn:aws:ec2:*:*:instance/*",\n "arn:aws:ssm:*::document/AWS-RunShellScript",\n "arn:aws:ssm:*::document/AWS-RunPowerShellScript"\n ]\n}\n'})}),"\n",(0,t.jsx)(n.h2,{id:"restricting-ssm-permissions",children:"Restricting SSM Permissions"}),"\n",(0,t.jsxs)(n.p,{children:["To tighten these permissions, you can restrict SSM commands to only target specific EC2 instances by using ",(0,t.jsx)(n.strong,{children:"Tag Conditions"}),". This method ensures that only instances with a designated tag can be accessed via SSM."]}),"\n",(0,t.jsx)(n.h3,{id:"example-policy-with-tag-conditions",children:"Example Policy with Tag Conditions"}),"\n",(0,t.jsxs)(n.p,{children:["Here\u2019s an example IAM policy that limits SSM commands to EC2 instances tagged with ",(0,t.jsx)(n.code,{children:"CadoResponseSSMEnabled: True"}),":"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "Sid": "RequiredForTriageAndRunCommandTagged",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation",\n "ssm:StartSession",\n "ssm:TerminateSession"\n ],\n "Resource": [\n "arn:aws:ec2:*:*:instance/*"\n ],\n "Condition": {\n "StringLike": {\n "ssm:resourceTag/CadoResponseSSMEnabled": [\n "True"\n ]\n }\n }\n},\n{\n "Sid": "RequiredForTriageAndRunCommandRun",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation",\n "ssm:StartSession",\n "ssm:TerminateSession"\n ],\n "Resource": [\n "arn:aws:ssm:*::document/AWS-RunShellScript",\n "arn:aws:ssm:*::document/AWS-RunPowerShellScript"\n ]\n}\n'})}),"\n",(0,t.jsx)(n.h3,{id:"adding-tags-to-ec2-instances",children:"Adding Tags to EC2 Instances"}),"\n",(0,t.jsxs)(n.p,{children:["To implement this, add the tag ",(0,t.jsx)(n.code,{children:"CadoResponseSSMEnabled: True"})," to the EC2 instances you want to allow access via SSM. You can manage tags in the AWS Management Console:"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"IAM Tagging",src:s(21139).A+"",width:"1662",height:"822"})}),"\n",(0,t.jsx)(n.h3,{id:"error-handling",children:"Error Handling"}),"\n",(0,t.jsx)(n.p,{children:"If an EC2 instance you are trying to access via SSM does not have the required tag, you will encounter the following error:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{children:"An error occurred (AccessDeniedException) when calling the SendCommand operation: User: xxx is not authorized to perform: ssm:SendCommand on resource: i-xxx because no identity-based policy allows the ssm:SendCommand action.\n"})}),"\n",(0,t.jsxs)(n.p,{children:["This error indicates that the required tag (",(0,t.jsx)(n.code,{children:"CadoResponseSSMEnabled: True"}),") is missing from the instance."]})]})}function m(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},21139:(e,n,s)=>{s.d(n,{A:()=>t});const t=s.p+"assets/images/ssm_tag-dc33a08e7afa2c85a1ba6b9cb4c8492b.png"},28453:(e,n,s)=>{s.d(n,{R:()=>a,x:()=>r});var t=s(96540);const i={},o=t.createContext(i);function a(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/8cc61b5f.bbf0b1ea.js b/assets/js/8cc61b5f.992d447b.js similarity index 99% rename from assets/js/8cc61b5f.bbf0b1ea.js rename to assets/js/8cc61b5f.992d447b.js index db2e717cd..95b4cf395 100644 --- a/assets/js/8cc61b5f.bbf0b1ea.js +++ b/assets/js/8cc61b5f.992d447b.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7479],{8387:(n,e,t)=>{t.r(e),t.d(e,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>c});var s=t(74848),i=t(28453);const r={title:"Okta SAML",hide_title:!0,sidebar_position:3},a="How to Set Up the Okta SAML Integration",o={id:"cado/manage/users-authentication/sso/okta_saml",title:"Okta SAML",description:"If you encounter issues, please contact support@cadosecurity.com with a detailed description of your configuration.",source:"@site/docs/cado/manage/users-authentication/sso/okta_saml.md",sourceDirName:"cado/manage/users-authentication/sso",slug:"/cado/manage/users-authentication/sso/okta_saml",permalink:"/cado/manage/users-authentication/sso/okta_saml",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/sso/okta_saml.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Okta SAML",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Okta OAuth",permalink:"/cado/manage/users-authentication/sso/okta"},next:{title:"Ping SAML",permalink:"/cado/manage/users-authentication/sso/ping_saml"}},d={},c=[{value:"Setting up Okta SSO",id:"setting-up-okta-sso",level:3}];function l(n){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...n.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.h1,{id:"how-to-set-up-the-okta-saml-integration",children:"How to Set Up the Okta SAML Integration"}),"\n",(0,s.jsx)(e.admonition,{type:"warning",children:(0,s.jsxs)(e.p,{children:["If you encounter issues, please contact ",(0,s.jsx)(e.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," with a detailed description of your configuration."]})}),"\n",(0,s.jsxs)(e.p,{children:["You can enable the Okta SAML Integration beta in the Cado platform by navigating to ",(0,s.jsx)(e.code,{children:"Settings > SSO > Okta SAML"}),"."]}),"\n",(0,s.jsx)(e.h3,{id:"setting-up-okta-sso",children:"Setting up Okta SSO"}),"\n",(0,s.jsxs)(e.ol,{children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Open the Okta admin dashboard and go to ",(0,s.jsx)(e.code,{children:"Applications > Applications"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Create App Integration"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Select ",(0,s.jsx)(e.strong,{children:"SAML 2.0"})," and click ",(0,s.jsx)(e.strong,{children:"Next"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Name the Cado SAML app."}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Add a Single Sign-On URL. This should be the URL you use to access Cado in the browser, appended with ",(0,s.jsx)(e.code,{children:"/api/v2/auth/saml/okta"})," (e.g., ",(0,s.jsx)(e.a,{href:"https://my.cado.instance/api/v2/auth/saml/okta",children:"https://my.cado.instance/api/v2/auth/saml/okta"}),")."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Add an Audience URI (SP Entity ID), typically the instance URL (e.g., ",(0,s.jsx)(e.a,{href:"https://my.cado.instance",children:"https://my.cado.instance"}),")."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Add an Attribute Statement:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Name"}),": ",(0,s.jsx)(e.code,{children:"emailAttrStatement"})]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Name format"}),": ",(0,s.jsx)(e.strong,{children:"Unspecified"})]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Value"}),": ",(0,s.jsx)(e.strong,{children:"user.email"})]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Attribute Statement",src:t(26765).A+"",width:"857",height:"196"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Add a Group Attribute Statement:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Name"}),": ",(0,s.jsx)(e.code,{children:"groupAttrStatement"})]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Name format"}),": ",(0,s.jsx)(e.strong,{children:"Unspecified"})]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Filter"}),": Set to ",(0,s.jsx)(e.strong,{children:"Equals"})," and enter the name of your admin group (e.g., ",(0,s.jsx)(e.code,{children:"CadoAdmin"}),")."]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Group Attribute Statement",src:t(11919).A+"",width:"821",height:"194"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Next"}),", complete the feedback, and click ",(0,s.jsx)(e.strong,{children:"Finish"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"(Optional) Assign users to the app:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:["Go to the ",(0,s.jsx)(e.strong,{children:"Assignments"})," tab, select ",(0,s.jsx)(e.strong,{children:"Limit access to selected groups"}),", and add a user group."]}),"\n",(0,s.jsxs)(e.li,{children:["If you create a group named ",(0,s.jsx)(e.code,{children:"CadoAdmin"}),", users in that group will become Cado admin users."]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Assignments",src:t(66247).A+"",width:"725",height:"242"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(e.admonition,{type:"tip",children:(0,s.jsxs)(e.p,{children:["You can assign non-admin users by creating a group with a different name (e.g., ",(0,s.jsx)(e.code,{children:"CadoNonAdmin"}),"), and users in that group will be assigned as Normal Users in Cado."]})}),"\n",(0,s.jsxs)(e.ol,{start:"11",children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["In the ",(0,s.jsx)(e.strong,{children:"Sign On"})," tab, under ",(0,s.jsx)(e.strong,{children:"SAML Setup"}),", click ",(0,s.jsx)(e.strong,{children:"View SAML setup instructions"})," and keep the page open for reference."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Go to ",(0,s.jsx)(e.code,{children:"Customizations > Other > IFrame Embedding"})," and ensure this setting is enabled to allow access refresh."]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta IFrame Embedding",src:t(18709).A+"",width:"623",height:"264"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Configure SSO in Cado:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsx)(e.li,{children:"Log in to your Cado instance as an admin."}),"\n",(0,s.jsxs)(e.li,{children:["Navigate to ",(0,s.jsx)(e.code,{children:"Settings > SSO > Okta SAML"})," and click ",(0,s.jsx)(e.strong,{children:"Enabled"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Populate the fields using the information from the SAML setup instructions:","\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App IdP entity ID"}),": Enter the ",(0,s.jsx)(e.code,{children:"Identity Provider Issuer"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App IdP SSO URL"}),": Enter the ",(0,s.jsx)(e.code,{children:"Identity Provider Single Sign-On URL"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App x509 Cert"}),": Enter the ",(0,s.jsx)(e.code,{children:"X.509 Certificate"})," (text between ",(0,s.jsx)(e.code,{children:"-----BEGIN CERTIFICATE-----"})," and ",(0,s.jsx)(e.code,{children:"-----END CERTIFICATE-----"}),")."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App SP entity ID"}),": Enter the URL from step 6."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App SP ACS URL"}),": Enter the URL from step 5."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Admin Group Name"}),": Enter the admin group name from step 8."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["(Optional) Click ",(0,s.jsx)(e.strong,{children:"Test new settings"})," to verify the configuration."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Update"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Log out and log back in using Okta SAML."}),"\n"]}),"\n"]})]})}function h(n={}){const{wrapper:e}={...(0,i.R)(),...n.components};return e?(0,s.jsx)(e,{...n,children:(0,s.jsx)(l,{...n})}):l(n)}},66247:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-assignments-3b23b5eb60b1a663656d167431a6126c.png"},26765:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-attribute-statement-b94778a6027d51a31bffd5111af2dfa3.png"},11919:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-group-attribute-statement-90ee5bcdc3598a382d66cc49f725c8bf.png"},18709:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-iframe-embedding-c8e51df1d9547460ddc880d65b3fef53.png"},28453:(n,e,t)=>{t.d(e,{R:()=>a,x:()=>o});var s=t(96540);const i={},r=s.createContext(i);function a(n){const e=s.useContext(r);return s.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function o(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(i):n.components||i:a(n.components),s.createElement(r.Provider,{value:e},n.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7479],{8387:(n,e,t)=>{t.r(e),t.d(e,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>c});var s=t(74848),i=t(28453);const r={title:"Okta SAML",hide_title:!0,sidebar_position:3},a="How to Set Up the Okta SAML Integration",o={id:"cado/manage/users-authentication/sso/okta_saml",title:"Okta SAML",description:"If you encounter issues, please contact support@cadosecurity.com with a detailed description of your configuration.",source:"@site/docs/cado/manage/users-authentication/sso/okta_saml.md",sourceDirName:"cado/manage/users-authentication/sso",slug:"/cado/manage/users-authentication/sso/okta_saml",permalink:"/cado/manage/users-authentication/sso/okta_saml",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/sso/okta_saml.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Okta SAML",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Okta OAuth",permalink:"/cado/manage/users-authentication/sso/okta"},next:{title:"Ping SAML",permalink:"/cado/manage/users-authentication/sso/ping_saml"}},d={},c=[{value:"Setting up Okta SSO",id:"setting-up-okta-sso",level:3}];function l(n){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...n.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.h1,{id:"how-to-set-up-the-okta-saml-integration",children:"How to Set Up the Okta SAML Integration"}),"\n",(0,s.jsx)(e.admonition,{type:"warning",children:(0,s.jsxs)(e.p,{children:["If you encounter issues, please contact ",(0,s.jsx)(e.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," with a detailed description of your configuration."]})}),"\n",(0,s.jsxs)(e.p,{children:["You can enable the Okta SAML Integration beta in the Cado platform by navigating to ",(0,s.jsx)(e.code,{children:"Settings > SSO > Okta SAML"}),"."]}),"\n",(0,s.jsx)(e.h3,{id:"setting-up-okta-sso",children:"Setting up Okta SSO"}),"\n",(0,s.jsxs)(e.ol,{children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Open the Okta admin dashboard and go to ",(0,s.jsx)(e.code,{children:"Applications > Applications"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Create App Integration"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Select ",(0,s.jsx)(e.strong,{children:"SAML 2.0"})," and click ",(0,s.jsx)(e.strong,{children:"Next"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Name the Cado SAML app."}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Add a Single Sign-On URL. This should be the URL you use to access Cado in the browser, appended with ",(0,s.jsx)(e.code,{children:"/api/v2/auth/saml/okta"})," (e.g., ",(0,s.jsx)(e.a,{href:"https://my.cado.instance/api/v2/auth/saml/okta",children:"https://my.cado.instance/api/v2/auth/saml/okta"}),")."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Add an Audience URI (SP Entity ID), typically the instance URL (e.g., ",(0,s.jsx)(e.a,{href:"https://my.cado.instance",children:"https://my.cado.instance"}),")."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Add an Attribute Statement:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Name"}),": ",(0,s.jsx)(e.code,{children:"emailAttrStatement"})]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Name format"}),": ",(0,s.jsx)(e.strong,{children:"Unspecified"})]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Value"}),": ",(0,s.jsx)(e.strong,{children:"user.email"})]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Attribute Statement",src:t(26765).A+"",width:"857",height:"196"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Add a Group Attribute Statement:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Name"}),": ",(0,s.jsx)(e.code,{children:"groupAttrStatement"})]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Name format"}),": ",(0,s.jsx)(e.strong,{children:"Unspecified"})]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Filter"}),": Set to ",(0,s.jsx)(e.strong,{children:"Equals"})," and enter the name of your admin group (e.g., ",(0,s.jsx)(e.code,{children:"CadoAdmin"}),")."]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Group Attribute Statement",src:t(11919).A+"",width:"821",height:"194"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Next"}),", complete the feedback, and click ",(0,s.jsx)(e.strong,{children:"Finish"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"(Optional) Assign users to the app:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:["Go to the ",(0,s.jsx)(e.strong,{children:"Assignments"})," tab, select ",(0,s.jsx)(e.strong,{children:"Limit access to selected groups"}),", and add a user group."]}),"\n",(0,s.jsxs)(e.li,{children:["If you create a group named ",(0,s.jsx)(e.code,{children:"CadoAdmin"}),", users in that group will become Cado admin users."]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta Assignments",src:t(66247).A+"",width:"725",height:"242"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(e.admonition,{type:"tip",children:(0,s.jsxs)(e.p,{children:["You can assign non-admin users by creating a group with a different name (e.g., ",(0,s.jsx)(e.code,{children:"CadoNonAdmin"}),"), and users in that group will be assigned as Normal Users in Cado."]})}),"\n",(0,s.jsxs)(e.ol,{start:"11",children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["In the ",(0,s.jsx)(e.strong,{children:"Sign On"})," tab, under ",(0,s.jsx)(e.strong,{children:"SAML Setup"}),", click ",(0,s.jsx)(e.strong,{children:"View SAML setup instructions"})," and keep the page open for reference."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Go to ",(0,s.jsx)(e.code,{children:"Customizations > Other > IFrame Embedding"})," and ensure this setting is enabled to allow access refresh."]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Okta IFrame Embedding",src:t(18709).A+"",width:"623",height:"264"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Configure SSO in Cado:"}),"\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsx)(e.li,{children:"Log in to your Cado instance as an admin."}),"\n",(0,s.jsxs)(e.li,{children:["Navigate to ",(0,s.jsx)(e.code,{children:"Settings > SSO > Okta SAML"})," and click ",(0,s.jsx)(e.strong,{children:"Enabled"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:["Populate the fields using the information from the SAML setup instructions:","\n",(0,s.jsxs)(e.ul,{children:["\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App IdP entity ID"}),": Enter the ",(0,s.jsx)(e.code,{children:"Identity Provider Issuer"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App IdP SSO URL"}),": Enter the ",(0,s.jsx)(e.code,{children:"Identity Provider Single Sign-On URL"}),"."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App x509 Cert"}),": Enter the ",(0,s.jsx)(e.code,{children:"X.509 Certificate"})," (text between ",(0,s.jsx)(e.code,{children:"-----BEGIN CERTIFICATE-----"})," and ",(0,s.jsx)(e.code,{children:"-----END CERTIFICATE-----"}),")."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App SP entity ID"}),": Enter the URL from step 6."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Okta SAML App SP ACS URL"}),": Enter the URL from step 5."]}),"\n",(0,s.jsxs)(e.li,{children:[(0,s.jsx)(e.strong,{children:"Admin Group Name"}),": Enter the admin group name from step 8."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["(Optional) Click ",(0,s.jsx)(e.strong,{children:"Test new settings"})," to verify the configuration."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:["Click ",(0,s.jsx)(e.strong,{children:"Update"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsx)(e.p,{children:"Log out and log back in using Okta SAML."}),"\n"]}),"\n"]})]})}function h(n={}){const{wrapper:e}={...(0,i.R)(),...n.components};return e?(0,s.jsx)(e,{...n,children:(0,s.jsx)(l,{...n})}):l(n)}},66247:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-assignments-3b23b5eb60b1a663656d167431a6126c.png"},26765:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-attribute-statement-b94778a6027d51a31bffd5111af2dfa3.png"},11919:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-group-attribute-statement-90ee5bcdc3598a382d66cc49f725c8bf.png"},18709:(n,e,t)=>{t.d(e,{A:()=>s});const s=t.p+"assets/images/okta-iframe-embedding-c8e51df1d9547460ddc880d65b3fef53.png"},28453:(n,e,t)=>{t.d(e,{R:()=>a,x:()=>o});var s=t(96540);const i={},r=s.createContext(i);function a(n){const e=s.useContext(r);return s.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function o(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(i):n.components||i:a(n.components),s.createElement(r.Provider,{value:e},n.children)}}}]); \ No newline at end of file diff --git a/assets/js/8ea9f2a7.cd324627.js b/assets/js/8ea9f2a7.bb15be47.js similarity index 99% rename from assets/js/8ea9f2a7.cd324627.js rename to assets/js/8ea9f2a7.bb15be47.js index af5069d92..28ef611e2 100644 --- a/assets/js/8ea9f2a7.cd324627.js +++ b/assets/js/8ea9f2a7.bb15be47.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6480],{746:(e,a,o)=>{o.r(a),o.d(a,{assets:()=>l,contentTitle:()=>d,default:()=>h,frontMatter:()=>i,metadata:()=>r,toc:()=>s});var n=o(74848),t=o(28453);const i={title:"Add a load balancer and HTTPS",hide_title:!0,sidebar_position:1},d="How to add a Load Balancer and/or HTTPS to Cado",r={id:"cado/deploy/aws/networking/aws-load-balancer",title:"Add a load balancer and HTTPS",description:"Adding a valid SSL Certificate",source:"@site/docs/cado/deploy/aws/networking/aws-load-balancer.md",sourceDirName:"cado/deploy/aws/networking",slug:"/cado/deploy/aws/networking/aws-load-balancer",permalink:"/cado/deploy/aws/networking/aws-load-balancer",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/networking/aws-load-balancer.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Add a load balancer and HTTPS",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"How to Tighten IAM Permissions for SSM in AWS",permalink:"/cado/deploy/aws/iam/ssm"},next:{title:"Remove internet routable addresses",permalink:"/cado/deploy/aws/networking/internet-routable-addresses"}},l={},s=[{value:"Adding a valid SSL Certificate",id:"adding-a-valid-ssl-certificate",level:2},{value:"How to Add a Load Balancer in AWS",id:"how-to-add-a-load-balancer-in-aws",level:2},{value:"Get a SSL/TLS Certificate for your domain",id:"get-a-ssltls-certificate-for-your-domain",level:3},{value:"After Deploying the Load Balancer",id:"after-deploying-the-load-balancer",level:3},{value:"(Optional) Adding a Web Application Firewall to your Load Balancer",id:"optional-adding-a-web-application-firewall-to-your-load-balancer",level:3},{value:"Troubleshooting the Load Balancer",id:"troubleshooting-the-load-balancer",level:3}];function c(e){const a={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(a.h1,{id:"how-to-add-a-load-balancer-andor-https-to-cado",children:"How to add a Load Balancer and/or HTTPS to Cado"}),"\n",(0,n.jsx)(a.h2,{id:"adding-a-valid-ssl-certificate",children:"Adding a valid SSL Certificate"}),"\n",(0,n.jsxs)(a.p,{children:["The simplest option for adding a valid SSL certificate to Cado is to use a service such as ",(0,n.jsx)(a.a,{href:"https://www.cloudflare.com/",children:"Cloudflare"}),". This will provide a valid SSL certificate for your domain and allow you to access Cado over valid HTTPS."]}),"\n",(0,n.jsx)(a.p,{children:"Alternatively, you can use a load balancer in AWS to provide a valid SSL certificate. This is a more complex option but provides more control over the SSL certificate and can be used to add a Web Application Firewall."}),"\n",(0,n.jsx)(a.h2,{id:"how-to-add-a-load-balancer-in-aws",children:"How to Add a Load Balancer in AWS"}),"\n",(0,n.jsx)(a.p,{children:"An Application Load Balancer can be placed in front of the Cado web server in order to provide a valid HTTPS connection and add a Web Application Firewall. This can be configured via the pre-built Terraform or Cloudformation deployment scripts that include a Load Balancer."}),"\n",(0,n.jsxs)(a.p,{children:["Please see the ",(0,n.jsx)(a.a,{href:"/cado/deploy/aws/cloudformation",children:"AWS deployment overview"})," for more information on how to deploy Cado with a Load Balancer, in a private subnet. Connections between the Load Balancer and the Cado server will be over TLS."]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Load Balancer 1",src:o(83797).A+"",width:"960",height:"540"})}),"\n",(0,n.jsx)(a.h3,{id:"get-a-ssltls-certificate-for-your-domain",children:"Get a SSL/TLS Certificate for your domain"}),"\n",(0,n.jsxs)(a.p,{children:["In order to deploy with an ALB you will need to provide an ARN for an SSL/TLS certificate for a domain name you own. To do this you will need to visit the Amazon Certificate Manager. Click ",(0,n.jsx)(a.strong,{children:"Request"})," and follow the instructions."]}),"\n",(0,n.jsx)(a.h3,{id:"after-deploying-the-load-balancer",children:"After Deploying the Load Balancer"}),"\n",(0,n.jsxs)(a.p,{children:["Once the load balancer has been created, select the Load Balancer and open the domain name listed under DNS name e.g. ",(0,n.jsx)(a.code,{children:"https://cado-alb-test.us-east-1.elb.amazonaws.com/"})]}),"\n",(0,n.jsxs)(a.p,{children:["If you are using your own domain name, you will then need to point your custom domain name to this DNS name. For example, this is a typical record to point a domain you own (example: ",(0,n.jsx)(a.code,{children:"cado-alb.your-company.com"}),") to the ",(0,n.jsx)(a.code,{children:"*.amazonaws.com"})," DNS name of your Load Balancer:"]}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsxs)(a.li,{children:["Type: ",(0,n.jsx)(a.code,{children:"CNAME"})]}),"\n",(0,n.jsxs)(a.li,{children:["Name: ",(0,n.jsx)(a.code,{children:"cado-alb"})]}),"\n",(0,n.jsxs)(a.li,{children:["Target: ",(0,n.jsx)(a.code,{children:"cado-alb-test.us-east-1.elb.amazonaws.com"})]}),"\n"]}),"\n",(0,n.jsx)(a.p,{children:"You should then be able to visit the domain in your browser and login to Cado."}),"\n",(0,n.jsx)(a.h3,{id:"optional-adding-a-web-application-firewall-to-your-load-balancer",children:"(Optional) Adding a Web Application Firewall to your Load Balancer"}),"\n",(0,n.jsx)(a.p,{children:"You can also add a WAF by:"}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsxs)(a.li,{children:["Selecting your Load Balancer, then ",(0,n.jsx)(a.strong,{children:"Integrated Services"})," then ",(0,n.jsx)(a.strong,{children:"Create Web ACL"}),"."]}),"\n",(0,n.jsxs)(a.li,{children:["Under ",(0,n.jsx)(a.strong,{children:"Associated AWS resources"})," select your Load Balancer."]}),"\n",(0,n.jsxs)(a.li,{children:["Under ",(0,n.jsx)(a.strong,{children:"Add rules and rule groups"})," select the pre-built Firewall rules you want to enable."]}),"\n",(0,n.jsxs)(a.li,{children:["Click through to ",(0,n.jsx)(a.strong,{children:"Create Web ACL"})]}),"\n"]}),"\n",(0,n.jsx)(a.h3,{id:"troubleshooting-the-load-balancer",children:"Troubleshooting the Load Balancer"}),"\n",(0,n.jsx)(a.p,{children:"If your ALB shows a status as unhealthy, check that you have selected 443 (not 80) as the port and HTTPS (not HTTP) as the protocol in all instances."}),"\n",(0,n.jsxs)(a.p,{children:["If the Connection Times Out or you get the error \u201c504 Gateway Timeout\u201d, check that Security Group on both the load balancer and the Cado server allow traffic from Cado to the ALB to the User. Also select the Target Group, and check that under ",(0,n.jsx)(a.strong,{children:"Registered targets"})," the Instance is listed."]})]})}function h(e={}){const{wrapper:a}={...(0,t.R)(),...e.components};return a?(0,n.jsx)(a,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},83797:(e,a,o)=>{o.d(a,{A:()=>n});const n=o.p+"assets/images/aws-lb-1-a20e311eeab85a2a6b7d6395065eadde.png"},28453:(e,a,o)=>{o.d(a,{R:()=>d,x:()=>r});var n=o(96540);const t={},i=n.createContext(t);function d(e){const a=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function r(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:d(e.components),n.createElement(i.Provider,{value:a},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6480],{746:(e,a,o)=>{o.r(a),o.d(a,{assets:()=>l,contentTitle:()=>d,default:()=>h,frontMatter:()=>i,metadata:()=>r,toc:()=>s});var n=o(74848),t=o(28453);const i={title:"Add a load balancer and HTTPS",hide_title:!0,sidebar_position:1},d="How to add a Load Balancer and/or HTTPS to Cado",r={id:"cado/deploy/aws/networking/aws-load-balancer",title:"Add a load balancer and HTTPS",description:"Adding a valid SSL Certificate",source:"@site/docs/cado/deploy/aws/networking/aws-load-balancer.md",sourceDirName:"cado/deploy/aws/networking",slug:"/cado/deploy/aws/networking/aws-load-balancer",permalink:"/cado/deploy/aws/networking/aws-load-balancer",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/networking/aws-load-balancer.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Add a load balancer and HTTPS",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"How to Tighten IAM Permissions for SSM in AWS",permalink:"/cado/deploy/aws/iam/ssm"},next:{title:"Remove internet routable addresses",permalink:"/cado/deploy/aws/networking/internet-routable-addresses"}},l={},s=[{value:"Adding a valid SSL Certificate",id:"adding-a-valid-ssl-certificate",level:2},{value:"How to Add a Load Balancer in AWS",id:"how-to-add-a-load-balancer-in-aws",level:2},{value:"Get a SSL/TLS Certificate for your domain",id:"get-a-ssltls-certificate-for-your-domain",level:3},{value:"After Deploying the Load Balancer",id:"after-deploying-the-load-balancer",level:3},{value:"(Optional) Adding a Web Application Firewall to your Load Balancer",id:"optional-adding-a-web-application-firewall-to-your-load-balancer",level:3},{value:"Troubleshooting the Load Balancer",id:"troubleshooting-the-load-balancer",level:3}];function c(e){const a={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(a.h1,{id:"how-to-add-a-load-balancer-andor-https-to-cado",children:"How to add a Load Balancer and/or HTTPS to Cado"}),"\n",(0,n.jsx)(a.h2,{id:"adding-a-valid-ssl-certificate",children:"Adding a valid SSL Certificate"}),"\n",(0,n.jsxs)(a.p,{children:["The simplest option for adding a valid SSL certificate to Cado is to use a service such as ",(0,n.jsx)(a.a,{href:"https://www.cloudflare.com/",children:"Cloudflare"}),". This will provide a valid SSL certificate for your domain and allow you to access Cado over valid HTTPS."]}),"\n",(0,n.jsx)(a.p,{children:"Alternatively, you can use a load balancer in AWS to provide a valid SSL certificate. This is a more complex option but provides more control over the SSL certificate and can be used to add a Web Application Firewall."}),"\n",(0,n.jsx)(a.h2,{id:"how-to-add-a-load-balancer-in-aws",children:"How to Add a Load Balancer in AWS"}),"\n",(0,n.jsx)(a.p,{children:"An Application Load Balancer can be placed in front of the Cado web server in order to provide a valid HTTPS connection and add a Web Application Firewall. This can be configured via the pre-built Terraform or Cloudformation deployment scripts that include a Load Balancer."}),"\n",(0,n.jsxs)(a.p,{children:["Please see the ",(0,n.jsx)(a.a,{href:"/cado/deploy/aws/cloudformation",children:"AWS deployment overview"})," for more information on how to deploy Cado with a Load Balancer, in a private subnet. Connections between the Load Balancer and the Cado server will be over TLS."]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Load Balancer 1",src:o(83797).A+"",width:"960",height:"540"})}),"\n",(0,n.jsx)(a.h3,{id:"get-a-ssltls-certificate-for-your-domain",children:"Get a SSL/TLS Certificate for your domain"}),"\n",(0,n.jsxs)(a.p,{children:["In order to deploy with an ALB you will need to provide an ARN for an SSL/TLS certificate for a domain name you own. To do this you will need to visit the Amazon Certificate Manager. Click ",(0,n.jsx)(a.strong,{children:"Request"})," and follow the instructions."]}),"\n",(0,n.jsx)(a.h3,{id:"after-deploying-the-load-balancer",children:"After Deploying the Load Balancer"}),"\n",(0,n.jsxs)(a.p,{children:["Once the load balancer has been created, select the Load Balancer and open the domain name listed under DNS name e.g. ",(0,n.jsx)(a.code,{children:"https://cado-alb-test.us-east-1.elb.amazonaws.com/"})]}),"\n",(0,n.jsxs)(a.p,{children:["If you are using your own domain name, you will then need to point your custom domain name to this DNS name. For example, this is a typical record to point a domain you own (example: ",(0,n.jsx)(a.code,{children:"cado-alb.your-company.com"}),") to the ",(0,n.jsx)(a.code,{children:"*.amazonaws.com"})," DNS name of your Load Balancer:"]}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsxs)(a.li,{children:["Type: ",(0,n.jsx)(a.code,{children:"CNAME"})]}),"\n",(0,n.jsxs)(a.li,{children:["Name: ",(0,n.jsx)(a.code,{children:"cado-alb"})]}),"\n",(0,n.jsxs)(a.li,{children:["Target: ",(0,n.jsx)(a.code,{children:"cado-alb-test.us-east-1.elb.amazonaws.com"})]}),"\n"]}),"\n",(0,n.jsx)(a.p,{children:"You should then be able to visit the domain in your browser and login to Cado."}),"\n",(0,n.jsx)(a.h3,{id:"optional-adding-a-web-application-firewall-to-your-load-balancer",children:"(Optional) Adding a Web Application Firewall to your Load Balancer"}),"\n",(0,n.jsx)(a.p,{children:"You can also add a WAF by:"}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsxs)(a.li,{children:["Selecting your Load Balancer, then ",(0,n.jsx)(a.strong,{children:"Integrated Services"})," then ",(0,n.jsx)(a.strong,{children:"Create Web ACL"}),"."]}),"\n",(0,n.jsxs)(a.li,{children:["Under ",(0,n.jsx)(a.strong,{children:"Associated AWS resources"})," select your Load Balancer."]}),"\n",(0,n.jsxs)(a.li,{children:["Under ",(0,n.jsx)(a.strong,{children:"Add rules and rule groups"})," select the pre-built Firewall rules you want to enable."]}),"\n",(0,n.jsxs)(a.li,{children:["Click through to ",(0,n.jsx)(a.strong,{children:"Create Web ACL"})]}),"\n"]}),"\n",(0,n.jsx)(a.h3,{id:"troubleshooting-the-load-balancer",children:"Troubleshooting the Load Balancer"}),"\n",(0,n.jsx)(a.p,{children:"If your ALB shows a status as unhealthy, check that you have selected 443 (not 80) as the port and HTTPS (not HTTP) as the protocol in all instances."}),"\n",(0,n.jsxs)(a.p,{children:["If the Connection Times Out or you get the error \u201c504 Gateway Timeout\u201d, check that Security Group on both the load balancer and the Cado server allow traffic from Cado to the ALB to the User. Also select the Target Group, and check that under ",(0,n.jsx)(a.strong,{children:"Registered targets"})," the Instance is listed."]})]})}function h(e={}){const{wrapper:a}={...(0,t.R)(),...e.components};return a?(0,n.jsx)(a,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},83797:(e,a,o)=>{o.d(a,{A:()=>n});const n=o.p+"assets/images/aws-lb-1-a20e311eeab85a2a6b7d6395065eadde.png"},28453:(e,a,o)=>{o.d(a,{R:()=>d,x:()=>r});var n=o(96540);const t={},i=n.createContext(t);function d(e){const a=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function r(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:d(e.components),n.createElement(i.Provider,{value:a},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9065b7f6.72fca6a4.js b/assets/js/9065b7f6.d8f86660.js similarity index 98% rename from assets/js/9065b7f6.72fca6a4.js rename to assets/js/9065b7f6.d8f86660.js index cc8ff36b5..0ca69104e 100644 --- a/assets/js/9065b7f6.72fca6a4.js +++ b/assets/js/9065b7f6.d8f86660.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[18],{72592:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var s=t(74848),n=t(28453);const o={title:"Azure credentials",hide_title:!0,sidebar_position:4},i="How to Create Secure Azure Credentials",a={id:"cado/discovery-import/cado-host/azure-credentials",title:"Azure credentials",description:"We now recommend using the automatically generated temporary credentials from Cado. For more details, see our documentation here.",source:"@site/docs/cado/discovery-import/cado-host/azure-credentials.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/azure-credentials",permalink:"/cado/discovery-import/cado-host/azure-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/azure-credentials.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Azure credentials",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Google Cloud credentials",permalink:"/cado/discovery-import/cado-host/google-credentials"},next:{title:"Custom location for Cado Host",permalink:"/cado/discovery-import/cado-host/custom-locations"}},c={},d=[{value:"Step 1: Create Blob Storage",id:"step-1-create-blob-storage",level:2},{value:"Step 2: Generate a Shared Access Signature (SAS)",id:"step-2-generate-a-shared-access-signature-sas",level:2},{value:"Step 3: Generate a Shared Access Signature Using Azure Storage Explorer",id:"step-3-generate-a-shared-access-signature-using-azure-storage-explorer",level:2},{value:"Ready to Go",id:"ready-to-go",level:2}];function l(e){const r={a:"a",admonition:"admonition",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(r.admonition,{type:"warning",children:(0,s.jsxs)(r.p,{children:["We now recommend using the automatically generated temporary credentials from Cado. For more details, see our documentation ",(0,s.jsx)(r.strong,{children:(0,s.jsx)(r.a,{href:"deploy#deploy-through-cado-response-platform",children:"here"})}),"."]})}),"\n",(0,s.jsx)(r.h1,{id:"how-to-create-secure-azure-credentials",children:"How to Create Secure Azure Credentials"}),"\n",(0,s.jsx)(r.p,{children:"To securely write to Azure, you will need to create a limited-access key called a Shared Access Signature (SAS)."}),"\n",(0,s.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/FQoAnYVPRLo",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,s.jsx)(r.h2,{id:"step-1-create-blob-storage",children:"Step 1: Create Blob Storage"}),"\n",(0,s.jsxs)(r.p,{children:["If you haven\u2019t already, follow this guide to ",(0,s.jsx)(r.strong,{children:(0,s.jsx)(r.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal",children:"Create a Blob storage container"})})," in Azure to store your data."]}),"\n",(0,s.jsx)(r.h2,{id:"step-2-generate-a-shared-access-signature-sas",children:"Step 2: Generate a Shared Access Signature (SAS)"}),"\n",(0,s.jsxs)(r.ol,{children:["\n",(0,s.jsxs)(r.li,{children:["Go to your Azure ",(0,s.jsx)(r.strong,{children:"Storage Account"}),"."]}),"\n",(0,s.jsxs)(r.li,{children:["Click on ",(0,s.jsx)(r.strong,{children:"Shared Access Signature"})," to generate credentials for writing to the storage containers."]}),"\n",(0,s.jsxs)(r.li,{children:["Uncheck permissions for ",(0,s.jsx)(r.strong,{children:"Read"}),", ",(0,s.jsx)(r.strong,{children:"List"}),", and ",(0,s.jsx)(r.strong,{children:"Delete"})," to restrict access, and then click ",(0,s.jsx)(r.strong,{children:"Generate SAS"}),"."]}),"\n"]}),"\n",(0,s.jsx)(r.h2,{id:"step-3-generate-a-shared-access-signature-using-azure-storage-explorer",children:"Step 3: Generate a Shared Access Signature Using Azure Storage Explorer"}),"\n",(0,s.jsxs)(r.p,{children:["You can also generate a Shared Access Signature using ",(0,s.jsx)(r.strong,{children:(0,s.jsx)(r.a,{href:"https://azure.microsoft.com/en-us/features/storage-explorer/",children:"Azure Storage Explorer"})}),":"]}),"\n",(0,s.jsxs)(r.ol,{children:["\n",(0,s.jsxs)(r.li,{children:["Right-click the blob container you want to use and select ",(0,s.jsx)(r.strong,{children:"Get Shared Access Signature"}),"."]}),"\n",(0,s.jsxs)(r.li,{children:["Specify the time period for which the credentials will be valid, and untick all permissions except for ",(0,s.jsx)(r.strong,{children:"Write"}),"."]}),"\n",(0,s.jsxs)(r.li,{children:["Click ",(0,s.jsx)(r.strong,{children:"Next"})," and copy the ",(0,s.jsx)(r.strong,{children:"Query String"}),", which will be used for authentication."]}),"\n"]}),"\n",(0,s.jsx)(r.h2,{id:"ready-to-go",children:"Ready to Go"}),"\n",(0,s.jsx)(r.p,{children:"When you're ready for the imaging process, you should have:"}),"\n",(0,s.jsxs)(r.ol,{children:["\n",(0,s.jsxs)(r.li,{children:["The ",(0,s.jsx)(r.strong,{children:"Account Name"})," (the account that owns the container where the access signature was generated)."]}),"\n",(0,s.jsxs)(r.li,{children:["The ",(0,s.jsx)(r.strong,{children:"Container Name"})," (where the data will be stored)."]}),"\n",(0,s.jsxs)(r.li,{children:["The ",(0,s.jsx)(r.strong,{children:"Generated Access Signature"})," (the query string used for authentication)."]}),"\n"]}),"\n",(0,s.jsx)(r.admonition,{type:"warning",children:(0,s.jsx)(r.p,{children:"Keep this information safe, as you would with a sensitive password. Once access is no longer needed, we recommend revoking the credentials."})}),"\n",(0,s.jsx)(r.admonition,{type:"tip",children:(0,s.jsxs)(r.p,{children:["For additional security, we recommend setting up ",(0,s.jsx)(r.strong,{children:"IP whitelisting"})," for containers where possible. Ensure that ",(0,s.jsx)(r.strong,{children:"read"})," and ",(0,s.jsx)(r.strong,{children:"list"})," permissions are never granted, which prevents unauthorized access if the SAS token is exposed."]})})]})}function h(e={}){const{wrapper:r}={...(0,n.R)(),...e.components};return r?(0,s.jsx)(r,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},28453:(e,r,t)=>{t.d(r,{R:()=>i,x:()=>a});var s=t(96540);const n={},o=s.createContext(n);function i(e){const r=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function a(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),s.createElement(o.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[18],{72592:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var s=t(74848),n=t(28453);const o={title:"Azure credentials",hide_title:!0,sidebar_position:4},i="How to Create Secure Azure Credentials",a={id:"cado/discovery-import/cado-host/azure-credentials",title:"Azure credentials",description:"We now recommend using the automatically generated temporary credentials from Cado. For more details, see our documentation here.",source:"@site/docs/cado/discovery-import/cado-host/azure-credentials.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/azure-credentials",permalink:"/cado/discovery-import/cado-host/azure-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/azure-credentials.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Azure credentials",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Google Cloud credentials",permalink:"/cado/discovery-import/cado-host/google-credentials"},next:{title:"Custom location for Cado Host",permalink:"/cado/discovery-import/cado-host/custom-locations"}},c={},d=[{value:"Step 1: Create Blob Storage",id:"step-1-create-blob-storage",level:2},{value:"Step 2: Generate a Shared Access Signature (SAS)",id:"step-2-generate-a-shared-access-signature-sas",level:2},{value:"Step 3: Generate a Shared Access Signature Using Azure Storage Explorer",id:"step-3-generate-a-shared-access-signature-using-azure-storage-explorer",level:2},{value:"Ready to Go",id:"ready-to-go",level:2}];function l(e){const r={a:"a",admonition:"admonition",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(r.admonition,{type:"warning",children:(0,s.jsxs)(r.p,{children:["We now recommend using the automatically generated temporary credentials from Cado. For more details, see our documentation ",(0,s.jsx)(r.strong,{children:(0,s.jsx)(r.a,{href:"deploy#deploy-through-cado-response-platform",children:"here"})}),"."]})}),"\n",(0,s.jsx)(r.h1,{id:"how-to-create-secure-azure-credentials",children:"How to Create Secure Azure Credentials"}),"\n",(0,s.jsx)(r.p,{children:"To securely write to Azure, you will need to create a limited-access key called a Shared Access Signature (SAS)."}),"\n",(0,s.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/FQoAnYVPRLo",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,s.jsx)(r.h2,{id:"step-1-create-blob-storage",children:"Step 1: Create Blob Storage"}),"\n",(0,s.jsxs)(r.p,{children:["If you haven\u2019t already, follow this guide to ",(0,s.jsx)(r.strong,{children:(0,s.jsx)(r.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal",children:"Create a Blob storage container"})})," in Azure to store your data."]}),"\n",(0,s.jsx)(r.h2,{id:"step-2-generate-a-shared-access-signature-sas",children:"Step 2: Generate a Shared Access Signature (SAS)"}),"\n",(0,s.jsxs)(r.ol,{children:["\n",(0,s.jsxs)(r.li,{children:["Go to your Azure ",(0,s.jsx)(r.strong,{children:"Storage Account"}),"."]}),"\n",(0,s.jsxs)(r.li,{children:["Click on ",(0,s.jsx)(r.strong,{children:"Shared Access Signature"})," to generate credentials for writing to the storage containers."]}),"\n",(0,s.jsxs)(r.li,{children:["Uncheck permissions for ",(0,s.jsx)(r.strong,{children:"Read"}),", ",(0,s.jsx)(r.strong,{children:"List"}),", and ",(0,s.jsx)(r.strong,{children:"Delete"})," to restrict access, and then click ",(0,s.jsx)(r.strong,{children:"Generate SAS"}),"."]}),"\n"]}),"\n",(0,s.jsx)(r.h2,{id:"step-3-generate-a-shared-access-signature-using-azure-storage-explorer",children:"Step 3: Generate a Shared Access Signature Using Azure Storage Explorer"}),"\n",(0,s.jsxs)(r.p,{children:["You can also generate a Shared Access Signature using ",(0,s.jsx)(r.strong,{children:(0,s.jsx)(r.a,{href:"https://azure.microsoft.com/en-us/features/storage-explorer/",children:"Azure Storage Explorer"})}),":"]}),"\n",(0,s.jsxs)(r.ol,{children:["\n",(0,s.jsxs)(r.li,{children:["Right-click the blob container you want to use and select ",(0,s.jsx)(r.strong,{children:"Get Shared Access Signature"}),"."]}),"\n",(0,s.jsxs)(r.li,{children:["Specify the time period for which the credentials will be valid, and untick all permissions except for ",(0,s.jsx)(r.strong,{children:"Write"}),"."]}),"\n",(0,s.jsxs)(r.li,{children:["Click ",(0,s.jsx)(r.strong,{children:"Next"})," and copy the ",(0,s.jsx)(r.strong,{children:"Query String"}),", which will be used for authentication."]}),"\n"]}),"\n",(0,s.jsx)(r.h2,{id:"ready-to-go",children:"Ready to Go"}),"\n",(0,s.jsx)(r.p,{children:"When you're ready for the imaging process, you should have:"}),"\n",(0,s.jsxs)(r.ol,{children:["\n",(0,s.jsxs)(r.li,{children:["The ",(0,s.jsx)(r.strong,{children:"Account Name"})," (the account that owns the container where the access signature was generated)."]}),"\n",(0,s.jsxs)(r.li,{children:["The ",(0,s.jsx)(r.strong,{children:"Container Name"})," (where the data will be stored)."]}),"\n",(0,s.jsxs)(r.li,{children:["The ",(0,s.jsx)(r.strong,{children:"Generated Access Signature"})," (the query string used for authentication)."]}),"\n"]}),"\n",(0,s.jsx)(r.admonition,{type:"warning",children:(0,s.jsx)(r.p,{children:"Keep this information safe, as you would with a sensitive password. Once access is no longer needed, we recommend revoking the credentials."})}),"\n",(0,s.jsx)(r.admonition,{type:"tip",children:(0,s.jsxs)(r.p,{children:["For additional security, we recommend setting up ",(0,s.jsx)(r.strong,{children:"IP whitelisting"})," for containers where possible. Ensure that ",(0,s.jsx)(r.strong,{children:"read"})," and ",(0,s.jsx)(r.strong,{children:"list"})," permissions are never granted, which prevents unauthorized access if the SAS token is exposed."]})})]})}function h(e={}){const{wrapper:r}={...(0,n.R)(),...e.components};return r?(0,s.jsx)(r,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},28453:(e,r,t)=>{t.d(r,{R:()=>i,x:()=>a});var s=t(96540);const n={},o=s.createContext(n);function i(e){const r=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function a(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),s.createElement(o.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/90b7a613.00fc17ed.js b/assets/js/90b7a613.13a5b16d.js similarity index 98% rename from assets/js/90b7a613.00fc17ed.js rename to assets/js/90b7a613.13a5b16d.js index cac6aee4f..d3a620d3f 100644 --- a/assets/js/90b7a613.00fc17ed.js +++ b/assets/js/90b7a613.13a5b16d.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8804],{23198:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>n,default:()=>u,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var o=t(74848),r=t(28453);const i={title:"Adding Azure subscriptions to Azure/AWS/GCP",hide_title:!0,sidebar_position:7},n="How to add Azure Subscriptions to Azure, AWS, or GCP",a={id:"cado/deploy/cross/adding-azure",title:"Adding Azure subscriptions to Azure/AWS/GCP",description:"To allow Cado to access data from an Azure subscription, you must register an application within the target subscription. Follow the steps below to set up cross-subscription access. Ensure you have permission to register applications and create IAM roles.",source:"@site/docs/cado/deploy/cross/adding-azure.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/adding-azure",permalink:"/cado/deploy/cross/adding-azure",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/adding-azure.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"Adding Azure subscriptions to Azure/AWS/GCP",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Access an AWS account with via AMI Import",permalink:"/cado/deploy/cross/skip-role"},next:{title:"Import from subscriptions and tenants in Azure",permalink:"/cado/deploy/cross/azure-cross-tenancy-subscriptions"}},c={},d=[{value:"Steps to Add an Azure Subscription",id:"steps-to-add-an-azure-subscription",level:3},{value:"Cross-Cloud Import Diagram",id:"cross-cloud-import-diagram",level:3}];function l(e){const s={a:"a",br:"br",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-to-add-azure-subscriptions-to-azure-aws-or-gcp",children:"How to add Azure Subscriptions to Azure, AWS, or GCP"}),"\n",(0,o.jsx)(s.p,{children:"To allow Cado to access data from an Azure subscription, you must register an application within the target subscription. Follow the steps below to set up cross-subscription access. Ensure you have permission to register applications and create IAM roles."}),"\n",(0,o.jsx)(s.h3,{id:"steps-to-add-an-azure-subscription",children:"Steps to Add an Azure Subscription"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Log in to the Target Azure Subscription"}),(0,o.jsx)(s.br,{}),"\n","Start by logging into the Azure subscription where you want Cado to collect evidence."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Register a New Application"}),(0,o.jsx)(s.br,{}),"\n","Follow ",(0,o.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app",children:"Microsoft's instructions"})," to begin the process of registering a new application in the Azure subscription."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Configure the Application for Cado"}),(0,o.jsx)(s.br,{}),"\n","Once the application is registered, configure it for Cado by following the ",(0,o.jsx)(s.a,{href:"/cado/deploy/cross/azure-cross-tenancy-subscriptions#setting-up-an-app-registration-for-cross-tenancysubscription-acquisitions",children:"Cado documentation on setting up cross-tenancy/subscription acquisitions"}),"."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Add Application Details to Cado"}),(0,o.jsx)(s.br,{}),"\n","After configuring the application, add the required details to the Cado platform by following the instructions in the ",(0,o.jsx)(s.a,{href:"/cado/deploy/cross/azure-cross-tenancy-subscriptions#registering-credentials-within-cado",children:"Cado documentation"}),"."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Verify Access in Cado"}),(0,o.jsx)(s.br,{}),"\n","To ensure that Cado can access resources in the Azure subscription:"]}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsx)(s.li,{children:"Open an investigation in Cado."}),"\n",(0,o.jsxs)(s.li,{children:["Select ",(0,o.jsx)(s.strong,{children:"Import"})," > ",(0,o.jsx)(s.strong,{children:"Cloud"}),"."]}),"\n",(0,o.jsx)(s.li,{children:"Choose the Azure role you created."}),"\n",(0,o.jsx)(s.li,{children:"Confirm that the resources available for import are visible."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(s.h3,{id:"cross-cloud-import-diagram",children:"Cross-Cloud Import Diagram"}),"\n",(0,o.jsx)(s.p,{children:"For a visual representation of how cross-cloud imports from AWS into Azure work, refer to the diagram below:"}),"\n",(0,o.jsx)(s.p,{children:(0,o.jsx)(s.img,{alt:"Azure Cross",src:t(63755).A+"",width:"1896",height:"1056"})})]})}function u(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},63755:(e,s,t)=>{t.d(s,{A:()=>o});const o=t.p+"assets/images/azure-cross-6f16704f6890ab992de046ba5ff6b986.png"},28453:(e,s,t)=>{t.d(s,{R:()=>n,x:()=>a});var o=t(96540);const r={},i=o.createContext(r);function n(e){const s=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:n(e.components),o.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8804],{23198:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>n,default:()=>u,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var o=t(74848),r=t(28453);const i={title:"Adding Azure subscriptions to Azure/AWS/GCP",hide_title:!0,sidebar_position:7},n="How to add Azure Subscriptions to Azure, AWS, or GCP",a={id:"cado/deploy/cross/adding-azure",title:"Adding Azure subscriptions to Azure/AWS/GCP",description:"To allow Cado to access data from an Azure subscription, you must register an application within the target subscription. Follow the steps below to set up cross-subscription access. Ensure you have permission to register applications and create IAM roles.",source:"@site/docs/cado/deploy/cross/adding-azure.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/adding-azure",permalink:"/cado/deploy/cross/adding-azure",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/adding-azure.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"Adding Azure subscriptions to Azure/AWS/GCP",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Access an AWS account with via AMI Import",permalink:"/cado/deploy/cross/skip-role"},next:{title:"Import from subscriptions and tenants in Azure",permalink:"/cado/deploy/cross/azure-cross-tenancy-subscriptions"}},c={},d=[{value:"Steps to Add an Azure Subscription",id:"steps-to-add-an-azure-subscription",level:3},{value:"Cross-Cloud Import Diagram",id:"cross-cloud-import-diagram",level:3}];function l(e){const s={a:"a",br:"br",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-to-add-azure-subscriptions-to-azure-aws-or-gcp",children:"How to add Azure Subscriptions to Azure, AWS, or GCP"}),"\n",(0,o.jsx)(s.p,{children:"To allow Cado to access data from an Azure subscription, you must register an application within the target subscription. Follow the steps below to set up cross-subscription access. Ensure you have permission to register applications and create IAM roles."}),"\n",(0,o.jsx)(s.h3,{id:"steps-to-add-an-azure-subscription",children:"Steps to Add an Azure Subscription"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Log in to the Target Azure Subscription"}),(0,o.jsx)(s.br,{}),"\n","Start by logging into the Azure subscription where you want Cado to collect evidence."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Register a New Application"}),(0,o.jsx)(s.br,{}),"\n","Follow ",(0,o.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app",children:"Microsoft's instructions"})," to begin the process of registering a new application in the Azure subscription."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Configure the Application for Cado"}),(0,o.jsx)(s.br,{}),"\n","Once the application is registered, configure it for Cado by following the ",(0,o.jsx)(s.a,{href:"/cado/deploy/cross/azure-cross-tenancy-subscriptions#setting-up-an-app-registration-for-cross-tenancysubscription-acquisitions",children:"Cado documentation on setting up cross-tenancy/subscription acquisitions"}),"."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Add Application Details to Cado"}),(0,o.jsx)(s.br,{}),"\n","After configuring the application, add the required details to the Cado platform by following the instructions in the ",(0,o.jsx)(s.a,{href:"/cado/deploy/cross/azure-cross-tenancy-subscriptions#registering-credentials-within-cado",children:"Cado documentation"}),"."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Verify Access in Cado"}),(0,o.jsx)(s.br,{}),"\n","To ensure that Cado can access resources in the Azure subscription:"]}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsx)(s.li,{children:"Open an investigation in Cado."}),"\n",(0,o.jsxs)(s.li,{children:["Select ",(0,o.jsx)(s.strong,{children:"Import"})," > ",(0,o.jsx)(s.strong,{children:"Cloud"}),"."]}),"\n",(0,o.jsx)(s.li,{children:"Choose the Azure role you created."}),"\n",(0,o.jsx)(s.li,{children:"Confirm that the resources available for import are visible."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(s.h3,{id:"cross-cloud-import-diagram",children:"Cross-Cloud Import Diagram"}),"\n",(0,o.jsx)(s.p,{children:"For a visual representation of how cross-cloud imports from AWS into Azure work, refer to the diagram below:"}),"\n",(0,o.jsx)(s.p,{children:(0,o.jsx)(s.img,{alt:"Azure Cross",src:t(63755).A+"",width:"1896",height:"1056"})})]})}function u(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},63755:(e,s,t)=>{t.d(s,{A:()=>o});const o=t.p+"assets/images/azure-cross-6f16704f6890ab992de046ba5ff6b986.png"},28453:(e,s,t)=>{t.d(s,{R:()=>n,x:()=>a});var o=t(96540);const r={},i=o.createContext(r);function n(e){const s=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:n(e.components),o.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/92d849d5.0ebc6027.js b/assets/js/92d849d5.16c54507.js similarity index 97% rename from assets/js/92d849d5.0ebc6027.js rename to assets/js/92d849d5.16c54507.js index 5c278b284..9b286c878 100644 --- a/assets/js/92d849d5.0ebc6027.js +++ b/assets/js/92d849d5.16c54507.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[70],{42399:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>p,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var i=n(74848),o=n(28453);const s={title:"Set up proxy access",hide_title:!0,sidebar_position:9},r="How to set up proxy access",a={id:"cado/deploy/networking-proxy",title:"Set up proxy access",description:"Cado supports the use of proxies for communication between the Cado platform and services external to the environment in which you have deployed the Cado platform. This can include:",source:"@site/docs/cado/deploy/networking-proxy.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/networking-proxy",permalink:"/cado/deploy/networking-proxy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/networking-proxy.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:9,frontMatter:{title:"Set up proxy access",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Ports and network encryption",permalink:"/cado/deploy/ports"},next:{title:"Tagging Cado resources",permalink:"/cado/deploy/tag"}},c={},d=[{value:"Configure Proxy Access during installation",id:"configure-proxy-access-during-installation",level:2},{value:"Configure Proxy Access after installation",id:"configure-proxy-access-after-installation",level:2},{value:"Skipping SSL Verification in Cado Host Uploads",id:"skipping-ssl-verification-in-cado-host-uploads",level:2}];function l(e){const t={admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-set-up-proxy-access",children:"How to set up proxy access"}),"\n",(0,i.jsx)(t.p,{children:"Cado supports the use of proxies for communication between the Cado platform and services external to the environment in which you have deployed the Cado platform. This can include:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Cross-cloud acquisitions"}),"\n",(0,i.jsx)(t.li,{children:"XDR-based acquisitions"}),"\n",(0,i.jsx)(t.li,{children:"Importing from a URL"}),"\n",(0,i.jsx)(t.li,{children:"System updates"}),"\n",(0,i.jsx)(t.li,{children:"Providing diagnostic information to Cado"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Cado supports proxy authentication using basic HTTP and server certificate TLS authentication."}),"\n",(0,i.jsx)(t.h2,{id:"configure-proxy-access-during-installation",children:"Configure Proxy Access during installation"}),"\n",(0,i.jsx)(t.p,{children:"Please see the relevant deployment page, on how to configure proxy settings during installation by setting the proxy and proxy cert URL parameters."}),"\n",(0,i.jsx)(t.h2,{id:"configure-proxy-access-after-installation",children:"Configure Proxy Access after installation"}),"\n",(0,i.jsxs)(t.p,{children:["To configure proxy access go to ",(0,i.jsx)(t.em,{children:"Settings - Advanced"})]}),"\n",(0,i.jsxs)(t.p,{children:["Specify the URL of the proxy. If the proxy requires a user ID and password, include these as part of the URL in the format ",(0,i.jsx)(t.code,{children:"http://user:password@hostname:port"})]}),"\n",(0,i.jsxs)(t.p,{children:["If the proxy uses TLS, specify URL from which you can download the server certificate URL in the ",(0,i.jsx)(t.em,{children:"Proxy Cert URL"})," field. If the server does not user TLS, leave this field blank."]}),"\n",(0,i.jsxs)(t.p,{children:["To test these settings, click the ",(0,i.jsx)(t.em,{children:"Test proxy settings"})," button."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Proxy Setting",src:n(33158).A+"",width:"1211",height:"373"})}),"\n",(0,i.jsx)(t.admonition,{type:"warning",children:(0,i.jsx)(t.p,{children:"Settings will only be applied after the next system upgrade"})}),"\n",(0,i.jsx)(t.h2,{id:"skipping-ssl-verification-in-cado-host-uploads",children:"Skipping SSL Verification in Cado Host Uploads"}),"\n",(0,i.jsx)(t.p,{children:"Some MITM Proxies will present an invalid certificate, and prevent Cado Host (and other import methods which utilise Cado Host such as XDR integrations and Kubernetes acquisitions) from uploading data to cloud storage."}),"\n",(0,i.jsxs)(t.p,{children:["To skip SSL verification in Cado Host uploads, check the box under Settings > Advanced > Cado Host (Skip SSL Verification):\n",(0,i.jsx)(t.img,{alt:"Proxy Setting",src:n(22695).A+"",width:"1932",height:"220"})]})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},33158:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/proxy-setting-45149c60293a39341b878cdab8b68b6e.png"},22695:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/skip_ssl-a2804fdc68acea08ec7faa7a9bc1cc6c.png"},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>a});var i=n(96540);const o={},s=i.createContext(o);function r(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[70],{42399:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>p,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var i=n(74848),o=n(28453);const s={title:"Set up proxy access",hide_title:!0,sidebar_position:9},r="How to set up proxy access",a={id:"cado/deploy/networking-proxy",title:"Set up proxy access",description:"Cado supports the use of proxies for communication between the Cado platform and services external to the environment in which you have deployed the Cado platform. This can include:",source:"@site/docs/cado/deploy/networking-proxy.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/networking-proxy",permalink:"/cado/deploy/networking-proxy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/networking-proxy.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:9,frontMatter:{title:"Set up proxy access",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Ports and network encryption",permalink:"/cado/deploy/ports"},next:{title:"Tagging Cado resources",permalink:"/cado/deploy/tag"}},c={},d=[{value:"Configure Proxy Access during installation",id:"configure-proxy-access-during-installation",level:2},{value:"Configure Proxy Access after installation",id:"configure-proxy-access-after-installation",level:2},{value:"Skipping SSL Verification in Cado Host Uploads",id:"skipping-ssl-verification-in-cado-host-uploads",level:2}];function l(e){const t={admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-set-up-proxy-access",children:"How to set up proxy access"}),"\n",(0,i.jsx)(t.p,{children:"Cado supports the use of proxies for communication between the Cado platform and services external to the environment in which you have deployed the Cado platform. This can include:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Cross-cloud acquisitions"}),"\n",(0,i.jsx)(t.li,{children:"XDR-based acquisitions"}),"\n",(0,i.jsx)(t.li,{children:"Importing from a URL"}),"\n",(0,i.jsx)(t.li,{children:"System updates"}),"\n",(0,i.jsx)(t.li,{children:"Providing diagnostic information to Cado"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Cado supports proxy authentication using basic HTTP and server certificate TLS authentication."}),"\n",(0,i.jsx)(t.h2,{id:"configure-proxy-access-during-installation",children:"Configure Proxy Access during installation"}),"\n",(0,i.jsx)(t.p,{children:"Please see the relevant deployment page, on how to configure proxy settings during installation by setting the proxy and proxy cert URL parameters."}),"\n",(0,i.jsx)(t.h2,{id:"configure-proxy-access-after-installation",children:"Configure Proxy Access after installation"}),"\n",(0,i.jsxs)(t.p,{children:["To configure proxy access go to ",(0,i.jsx)(t.em,{children:"Settings - Advanced"})]}),"\n",(0,i.jsxs)(t.p,{children:["Specify the URL of the proxy. If the proxy requires a user ID and password, include these as part of the URL in the format ",(0,i.jsx)(t.code,{children:"http://user:password@hostname:port"})]}),"\n",(0,i.jsxs)(t.p,{children:["If the proxy uses TLS, specify URL from which you can download the server certificate URL in the ",(0,i.jsx)(t.em,{children:"Proxy Cert URL"})," field. If the server does not user TLS, leave this field blank."]}),"\n",(0,i.jsxs)(t.p,{children:["To test these settings, click the ",(0,i.jsx)(t.em,{children:"Test proxy settings"})," button."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Proxy Setting",src:n(33158).A+"",width:"1211",height:"373"})}),"\n",(0,i.jsx)(t.admonition,{type:"warning",children:(0,i.jsx)(t.p,{children:"Settings will only be applied after the next system upgrade"})}),"\n",(0,i.jsx)(t.h2,{id:"skipping-ssl-verification-in-cado-host-uploads",children:"Skipping SSL Verification in Cado Host Uploads"}),"\n",(0,i.jsx)(t.p,{children:"Some MITM Proxies will present an invalid certificate, and prevent Cado Host (and other import methods which utilise Cado Host such as XDR integrations and Kubernetes acquisitions) from uploading data to cloud storage."}),"\n",(0,i.jsxs)(t.p,{children:["To skip SSL verification in Cado Host uploads, check the box under Settings > Advanced > Cado Host (Skip SSL Verification):\n",(0,i.jsx)(t.img,{alt:"Proxy Setting",src:n(22695).A+"",width:"1932",height:"220"})]})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},33158:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/proxy-setting-45149c60293a39341b878cdab8b68b6e.png"},22695:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/skip_ssl-a2804fdc68acea08ec7faa7a9bc1cc6c.png"},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>a});var i=n(96540);const o={},s=i.createContext(o);function r(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/92f2ee11.8b289a79.js b/assets/js/92f2ee11.546298af.js similarity index 98% rename from assets/js/92f2ee11.8b289a79.js rename to assets/js/92f2ee11.546298af.js index ea782f297..8aa5d6ded 100644 --- a/assets/js/92f2ee11.8b289a79.js +++ b/assets/js/92f2ee11.546298af.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8954],{6235:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>d,contentTitle:()=>s,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>l});var n=t(74848),i=t(28453);const a={title:"Log in",hide_title:!0,sidebar_position:6},s="How to log in to the Cado platform",r={id:"cado/deploy/logging-in",title:"Log in",description:"Depending on the cloud provider in which you deployed the Cado platform, navigate to either your AWS Console or your Azure Portal and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to https:// where `` is the IPv4 of the Cado instance. You will now be able to log into the platform.",source:"@site/docs/cado/deploy/logging-in.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/logging-in",permalink:"/cado/deploy/logging-in",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/logging-in.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Log in",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Cross-cloud vs individual deployments",permalink:"/cado/deploy/cross/cross_vs_individual"},next:{title:"Get and apply a license",permalink:"/cado/deploy/licenses"}},d={},l=[{value:"Default Login",id:"default-login",level:3}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",strong:"strong",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(o.h1,{id:"how-to-log-in-to-the-cado-platform",children:"How to log in to the Cado platform"}),"\n",(0,n.jsxs)(o.p,{children:["Depending on the cloud provider in which you deployed the Cado platform, navigate to either your ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://console.aws.amazon.com",children:"AWS Console"})})," or your ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://portal.azure.com",children:"Azure Portal"})})," and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to ",(0,n.jsx)(o.code,{children:"https://"})," where ",(0,n.jsx)(o.code,{children:""})," is the IPv4 of the Cado instance. You will now be able to log into the platform."]}),"\n",(0,n.jsxs)(o.admonition,{type:"tip",children:[(0,n.jsx)(o.mdxAdmonitionTitle,{}),(0,n.jsxs)(o.p,{children:['You will see a browser notification stating that "Your connection is not private". Cado is unable to automatically generate SSL certificates. In AWS, if you require a valid SSL certificate, the easiest way to create one for the encrypted HTTPS connection is to ',(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"/cado/deploy/aws/networking/aws-load-balancer",children:"create your own Elastic Load Balancer"})})]})]}),"\n",(0,n.jsx)(o.p,{children:(0,n.jsx)(o.img,{alt:"Login Page",src:t(82422).A+"",width:"456",height:"528"})}),"\n",(0,n.jsx)(o.h3,{id:"default-login",children:"Default Login"}),"\n",(0,n.jsx)(o.p,{children:'On first boot, the platform will take about 10 minutes to install, during which time, on the login URL page, you will see a message indicating that the system is "Installing Cado...".'}),"\n",(0,n.jsxs)(o.p,{children:["After initial install, you can login with the username ",(0,n.jsx)(o.code,{children:"admin"}),"."]}),"\n",(0,n.jsxs)(o.p,{children:["For AWS, the password is ",(0,n.jsx)(o.code,{children:"i-xxx"}),", where ",(0,n.jsx)(o.code,{children:"i-xxx"})," is the Instance ID of your Cado instance."]}),"\n",(0,n.jsxs)(o.p,{children:["For Azure, the password is the very long resource ID that can be found by opening the VM in the Azure portal > Settings > Properties > Resource ID starting with ",(0,n.jsx)(o.code,{children:"/subscription/..."})," ending with ",(0,n.jsx)(o.code,{children:"/subscription/.../VM NAME"})," After initial login, you will be asked to accept the EULA and change your password."]}),"\n",(0,n.jsxs)(o.p,{children:["For GCP, the password is the instance-id found in the Compute Engine console for your instance e.g. ",(0,n.jsx)(o.code,{children:"87844815082567668776"})]}),"\n",(0,n.jsxs)(o.p,{children:["For High Availability in AWS, the password is the name of the load balancer, for example if the full ARN of the load balancer is ",(0,n.jsx)(o.code,{children:"arn:aws:elasticloadbalancing:us-east-1:111:loadbalancer/app/my-load-balancer/abc"})," then the password will be ",(0,n.jsx)(o.code,{children:"my-load-balancer"})]})]})}function h(e={}){const{wrapper:o}={...(0,i.R)(),...e.components};return o?(0,n.jsx)(o,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},82422:(e,o,t)=>{t.d(o,{A:()=>n});const n=t.p+"assets/images/login-7194fb115da3e43cb1d8ca36b1ace509.png"},28453:(e,o,t)=>{t.d(o,{R:()=>s,x:()=>r});var n=t(96540);const i={},a=n.createContext(i);function s(e){const o=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),n.createElement(a.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8954],{6235:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>d,contentTitle:()=>s,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>l});var n=t(74848),i=t(28453);const a={title:"Log in",hide_title:!0,sidebar_position:6},s="How to log in to the Cado platform",r={id:"cado/deploy/logging-in",title:"Log in",description:"Depending on the cloud provider in which you deployed the Cado platform, navigate to either your AWS Console or your Azure Portal and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to https:// where `` is the IPv4 of the Cado instance. You will now be able to log into the platform.",source:"@site/docs/cado/deploy/logging-in.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/logging-in",permalink:"/cado/deploy/logging-in",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/logging-in.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Log in",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Cross-cloud vs individual deployments",permalink:"/cado/deploy/cross/cross_vs_individual"},next:{title:"Get and apply a license",permalink:"/cado/deploy/licenses"}},d={},l=[{value:"Default Login",id:"default-login",level:3}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",strong:"strong",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(o.h1,{id:"how-to-log-in-to-the-cado-platform",children:"How to log in to the Cado platform"}),"\n",(0,n.jsxs)(o.p,{children:["Depending on the cloud provider in which you deployed the Cado platform, navigate to either your ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://console.aws.amazon.com",children:"AWS Console"})})," or your ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://portal.azure.com",children:"Azure Portal"})})," and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to ",(0,n.jsx)(o.code,{children:"https://"})," where ",(0,n.jsx)(o.code,{children:""})," is the IPv4 of the Cado instance. You will now be able to log into the platform."]}),"\n",(0,n.jsxs)(o.admonition,{type:"tip",children:[(0,n.jsx)(o.mdxAdmonitionTitle,{}),(0,n.jsxs)(o.p,{children:['You will see a browser notification stating that "Your connection is not private". Cado is unable to automatically generate SSL certificates. In AWS, if you require a valid SSL certificate, the easiest way to create one for the encrypted HTTPS connection is to ',(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"/cado/deploy/aws/networking/aws-load-balancer",children:"create your own Elastic Load Balancer"})})]})]}),"\n",(0,n.jsx)(o.p,{children:(0,n.jsx)(o.img,{alt:"Login Page",src:t(82422).A+"",width:"456",height:"528"})}),"\n",(0,n.jsx)(o.h3,{id:"default-login",children:"Default Login"}),"\n",(0,n.jsx)(o.p,{children:'On first boot, the platform will take about 10 minutes to install, during which time, on the login URL page, you will see a message indicating that the system is "Installing Cado...".'}),"\n",(0,n.jsxs)(o.p,{children:["After initial install, you can login with the username ",(0,n.jsx)(o.code,{children:"admin"}),"."]}),"\n",(0,n.jsxs)(o.p,{children:["For AWS, the password is ",(0,n.jsx)(o.code,{children:"i-xxx"}),", where ",(0,n.jsx)(o.code,{children:"i-xxx"})," is the Instance ID of your Cado instance."]}),"\n",(0,n.jsxs)(o.p,{children:["For Azure, the password is the very long resource ID that can be found by opening the VM in the Azure portal > Settings > Properties > Resource ID starting with ",(0,n.jsx)(o.code,{children:"/subscription/..."})," ending with ",(0,n.jsx)(o.code,{children:"/subscription/.../VM NAME"})," After initial login, you will be asked to accept the EULA and change your password."]}),"\n",(0,n.jsxs)(o.p,{children:["For GCP, the password is the instance-id found in the Compute Engine console for your instance e.g. ",(0,n.jsx)(o.code,{children:"87844815082567668776"})]}),"\n",(0,n.jsxs)(o.p,{children:["For High Availability in AWS, the password is the name of the load balancer, for example if the full ARN of the load balancer is ",(0,n.jsx)(o.code,{children:"arn:aws:elasticloadbalancing:us-east-1:111:loadbalancer/app/my-load-balancer/abc"})," then the password will be ",(0,n.jsx)(o.code,{children:"my-load-balancer"})]})]})}function h(e={}){const{wrapper:o}={...(0,i.R)(),...e.components};return o?(0,n.jsx)(o,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},82422:(e,o,t)=>{t.d(o,{A:()=>n});const n=t.p+"assets/images/login-7194fb115da3e43cb1d8ca36b1ace509.png"},28453:(e,o,t)=>{t.d(o,{R:()=>s,x:()=>r});var n=t(96540);const i={},a=n.createContext(i);function s(e){const o=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),n.createElement(a.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9307d943.6c03608e.js b/assets/js/9307d943.8c488540.js similarity index 98% rename from assets/js/9307d943.6c03608e.js rename to assets/js/9307d943.8c488540.js index 263af0c8c..79e14a52d 100644 --- a/assets/js/9307d943.6c03608e.js +++ b/assets/js/9307d943.8c488540.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7194],{94548:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var s=t(74848),n=t(28453);const i={title:"Google Workspace logs",hide_title:!0,sidebar_position:10},r="How to Import Google Workspace Logs",c={id:"cado/discovery-import/google-workspace-logs",title:"Google Workspace logs",description:"Introduction",source:"@site/docs/cado/discovery-import/google-workspace-logs.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/google-workspace-logs",permalink:"/cado/discovery-import/google-workspace-logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/google-workspace-logs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:10,frontMatter:{title:"Google Workspace logs",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Kubernetes",permalink:"/cado/discovery-import/kubernetes"},next:{title:"Microsoft 365 and Entra ID",permalink:"/cado/discovery-import/m365-logs"}},a={},l=[{value:"Introduction",id:"introduction",level:3},{value:"Log Acquisition",id:"log-acquisition",level:3},{value:"Log Field Mapping",id:"log-field-mapping",level:3}];function d(e){const o={a:"a",br:"br",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(o.h1,{id:"how-to-import-google-workspace-logs",children:"How to Import Google Workspace Logs"}),"\n",(0,s.jsx)(o.h3,{id:"introduction",children:"Introduction"}),"\n",(0,s.jsxs)(o.p,{children:["The Cado platform supports the acquisition and processing of Google Workspace logs. Activity logs from various Google Workspace applications can be captured, as listed ",(0,s.jsx)(o.a,{href:"https://developers.google.com/admin-sdk/reports/reference/rest/v1/activities",children:"here"}),"."]}),"\n",(0,s.jsxs)(o.p,{children:['Note: This feature is currently in Beta. To use it, enable the "SaaS Imports" feature on the ',(0,s.jsx)(o.strong,{children:"/settings/experiments"})," page."]}),"\n",(0,s.jsx)(o.p,{children:"Before importing Google Workspace logs into Cado, follow these steps:"}),"\n",(0,s.jsxs)(o.ol,{children:["\n",(0,s.jsxs)(o.li,{children:["Ensure that ",(0,s.jsx)(o.strong,{children:"Workspace API access"})," for your Google Cloud project is enabled (Admin SDK API access)."]}),"\n"]}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:["Open the ",(0,s.jsx)(o.a,{href:"https://console.cloud.google.com/workspace-api/products",children:"product library in Google Cloud"})]}),"\n"]}),"\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.img,{alt:"SDK 1",src:t(40714).A+"",width:"1916",height:"1190"}),"\n",(0,s.jsx)(o.img,{alt:"SDK 1",src:t(89697).A+"",width:"2632",height:"1078"})]}),"\n",(0,s.jsxs)(o.ol,{start:"2",children:["\n",(0,s.jsxs)(o.li,{children:["Enable the ",(0,s.jsx)(o.a,{href:"https://developers.google.com/workspace/guides/configure-oauth-consent",children:"Internal OAuth Consent Screen"})," to allow authentication with a service account."]}),"\n"]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"OAuth Consent Screen",src:t(58223).A+"",width:"1292",height:"1534"})}),"\n",(0,s.jsxs)(o.ol,{start:"3",children:["\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.a,{href:"https://developers.google.com/identity/protocols/oauth2/service-account",children:"Create a service account"})," in Google Cloud, and download the JSON file of the access key created for the service account."]}),"\n"]}),"\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:["Note the email address of a ",(0,s.jsx)(o.strong,{children:"Google Workspace admin account"})," for the Impersonation Email field, which will be entered into the Cado platform."]}),"\n"]}),"\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:["Grant the service account permission to access the Workspace API via ",(0,s.jsx)(o.strong,{children:"domain-wide delegation"}),", with read-only access to audit logs:",(0,s.jsx)(o.br,{}),"\n",(0,s.jsx)(o.code,{children:"https://www.googleapis.com/auth/admin.reports.audit.readonly"}),"."]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(o.h3,{id:"log-acquisition",children:"Log Acquisition"}),"\n",(0,s.jsxs)(o.p,{children:["After completing the setup, you can add the service account credentials to the Cado platform by navigating to ",(0,s.jsx)(o.strong,{children:"Settings > Accounts"})," and selecting ",(0,s.jsx)(o.strong,{children:"Create an account"}),". Select ",(0,s.jsx)(o.strong,{children:"Google Workspace"})," from the set of providers. Provide the following details:"]}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Name"}),": A friendly name for your credentials, such as \u201cGoogle Workspace.\u201d"]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Impersonation Email"}),": The Google Workspace admin email."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Service Account Credentials"}),": Upload the JSON file for the service account."]}),"\n"]}),"\n",(0,s.jsx)(o.p,{children:"Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'. Navigate to the 'Accounts' table and the newly created Google Workspace account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,s.jsxs)(o.p,{children:["Once the credentials are set, you can acquire Google Workspace logs. In an investigation, use the import wizard and select ",(0,s.jsx)(o.strong,{children:"SaaS"}),", then choose ",(0,s.jsx)(o.strong,{children:"Google Workspace"}),"."]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Google Workspace - Import",src:t(37080).A+"",width:"1910",height:"1164"})}),"\n",(0,s.jsx)(o.p,{children:"Next, select the credentials you entered in the integrations page."}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Google Workspace - Select credentials",src:t(13231).A+"",width:"5098",height:"1120"})}),"\n",(0,s.jsx)(o.p,{children:"You will then have the option to refine the acquisition by timeframe, application, or user."}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Google Workspace - Import Configuration",src:t(87109).A+"",width:"3132",height:"1240"})}),"\n",(0,s.jsx)(o.p,{children:"Review your selections and proceed with the import. Once the acquisition and processing are complete, the logs will be available for viewing and searching on the main timeline page."}),"\n",(0,s.jsx)(o.h3,{id:"log-field-mapping",children:"Log Field Mapping"}),"\n",(0,s.jsx)(o.p,{children:"To help with analysis, certain Google Workspace fields are mapped to Cado fields:"}),"\n",(0,s.jsxs)(o.table,{children:[(0,s.jsx)(o.thead,{children:(0,s.jsxs)(o.tr,{children:[(0,s.jsx)(o.th,{children:"Google Workspace Field"}),(0,s.jsx)(o.th,{children:"Cado Field"}),(0,s.jsx)(o.th,{children:"Cado Facet Name"})]})}),(0,s.jsxs)(o.tbody,{children:[(0,s.jsxs)(o.tr,{children:[(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"ipAddress"})}),(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"source_hostname"})}),(0,s.jsx)(o.td,{children:"Source Hostname"})]}),(0,s.jsxs)(o.tr,{children:[(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"actor.email"})}),(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"user"})}),(0,s.jsx)(o.td,{children:"Users"})]}),(0,s.jsxs)(o.tr,{children:[(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"id.applicationName"})}),(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"sourcetype"})}),(0,s.jsx)(o.td,{children:"Datatype"})]})]})]}),"\n",(0,s.jsx)(o.p,{children:"For example, you can filter the dataset by the 'Mobile' application by selecting it under the \"Datatype\" facet."}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Google Workspace - Timeline Filtering",src:t(90582).A+"",width:"1220",height:"667"})})]})}function h(e={}){const{wrapper:o}={...(0,n.R)(),...e.components};return o?(0,s.jsx)(o,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},87109:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gws-import-config-0bd91b68e7637090aa49a35b6a67f8a4.png"},13231:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gws-import-select-creds-4ef08d6ac74736145fd2332e3d69f582.png"},37080:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gws-import-00ec980218ac5393140899cfef741900.png"},90582:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gws-timeline-a83039851137ee397b07c2445faf5549.png"},58223:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/oauth_consent-1359432c28ee523ed987d70de51cbefa.png"},40714:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/workspace_sdk1-f47b33b6981c60ea38750293b80ea803.png"},89697:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/workspace_sdk2-a4854ed809e6105cbd04764a29adbc96.png"},28453:(e,o,t)=>{t.d(o,{R:()=>r,x:()=>c});var s=t(96540);const n={},i=s.createContext(n);function r(e){const o=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),s.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7194],{94548:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var s=t(74848),n=t(28453);const i={title:"Google Workspace logs",hide_title:!0,sidebar_position:10},r="How to Import Google Workspace Logs",c={id:"cado/discovery-import/google-workspace-logs",title:"Google Workspace logs",description:"Introduction",source:"@site/docs/cado/discovery-import/google-workspace-logs.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/google-workspace-logs",permalink:"/cado/discovery-import/google-workspace-logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/google-workspace-logs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:10,frontMatter:{title:"Google Workspace logs",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Kubernetes",permalink:"/cado/discovery-import/kubernetes"},next:{title:"Microsoft 365 and Entra ID",permalink:"/cado/discovery-import/m365-logs"}},a={},l=[{value:"Introduction",id:"introduction",level:3},{value:"Log Acquisition",id:"log-acquisition",level:3},{value:"Log Field Mapping",id:"log-field-mapping",level:3}];function d(e){const o={a:"a",br:"br",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(o.h1,{id:"how-to-import-google-workspace-logs",children:"How to Import Google Workspace Logs"}),"\n",(0,s.jsx)(o.h3,{id:"introduction",children:"Introduction"}),"\n",(0,s.jsxs)(o.p,{children:["The Cado platform supports the acquisition and processing of Google Workspace logs. Activity logs from various Google Workspace applications can be captured, as listed ",(0,s.jsx)(o.a,{href:"https://developers.google.com/admin-sdk/reports/reference/rest/v1/activities",children:"here"}),"."]}),"\n",(0,s.jsxs)(o.p,{children:['Note: This feature is currently in Beta. To use it, enable the "SaaS Imports" feature on the ',(0,s.jsx)(o.strong,{children:"/settings/experiments"})," page."]}),"\n",(0,s.jsx)(o.p,{children:"Before importing Google Workspace logs into Cado, follow these steps:"}),"\n",(0,s.jsxs)(o.ol,{children:["\n",(0,s.jsxs)(o.li,{children:["Ensure that ",(0,s.jsx)(o.strong,{children:"Workspace API access"})," for your Google Cloud project is enabled (Admin SDK API access)."]}),"\n"]}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:["Open the ",(0,s.jsx)(o.a,{href:"https://console.cloud.google.com/workspace-api/products",children:"product library in Google Cloud"})]}),"\n"]}),"\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.img,{alt:"SDK 1",src:t(40714).A+"",width:"1916",height:"1190"}),"\n",(0,s.jsx)(o.img,{alt:"SDK 1",src:t(89697).A+"",width:"2632",height:"1078"})]}),"\n",(0,s.jsxs)(o.ol,{start:"2",children:["\n",(0,s.jsxs)(o.li,{children:["Enable the ",(0,s.jsx)(o.a,{href:"https://developers.google.com/workspace/guides/configure-oauth-consent",children:"Internal OAuth Consent Screen"})," to allow authentication with a service account."]}),"\n"]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"OAuth Consent Screen",src:t(58223).A+"",width:"1292",height:"1534"})}),"\n",(0,s.jsxs)(o.ol,{start:"3",children:["\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:[(0,s.jsx)(o.a,{href:"https://developers.google.com/identity/protocols/oauth2/service-account",children:"Create a service account"})," in Google Cloud, and download the JSON file of the access key created for the service account."]}),"\n"]}),"\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:["Note the email address of a ",(0,s.jsx)(o.strong,{children:"Google Workspace admin account"})," for the Impersonation Email field, which will be entered into the Cado platform."]}),"\n"]}),"\n",(0,s.jsxs)(o.li,{children:["\n",(0,s.jsxs)(o.p,{children:["Grant the service account permission to access the Workspace API via ",(0,s.jsx)(o.strong,{children:"domain-wide delegation"}),", with read-only access to audit logs:",(0,s.jsx)(o.br,{}),"\n",(0,s.jsx)(o.code,{children:"https://www.googleapis.com/auth/admin.reports.audit.readonly"}),"."]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(o.h3,{id:"log-acquisition",children:"Log Acquisition"}),"\n",(0,s.jsxs)(o.p,{children:["After completing the setup, you can add the service account credentials to the Cado platform by navigating to ",(0,s.jsx)(o.strong,{children:"Settings > Accounts"})," and selecting ",(0,s.jsx)(o.strong,{children:"Create an account"}),". Select ",(0,s.jsx)(o.strong,{children:"Google Workspace"})," from the set of providers. Provide the following details:"]}),"\n",(0,s.jsxs)(o.ul,{children:["\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Name"}),": A friendly name for your credentials, such as \u201cGoogle Workspace.\u201d"]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Impersonation Email"}),": The Google Workspace admin email."]}),"\n",(0,s.jsxs)(o.li,{children:[(0,s.jsx)(o.strong,{children:"Service Account Credentials"}),": Upload the JSON file for the service account."]}),"\n"]}),"\n",(0,s.jsx)(o.p,{children:"Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'. Navigate to the 'Accounts' table and the newly created Google Workspace account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,s.jsxs)(o.p,{children:["Once the credentials are set, you can acquire Google Workspace logs. In an investigation, use the import wizard and select ",(0,s.jsx)(o.strong,{children:"SaaS"}),", then choose ",(0,s.jsx)(o.strong,{children:"Google Workspace"}),"."]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Google Workspace - Import",src:t(37080).A+"",width:"1910",height:"1164"})}),"\n",(0,s.jsx)(o.p,{children:"Next, select the credentials you entered in the integrations page."}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Google Workspace - Select credentials",src:t(13231).A+"",width:"5098",height:"1120"})}),"\n",(0,s.jsx)(o.p,{children:"You will then have the option to refine the acquisition by timeframe, application, or user."}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Google Workspace - Import Configuration",src:t(87109).A+"",width:"3132",height:"1240"})}),"\n",(0,s.jsx)(o.p,{children:"Review your selections and proceed with the import. Once the acquisition and processing are complete, the logs will be available for viewing and searching on the main timeline page."}),"\n",(0,s.jsx)(o.h3,{id:"log-field-mapping",children:"Log Field Mapping"}),"\n",(0,s.jsx)(o.p,{children:"To help with analysis, certain Google Workspace fields are mapped to Cado fields:"}),"\n",(0,s.jsxs)(o.table,{children:[(0,s.jsx)(o.thead,{children:(0,s.jsxs)(o.tr,{children:[(0,s.jsx)(o.th,{children:"Google Workspace Field"}),(0,s.jsx)(o.th,{children:"Cado Field"}),(0,s.jsx)(o.th,{children:"Cado Facet Name"})]})}),(0,s.jsxs)(o.tbody,{children:[(0,s.jsxs)(o.tr,{children:[(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"ipAddress"})}),(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"source_hostname"})}),(0,s.jsx)(o.td,{children:"Source Hostname"})]}),(0,s.jsxs)(o.tr,{children:[(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"actor.email"})}),(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"user"})}),(0,s.jsx)(o.td,{children:"Users"})]}),(0,s.jsxs)(o.tr,{children:[(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"id.applicationName"})}),(0,s.jsx)(o.td,{children:(0,s.jsx)(o.code,{children:"sourcetype"})}),(0,s.jsx)(o.td,{children:"Datatype"})]})]})]}),"\n",(0,s.jsx)(o.p,{children:"For example, you can filter the dataset by the 'Mobile' application by selecting it under the \"Datatype\" facet."}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"Google Workspace - Timeline Filtering",src:t(90582).A+"",width:"1220",height:"667"})})]})}function h(e={}){const{wrapper:o}={...(0,n.R)(),...e.components};return o?(0,s.jsx)(o,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},87109:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gws-import-config-0bd91b68e7637090aa49a35b6a67f8a4.png"},13231:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gws-import-select-creds-4ef08d6ac74736145fd2332e3d69f582.png"},37080:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gws-import-00ec980218ac5393140899cfef741900.png"},90582:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/gws-timeline-a83039851137ee397b07c2445faf5549.png"},58223:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/oauth_consent-1359432c28ee523ed987d70de51cbefa.png"},40714:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/workspace_sdk1-f47b33b6981c60ea38750293b80ea803.png"},89697:(e,o,t)=>{t.d(o,{A:()=>s});const s=t.p+"assets/images/workspace_sdk2-a4854ed809e6105cbd04764a29adbc96.png"},28453:(e,o,t)=>{t.d(o,{R:()=>r,x:()=>c});var s=t(96540);const n={},i=s.createContext(n);function r(e){const o=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),s.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/95dc77a9.ddb9a621.js b/assets/js/95dc77a9.055c04ac.js similarity index 99% rename from assets/js/95dc77a9.ddb9a621.js rename to assets/js/95dc77a9.055c04ac.js index 552d29b9b..2220c7a5e 100644 --- a/assets/js/95dc77a9.ddb9a621.js +++ b/assets/js/95dc77a9.055c04ac.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2898],{71770:(e,i,s)=>{s.r(i),s.d(i,{assets:()=>l,contentTitle:()=>n,default:()=>a,frontMatter:()=>t,metadata:()=>c,toc:()=>h});var d=s(74848),r=s(28453);const t={title:"Timeline Search",hide_title:!0,sidebar_position:3},n="What is the Timeline Tab?",c={id:"cado/investigate/timeline-search",title:"Timeline Search",description:"The Timeline tab in the Cado platform provides an advanced search interface that supports complex queries to help you filter and analyze investigation data efficiently.",source:"@site/docs/cado/investigate/timeline-search.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/timeline-search",permalink:"/cado/investigate/timeline-search",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/timeline-search.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Timeline Search",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Overview Tab",permalink:"/cado/investigate/overview"},next:{title:"Automated Investigation",permalink:"/cado/investigate/automated-investigation"}},l={},h=[{value:"Faceted Search",id:"faceted-search",level:3},{value:"Basic Searches",id:"basic-searches",level:3},{value:"Plain Search Terms",id:"plain-search-terms",level:4},{value:"Field-Specific Searches",id:"field-specific-searches",level:4},{value:"Ranges",id:"ranges",level:4},{value:"Building Complex Queries",id:"building-complex-queries",level:3},{value:"Searchable Fields",id:"searchable-fields",level:2},{value:"Notes on Search Behavior:",id:"notes-on-search-behavior",level:3}];function o(e){const i={admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(i.h1,{id:"what-is-the-timeline-tab",children:"What is the Timeline Tab?"}),"\n",(0,d.jsxs)(i.p,{children:["The ",(0,d.jsx)(i.strong,{children:"Timeline"})," tab in the Cado platform provides an advanced search interface that supports complex queries to help you filter and analyze investigation data efficiently."]}),"\n",(0,d.jsx)(i.h3,{id:"faceted-search",children:"Faceted Search"}),"\n",(0,d.jsxs)(i.p,{children:["Cado enables you to filter search results using ",(0,d.jsx)(i.strong,{children:"facets"}),", such as event severity, associated usernames, files, or source/destination IP addresses."]}),"\n",(0,d.jsx)(i.p,{children:(0,d.jsx)(i.img,{alt:"Faceted Search",src:s(89954).A+"",width:"1851",height:"852"})}),"\n",(0,d.jsx)(i.p,{children:"For long lists of facets, you can easily search and sort through them."}),"\n",(0,d.jsx)(i.p,{children:(0,d.jsx)(i.img,{alt:"Faceted List",src:s(88843).A+"",width:"1503",height:"752"})}),"\n",(0,d.jsx)(i.h3,{id:"basic-searches",children:"Basic Searches"}),"\n",(0,d.jsx)(i.p,{children:"You can also use the search bar to perform specific queries using search strings."}),"\n",(0,d.jsx)(i.h4,{id:"plain-search-terms",children:"Plain Search Terms"}),"\n",(0,d.jsxs)(i.p,{children:["A plain search term will search across all fields. For example: ",(0,d.jsx)(i.code,{children:"foo"})]}),"\n",(0,d.jsxs)(i.p,{children:["If the term contains spaces, enclose it in quotes: ",(0,d.jsx)(i.code,{children:'"foo bar"'})]}),"\n",(0,d.jsx)(i.h4,{id:"field-specific-searches",children:"Field-Specific Searches"}),"\n",(0,d.jsx)(i.p,{children:"To search within a specific field, prepend the field name to the search term. For example:"}),"\n",(0,d.jsxs)(i.ul,{children:["\n",(0,d.jsx)(i.li,{children:(0,d.jsx)(i.code,{children:"user: Chris"})}),"\n",(0,d.jsx)(i.li,{children:(0,d.jsx)(i.code,{children:'extra: "foo bar"'})}),"\n"]}),"\n",(0,d.jsx)(i.h4,{id:"ranges",children:"Ranges"}),"\n",(0,d.jsx)(i.p,{children:"You can search for a range of values within a field. For example:"}),"\n",(0,d.jsxs)(i.ul,{children:["\n",(0,d.jsx)(i.li,{children:(0,d.jsx)(i.code,{children:"file_size: [1024 TO 8196]"})}),"\n"]}),"\n",(0,d.jsx)(i.h3,{id:"building-complex-queries",children:"Building Complex Queries"}),"\n",(0,d.jsxs)(i.p,{children:["You can combine search terms using ",(0,d.jsx)(i.code,{children:"AND"}),", ",(0,d.jsx)(i.code,{children:"OR"}),", and ",(0,d.jsx)(i.code,{children:"NOT"}),", and use parentheses to group them:"]}),"\n",(0,d.jsx)(i.p,{children:"Example:"}),"\n",(0,d.jsx)(i.pre,{children:(0,d.jsx)(i.code,{children:'alarm_severity: [0 TO 5] AND (user: "Chris" OR user: "James") AND NOT filename: "/foo/bar.txt"\n'})}),"\n",(0,d.jsxs)(i.admonition,{type:"info",children:[(0,d.jsxs)(i.p,{children:["Without parentheses, ",(0,d.jsx)(i.code,{children:"AND"})," operations are evaluated before ",(0,d.jsx)(i.code,{children:"OR"}),". For example:"]}),(0,d.jsx)(i.pre,{children:(0,d.jsx)(i.code,{children:'user: "Chris" AND user: "James" OR filename: "/foo/bar.txt"\n'})}),(0,d.jsx)(i.p,{children:"is treated as:"}),(0,d.jsx)(i.pre,{children:(0,d.jsx)(i.code,{children:'(user: "Chris" AND user: "James") OR filename: "/foo/bar.txt"\n'})})]}),"\n",(0,d.jsx)(i.h2,{id:"searchable-fields",children:"Searchable Fields"}),"\n",(0,d.jsx)(i.p,{children:"The following fields are searchable:"}),"\n",(0,d.jsxs)(i.table,{children:[(0,d.jsx)(i.thead,{children:(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.th,{children:"Field"}),(0,d.jsx)(i.th,{children:"Type"}),(0,d.jsx)(i.th,{children:"Description"})]})}),(0,d.jsxs)(i.tbody,{children:[(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"macb"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["A 4-character string encoding MACB information (e.g., ",(0,d.jsx)(i.code,{children:"M..B"})," for Modified and Birth events)."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"source"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["The type of file or data producing this event (e.g., ",(0,d.jsx)(i.code,{children:"EVT"}),", ",(0,d.jsx)(i.code,{children:"CLOUDTRAIL"}),", ",(0,d.jsx)(i.code,{children:"FILE"}),")."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"sourcetype"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["More specific subtype of ",(0,d.jsx)(i.code,{children:"source"}),"."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"type"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["A ",(0,d.jsx)(i.code,{children:";"})," separated list of event types (e.g., ",(0,d.jsx)(i.code,{children:"Last Executed Time"}),", ",(0,d.jsx)(i.code,{children:"Updated Time"}),", ",(0,d.jsx)(i.code,{children:"Creation Time"}),")."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"user"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The user associated with the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"host"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The hostname linked to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"filename"})}),(0,d.jsx)(i.td,{children:"special"}),(0,d.jsx)(i.td,{children:"The path of the file related to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"full_filename"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The full path of the file, supports regex and must match the entire path."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"inode"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The inode number of the file."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"source_hostname"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The source hostname for network connections."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"destination_hostname"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The destination hostname for network connections."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"tag"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["Tag representing the event type (e.g., ",(0,d.jsx)(i.code,{children:"Network Logon"}),", ",(0,d.jsx)(i.code,{children:"File Access"}),", ",(0,d.jsx)(i.code,{children:"Execution"}),")."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"executed_process"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The path of an executed file, if detected."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"short"})}),(0,d.jsx)(i.td,{children:"text"}),(0,d.jsx)(i.td,{children:"Short text providing additional event details."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"extra"})}),(0,d.jsx)(i.td,{children:"text"}),(0,d.jsxs)(i.td,{children:["Additional data from the raw event, longer than ",(0,d.jsx)(i.code,{children:"short"}),"."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"alarm_severity"})}),(0,d.jsx)(i.td,{children:"int"}),(0,d.jsxs)(i.td,{children:["Severity of the event (Malicious: ",(0,d.jsx)(i.code,{children:"1"}),", Suspicious: ",(0,d.jsx)(i.code,{children:"3"}),", Other: ",(0,d.jsx)(i.code,{children:"10"}),")."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"isFolder"})}),(0,d.jsx)(i.td,{children:"boolean"}),(0,d.jsx)(i.td,{children:"Whether the event is related to a folder."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"evidence_id"})}),(0,d.jsx)(i.td,{children:"int"}),(0,d.jsx)(i.td,{children:"ID of the evidence item."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"timestamp"})}),(0,d.jsx)(i.td,{children:"int"}),(0,d.jsx)(i.td,{children:"Unix timestamp of the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"file_size"})}),(0,d.jsx)(i.td,{children:"int"}),(0,d.jsx)(i.td,{children:"The size of the file related to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"sha256"})}),(0,d.jsx)(i.td,{children:"text"}),(0,d.jsx)(i.td,{children:"SHA-256 hash of the file related to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"strings"})}),(0,d.jsx)(i.td,{children:"text"}),(0,d.jsx)(i.td,{children:"Extracted strings from the file related to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"is_starred"})}),(0,d.jsx)(i.td,{children:"bool"}),(0,d.jsx)(i.td,{children:"Whether the event is starred."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"for_report"})}),(0,d.jsx)(i.td,{children:"bool"}),(0,d.jsx)(i.td,{children:"Whether the event is included in a report."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"alarm_description"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"A short description explaining the reason for an alarm."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"alarm_attack"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"MITRE ATT&CK tactic or technique code."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"attribute_name"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["File attribute information (e.g., ",(0,d.jsx)(i.code,{children:"$STANDARD_INFORMATION"}),", ",(0,d.jsx)(i.code,{children:"$FILENAME"}),")."]})]})]})]}),"\n",(0,d.jsx)(i.h3,{id:"notes-on-search-behavior",children:"Notes on Search Behavior:"}),"\n",(0,d.jsxs)(i.ul,{children:["\n",(0,d.jsxs)(i.li,{children:["Fields of type ",(0,d.jsx)(i.code,{children:"int"})," or ",(0,d.jsx)(i.code,{children:"keyword"})," require exact matches."]}),"\n",(0,d.jsxs)(i.li,{children:["Wildcard characters (",(0,d.jsx)(i.code,{children:"*"})," for multiple, ",(0,d.jsx)(i.code,{children:"?"})," for single) can be used in ",(0,d.jsx)(i.code,{children:"keyword"})," fields."]}),"\n",(0,d.jsxs)(i.li,{children:["Fields of type ",(0,d.jsx)(i.code,{children:"text"})," support partial matches."]}),"\n"]}),"\n",(0,d.jsx)(i.p,{children:"Example:"}),"\n",(0,d.jsxs)(i.ul,{children:["\n",(0,d.jsxs)(i.li,{children:[(0,d.jsx)(i.code,{children:"user: chris"})," matches ",(0,d.jsx)(i.code,{children:"user"})," field with value ",(0,d.jsx)(i.code,{children:"chris"}),"."]}),"\n",(0,d.jsxs)(i.li,{children:[(0,d.jsx)(i.code,{children:"user: ch*"})," matches ",(0,d.jsx)(i.code,{children:"chris"})," or any string starting with ",(0,d.jsx)(i.code,{children:"ch"}),"."]}),"\n",(0,d.jsxs)(i.li,{children:[(0,d.jsx)(i.code,{children:"user: ch"})," does not match as it requires a full or wildcard match."]}),"\n"]}),"\n",(0,d.jsxs)(i.p,{children:["Searching ",(0,d.jsx)(i.code,{children:"strings: content"})," will return events with matching data, such as ",(0,d.jsx)(i.code,{children:'"This is some example content."'}),"."]})]})}function a(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,d.jsx)(i,{...e,children:(0,d.jsx)(o,{...e})}):o(e)}},88843:(e,i,s)=>{s.d(i,{A:()=>d});const d=s.p+"assets/images/facet-list-a1d065c77242caa2c6cbdfc13f04fb9c.png"},89954:(e,i,s)=>{s.d(i,{A:()=>d});const d=s.p+"assets/images/faceted-search-daeb0f7d4da312b1abe08c856d072193.png"},28453:(e,i,s)=>{s.d(i,{R:()=>n,x:()=>c});var d=s(96540);const r={},t=d.createContext(r);function n(e){const i=d.useContext(t);return d.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function c(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:n(e.components),d.createElement(t.Provider,{value:i},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2898],{71770:(e,i,s)=>{s.r(i),s.d(i,{assets:()=>l,contentTitle:()=>n,default:()=>a,frontMatter:()=>t,metadata:()=>c,toc:()=>h});var d=s(74848),r=s(28453);const t={title:"Timeline Search",hide_title:!0,sidebar_position:3},n="What is the Timeline Tab?",c={id:"cado/investigate/timeline-search",title:"Timeline Search",description:"The Timeline tab in the Cado platform provides an advanced search interface that supports complex queries to help you filter and analyze investigation data efficiently.",source:"@site/docs/cado/investigate/timeline-search.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/timeline-search",permalink:"/cado/investigate/timeline-search",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/timeline-search.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Timeline Search",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Overview Tab",permalink:"/cado/investigate/overview"},next:{title:"Automated Investigation",permalink:"/cado/investigate/automated-investigation"}},l={},h=[{value:"Faceted Search",id:"faceted-search",level:3},{value:"Basic Searches",id:"basic-searches",level:3},{value:"Plain Search Terms",id:"plain-search-terms",level:4},{value:"Field-Specific Searches",id:"field-specific-searches",level:4},{value:"Ranges",id:"ranges",level:4},{value:"Building Complex Queries",id:"building-complex-queries",level:3},{value:"Searchable Fields",id:"searchable-fields",level:2},{value:"Notes on Search Behavior:",id:"notes-on-search-behavior",level:3}];function o(e){const i={admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(i.h1,{id:"what-is-the-timeline-tab",children:"What is the Timeline Tab?"}),"\n",(0,d.jsxs)(i.p,{children:["The ",(0,d.jsx)(i.strong,{children:"Timeline"})," tab in the Cado platform provides an advanced search interface that supports complex queries to help you filter and analyze investigation data efficiently."]}),"\n",(0,d.jsx)(i.h3,{id:"faceted-search",children:"Faceted Search"}),"\n",(0,d.jsxs)(i.p,{children:["Cado enables you to filter search results using ",(0,d.jsx)(i.strong,{children:"facets"}),", such as event severity, associated usernames, files, or source/destination IP addresses."]}),"\n",(0,d.jsx)(i.p,{children:(0,d.jsx)(i.img,{alt:"Faceted Search",src:s(89954).A+"",width:"1851",height:"852"})}),"\n",(0,d.jsx)(i.p,{children:"For long lists of facets, you can easily search and sort through them."}),"\n",(0,d.jsx)(i.p,{children:(0,d.jsx)(i.img,{alt:"Faceted List",src:s(88843).A+"",width:"1503",height:"752"})}),"\n",(0,d.jsx)(i.h3,{id:"basic-searches",children:"Basic Searches"}),"\n",(0,d.jsx)(i.p,{children:"You can also use the search bar to perform specific queries using search strings."}),"\n",(0,d.jsx)(i.h4,{id:"plain-search-terms",children:"Plain Search Terms"}),"\n",(0,d.jsxs)(i.p,{children:["A plain search term will search across all fields. For example: ",(0,d.jsx)(i.code,{children:"foo"})]}),"\n",(0,d.jsxs)(i.p,{children:["If the term contains spaces, enclose it in quotes: ",(0,d.jsx)(i.code,{children:'"foo bar"'})]}),"\n",(0,d.jsx)(i.h4,{id:"field-specific-searches",children:"Field-Specific Searches"}),"\n",(0,d.jsx)(i.p,{children:"To search within a specific field, prepend the field name to the search term. For example:"}),"\n",(0,d.jsxs)(i.ul,{children:["\n",(0,d.jsx)(i.li,{children:(0,d.jsx)(i.code,{children:"user: Chris"})}),"\n",(0,d.jsx)(i.li,{children:(0,d.jsx)(i.code,{children:'extra: "foo bar"'})}),"\n"]}),"\n",(0,d.jsx)(i.h4,{id:"ranges",children:"Ranges"}),"\n",(0,d.jsx)(i.p,{children:"You can search for a range of values within a field. For example:"}),"\n",(0,d.jsxs)(i.ul,{children:["\n",(0,d.jsx)(i.li,{children:(0,d.jsx)(i.code,{children:"file_size: [1024 TO 8196]"})}),"\n"]}),"\n",(0,d.jsx)(i.h3,{id:"building-complex-queries",children:"Building Complex Queries"}),"\n",(0,d.jsxs)(i.p,{children:["You can combine search terms using ",(0,d.jsx)(i.code,{children:"AND"}),", ",(0,d.jsx)(i.code,{children:"OR"}),", and ",(0,d.jsx)(i.code,{children:"NOT"}),", and use parentheses to group them:"]}),"\n",(0,d.jsx)(i.p,{children:"Example:"}),"\n",(0,d.jsx)(i.pre,{children:(0,d.jsx)(i.code,{children:'alarm_severity: [0 TO 5] AND (user: "Chris" OR user: "James") AND NOT filename: "/foo/bar.txt"\n'})}),"\n",(0,d.jsxs)(i.admonition,{type:"info",children:[(0,d.jsxs)(i.p,{children:["Without parentheses, ",(0,d.jsx)(i.code,{children:"AND"})," operations are evaluated before ",(0,d.jsx)(i.code,{children:"OR"}),". For example:"]}),(0,d.jsx)(i.pre,{children:(0,d.jsx)(i.code,{children:'user: "Chris" AND user: "James" OR filename: "/foo/bar.txt"\n'})}),(0,d.jsx)(i.p,{children:"is treated as:"}),(0,d.jsx)(i.pre,{children:(0,d.jsx)(i.code,{children:'(user: "Chris" AND user: "James") OR filename: "/foo/bar.txt"\n'})})]}),"\n",(0,d.jsx)(i.h2,{id:"searchable-fields",children:"Searchable Fields"}),"\n",(0,d.jsx)(i.p,{children:"The following fields are searchable:"}),"\n",(0,d.jsxs)(i.table,{children:[(0,d.jsx)(i.thead,{children:(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.th,{children:"Field"}),(0,d.jsx)(i.th,{children:"Type"}),(0,d.jsx)(i.th,{children:"Description"})]})}),(0,d.jsxs)(i.tbody,{children:[(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"macb"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["A 4-character string encoding MACB information (e.g., ",(0,d.jsx)(i.code,{children:"M..B"})," for Modified and Birth events)."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"source"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["The type of file or data producing this event (e.g., ",(0,d.jsx)(i.code,{children:"EVT"}),", ",(0,d.jsx)(i.code,{children:"CLOUDTRAIL"}),", ",(0,d.jsx)(i.code,{children:"FILE"}),")."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"sourcetype"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["More specific subtype of ",(0,d.jsx)(i.code,{children:"source"}),"."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"type"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["A ",(0,d.jsx)(i.code,{children:";"})," separated list of event types (e.g., ",(0,d.jsx)(i.code,{children:"Last Executed Time"}),", ",(0,d.jsx)(i.code,{children:"Updated Time"}),", ",(0,d.jsx)(i.code,{children:"Creation Time"}),")."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"user"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The user associated with the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"host"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The hostname linked to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"filename"})}),(0,d.jsx)(i.td,{children:"special"}),(0,d.jsx)(i.td,{children:"The path of the file related to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"full_filename"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The full path of the file, supports regex and must match the entire path."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"inode"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The inode number of the file."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"source_hostname"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The source hostname for network connections."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"destination_hostname"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The destination hostname for network connections."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"tag"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["Tag representing the event type (e.g., ",(0,d.jsx)(i.code,{children:"Network Logon"}),", ",(0,d.jsx)(i.code,{children:"File Access"}),", ",(0,d.jsx)(i.code,{children:"Execution"}),")."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"executed_process"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"The path of an executed file, if detected."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"short"})}),(0,d.jsx)(i.td,{children:"text"}),(0,d.jsx)(i.td,{children:"Short text providing additional event details."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"extra"})}),(0,d.jsx)(i.td,{children:"text"}),(0,d.jsxs)(i.td,{children:["Additional data from the raw event, longer than ",(0,d.jsx)(i.code,{children:"short"}),"."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"alarm_severity"})}),(0,d.jsx)(i.td,{children:"int"}),(0,d.jsxs)(i.td,{children:["Severity of the event (Malicious: ",(0,d.jsx)(i.code,{children:"1"}),", Suspicious: ",(0,d.jsx)(i.code,{children:"3"}),", Other: ",(0,d.jsx)(i.code,{children:"10"}),")."]})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"isFolder"})}),(0,d.jsx)(i.td,{children:"boolean"}),(0,d.jsx)(i.td,{children:"Whether the event is related to a folder."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"evidence_id"})}),(0,d.jsx)(i.td,{children:"int"}),(0,d.jsx)(i.td,{children:"ID of the evidence item."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"timestamp"})}),(0,d.jsx)(i.td,{children:"int"}),(0,d.jsx)(i.td,{children:"Unix timestamp of the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"file_size"})}),(0,d.jsx)(i.td,{children:"int"}),(0,d.jsx)(i.td,{children:"The size of the file related to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"sha256"})}),(0,d.jsx)(i.td,{children:"text"}),(0,d.jsx)(i.td,{children:"SHA-256 hash of the file related to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"strings"})}),(0,d.jsx)(i.td,{children:"text"}),(0,d.jsx)(i.td,{children:"Extracted strings from the file related to the event."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"is_starred"})}),(0,d.jsx)(i.td,{children:"bool"}),(0,d.jsx)(i.td,{children:"Whether the event is starred."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"for_report"})}),(0,d.jsx)(i.td,{children:"bool"}),(0,d.jsx)(i.td,{children:"Whether the event is included in a report."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"alarm_description"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"A short description explaining the reason for an alarm."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"alarm_attack"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsx)(i.td,{children:"MITRE ATT&CK tactic or technique code."})]}),(0,d.jsxs)(i.tr,{children:[(0,d.jsx)(i.td,{children:(0,d.jsx)(i.code,{children:"attribute_name"})}),(0,d.jsx)(i.td,{children:"keyword"}),(0,d.jsxs)(i.td,{children:["File attribute information (e.g., ",(0,d.jsx)(i.code,{children:"$STANDARD_INFORMATION"}),", ",(0,d.jsx)(i.code,{children:"$FILENAME"}),")."]})]})]})]}),"\n",(0,d.jsx)(i.h3,{id:"notes-on-search-behavior",children:"Notes on Search Behavior:"}),"\n",(0,d.jsxs)(i.ul,{children:["\n",(0,d.jsxs)(i.li,{children:["Fields of type ",(0,d.jsx)(i.code,{children:"int"})," or ",(0,d.jsx)(i.code,{children:"keyword"})," require exact matches."]}),"\n",(0,d.jsxs)(i.li,{children:["Wildcard characters (",(0,d.jsx)(i.code,{children:"*"})," for multiple, ",(0,d.jsx)(i.code,{children:"?"})," for single) can be used in ",(0,d.jsx)(i.code,{children:"keyword"})," fields."]}),"\n",(0,d.jsxs)(i.li,{children:["Fields of type ",(0,d.jsx)(i.code,{children:"text"})," support partial matches."]}),"\n"]}),"\n",(0,d.jsx)(i.p,{children:"Example:"}),"\n",(0,d.jsxs)(i.ul,{children:["\n",(0,d.jsxs)(i.li,{children:[(0,d.jsx)(i.code,{children:"user: chris"})," matches ",(0,d.jsx)(i.code,{children:"user"})," field with value ",(0,d.jsx)(i.code,{children:"chris"}),"."]}),"\n",(0,d.jsxs)(i.li,{children:[(0,d.jsx)(i.code,{children:"user: ch*"})," matches ",(0,d.jsx)(i.code,{children:"chris"})," or any string starting with ",(0,d.jsx)(i.code,{children:"ch"}),"."]}),"\n",(0,d.jsxs)(i.li,{children:[(0,d.jsx)(i.code,{children:"user: ch"})," does not match as it requires a full or wildcard match."]}),"\n"]}),"\n",(0,d.jsxs)(i.p,{children:["Searching ",(0,d.jsx)(i.code,{children:"strings: content"})," will return events with matching data, such as ",(0,d.jsx)(i.code,{children:'"This is some example content."'}),"."]})]})}function a(e={}){const{wrapper:i}={...(0,r.R)(),...e.components};return i?(0,d.jsx)(i,{...e,children:(0,d.jsx)(o,{...e})}):o(e)}},88843:(e,i,s)=>{s.d(i,{A:()=>d});const d=s.p+"assets/images/facet-list-a1d065c77242caa2c6cbdfc13f04fb9c.png"},89954:(e,i,s)=>{s.d(i,{A:()=>d});const d=s.p+"assets/images/faceted-search-daeb0f7d4da312b1abe08c856d072193.png"},28453:(e,i,s)=>{s.d(i,{R:()=>n,x:()=>c});var d=s(96540);const r={},t=d.createContext(r);function n(e){const i=d.useContext(t);return d.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function c(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:n(e.components),d.createElement(t.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/980335ef.9f8fac9e.js b/assets/js/980335ef.58d6933c.js similarity index 98% rename from assets/js/980335ef.9f8fac9e.js rename to assets/js/980335ef.58d6933c.js index abfec2e5d..301fc634c 100644 --- a/assets/js/980335ef.9f8fac9e.js +++ b/assets/js/980335ef.58d6933c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7118],{49829:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>u,frontMatter:()=>o,metadata:()=>i,toc:()=>d});var a=n(74848),s=n(28453);const o={title:"Platform encryption in AWS",hide_title:!0,sidebar_position:3},r="What encryption does the Cado platform use in AWS?",i={id:"cado/deploy/aws/security/data-encryption-overview",title:"Platform encryption in AWS",description:"General",source:"@site/docs/cado/deploy/aws/security/data-encryption-overview.md",sourceDirName:"cado/deploy/aws/security",slug:"/cado/deploy/aws/security/data-encryption-overview",permalink:"/cado/deploy/aws/security/data-encryption-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/security/data-encryption-overview.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Platform encryption in AWS",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Logging best practices",permalink:"/cado/deploy/aws/security/logging"},next:{title:"Dedicated forensics account",permalink:"/cado/deploy/aws/security/forensics-account"}},c={},d=[{value:"General",id:"general",level:2},{value:"AWS",id:"aws",level:2}];function l(e){const t={a:"a",h1:"h1",h2:"h2",p:"p",...(0,s.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"what-encryption-does-the-cado-platform-use-in-aws",children:"What encryption does the Cado platform use in AWS?"}),"\n",(0,a.jsx)(t.h2,{id:"general",children:"General"}),"\n",(0,a.jsx)(t.p,{children:"The default VPC and Subnet create an isolated environment to which customers can control access rights.\nWhen processing data, the Cado worker instances are launched within the same VPC as the main Cado instance.\nWorker instances are started using the same AMI as the main Cado instance as well."}),"\n",(0,a.jsx)(t.h2,{id:"aws",children:"AWS"}),"\n",(0,a.jsx)(t.p,{children:"During deployment, by default, an S3 bucket, a VPC and a Subnet are created for use by the Cado solution."}),"\n",(0,a.jsxs)(t.p,{children:["During deployment, a default S3 bucket for collections is created. This can be customized, including to use an existing bucket, but by default the created S3 Bucket is encrypted with server-side encryption using AES256 (SSE-AES256 - See ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html",children:"Protecting data with server-side encryption"}),".\nAttached EBS volumes are encrypted using ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html",children:"KMS"}),".\nAccess to EFS/NFS ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/efs/latest/ug/encryption-in-transit.html",children:"is over TLS "}),".\nSecrets are stored using ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html",children:"AWS Secrets Manager"}),"."]}),"\n",(0,a.jsxs)(t.p,{children:["Some settings can be customized, and you may wish to ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html",children:"enable key rotation"})," as well ."]})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(l,{...e})}):l(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>i});var a=n(96540);const s={},o=a.createContext(s);function r(e){const t=a.useContext(o);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),a.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7118],{49829:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>u,frontMatter:()=>o,metadata:()=>i,toc:()=>d});var a=n(74848),s=n(28453);const o={title:"Platform encryption in AWS",hide_title:!0,sidebar_position:3},r="What encryption does the Cado platform use in AWS?",i={id:"cado/deploy/aws/security/data-encryption-overview",title:"Platform encryption in AWS",description:"General",source:"@site/docs/cado/deploy/aws/security/data-encryption-overview.md",sourceDirName:"cado/deploy/aws/security",slug:"/cado/deploy/aws/security/data-encryption-overview",permalink:"/cado/deploy/aws/security/data-encryption-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/security/data-encryption-overview.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Platform encryption in AWS",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Logging best practices",permalink:"/cado/deploy/aws/security/logging"},next:{title:"Dedicated forensics account",permalink:"/cado/deploy/aws/security/forensics-account"}},c={},d=[{value:"General",id:"general",level:2},{value:"AWS",id:"aws",level:2}];function l(e){const t={a:"a",h1:"h1",h2:"h2",p:"p",...(0,s.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"what-encryption-does-the-cado-platform-use-in-aws",children:"What encryption does the Cado platform use in AWS?"}),"\n",(0,a.jsx)(t.h2,{id:"general",children:"General"}),"\n",(0,a.jsx)(t.p,{children:"The default VPC and Subnet create an isolated environment to which customers can control access rights.\nWhen processing data, the Cado worker instances are launched within the same VPC as the main Cado instance.\nWorker instances are started using the same AMI as the main Cado instance as well."}),"\n",(0,a.jsx)(t.h2,{id:"aws",children:"AWS"}),"\n",(0,a.jsx)(t.p,{children:"During deployment, by default, an S3 bucket, a VPC and a Subnet are created for use by the Cado solution."}),"\n",(0,a.jsxs)(t.p,{children:["During deployment, a default S3 bucket for collections is created. This can be customized, including to use an existing bucket, but by default the created S3 Bucket is encrypted with server-side encryption using AES256 (SSE-AES256 - See ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html",children:"Protecting data with server-side encryption"}),".\nAttached EBS volumes are encrypted using ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html",children:"KMS"}),".\nAccess to EFS/NFS ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/efs/latest/ug/encryption-in-transit.html",children:"is over TLS "}),".\nSecrets are stored using ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html",children:"AWS Secrets Manager"}),"."]}),"\n",(0,a.jsxs)(t.p,{children:["Some settings can be customized, and you may wish to ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html",children:"enable key rotation"})," as well ."]})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(l,{...e})}):l(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>i});var a=n(96540);const s={},o=a.createContext(s);function r(e){const t=a.useContext(o);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),a.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9b6f7a10.3234711d.js b/assets/js/9b6f7a10.9fbaf9e2.js similarity index 98% rename from assets/js/9b6f7a10.3234711d.js rename to assets/js/9b6f7a10.9fbaf9e2.js index 9b8b80234..aac4114d1 100644 --- a/assets/js/9b6f7a10.3234711d.js +++ b/assets/js/9b6f7a10.9fbaf9e2.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2485],{22468:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>o,default:()=>u,frontMatter:()=>c,metadata:()=>r,toc:()=>d});var s=n(74848),i=n(28453);const c={title:"Bucket",hide_title:!0,sidebar_position:11},o="Bucket",r={id:"cado/deploy/gcp/gcp-bucket",title:"Bucket",description:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions.",source:"@site/docs/cado/deploy/gcp/gcp-bucket.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-bucket",permalink:"/cado/deploy/gcp/gcp-bucket",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-bucket.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:11,frontMatter:{title:"Bucket",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Secret Manager",permalink:"/cado/deploy/gcp/gcp-secret-manager"},next:{title:"Workers",permalink:"/cado/deploy/gcp/gcp-workers"}},a={},d=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function l(e){const t={code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"bucket",children:"Bucket"}),"\n",(0,s.jsx)(t.p,{children:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions."}),"\n",(0,s.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"The IAM role used in the initial deployment, and permission to edit it"}),"\n",(0,s.jsx)(t.li,{children:"Permission to create a GCS bucket in the GCP console"}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"Add the necessary permissions by adding the following to your IAM role:"}),"\n"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-json",children:' // Bucket Access\n "storage.buckets.get",\n "storage.buckets.list",\n "storage.objects.create",\n "storage.objects.delete",\n "storage.objects.get",\n "storage.objects.list",\n'})}),"\n",(0,s.jsxs)(t.ol,{start:"2",children:["\n",(0,s.jsx)(t.li,{children:"Create a GCS bucket in the GCP console"}),"\n",(0,s.jsx)(t.li,{children:"Enter the bucket name in the Setup Wizard - if the configured permissions are insufficient you will be notified and asked to correct before logging into the platform."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"GCP Bucket",src:n(14624).A+"",width:"512",height:"212"})})]})}function u(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},14624:(e,t,n)=>{n.d(t,{A:()=>s});const s=n.p+"assets/images/gcp-bucket-f7b5c94fd7e66f9bc1789cba8ae162d0.png"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>r});var s=n(96540);const i={},c=s.createContext(i);function o(e){const t=s.useContext(c);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(c.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2485],{22468:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>a,contentTitle:()=>o,default:()=>u,frontMatter:()=>c,metadata:()=>r,toc:()=>d});var s=n(74848),i=n(28453);const c={title:"Bucket",hide_title:!0,sidebar_position:11},o="Bucket",r={id:"cado/deploy/gcp/gcp-bucket",title:"Bucket",description:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions.",source:"@site/docs/cado/deploy/gcp/gcp-bucket.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-bucket",permalink:"/cado/deploy/gcp/gcp-bucket",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-bucket.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:11,frontMatter:{title:"Bucket",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Secret Manager",permalink:"/cado/deploy/gcp/gcp-secret-manager"},next:{title:"Workers",permalink:"/cado/deploy/gcp/gcp-workers"}},a={},d=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function l(e){const t={code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"bucket",children:"Bucket"}),"\n",(0,s.jsx)(t.p,{children:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions."}),"\n",(0,s.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"The IAM role used in the initial deployment, and permission to edit it"}),"\n",(0,s.jsx)(t.li,{children:"Permission to create a GCS bucket in the GCP console"}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"Add the necessary permissions by adding the following to your IAM role:"}),"\n"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-json",children:' // Bucket Access\n "storage.buckets.get",\n "storage.buckets.list",\n "storage.objects.create",\n "storage.objects.delete",\n "storage.objects.get",\n "storage.objects.list",\n'})}),"\n",(0,s.jsxs)(t.ol,{start:"2",children:["\n",(0,s.jsx)(t.li,{children:"Create a GCS bucket in the GCP console"}),"\n",(0,s.jsx)(t.li,{children:"Enter the bucket name in the Setup Wizard - if the configured permissions are insufficient you will be notified and asked to correct before logging into the platform."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"GCP Bucket",src:n(14624).A+"",width:"512",height:"212"})})]})}function u(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},14624:(e,t,n)=>{n.d(t,{A:()=>s});const s=n.p+"assets/images/gcp-bucket-f7b5c94fd7e66f9bc1789cba8ae162d0.png"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>r});var s=n(96540);const i={},c=s.createContext(i);function o(e){const t=s.useContext(c);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(c.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9cd36c57.8a1b27df.js b/assets/js/9cd36c57.453855f4.js similarity index 99% rename from assets/js/9cd36c57.8a1b27df.js rename to assets/js/9cd36c57.453855f4.js index f36f03443..227b00301 100644 --- a/assets/js/9cd36c57.8a1b27df.js +++ b/assets/js/9cd36c57.453855f4.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2829],{38796:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>o,toc:()=>d});var t=n(74848),r=n(28453);const i={title:"Manage users",hide_title:!0,sidebar_position:3},a="How to Manage Users and Authentication in Cado",o={id:"cado/manage/users-authentication/users",title:"Manage users",description:"In the Cado platform, you can control user access to both processed data and raw data stored in the cloud, ensuring users only access the data they need.",source:"@site/docs/cado/manage/users-authentication/users.md",sourceDirName:"cado/manage/users-authentication",slug:"/cado/manage/users-authentication/users",permalink:"/cado/manage/users-authentication/users",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/users.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Manage users",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Community edition",permalink:"/cado/community-intro"},next:{title:"Azure AD",permalink:"/cado/manage/users-authentication/sso/azure-ad"}},c={},d=[{value:"User Types",id:"user-types",level:3},{value:"Configuring Single Sign-On (SSO)",id:"configuring-single-sign-on-sso",level:3},{value:"Managing Roles",id:"managing-roles",level:3},{value:"Managing Groups",id:"managing-groups",level:3},{value:"Creating a New User",id:"creating-a-new-user",level:3},{value:"Granting Administrator Access",id:"granting-administrator-access",level:3},{value:"Granting Access to an Investigation",id:"granting-access-to-an-investigation",level:3},{value:"Password Policy",id:"password-policy",level:3}];function l(e){const s={a:"a",admonition:"admonition",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"how-to-manage-users-and-authentication-in-cado",children:"How to Manage Users and Authentication in Cado"}),"\n",(0,t.jsx)(s.p,{children:"In the Cado platform, you can control user access to both processed data and raw data stored in the cloud, ensuring users only access the data they need."}),"\n",(0,t.jsx)(s.h3,{id:"user-types",children:"User Types"}),"\n",(0,t.jsx)(s.p,{children:"There are two user roles in the Cado platform:"}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Name"}),(0,t.jsx)(s.th,{children:"Description"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Administrator"}),(0,t.jsx)(s.td,{children:"Can manage users and has access to all investigations and cloud resources."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Normal User"}),(0,t.jsx)(s.td,{children:"Has restricted access to specific investigations and cloud resources."})]})]})]}),"\n",(0,t.jsxs)(s.p,{children:["A ",(0,t.jsx)(s.strong,{children:"Normal User"})," must be added to an investigation or a group with access to that investigation to gain access. To acquire cloud data, the user needs access to a CSP Role that has permissions to the cloud resource or be part of a group with access to that CSP Role."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Users-Groups-Roles",src:n(57296).A+"",width:"809",height:"262"})}),"\n",(0,t.jsx)(s.h3,{id:"configuring-single-sign-on-sso",children:"Configuring Single Sign-On (SSO)"}),"\n",(0,t.jsxs)(s.p,{children:["Cado supports SSO integration with ",(0,t.jsx)(s.a,{href:"/cado/manage/users-authentication/sso/azure-ad",children:"Azure AD"}),", Okta (",(0,t.jsx)(s.a,{href:"/cado/manage/users-authentication/sso/okta",children:"OAuth"})," or ",(0,t.jsx)(s.a,{href:"/cado/manage/users-authentication/sso/okta_saml",children:"SAML"}),"), and ",(0,t.jsx)(s.a,{href:"/cado/manage/users-authentication/sso/ping_saml",children:"PingID"}),". When SSO is configured, the Cado platform automatically creates the user at first login. By integrating SSO, you can enforce authentication mechanisms such as two-factor authentication supported by your SSO provider."]}),"\n",(0,t.jsx)(s.h3,{id:"managing-roles",children:"Managing Roles"}),"\n",(0,t.jsxs)(s.p,{children:["Roles in Cado correspond to cloud roles in AWS, Azure, or GCP that have the necessary permissions to access cloud resources. Only Administrators can manage roles. These roles are automatically populated when CSP credentials are added, following instructions for ",(0,t.jsx)(s.a,{href:"/cado/deploy/cross/cross-account-creation#adding-the-role-to-cado",children:"AWS"}),", ",(0,t.jsx)(s.a,{href:"/cado/deploy/cross/azure-cross-tenancy-subscriptions#registering-credentials-within-cado",children:"Azure"}),", and ",(0,t.jsx)(s.a,{href:"/cado/deploy/gcp/gcp-settings#en",children:"GCP"}),"."]}),"\n",(0,t.jsxs)(s.p,{children:["It\u2019s recommended to perform ",(0,t.jsx)(s.strong,{children:"Account Checks"})," periodically to ensure correct permissions are in place for successful data acquisitions. See ",(0,t.jsx)(s.a,{href:"/cado/manage/monitoring#account-check",children:"Account Check"})," for more details."]}),"\n",(0,t.jsx)(s.h3,{id:"managing-groups",children:"Managing Groups"}),"\n",(0,t.jsx)(s.p,{children:"Groups allow Administrators to manage user access to investigations and cloud resources. Only Administrators can create or manage groups."}),"\n",(0,t.jsx)(s.p,{children:"To create a new group:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Go to ",(0,t.jsx)(s.strong,{children:"Groups"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Add Group"}),"."]}),"\n",(0,t.jsx)(s.li,{children:"Enter the group name."}),"\n",(0,t.jsx)(s.li,{children:"Enter the corresponding SSO group name to auto-assign users who log in via SSO."}),"\n",(0,t.jsx)(s.li,{children:"Assign users and select the CSP Roles the group should have access to."}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Groups",src:n(1861).A+"",width:"713",height:"465"})}),"\n",(0,t.jsx)(s.h3,{id:"creating-a-new-user",children:"Creating a New User"}),"\n",(0,t.jsx)(s.p,{children:"Only Administrators can create new users. When a new user is created, a temporary password must be set, which the user will be required to change upon first login."}),"\n",(0,t.jsx)(s.p,{children:"To add a new user:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Go to ",(0,t.jsx)(s.strong,{children:"Users"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Add Users"}),"."]}),"\n",(0,t.jsx)(s.li,{children:"Assign the user to any relevant groups."}),"\n",(0,t.jsx)(s.li,{children:"Assign any required CSP Roles to the user."}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"granting-administrator-access",children:"Granting Administrator Access"}),"\n",(0,t.jsx)(s.p,{children:"To grant Administrator access to a user:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Go to ",(0,t.jsx)(s.strong,{children:"Users"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Next to the user, click the Edit icon ",(0,t.jsx)(s.img,{alt:"Edit",src:n(37553).A+"",width:"21",height:"19"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Check the ",(0,t.jsx)(s.strong,{children:"This user has administrator access"})," option."]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Update"}),"."]}),"\n"]}),"\n",(0,t.jsx)(s.admonition,{type:"caution",children:(0,t.jsx)(s.p,{children:"Follow the principle of least privilege when creating users and assigning Administrator access."})}),"\n",(0,t.jsx)(s.h3,{id:"granting-access-to-an-investigation",children:"Granting Access to an Investigation"}),"\n",(0,t.jsx)(s.p,{children:"To grant a user or group access to an existing investigation:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Go to ",(0,t.jsx)(s.strong,{children:"Investigations"})," and select the investigation."]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Access"})," button."]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Add Users"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Select the users or groups to add and click ",(0,t.jsx)(s.strong,{children:"Add"}),"."]}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"password-policy",children:"Password Policy"}),"\n",(0,t.jsx)(s.p,{children:"Passwords must:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Allow special characters."}),"\n",(0,t.jsx)(s.li,{children:"Be at least 8 characters long, including 1 number and 1 uppercase letter."}),"\n",(0,t.jsx)(s.li,{children:"Avoid commonly used passwords."}),"\n"]})]})}function h(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},37553:(e,s,n)=>{n.d(s,{A:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABUAAAATCAYAAAB/TkaLAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFYSURBVDhPY/wPBAxUBhQbuu/waYbXb98zmBlqMyjKS4PFKDIUZOD9h0+hPAYGJ1tTsMFwQ89dvM5w/vJNsCQ+ICkuwuDlasNw/tINBgF+XrDBMMDFxcEQGeTBwATlE2WgoAAfg5WZPsPRkxcYzgEN/fnrN9h1MCAuKgym4S6du2QDWCA5JgBM4wIgA2/cfgDlMTBYmxswsLOxMtx/9AxuAdylxAB0A0EAJPbh42cUFxNtKDYDQUBBTorBUE8DyoMAogw9ePQsVgNBMe1sZwblIQBBQ0Gxe+f+YygPAUAGInsZGeA1FD0dwgDIQCOgl7ftPgIVQQV4DQVFADqAuRBk4fOXb6CiqACvod++fYeyIADZy+8/fALT2ABeQ0GJm52djUEImOjxhSE6wGsoKCPEhHoxBPo4EW0gCGDkKFIBthwId6mhrjqURTzApYfi8hQbwBum5AEGBgCpB4w70q85UwAAAABJRU5ErkJggg=="},1861:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/groups-b8da3a2285c1b36a6aff417aad36948a.png"},57296:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/users-groups-roles-d8a30a18b94f525420309d2128d0bfa1.png"},28453:(e,s,n)=>{n.d(s,{R:()=>a,x:()=>o});var t=n(96540);const r={},i=t.createContext(r);function a(e){const s=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function o(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),t.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2829],{38796:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>o,toc:()=>d});var t=n(74848),r=n(28453);const i={title:"Manage users",hide_title:!0,sidebar_position:3},a="How to Manage Users and Authentication in Cado",o={id:"cado/manage/users-authentication/users",title:"Manage users",description:"In the Cado platform, you can control user access to both processed data and raw data stored in the cloud, ensuring users only access the data they need.",source:"@site/docs/cado/manage/users-authentication/users.md",sourceDirName:"cado/manage/users-authentication",slug:"/cado/manage/users-authentication/users",permalink:"/cado/manage/users-authentication/users",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/users.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Manage users",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Community edition",permalink:"/cado/community-intro"},next:{title:"Azure AD",permalink:"/cado/manage/users-authentication/sso/azure-ad"}},c={},d=[{value:"User Types",id:"user-types",level:3},{value:"Configuring Single Sign-On (SSO)",id:"configuring-single-sign-on-sso",level:3},{value:"Managing Roles",id:"managing-roles",level:3},{value:"Managing Groups",id:"managing-groups",level:3},{value:"Creating a New User",id:"creating-a-new-user",level:3},{value:"Granting Administrator Access",id:"granting-administrator-access",level:3},{value:"Granting Access to an Investigation",id:"granting-access-to-an-investigation",level:3},{value:"Password Policy",id:"password-policy",level:3}];function l(e){const s={a:"a",admonition:"admonition",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"how-to-manage-users-and-authentication-in-cado",children:"How to Manage Users and Authentication in Cado"}),"\n",(0,t.jsx)(s.p,{children:"In the Cado platform, you can control user access to both processed data and raw data stored in the cloud, ensuring users only access the data they need."}),"\n",(0,t.jsx)(s.h3,{id:"user-types",children:"User Types"}),"\n",(0,t.jsx)(s.p,{children:"There are two user roles in the Cado platform:"}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Name"}),(0,t.jsx)(s.th,{children:"Description"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Administrator"}),(0,t.jsx)(s.td,{children:"Can manage users and has access to all investigations and cloud resources."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Normal User"}),(0,t.jsx)(s.td,{children:"Has restricted access to specific investigations and cloud resources."})]})]})]}),"\n",(0,t.jsxs)(s.p,{children:["A ",(0,t.jsx)(s.strong,{children:"Normal User"})," must be added to an investigation or a group with access to that investigation to gain access. To acquire cloud data, the user needs access to a CSP Role that has permissions to the cloud resource or be part of a group with access to that CSP Role."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Users-Groups-Roles",src:n(57296).A+"",width:"809",height:"262"})}),"\n",(0,t.jsx)(s.h3,{id:"configuring-single-sign-on-sso",children:"Configuring Single Sign-On (SSO)"}),"\n",(0,t.jsxs)(s.p,{children:["Cado supports SSO integration with ",(0,t.jsx)(s.a,{href:"/cado/manage/users-authentication/sso/azure-ad",children:"Azure AD"}),", Okta (",(0,t.jsx)(s.a,{href:"/cado/manage/users-authentication/sso/okta",children:"OAuth"})," or ",(0,t.jsx)(s.a,{href:"/cado/manage/users-authentication/sso/okta_saml",children:"SAML"}),"), and ",(0,t.jsx)(s.a,{href:"/cado/manage/users-authentication/sso/ping_saml",children:"PingID"}),". When SSO is configured, the Cado platform automatically creates the user at first login. By integrating SSO, you can enforce authentication mechanisms such as two-factor authentication supported by your SSO provider."]}),"\n",(0,t.jsx)(s.h3,{id:"managing-roles",children:"Managing Roles"}),"\n",(0,t.jsxs)(s.p,{children:["Roles in Cado correspond to cloud roles in AWS, Azure, or GCP that have the necessary permissions to access cloud resources. Only Administrators can manage roles. These roles are automatically populated when CSP credentials are added, following instructions for ",(0,t.jsx)(s.a,{href:"/cado/deploy/cross/cross-account-creation#adding-the-role-to-cado",children:"AWS"}),", ",(0,t.jsx)(s.a,{href:"/cado/deploy/cross/azure-cross-tenancy-subscriptions#registering-credentials-within-cado",children:"Azure"}),", and ",(0,t.jsx)(s.a,{href:"/cado/deploy/gcp/gcp-settings#en",children:"GCP"}),"."]}),"\n",(0,t.jsxs)(s.p,{children:["It\u2019s recommended to perform ",(0,t.jsx)(s.strong,{children:"Account Checks"})," periodically to ensure correct permissions are in place for successful data acquisitions. See ",(0,t.jsx)(s.a,{href:"/cado/manage/monitoring#account-check",children:"Account Check"})," for more details."]}),"\n",(0,t.jsx)(s.h3,{id:"managing-groups",children:"Managing Groups"}),"\n",(0,t.jsx)(s.p,{children:"Groups allow Administrators to manage user access to investigations and cloud resources. Only Administrators can create or manage groups."}),"\n",(0,t.jsx)(s.p,{children:"To create a new group:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Go to ",(0,t.jsx)(s.strong,{children:"Groups"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Add Group"}),"."]}),"\n",(0,t.jsx)(s.li,{children:"Enter the group name."}),"\n",(0,t.jsx)(s.li,{children:"Enter the corresponding SSO group name to auto-assign users who log in via SSO."}),"\n",(0,t.jsx)(s.li,{children:"Assign users and select the CSP Roles the group should have access to."}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Groups",src:n(1861).A+"",width:"713",height:"465"})}),"\n",(0,t.jsx)(s.h3,{id:"creating-a-new-user",children:"Creating a New User"}),"\n",(0,t.jsx)(s.p,{children:"Only Administrators can create new users. When a new user is created, a temporary password must be set, which the user will be required to change upon first login."}),"\n",(0,t.jsx)(s.p,{children:"To add a new user:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Go to ",(0,t.jsx)(s.strong,{children:"Users"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Add Users"}),"."]}),"\n",(0,t.jsx)(s.li,{children:"Assign the user to any relevant groups."}),"\n",(0,t.jsx)(s.li,{children:"Assign any required CSP Roles to the user."}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"granting-administrator-access",children:"Granting Administrator Access"}),"\n",(0,t.jsx)(s.p,{children:"To grant Administrator access to a user:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Go to ",(0,t.jsx)(s.strong,{children:"Users"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Next to the user, click the Edit icon ",(0,t.jsx)(s.img,{alt:"Edit",src:n(37553).A+"",width:"21",height:"19"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Check the ",(0,t.jsx)(s.strong,{children:"This user has administrator access"})," option."]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Update"}),"."]}),"\n"]}),"\n",(0,t.jsx)(s.admonition,{type:"caution",children:(0,t.jsx)(s.p,{children:"Follow the principle of least privilege when creating users and assigning Administrator access."})}),"\n",(0,t.jsx)(s.h3,{id:"granting-access-to-an-investigation",children:"Granting Access to an Investigation"}),"\n",(0,t.jsx)(s.p,{children:"To grant a user or group access to an existing investigation:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Go to ",(0,t.jsx)(s.strong,{children:"Investigations"})," and select the investigation."]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Access"})," button."]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Add Users"}),"."]}),"\n",(0,t.jsxs)(s.li,{children:["Select the users or groups to add and click ",(0,t.jsx)(s.strong,{children:"Add"}),"."]}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"password-policy",children:"Password Policy"}),"\n",(0,t.jsx)(s.p,{children:"Passwords must:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Allow special characters."}),"\n",(0,t.jsx)(s.li,{children:"Be at least 8 characters long, including 1 number and 1 uppercase letter."}),"\n",(0,t.jsx)(s.li,{children:"Avoid commonly used passwords."}),"\n"]})]})}function h(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},37553:(e,s,n)=>{n.d(s,{A:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABUAAAATCAYAAAB/TkaLAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFYSURBVDhPY/wPBAxUBhQbuu/waYbXb98zmBlqMyjKS4PFKDIUZOD9h0+hPAYGJ1tTsMFwQ89dvM5w/vJNsCQ+ICkuwuDlasNw/tINBgF+XrDBMMDFxcEQGeTBwATlE2WgoAAfg5WZPsPRkxcYzgEN/fnrN9h1MCAuKgym4S6du2QDWCA5JgBM4wIgA2/cfgDlMTBYmxswsLOxMtx/9AxuAdylxAB0A0EAJPbh42cUFxNtKDYDQUBBTorBUE8DyoMAogw9ePQsVgNBMe1sZwblIQBBQ0Gxe+f+YygPAUAGInsZGeA1FD0dwgDIQCOgl7ftPgIVQQV4DQVFADqAuRBk4fOXb6CiqACvod++fYeyIADZy+8/fALT2ABeQ0GJm52djUEImOjxhSE6wGsoKCPEhHoxBPo4EW0gCGDkKFIBthwId6mhrjqURTzApYfi8hQbwBum5AEGBgCpB4w70q85UwAAAABJRU5ErkJggg=="},1861:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/groups-b8da3a2285c1b36a6aff417aad36948a.png"},57296:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/users-groups-roles-d8a30a18b94f525420309d2128d0bfa1.png"},28453:(e,s,n)=>{n.d(s,{R:()=>a,x:()=>o});var t=n(96540);const r={},i=t.createContext(r);function a(e){const s=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function o(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),t.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9cd6de3b.e48d2f3b.js b/assets/js/9cd6de3b.ef71853c.js similarity index 98% rename from assets/js/9cd6de3b.e48d2f3b.js rename to assets/js/9cd6de3b.ef71853c.js index 1097487e6..d2fb45318 100644 --- a/assets/js/9cd6de3b.e48d2f3b.js +++ b/assets/js/9cd6de3b.ef71853c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7],{17091:(e,s,o)=>{o.r(s),o.d(s,{assets:()=>a,contentTitle:()=>l,default:()=>h,frontMatter:()=>t,metadata:()=>r,toc:()=>d});var i=o(74848),n=o(28453);const t={title:"Log & artifact types",hide_title:!0,sidebar_position:1},l="What Log and Artifact Types Can Cado Process?",r={id:"cado/discovery-import/data-types/logs",title:"Log & artifact types",description:"Cado supports the processing of a wide range of evidence types, which may vary slightly depending on your cloud platform.",source:"@site/docs/cado/discovery-import/data-types/logs.md",sourceDirName:"cado/discovery-import/data-types",slug:"/cado/discovery-import/data-types/logs",permalink:"/cado/discovery-import/data-types/logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/data-types/logs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Log & artifact types",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"File Types",permalink:"/cado/discovery-import/data-types/filetypes"},next:{title:"Memory analysis",permalink:"/cado/discovery-import/data-types/memory"}},a={},d=[{value:"What Cloud Logs Can Cado Import from Cloud Storage?",id:"what-cloud-logs-can-cado-import-from-cloud-storage",level:2},{value:"AWS Log Formats",id:"aws-log-formats",level:3},{value:"Azure Log Formats",id:"azure-log-formats",level:3},{value:"GCP Log Formats",id:"gcp-log-formats",level:3},{value:"What Logs Does Cado Capture via APIs?",id:"what-logs-does-cado-capture-via-apis",level:2},{value:"Operating System Log and Artifact Formats",id:"operating-system-log-and-artifact-formats",level:2},{value:"Adding Your Own Events",id:"adding-your-own-events",level:2},{value:"Log Analysis Considerations",id:"log-analysis-considerations",level:2}];function c(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"what-log-and-artifact-types-can-cado-process",children:"What Log and Artifact Types Can Cado Process?"}),"\n",(0,i.jsx)(s.p,{children:"Cado supports the processing of a wide range of evidence types, which may vary slightly depending on your cloud platform."}),"\n",(0,i.jsx)(s.h2,{id:"what-cloud-logs-can-cado-import-from-cloud-storage",children:"What Cloud Logs Can Cado Import from Cloud Storage?"}),"\n",(0,i.jsx)(s.p,{children:"Cado can import various cloud log types from cloud storage, including:"}),"\n",(0,i.jsx)(s.h3,{id:"aws-log-formats",children:"AWS Log Formats"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"CloudTrail logs"}),"\n",(0,i.jsx)(s.li,{children:"GuardDuty logs"}),"\n",(0,i.jsx)(s.li,{children:"Kubernetes logs"}),"\n",(0,i.jsx)(s.li,{children:"VPC Flow logs"}),"\n",(0,i.jsx)(s.li,{children:"SSM logs"}),"\n",(0,i.jsx)(s.li,{children:"S3 Access Logs"}),"\n",(0,i.jsx)(s.li,{children:"Route 53 (DNS) logs"}),"\n"]}),"\n",(0,i.jsx)(s.h3,{id:"azure-log-formats",children:"Azure Log Formats"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Activity logs"}),"\n",(0,i.jsx)(s.li,{children:"Storage logs"}),"\n"]}),"\n",(0,i.jsx)(s.h3,{id:"gcp-log-formats",children:"GCP Log Formats"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"VPC Flow logs"}),"\n",(0,i.jsx)(s.li,{children:"IAM logs"}),"\n",(0,i.jsx)(s.li,{children:"Admin Activity logs"}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"Cado also processes additional log types using generic extractors, so this list is not exhaustive."}),"\n",(0,i.jsx)(s.h2,{id:"what-logs-does-cado-capture-via-apis",children:"What Logs Does Cado Capture via APIs?"}),"\n",(0,i.jsx)(s.p,{children:"Cado can capture logs from the following cloud services via their APIs:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"AWS EC2"}),": When acquiring an EC2 system, Cado accesses the CloudTrail API to retrieve ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/vpc/latest/userguide/working-with-flow-logs.html#create-flow-log",children:"VPC flow logs"})," and ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-getting-started.html",children:"CloudTrail logs"})," associated with the instance ID, if enabled."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"AWS Lambda"}),": Cado accesses the CloudWatch API to retrieve ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.html",children:"logs associated with the Lambda function"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Azure Compute"}),": Cado retrieves ",(0,i.jsx)(s.a,{href:"https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-log",children:"activity logs associated with the virtual machine"}),"."]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"If logs are stored in a central account, Cado currently cannot traverse accounts to pull logs from different accounts. In such cases, logs must be collected in cloud storage and imported from there."}),"\n",(0,i.jsx)(s.h2,{id:"operating-system-log-and-artifact-formats",children:"Operating System Log and Artifact Formats"}),"\n",(0,i.jsx)(s.p,{children:"Here is a non-exhaustive list of the forensic artifacts Cado can process:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Common AWS, Azure, and GCP logs"}),"\n",(0,i.jsx)(s.li,{children:"Apple System Log (ASL)"}),"\n",(0,i.jsx)(s.li,{children:"Android usage history (app usage)"}),"\n",(0,i.jsx)(s.li,{children:"Basic Security Module (BSM)"}),"\n",(0,i.jsx)(s.li,{children:"Bencode files"}),"\n",(0,i.jsx)(s.li,{children:"Chrome Disk Cache and Preferences"}),"\n",(0,i.jsx)(s.li,{children:"CUPS IPP logs"}),"\n",(0,i.jsx)(s.li,{children:"Extensible Storage Engine (ESE) Database (EDB)"}),"\n",(0,i.jsx)(s.li,{children:"Firefox Cache"}),"\n",(0,i.jsx)(s.li,{children:"Java Web Start IDX"}),"\n",(0,i.jsxs)(s.li,{children:["JumpLists (",(0,i.jsx)(s.code,{children:"customDestinations-ms"})," files)"]}),"\n",(0,i.jsx)(s.li,{children:"MacOS Application Firewall, Keychain, Securityd, and Wifi logs"}),"\n",(0,i.jsx)(s.li,{children:"McAfee Anti-Virus logs"}),"\n",(0,i.jsxs)(s.li,{children:["Microsoft Internet Explorer History (MSIE4-9 Cache Files or ",(0,i.jsx)(s.code,{children:"index.dat"}),")"]}),"\n",(0,i.jsx)(s.li,{children:"Microsoft IIS logs"}),"\n",(0,i.jsxs)(s.li,{children:["NTFS ",(0,i.jsx)(s.code,{children:"$MFT"})," and ",(0,i.jsx)(s.code,{children:"$UsnJrnl:$J"})]}),"\n",(0,i.jsx)(s.li,{children:"OLE Compound Files"}),"\n",(0,i.jsx)(s.li,{children:"Opera Browser History"}),"\n",(0,i.jsx)(s.li,{children:"OpenXML"}),"\n",(0,i.jsx)(s.li,{children:"Portable Executable (PE) files"}),"\n",(0,i.jsx)(s.li,{children:"PLSQL cache files (PL-SQL developer recall files)"}),"\n",(0,i.jsx)(s.li,{children:"Popularity Contest logs"}),"\n",(0,i.jsx)(s.li,{children:"Property List (plist)"}),"\n",(0,i.jsxs)(s.li,{children:["Restore Point logs (",(0,i.jsx)(s.code,{children:"rp.log"}),")"]}),"\n",(0,i.jsx)(s.li,{children:"Safari Binary Cookies"}),"\n",(0,i.jsx)(s.li,{children:"SCCM Client logs"}),"\n",(0,i.jsx)(s.li,{children:"SELinux audit logs"}),"\n",(0,i.jsx)(s.li,{children:"SkyDrive log and error logs"}),"\n",(0,i.jsx)(s.li,{children:"SQLite databases"}),"\n",(0,i.jsx)(s.li,{children:"Symantec AV Corporate Edition and Endpoint Protection logs"}),"\n",(0,i.jsx)(s.li,{children:"Syslog"}),"\n",(0,i.jsx)(s.li,{children:"Utmp, Utmpx"}),"\n",(0,i.jsx)(s.li,{children:"Windows Event Logs (EVT, EVTX)"}),"\n",(0,i.jsx)(s.li,{children:"Windows Firewall logs"}),"\n",(0,i.jsx)(s.li,{children:"Windows Job files (atjobs)"}),"\n",(0,i.jsx)(s.li,{children:"Windows Prefetch files"}),"\n",(0,i.jsxs)(s.li,{children:["Windows Recycle Bin (",(0,i.jsx)(s.code,{children:"INFO2"})," and ",(0,i.jsx)(s.code,{children:"$I/$R"}),")"]}),"\n",(0,i.jsx)(s.li,{children:"Windows NT Registry Files"}),"\n",(0,i.jsx)(s.li,{children:"Windows Shortcut Files (LNK)"}),"\n",(0,i.jsx)(s.li,{children:"Xchat and Xchat scrollback files"}),"\n",(0,i.jsx)(s.li,{children:"Zsh history files"}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["Cado can also process many other log formats not listed here. If you have a log format you'd like to see supported, please contact us at ",(0,i.jsx)(s.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"}),"."]}),"\n",(0,i.jsx)(s.h2,{id:"adding-your-own-events",children:"Adding Your Own Events"}),"\n",(0,i.jsx)(s.p,{children:"During an investigation, you may want to add custom events to the timeline, such as key events tracked in a spreadsheet. The simplest way to add custom events is to import an ISO format log event with the following format:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"YYYY-MM-DD HH:MM:SS Log Event Message\n"})}),"\n",(0,i.jsxs)(s.p,{children:["For example, saving this text in a file named ",(0,i.jsx)(s.code,{children:"custom_events.log"})," and importing it into the platform:"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"2021-01-01 01:01:01 User phoned help desk and reported ransomware\n2021-01-01 01:01:02 Three more phone calls to help desk\n"})}),"\n",(0,i.jsx)(s.p,{children:"Will result in events such as the following:"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Custom logs imported into Cado",src:o(23979).A+"",width:"433",height:"255"})}),"\n",(0,i.jsx)(s.h2,{id:"log-analysis-considerations",children:"Log Analysis Considerations"}),"\n",(0,i.jsxs)(s.p,{children:["For analyzing large sets of logs (typically over 1 million events) and uncovering suspicious behavior, we recommend using traditional SIEM solutions or open-source tools like Cado's ",(0,i.jsx)(s.a,{href:"https://github.com/cado-security/cloudgrep",children:"cloudgrep"}),". Cado's primary focus is on capturing more than just logs from cloud service providers and other log sources. See ",(0,i.jsx)(s.a,{href:"/cado/intro",children:"here"})," for more details on Cado's capabilities."]})]})}function h(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},23979:(e,s,o)=>{o.d(s,{A:()=>i});const i=o.p+"assets/images/custom_log-c23723dfac762109a84bbbdd4a04d760.png"},28453:(e,s,o)=>{o.d(s,{R:()=>l,x:()=>r});var i=o(96540);const n={},t=i.createContext(n);function l(e){const s=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function r(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:l(e.components),i.createElement(t.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7],{17091:(e,s,o)=>{o.r(s),o.d(s,{assets:()=>a,contentTitle:()=>l,default:()=>h,frontMatter:()=>t,metadata:()=>r,toc:()=>d});var i=o(74848),n=o(28453);const t={title:"Log & artifact types",hide_title:!0,sidebar_position:1},l="What Log and Artifact Types Can Cado Process?",r={id:"cado/discovery-import/data-types/logs",title:"Log & artifact types",description:"Cado supports the processing of a wide range of evidence types, which may vary slightly depending on your cloud platform.",source:"@site/docs/cado/discovery-import/data-types/logs.md",sourceDirName:"cado/discovery-import/data-types",slug:"/cado/discovery-import/data-types/logs",permalink:"/cado/discovery-import/data-types/logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/data-types/logs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Log & artifact types",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"File Types",permalink:"/cado/discovery-import/data-types/filetypes"},next:{title:"Memory analysis",permalink:"/cado/discovery-import/data-types/memory"}},a={},d=[{value:"What Cloud Logs Can Cado Import from Cloud Storage?",id:"what-cloud-logs-can-cado-import-from-cloud-storage",level:2},{value:"AWS Log Formats",id:"aws-log-formats",level:3},{value:"Azure Log Formats",id:"azure-log-formats",level:3},{value:"GCP Log Formats",id:"gcp-log-formats",level:3},{value:"What Logs Does Cado Capture via APIs?",id:"what-logs-does-cado-capture-via-apis",level:2},{value:"Operating System Log and Artifact Formats",id:"operating-system-log-and-artifact-formats",level:2},{value:"Adding Your Own Events",id:"adding-your-own-events",level:2},{value:"Log Analysis Considerations",id:"log-analysis-considerations",level:2}];function c(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"what-log-and-artifact-types-can-cado-process",children:"What Log and Artifact Types Can Cado Process?"}),"\n",(0,i.jsx)(s.p,{children:"Cado supports the processing of a wide range of evidence types, which may vary slightly depending on your cloud platform."}),"\n",(0,i.jsx)(s.h2,{id:"what-cloud-logs-can-cado-import-from-cloud-storage",children:"What Cloud Logs Can Cado Import from Cloud Storage?"}),"\n",(0,i.jsx)(s.p,{children:"Cado can import various cloud log types from cloud storage, including:"}),"\n",(0,i.jsx)(s.h3,{id:"aws-log-formats",children:"AWS Log Formats"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"CloudTrail logs"}),"\n",(0,i.jsx)(s.li,{children:"GuardDuty logs"}),"\n",(0,i.jsx)(s.li,{children:"Kubernetes logs"}),"\n",(0,i.jsx)(s.li,{children:"VPC Flow logs"}),"\n",(0,i.jsx)(s.li,{children:"SSM logs"}),"\n",(0,i.jsx)(s.li,{children:"S3 Access Logs"}),"\n",(0,i.jsx)(s.li,{children:"Route 53 (DNS) logs"}),"\n"]}),"\n",(0,i.jsx)(s.h3,{id:"azure-log-formats",children:"Azure Log Formats"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Activity logs"}),"\n",(0,i.jsx)(s.li,{children:"Storage logs"}),"\n"]}),"\n",(0,i.jsx)(s.h3,{id:"gcp-log-formats",children:"GCP Log Formats"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"VPC Flow logs"}),"\n",(0,i.jsx)(s.li,{children:"IAM logs"}),"\n",(0,i.jsx)(s.li,{children:"Admin Activity logs"}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"Cado also processes additional log types using generic extractors, so this list is not exhaustive."}),"\n",(0,i.jsx)(s.h2,{id:"what-logs-does-cado-capture-via-apis",children:"What Logs Does Cado Capture via APIs?"}),"\n",(0,i.jsx)(s.p,{children:"Cado can capture logs from the following cloud services via their APIs:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"AWS EC2"}),": When acquiring an EC2 system, Cado accesses the CloudTrail API to retrieve ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/vpc/latest/userguide/working-with-flow-logs.html#create-flow-log",children:"VPC flow logs"})," and ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-getting-started.html",children:"CloudTrail logs"})," associated with the instance ID, if enabled."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"AWS Lambda"}),": Cado accesses the CloudWatch API to retrieve ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.html",children:"logs associated with the Lambda function"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Azure Compute"}),": Cado retrieves ",(0,i.jsx)(s.a,{href:"https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-log",children:"activity logs associated with the virtual machine"}),"."]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"If logs are stored in a central account, Cado currently cannot traverse accounts to pull logs from different accounts. In such cases, logs must be collected in cloud storage and imported from there."}),"\n",(0,i.jsx)(s.h2,{id:"operating-system-log-and-artifact-formats",children:"Operating System Log and Artifact Formats"}),"\n",(0,i.jsx)(s.p,{children:"Here is a non-exhaustive list of the forensic artifacts Cado can process:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Common AWS, Azure, and GCP logs"}),"\n",(0,i.jsx)(s.li,{children:"Apple System Log (ASL)"}),"\n",(0,i.jsx)(s.li,{children:"Android usage history (app usage)"}),"\n",(0,i.jsx)(s.li,{children:"Basic Security Module (BSM)"}),"\n",(0,i.jsx)(s.li,{children:"Bencode files"}),"\n",(0,i.jsx)(s.li,{children:"Chrome Disk Cache and Preferences"}),"\n",(0,i.jsx)(s.li,{children:"CUPS IPP logs"}),"\n",(0,i.jsx)(s.li,{children:"Extensible Storage Engine (ESE) Database (EDB)"}),"\n",(0,i.jsx)(s.li,{children:"Firefox Cache"}),"\n",(0,i.jsx)(s.li,{children:"Java Web Start IDX"}),"\n",(0,i.jsxs)(s.li,{children:["JumpLists (",(0,i.jsx)(s.code,{children:"customDestinations-ms"})," files)"]}),"\n",(0,i.jsx)(s.li,{children:"MacOS Application Firewall, Keychain, Securityd, and Wifi logs"}),"\n",(0,i.jsx)(s.li,{children:"McAfee Anti-Virus logs"}),"\n",(0,i.jsxs)(s.li,{children:["Microsoft Internet Explorer History (MSIE4-9 Cache Files or ",(0,i.jsx)(s.code,{children:"index.dat"}),")"]}),"\n",(0,i.jsx)(s.li,{children:"Microsoft IIS logs"}),"\n",(0,i.jsxs)(s.li,{children:["NTFS ",(0,i.jsx)(s.code,{children:"$MFT"})," and ",(0,i.jsx)(s.code,{children:"$UsnJrnl:$J"})]}),"\n",(0,i.jsx)(s.li,{children:"OLE Compound Files"}),"\n",(0,i.jsx)(s.li,{children:"Opera Browser History"}),"\n",(0,i.jsx)(s.li,{children:"OpenXML"}),"\n",(0,i.jsx)(s.li,{children:"Portable Executable (PE) files"}),"\n",(0,i.jsx)(s.li,{children:"PLSQL cache files (PL-SQL developer recall files)"}),"\n",(0,i.jsx)(s.li,{children:"Popularity Contest logs"}),"\n",(0,i.jsx)(s.li,{children:"Property List (plist)"}),"\n",(0,i.jsxs)(s.li,{children:["Restore Point logs (",(0,i.jsx)(s.code,{children:"rp.log"}),")"]}),"\n",(0,i.jsx)(s.li,{children:"Safari Binary Cookies"}),"\n",(0,i.jsx)(s.li,{children:"SCCM Client logs"}),"\n",(0,i.jsx)(s.li,{children:"SELinux audit logs"}),"\n",(0,i.jsx)(s.li,{children:"SkyDrive log and error logs"}),"\n",(0,i.jsx)(s.li,{children:"SQLite databases"}),"\n",(0,i.jsx)(s.li,{children:"Symantec AV Corporate Edition and Endpoint Protection logs"}),"\n",(0,i.jsx)(s.li,{children:"Syslog"}),"\n",(0,i.jsx)(s.li,{children:"Utmp, Utmpx"}),"\n",(0,i.jsx)(s.li,{children:"Windows Event Logs (EVT, EVTX)"}),"\n",(0,i.jsx)(s.li,{children:"Windows Firewall logs"}),"\n",(0,i.jsx)(s.li,{children:"Windows Job files (atjobs)"}),"\n",(0,i.jsx)(s.li,{children:"Windows Prefetch files"}),"\n",(0,i.jsxs)(s.li,{children:["Windows Recycle Bin (",(0,i.jsx)(s.code,{children:"INFO2"})," and ",(0,i.jsx)(s.code,{children:"$I/$R"}),")"]}),"\n",(0,i.jsx)(s.li,{children:"Windows NT Registry Files"}),"\n",(0,i.jsx)(s.li,{children:"Windows Shortcut Files (LNK)"}),"\n",(0,i.jsx)(s.li,{children:"Xchat and Xchat scrollback files"}),"\n",(0,i.jsx)(s.li,{children:"Zsh history files"}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["Cado can also process many other log formats not listed here. If you have a log format you'd like to see supported, please contact us at ",(0,i.jsx)(s.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"}),"."]}),"\n",(0,i.jsx)(s.h2,{id:"adding-your-own-events",children:"Adding Your Own Events"}),"\n",(0,i.jsx)(s.p,{children:"During an investigation, you may want to add custom events to the timeline, such as key events tracked in a spreadsheet. The simplest way to add custom events is to import an ISO format log event with the following format:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"YYYY-MM-DD HH:MM:SS Log Event Message\n"})}),"\n",(0,i.jsxs)(s.p,{children:["For example, saving this text in a file named ",(0,i.jsx)(s.code,{children:"custom_events.log"})," and importing it into the platform:"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"2021-01-01 01:01:01 User phoned help desk and reported ransomware\n2021-01-01 01:01:02 Three more phone calls to help desk\n"})}),"\n",(0,i.jsx)(s.p,{children:"Will result in events such as the following:"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Custom logs imported into Cado",src:o(23979).A+"",width:"433",height:"255"})}),"\n",(0,i.jsx)(s.h2,{id:"log-analysis-considerations",children:"Log Analysis Considerations"}),"\n",(0,i.jsxs)(s.p,{children:["For analyzing large sets of logs (typically over 1 million events) and uncovering suspicious behavior, we recommend using traditional SIEM solutions or open-source tools like Cado's ",(0,i.jsx)(s.a,{href:"https://github.com/cado-security/cloudgrep",children:"cloudgrep"}),". Cado's primary focus is on capturing more than just logs from cloud service providers and other log sources. See ",(0,i.jsx)(s.a,{href:"/cado/intro",children:"here"})," for more details on Cado's capabilities."]})]})}function h(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},23979:(e,s,o)=>{o.d(s,{A:()=>i});const i=o.p+"assets/images/custom_log-c23723dfac762109a84bbbdd4a04d760.png"},28453:(e,s,o)=>{o.d(s,{R:()=>l,x:()=>r});var i=o(96540);const n={},t=i.createContext(n);function l(e){const s=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function r(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:l(e.components),i.createElement(t.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9db271a1.b5d6d678.js b/assets/js/9db271a1.f4fe78c2.js similarity index 99% rename from assets/js/9db271a1.b5d6d678.js rename to assets/js/9db271a1.f4fe78c2.js index 75d7d800d..b889f8804 100644 --- a/assets/js/9db271a1.b5d6d678.js +++ b/assets/js/9db271a1.f4fe78c2.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9250],{43850:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>c,frontMatter:()=>s,metadata:()=>r,toc:()=>d});var t=o(74848),i=o(28453);const s={title:"Webhooks",hide_title:!0,sidebar_position:3},a="How to Integrate with Platforms Using Webhooks",r={id:"cado/integrations/webhooks",title:"Webhooks",description:"Webhook integrations enable you to automatically send information from the Cado platform to other applications using a unique URL.",source:"@site/docs/cado/integrations/webhooks.md",sourceDirName:"cado/integrations",slug:"/cado/integrations/webhooks",permalink:"/cado/integrations/webhooks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/webhooks.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Webhooks",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"How to export to SIEM",permalink:"/cado/integrations/siem"},next:{title:"Tines",permalink:"/cado/integrations/soar/tines"}},l={},d=[{value:"Before You Begin",id:"before-you-begin",level:2},{value:"Adding or Modifying a Webhook",id:"adding-or-modifying-a-webhook",level:2},{value:"Adding a New Webhook",id:"adding-a-new-webhook",level:3},{value:"Modifying an Existing Webhook",id:"modifying-an-existing-webhook",level:3},{value:"Deleting a Webhook",id:"deleting-a-webhook",level:2},{value:"Custom Payloads",id:"custom-payloads",level:2},{value:"Example of a Valid Payload",id:"example-of-a-valid-payload",level:3},{value:"Slack Integration",id:"slack-integration",level:2},{value:"Teams Integration",id:"teams-integration",level:2},{value:"Jira Integration",id:"jira-integration",level:2},{value:"ServiceNow Integration",id:"servicenow-integration",level:2}];function h(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-integrate-with-platforms-using-webhooks",children:"How to Integrate with Platforms Using Webhooks"}),"\n",(0,t.jsx)(n.p,{children:"Webhook integrations enable you to automatically send information from the Cado platform to other applications using a unique URL."}),"\n",(0,t.jsx)(n.h2,{id:"before-you-begin",children:"Before You Begin"}),"\n",(0,t.jsx)(n.p,{children:"To set up a webhook integration in Cado, you first need to generate a webhook URL from the application you wish to integrate with. Most applications that can receive POST requests are supported."}),"\n",(0,t.jsxs)(n.p,{children:["To manage your webhooks, navigate to ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Integrations"})," > ",(0,t.jsx)(n.strong,{children:"Webhooks"}),"."]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Webhooks settings page",src:o(33277).A+"",width:"1485",height:"706"})}),"\n",(0,t.jsx)(n.h2,{id:"adding-or-modifying-a-webhook",children:"Adding or Modifying a Webhook"}),"\n",(0,t.jsx)(n.h3,{id:"adding-a-new-webhook",children:"Adding a New Webhook"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click the ",(0,t.jsx)(n.strong,{children:"New Webhook"})," button at the bottom of the settings page."]}),"\n",(0,t.jsxs)(n.li,{children:["Fill out the following details in the form:","\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Name"}),": A descriptive name for the webhook."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"URL"}),": The webhook URL generated by the application you are integrating with."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Events to Send"}),": Choose the types of events you want to send to the webhook URL. Cado supports the following events:","\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"High Severity Alarm"}),"\n",(0,t.jsx)(n.li,{children:"Suspicious Severity Event"}),"\n",(0,t.jsx)(n.li,{children:"Processing with Alarms"}),"\n",(0,t.jsx)(n.li,{children:"Processing Finished"}),"\n",(0,t.jsx)(n.li,{children:"Processing Failed"}),"\n",(0,t.jsx)(n.li,{children:"Admin Login"}),"\n",(0,t.jsx)(n.li,{children:"Audit Events (Create, Update, Delete, Login, Logout, Download, Reboot, Upgrade)"}),"\n",(0,t.jsx)(n.li,{children:"Detection (Created, Updated)"}),"\n",(0,t.jsx)(n.li,{children:"Detection Group (Created, Updated)"}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Payload"}),": This is a JSON object that defines how the webhook URL will receive the data (see more details in the ",(0,t.jsx)(n.a,{href:"#custom-payloads",children:"Custom Payloads"})," section)."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Event Formatting"}),": Choose the format for sending the ",(0,t.jsx)(n.code,{children:"$Event"})," data. Options include:","\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Default"}),": Sends the raw event as a string with details of the event."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Slack"}),": Only the ",(0,t.jsx)(n.code,{children:"$Title"}),' is sent, e.g., "HIGH SEVERITY ALARM DETECTED."']}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Jira"}),": Only supported for Detection events. Formats the event with markdown to include metadata about the detection."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Adding a new webhook",src:o(36014).A+"",width:"1174",height:"1980"})}),"\n",(0,t.jsx)(n.h3,{id:"modifying-an-existing-webhook",children:"Modifying an Existing Webhook"}),"\n",(0,t.jsxs)(n.p,{children:["To modify a webhook, click the ",(0,t.jsx)(n.strong,{children:"Edit"})," button next to the webhook you wish to change. Any new events will be sent to the updated URL or modified payload."]}),"\n",(0,t.jsx)(n.h2,{id:"deleting-a-webhook",children:"Deleting a Webhook"}),"\n",(0,t.jsxs)(n.p,{children:["To delete a webhook, click the ",(0,t.jsx)(n.strong,{children:"Delete"})," button next to the webhook you want to remove. Once deleted, no further events will be sent to that URL."]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Deleting a webhook",src:o(32039).A+"",width:"884",height:"264"})}),"\n",(0,t.jsx)(n.h2,{id:"custom-payloads",children:"Custom Payloads"}),"\n",(0,t.jsxs)(n.p,{children:["When creating a webhook, you must specify a payload, which defines how the webhook URL receives data from Cado. The payload must be a valid JSON object and include both ",(0,t.jsx)(n.strong,{children:"$Title"})," and ",(0,t.jsx)(n.strong,{children:"$Event"})," values. These values tell Cado where to insert the data about the event."]}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"Check the documentation of the application you are integrating with to ensure the payload format is correct. If the payload doesn't match the expected format, the event might not be received."})}),"\n",(0,t.jsx)(n.h3,{id:"example-of-a-valid-payload",children:"Example of a Valid Payload"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "title": "$Title",\n "message": "$Event"\n}\n'})}),"\n",(0,t.jsx)(n.h2,{id:"slack-integration",children:"Slack Integration"}),"\n",(0,t.jsx)(n.p,{children:"You can send notifications to a Slack channel using webhooks."}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Follow the ",(0,t.jsx)(n.a,{href:"https://api.slack.com/messaging/webhooks#create_a_webhook",children:"Slack documentation"})," to create an incoming webhook for Slack, then copy the webhook URL."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In Cado, navigate to ",(0,t.jsx)(n.strong,{children:"Settings > Integrations > Webhooks"})," and select ",(0,t.jsx)(n.strong,{children:"New Webhook"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:'Enter a name for your webhook and paste the Slack webhook URL. Check the "High Severity Alarms" option under events to send.'}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Set up the payload in Cado to include ",(0,t.jsx)(n.code,{children:"$Title"})," and ",(0,t.jsx)(n.code,{children:"$Event"}),", and format it as required by Slack:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "text": "*$Title*\\nDetails: $Event"\n}\n'})}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["For more details on Slack message payloads, see ",(0,t.jsx)(n.a,{href:"https://api.slack.com/reference/messaging/payload",children:"Slack messaging documentation"})," and ",(0,t.jsx)(n.a,{href:"https://api.slack.com/messaging/composing",children:"Slack message formatting with Markdown"}),"."]}),"\n",(0,t.jsx)(n.h2,{id:"teams-integration",children:"Teams Integration"}),"\n",(0,t.jsx)(n.p,{children:"You can send notifications to a Microsoft Teams channel using webhooks."}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Follow the ",(0,t.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook",children:"Microsoft Teams documentation"})," to create an incoming webhook, then copy the webhook URL."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In Cado, go to ",(0,t.jsx)(n.strong,{children:"Settings > Integrations > Webhooks"})," and select ",(0,t.jsx)(n.strong,{children:"New Webhook"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:'Name your webhook and paste the Teams webhook URL. Check the "High Severity Alarms" event.'}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Set the payload format to include ",(0,t.jsx)(n.code,{children:"$Title"})," and ",(0,t.jsx)(n.code,{children:"$Event"}),", with a JSON key of ",(0,t.jsx)(n.code,{children:"text"}),":"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "text": "**$Title** \\nDetails: $Event"\n}\n'})}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["Refer to the ",(0,t.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/connectors-using?tabs=cURL",children:"Teams message payload documentation"})," and ",(0,t.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/task-modules-and-cards/cards/cards-format?tabs=adaptive-md%2Cconnector-html",children:"Teams Markdown formatting"})," for more details."]}),"\n",(0,t.jsx)(n.h2,{id:"jira-integration",children:"Jira Integration"}),"\n",(0,t.jsx)(n.p,{children:"You can create Jira tickets using Cado webhooks."}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Follow the ",(0,t.jsx)(n.a,{href:"https://confluence.atlassian.com/jirakb/working-with-incoming-webhook-data-in-automation-for-jira-1125878776.html",children:"Jira documentation"})," to create an incoming webhook in Jira."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Create a new webhook by selecting ",(0,t.jsx)(n.strong,{children:"Project settings"})," > ",(0,t.jsx)(n.strong,{children:"Automations"})," > ",(0,t.jsx)(n.strong,{children:"Create a Rule"})," > ",(0,t.jsx)(n.strong,{children:"Incoming Webhook"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:'Choose "Then, Create a New Ticket" and use the following description:'}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:"{{webhookData.title}}\n{{webhookData.message}}\n"})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In Cado, go to ",(0,t.jsx)(n.strong,{children:"Settings > Integrations > Webhooks"}),', and add a new webhook with the Jira webhook URL. Select the "High Severity Alarms" event as an example.']}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Jira Webhook",src:o(18375).A+"",width:"2300",height:"1324"})}),"\n",(0,t.jsx)(n.p,{children:'More complex webhooks are available to the Detection webhooks, for example this can be set as the "Custom Payload" in Cado for the "Detection Updated" webhook:'}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "detection_id": "$detection_id",\n "event_type": "$event_type",\n "group_id": "$group_id",\n "message": "$Event",\n "title": "$Title"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"And correspondingly in Jira:"}),"\n",(0,t.jsx)(n.p,{children:"Summary:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{children:"[{{webhookData.event_type}}] - {{webhookData.title}}\n"})}),"\n",(0,t.jsx)(n.p,{children:"Description:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{children:"{{webhookData.message}}\n"})}),"\n",(0,t.jsx)(n.p,{children:"Additional fields:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "update": {\n "labels": [\n {\n "set": ["Cado_Group_{{webhookData.group_id}}"]\n }\n ]\n }\n}\n'})}),"\n",(0,t.jsx)(n.h2,{id:"servicenow-integration",children:"ServiceNow Integration"}),"\n",(0,t.jsx)(n.p,{children:"To integrate with ServiceNow:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Follow the ",(0,t.jsx)(n.a,{href:"https://www.servicenow.com/community/in-other-news/how-to-integrate-webhooks-into-servicenow/ba-p/2271745",children:"ServiceNow documentation"})," to create incoming webhooks."]}),"\n",(0,t.jsx)(n.li,{children:"Create the webhook in the ServiceNow project, similar to the steps outlined for Jira."}),"\n"]})]})}function c(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(h,{...e})}):h(e)}},18375:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/jira_webhook-fc08a7a79d2c9c2e5e2b61545960462b.png"},32039:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/webhooks-delete-09740d9658ce1f18e810770c50c862a3.png"},36014:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/webhooks-new-16a30bbe0cfde962ffb08045fee2902c.png"},33277:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/webhooks-settings-9eb14e87309649b9936e1fe52d0bac12.png"},28453:(e,n,o)=>{o.d(n,{R:()=>a,x:()=>r});var t=o(96540);const i={},s=t.createContext(i);function a(e){const n=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),t.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9250],{43850:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>c,frontMatter:()=>s,metadata:()=>r,toc:()=>d});var t=o(74848),i=o(28453);const s={title:"Webhooks",hide_title:!0,sidebar_position:3},a="How to Integrate with Platforms Using Webhooks",r={id:"cado/integrations/webhooks",title:"Webhooks",description:"Webhook integrations enable you to automatically send information from the Cado platform to other applications using a unique URL.",source:"@site/docs/cado/integrations/webhooks.md",sourceDirName:"cado/integrations",slug:"/cado/integrations/webhooks",permalink:"/cado/integrations/webhooks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/webhooks.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Webhooks",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"How to export to SIEM",permalink:"/cado/integrations/siem"},next:{title:"Tines",permalink:"/cado/integrations/soar/tines"}},l={},d=[{value:"Before You Begin",id:"before-you-begin",level:2},{value:"Adding or Modifying a Webhook",id:"adding-or-modifying-a-webhook",level:2},{value:"Adding a New Webhook",id:"adding-a-new-webhook",level:3},{value:"Modifying an Existing Webhook",id:"modifying-an-existing-webhook",level:3},{value:"Deleting a Webhook",id:"deleting-a-webhook",level:2},{value:"Custom Payloads",id:"custom-payloads",level:2},{value:"Example of a Valid Payload",id:"example-of-a-valid-payload",level:3},{value:"Slack Integration",id:"slack-integration",level:2},{value:"Teams Integration",id:"teams-integration",level:2},{value:"Jira Integration",id:"jira-integration",level:2},{value:"ServiceNow Integration",id:"servicenow-integration",level:2}];function h(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-integrate-with-platforms-using-webhooks",children:"How to Integrate with Platforms Using Webhooks"}),"\n",(0,t.jsx)(n.p,{children:"Webhook integrations enable you to automatically send information from the Cado platform to other applications using a unique URL."}),"\n",(0,t.jsx)(n.h2,{id:"before-you-begin",children:"Before You Begin"}),"\n",(0,t.jsx)(n.p,{children:"To set up a webhook integration in Cado, you first need to generate a webhook URL from the application you wish to integrate with. Most applications that can receive POST requests are supported."}),"\n",(0,t.jsxs)(n.p,{children:["To manage your webhooks, navigate to ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Integrations"})," > ",(0,t.jsx)(n.strong,{children:"Webhooks"}),"."]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Webhooks settings page",src:o(33277).A+"",width:"1485",height:"706"})}),"\n",(0,t.jsx)(n.h2,{id:"adding-or-modifying-a-webhook",children:"Adding or Modifying a Webhook"}),"\n",(0,t.jsx)(n.h3,{id:"adding-a-new-webhook",children:"Adding a New Webhook"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Click the ",(0,t.jsx)(n.strong,{children:"New Webhook"})," button at the bottom of the settings page."]}),"\n",(0,t.jsxs)(n.li,{children:["Fill out the following details in the form:","\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Name"}),": A descriptive name for the webhook."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"URL"}),": The webhook URL generated by the application you are integrating with."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Events to Send"}),": Choose the types of events you want to send to the webhook URL. Cado supports the following events:","\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"High Severity Alarm"}),"\n",(0,t.jsx)(n.li,{children:"Suspicious Severity Event"}),"\n",(0,t.jsx)(n.li,{children:"Processing with Alarms"}),"\n",(0,t.jsx)(n.li,{children:"Processing Finished"}),"\n",(0,t.jsx)(n.li,{children:"Processing Failed"}),"\n",(0,t.jsx)(n.li,{children:"Admin Login"}),"\n",(0,t.jsx)(n.li,{children:"Audit Events (Create, Update, Delete, Login, Logout, Download, Reboot, Upgrade)"}),"\n",(0,t.jsx)(n.li,{children:"Detection (Created, Updated)"}),"\n",(0,t.jsx)(n.li,{children:"Detection Group (Created, Updated)"}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Payload"}),": This is a JSON object that defines how the webhook URL will receive the data (see more details in the ",(0,t.jsx)(n.a,{href:"#custom-payloads",children:"Custom Payloads"})," section)."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Event Formatting"}),": Choose the format for sending the ",(0,t.jsx)(n.code,{children:"$Event"})," data. Options include:","\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Default"}),": Sends the raw event as a string with details of the event."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Slack"}),": Only the ",(0,t.jsx)(n.code,{children:"$Title"}),' is sent, e.g., "HIGH SEVERITY ALARM DETECTED."']}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Jira"}),": Only supported for Detection events. Formats the event with markdown to include metadata about the detection."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Adding a new webhook",src:o(36014).A+"",width:"1174",height:"1980"})}),"\n",(0,t.jsx)(n.h3,{id:"modifying-an-existing-webhook",children:"Modifying an Existing Webhook"}),"\n",(0,t.jsxs)(n.p,{children:["To modify a webhook, click the ",(0,t.jsx)(n.strong,{children:"Edit"})," button next to the webhook you wish to change. Any new events will be sent to the updated URL or modified payload."]}),"\n",(0,t.jsx)(n.h2,{id:"deleting-a-webhook",children:"Deleting a Webhook"}),"\n",(0,t.jsxs)(n.p,{children:["To delete a webhook, click the ",(0,t.jsx)(n.strong,{children:"Delete"})," button next to the webhook you want to remove. Once deleted, no further events will be sent to that URL."]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Deleting a webhook",src:o(32039).A+"",width:"884",height:"264"})}),"\n",(0,t.jsx)(n.h2,{id:"custom-payloads",children:"Custom Payloads"}),"\n",(0,t.jsxs)(n.p,{children:["When creating a webhook, you must specify a payload, which defines how the webhook URL receives data from Cado. The payload must be a valid JSON object and include both ",(0,t.jsx)(n.strong,{children:"$Title"})," and ",(0,t.jsx)(n.strong,{children:"$Event"})," values. These values tell Cado where to insert the data about the event."]}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"Check the documentation of the application you are integrating with to ensure the payload format is correct. If the payload doesn't match the expected format, the event might not be received."})}),"\n",(0,t.jsx)(n.h3,{id:"example-of-a-valid-payload",children:"Example of a Valid Payload"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "title": "$Title",\n "message": "$Event"\n}\n'})}),"\n",(0,t.jsx)(n.h2,{id:"slack-integration",children:"Slack Integration"}),"\n",(0,t.jsx)(n.p,{children:"You can send notifications to a Slack channel using webhooks."}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Follow the ",(0,t.jsx)(n.a,{href:"https://api.slack.com/messaging/webhooks#create_a_webhook",children:"Slack documentation"})," to create an incoming webhook for Slack, then copy the webhook URL."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In Cado, navigate to ",(0,t.jsx)(n.strong,{children:"Settings > Integrations > Webhooks"})," and select ",(0,t.jsx)(n.strong,{children:"New Webhook"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:'Enter a name for your webhook and paste the Slack webhook URL. Check the "High Severity Alarms" option under events to send.'}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Set up the payload in Cado to include ",(0,t.jsx)(n.code,{children:"$Title"})," and ",(0,t.jsx)(n.code,{children:"$Event"}),", and format it as required by Slack:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "text": "*$Title*\\nDetails: $Event"\n}\n'})}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["For more details on Slack message payloads, see ",(0,t.jsx)(n.a,{href:"https://api.slack.com/reference/messaging/payload",children:"Slack messaging documentation"})," and ",(0,t.jsx)(n.a,{href:"https://api.slack.com/messaging/composing",children:"Slack message formatting with Markdown"}),"."]}),"\n",(0,t.jsx)(n.h2,{id:"teams-integration",children:"Teams Integration"}),"\n",(0,t.jsx)(n.p,{children:"You can send notifications to a Microsoft Teams channel using webhooks."}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Follow the ",(0,t.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook",children:"Microsoft Teams documentation"})," to create an incoming webhook, then copy the webhook URL."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In Cado, go to ",(0,t.jsx)(n.strong,{children:"Settings > Integrations > Webhooks"})," and select ",(0,t.jsx)(n.strong,{children:"New Webhook"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:'Name your webhook and paste the Teams webhook URL. Check the "High Severity Alarms" event.'}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Set the payload format to include ",(0,t.jsx)(n.code,{children:"$Title"})," and ",(0,t.jsx)(n.code,{children:"$Event"}),", with a JSON key of ",(0,t.jsx)(n.code,{children:"text"}),":"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "text": "**$Title** \\nDetails: $Event"\n}\n'})}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["Refer to the ",(0,t.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/connectors-using?tabs=cURL",children:"Teams message payload documentation"})," and ",(0,t.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/task-modules-and-cards/cards/cards-format?tabs=adaptive-md%2Cconnector-html",children:"Teams Markdown formatting"})," for more details."]}),"\n",(0,t.jsx)(n.h2,{id:"jira-integration",children:"Jira Integration"}),"\n",(0,t.jsx)(n.p,{children:"You can create Jira tickets using Cado webhooks."}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Follow the ",(0,t.jsx)(n.a,{href:"https://confluence.atlassian.com/jirakb/working-with-incoming-webhook-data-in-automation-for-jira-1125878776.html",children:"Jira documentation"})," to create an incoming webhook in Jira."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Create a new webhook by selecting ",(0,t.jsx)(n.strong,{children:"Project settings"})," > ",(0,t.jsx)(n.strong,{children:"Automations"})," > ",(0,t.jsx)(n.strong,{children:"Create a Rule"})," > ",(0,t.jsx)(n.strong,{children:"Incoming Webhook"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:'Choose "Then, Create a New Ticket" and use the following description:'}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:"{{webhookData.title}}\n{{webhookData.message}}\n"})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["In Cado, go to ",(0,t.jsx)(n.strong,{children:"Settings > Integrations > Webhooks"}),', and add a new webhook with the Jira webhook URL. Select the "High Severity Alarms" event as an example.']}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Jira Webhook",src:o(18375).A+"",width:"2300",height:"1324"})}),"\n",(0,t.jsx)(n.p,{children:'More complex webhooks are available to the Detection webhooks, for example this can be set as the "Custom Payload" in Cado for the "Detection Updated" webhook:'}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "detection_id": "$detection_id",\n "event_type": "$event_type",\n "group_id": "$group_id",\n "message": "$Event",\n "title": "$Title"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"And correspondingly in Jira:"}),"\n",(0,t.jsx)(n.p,{children:"Summary:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{children:"[{{webhookData.event_type}}] - {{webhookData.title}}\n"})}),"\n",(0,t.jsx)(n.p,{children:"Description:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{children:"{{webhookData.message}}\n"})}),"\n",(0,t.jsx)(n.p,{children:"Additional fields:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "update": {\n "labels": [\n {\n "set": ["Cado_Group_{{webhookData.group_id}}"]\n }\n ]\n }\n}\n'})}),"\n",(0,t.jsx)(n.h2,{id:"servicenow-integration",children:"ServiceNow Integration"}),"\n",(0,t.jsx)(n.p,{children:"To integrate with ServiceNow:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Follow the ",(0,t.jsx)(n.a,{href:"https://www.servicenow.com/community/in-other-news/how-to-integrate-webhooks-into-servicenow/ba-p/2271745",children:"ServiceNow documentation"})," to create incoming webhooks."]}),"\n",(0,t.jsx)(n.li,{children:"Create the webhook in the ServiceNow project, similar to the steps outlined for Jira."}),"\n"]})]})}function c(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(h,{...e})}):h(e)}},18375:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/jira_webhook-fc08a7a79d2c9c2e5e2b61545960462b.png"},32039:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/webhooks-delete-09740d9658ce1f18e810770c50c862a3.png"},36014:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/webhooks-new-16a30bbe0cfde962ffb08045fee2902c.png"},33277:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/webhooks-settings-9eb14e87309649b9936e1fe52d0bac12.png"},28453:(e,n,o)=>{o.d(n,{R:()=>a,x:()=>r});var t=o(96540);const i={},s=t.createContext(i);function a(e){const n=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),t.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9ddd9c6e.108ff488.js b/assets/js/9ddd9c6e.b48d54ca.js similarity index 97% rename from assets/js/9ddd9c6e.108ff488.js rename to assets/js/9ddd9c6e.b48d54ca.js index 97a2cf991..12c6ea72a 100644 --- a/assets/js/9ddd9c6e.108ff488.js +++ b/assets/js/9ddd9c6e.b48d54ca.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8047],{58606:(e,o,r)=>{r.r(o),r.d(o,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>n,metadata:()=>i,toc:()=>d});var t=r(74848),s=r(28453);const n={title:"Azure Storage",hide_title:!0,sidebar_position:2},a="How to Import Azure Storage",i={id:"cado/discovery-import/azure/azure-storage",title:"Azure Storage",description:"The Cado platform supports acquiring data from Azure Blob Storage. The two main use cases for Azure Storage acquisition are:",source:"@site/docs/cado/discovery-import/azure/azure-storage.md",sourceDirName:"cado/discovery-import/azure",slug:"/cado/discovery-import/azure/azure-storage",permalink:"/cado/discovery-import/azure/azure-storage",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/azure/azure-storage.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Azure Storage",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Azure Compute",permalink:"/cado/discovery-import/azure/azure-compute"},next:{title:"Azure Kubernetes Service",permalink:"/cado/discovery-import/azure/azure-aks"}},c={},d=[{value:"Steps to Import Data from Azure Blob Storage",id:"steps-to-import-data-from-azure-blob-storage",level:3},{value:"Uploading On-Premise Evidence to Azure Storage for Import",id:"uploading-on-premise-evidence-to-azure-storage-for-import",level:2}];function l(e){const o={a:"a",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-import-azure-storage",children:"How to Import Azure Storage"}),"\n",(0,t.jsx)(o.p,{children:"The Cado platform supports acquiring data from Azure Blob Storage. The two main use cases for Azure Storage acquisition are:"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Analyzing disk images or zip files"})," uploaded to an Azure Blob Storage container as part of an investigation."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Analyzing the contents of an Azure Blob Storage container"})," for any uploaded content that could be part of an incident."]}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"steps-to-import-data-from-azure-blob-storage",children:"Steps to Import Data from Azure Blob Storage"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Select an Azure Subscription"}),(0,t.jsx)(o.br,{}),"\n","Choose the Azure subscription linked to your investigation."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Select the Storage Account"}),(0,t.jsx)(o.br,{}),"\n","Pick the appropriate storage account and then select the container containing the data you wish to analyze."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Download the Blob"}),(0,t.jsx)(o.br,{}),"\n","Click the download icon next to the relevant blob to start the acquisition process."]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Import Azure Storage",src:r(99016).A+"",width:"1777",height:"721"})}),"\n",(0,t.jsx)(o.h2,{id:"uploading-on-premise-evidence-to-azure-storage-for-import",children:"Uploading On-Premise Evidence to Azure Storage for Import"}),"\n",(0,t.jsxs)(o.p,{children:["If you have access to the ",(0,t.jsx)(o.a,{href:"https://portal.azure.com/",children:"Azure Console"}),", you can upload data directly from your web browser."]}),"\n",(0,t.jsxs)(o.p,{children:["Alternatively, you can use a ",(0,t.jsx)(o.strong,{children:"SAS Token"})," or ",(0,t.jsx)(o.strong,{children:"Access Key"})," with a desktop tool like ",(0,t.jsx)(o.a,{href:"https://cyberduck.io/azure/",children:"Cyberduck"})," to upload files easily. Tools like Cyberduck support useful features such as resuming failed uploads."]}),"\n",(0,t.jsxs)(o.p,{children:["We recommend scoping the access permissions by giving ",(0,t.jsx)(o.strong,{children:"write-only"})," access to Azure Storage. More information on setting write-only permissions can be found ",(0,t.jsx)(o.a,{href:"https://stackoverflow.com/questions/50864068/write-only-access-no-read-no-list-no-delete-to-azure-storage",children:"here"}),"."]}),"\n",(0,t.jsxs)(o.p,{children:["You can also use ",(0,t.jsx)(o.strong,{children:"Cado Host"})," with the ",(0,t.jsx)(o.code,{children:"--single_file_unzipped"})," parameter to upload evidence. This is particularly useful if you do not have direct access to Azure, as Cado will generate the necessary credentials under ",(0,t.jsx)(o.strong,{children:"Import > Cado Host"}),"."]})]})}function u(e={}){const{wrapper:o}={...(0,s.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},99016:(e,o,r)=>{r.d(o,{A:()=>t});const t=r.p+"assets/images/azure-storage-0814ca3c04c4e6ae93c1d365601b1b3d.png"},28453:(e,o,r)=>{r.d(o,{R:()=>a,x:()=>i});var t=r(96540);const s={},n=t.createContext(s);function a(e){const o=t.useContext(n);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),t.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8047],{58606:(e,o,r)=>{r.r(o),r.d(o,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>n,metadata:()=>i,toc:()=>d});var t=r(74848),s=r(28453);const n={title:"Azure Storage",hide_title:!0,sidebar_position:2},a="How to Import Azure Storage",i={id:"cado/discovery-import/azure/azure-storage",title:"Azure Storage",description:"The Cado platform supports acquiring data from Azure Blob Storage. The two main use cases for Azure Storage acquisition are:",source:"@site/docs/cado/discovery-import/azure/azure-storage.md",sourceDirName:"cado/discovery-import/azure",slug:"/cado/discovery-import/azure/azure-storage",permalink:"/cado/discovery-import/azure/azure-storage",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/azure/azure-storage.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Azure Storage",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Azure Compute",permalink:"/cado/discovery-import/azure/azure-compute"},next:{title:"Azure Kubernetes Service",permalink:"/cado/discovery-import/azure/azure-aks"}},c={},d=[{value:"Steps to Import Data from Azure Blob Storage",id:"steps-to-import-data-from-azure-blob-storage",level:3},{value:"Uploading On-Premise Evidence to Azure Storage for Import",id:"uploading-on-premise-evidence-to-azure-storage-for-import",level:2}];function l(e){const o={a:"a",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-import-azure-storage",children:"How to Import Azure Storage"}),"\n",(0,t.jsx)(o.p,{children:"The Cado platform supports acquiring data from Azure Blob Storage. The two main use cases for Azure Storage acquisition are:"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Analyzing disk images or zip files"})," uploaded to an Azure Blob Storage container as part of an investigation."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Analyzing the contents of an Azure Blob Storage container"})," for any uploaded content that could be part of an incident."]}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"steps-to-import-data-from-azure-blob-storage",children:"Steps to Import Data from Azure Blob Storage"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Select an Azure Subscription"}),(0,t.jsx)(o.br,{}),"\n","Choose the Azure subscription linked to your investigation."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Select the Storage Account"}),(0,t.jsx)(o.br,{}),"\n","Pick the appropriate storage account and then select the container containing the data you wish to analyze."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Download the Blob"}),(0,t.jsx)(o.br,{}),"\n","Click the download icon next to the relevant blob to start the acquisition process."]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Import Azure Storage",src:r(99016).A+"",width:"1777",height:"721"})}),"\n",(0,t.jsx)(o.h2,{id:"uploading-on-premise-evidence-to-azure-storage-for-import",children:"Uploading On-Premise Evidence to Azure Storage for Import"}),"\n",(0,t.jsxs)(o.p,{children:["If you have access to the ",(0,t.jsx)(o.a,{href:"https://portal.azure.com/",children:"Azure Console"}),", you can upload data directly from your web browser."]}),"\n",(0,t.jsxs)(o.p,{children:["Alternatively, you can use a ",(0,t.jsx)(o.strong,{children:"SAS Token"})," or ",(0,t.jsx)(o.strong,{children:"Access Key"})," with a desktop tool like ",(0,t.jsx)(o.a,{href:"https://cyberduck.io/azure/",children:"Cyberduck"})," to upload files easily. Tools like Cyberduck support useful features such as resuming failed uploads."]}),"\n",(0,t.jsxs)(o.p,{children:["We recommend scoping the access permissions by giving ",(0,t.jsx)(o.strong,{children:"write-only"})," access to Azure Storage. More information on setting write-only permissions can be found ",(0,t.jsx)(o.a,{href:"https://stackoverflow.com/questions/50864068/write-only-access-no-read-no-list-no-delete-to-azure-storage",children:"here"}),"."]}),"\n",(0,t.jsxs)(o.p,{children:["You can also use ",(0,t.jsx)(o.strong,{children:"Cado Host"})," with the ",(0,t.jsx)(o.code,{children:"--single_file_unzipped"})," parameter to upload evidence. This is particularly useful if you do not have direct access to Azure, as Cado will generate the necessary credentials under ",(0,t.jsx)(o.strong,{children:"Import > Cado Host"}),"."]})]})}function u(e={}){const{wrapper:o}={...(0,s.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},99016:(e,o,r)=>{r.d(o,{A:()=>t});const t=r.p+"assets/images/azure-storage-0814ca3c04c4e6ae93c1d365601b1b3d.png"},28453:(e,o,r)=>{r.d(o,{R:()=>a,x:()=>i});var t=r(96540);const s={},n=t.createContext(s);function a(e){const o=t.useContext(n);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),t.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9f04a68e.f6a1e985.js b/assets/js/9f04a68e.793f2b76.js similarity index 99% rename from assets/js/9f04a68e.f6a1e985.js rename to assets/js/9f04a68e.793f2b76.js index a7ce07ec5..482117cc9 100644 --- a/assets/js/9f04a68e.f6a1e985.js +++ b/assets/js/9f04a68e.793f2b76.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9114],{20061:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>d,default:()=>o,frontMatter:()=>r,metadata:()=>c,toc:()=>a});var i=n(74848),s=n(28453);const r={title:"Splunk SOAR",hide_title:!0,sidebar_position:5},d="How to integrate with Splunk SOAR",c={id:"cado/integrations/soar/splunk-soar",title:"Splunk SOAR",description:"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado.",source:"@site/docs/cado/integrations/soar/splunk-soar.md",sourceDirName:"cado/integrations/soar",slug:"/cado/integrations/soar/splunk-soar",permalink:"/cado/integrations/soar/splunk-soar",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/soar/splunk-soar.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"Splunk SOAR",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Tines",permalink:"/cado/integrations/soar/tines"},next:{title:"Cortex XSOAR",permalink:"/cado/integrations/soar/cortex-xsoar"}},l={},a=[{value:"Getting Started",id:"getting-started",level:2},{value:"Create an API Access Key",id:"create-an-api-access-key",level:3},{value:"Install and Configure the Cado App",id:"install-and-configure-the-cado-app",level:3},{value:"Configuration Variables",id:"configuration-variables",level:4},{value:"Test your connection",id:"test-your-connection",level:3},{value:"Atomic Actions",id:"atomic-actions",level:2},{value:"List Projects",id:"list-projects",level:3},{value:"List EC2 instances",id:"list-ec2-instances",level:3},{value:"List S3 buckets",id:"list-s3-buckets",level:3},{value:"List Pipelines",id:"list-pipelines",level:3},{value:"Get a pipeline",id:"get-a-pipeline",level:3},{value:"Loop Until Terminated",id:"loop-until-terminated",level:3},{value:"Create Project",id:"create-project",level:3},{value:"Capture EC2 instance",id:"capture-ec2-instance",level:3},{value:"Capture S3 bucket",id:"capture-s3-bucket",level:3},{value:"Playbooks",id:"playbooks",level:2},{value:"Capture EC2 Instance",id:"capture-ec2-instance-1",level:3},{value:"Prompt: Set Project Name",id:"prompt-set-project-name",level:4},{value:"Action: Creating the Project",id:"action-creating-the-project",level:4},{value:"Action: List S3 Buckets",id:"action-list-s3-buckets",level:4},{value:"Prompt: Set S3 Bucket",id:"prompt-set-s3-bucket",level:4},{value:"Action: List EC2 Instances",id:"action-list-ec2-instances",level:4},{value:"Prompt: Set EC2 Instance",id:"prompt-set-ec2-instance",level:4},{value:"Action: Capture EC2 Instance",id:"action-capture-ec2-instance",level:4},{value:"Action: Loop Pipeline until Terminated",id:"action-loop-pipeline-until-terminated",level:4}];function h(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-integrate-with-splunk-soar",children:"How to integrate with Splunk SOAR"}),"\n",(0,i.jsx)(t.p,{children:"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado."}),"\n",(0,i.jsxs)(t.p,{children:["For more information, see our blog on integrating with ",(0,i.jsx)(t.a,{href:"https://www.cadosecurity.com/cado-response-now-integrates-with-splunk-soar-to-automate-your-cloud-incident-response-workflow/",children:"Splunk SOAR"}),", and the Splunkbase page for the ",(0,i.jsx)(t.a,{href:"https://splunkbase.splunk.com/app/6181",children:"Cado App"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,i.jsxs)(t.p,{children:["Before getting started, please see the ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})," page for general instructions on setting up the Cado platform for integration with third-party tools."]}),"\n",(0,i.jsx)(t.p,{children:"Below are the instructions for setting up the Cado and Splunk SOAR integration:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#create-an-api-access-key",children:"Create an API Access Key"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#install-and-configure-the-cado-response-app",children:"Install and configure the Cado app in Splunk SOAR"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#configuration-variables",children:"Set your configuration variables"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#test-your-connection",children:"Test your connection"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#playbooks",children:"Setup your Playbooks"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"create-an-api-access-key",children:"Create an API Access Key"}),"\n",(0,i.jsxs)(t.p,{children:["In order to allow third-party services to authenticate and interact with a Cado instance, you will need to ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Create an API Access Key"})})," for use within Splunk SOAR."]}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsx)(t.p,{children:"In addition to the API Access Key, please ensure that the Splunk SOAR platform has access (network, firewall, etc) to make API calls to the Cado platform."})}),"\n",(0,i.jsx)(t.h3,{id:"install-and-configure-the-cado-app",children:"Install and Configure the Cado App"}),"\n",(0,i.jsx)(t.p,{children:"In order to install and configure the Cado Splunk SOAR App, you will need the below information:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["The latest version of the Cado Splunk SOAR App Add-on from the ",(0,i.jsx)(t.a,{href:"https://splunkbase.splunk.com/app/6181/",children:(0,i.jsx)(t.strong,{children:"Splunkbase Marketplace"})})]}),"\n",(0,i.jsxs)(t.li,{children:["The URL to Cado, followed by ",(0,i.jsx)(t.code,{children:"/api/v2"})]}),"\n",(0,i.jsx)(t.li,{children:"The API Access Key"}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["To install the Cado App, from within Splunk SOAR, navigate to ",(0,i.jsx)(t.strong,{children:"Apps"})," and click the ",(0,i.jsx)(t.strong,{children:"INSTALL APP"})," button in the top right of the page, then upload the Cado tarball and click ",(0,i.jsx)(t.strong,{children:"INSTALL"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["If you have successfully installed the Cado App you will see it appear under your ",(0,i.jsx)(t.strong,{children:"Unconfigured Apps"}),". Next, do the following:"]}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"CONFIGURE NEW ASSET"})," on the Cado App."]}),"\n",(0,i.jsx)(t.li,{children:"Fill in the Asset Info fields with a name and description."}),"\n",(0,i.jsx)(t.li,{children:"Navigate to Asset Settings"}),"\n",(0,i.jsx)(t.li,{children:"input your URL for the Cado platform"}),"\n",(0,i.jsxs)(t.li,{children:["input your ",(0,i.jsx)(t.strong,{children:"Access token"})," you generated earlier."]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"SAVE"})," and ",(0,i.jsx)(t.strong,{children:"TEST CONNECTIVITY"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["If all is successful, you should see a ",(0,i.jsx)(t.code,{children:"Test Connectivity Passed"})," message."]}),"\n",(0,i.jsx)(t.h4,{id:"configuration-variables",children:"Configuration Variables"}),"\n",(0,i.jsx)(t.p,{children:"The below configuration variables are required to operate Cado via the Splunk SOAR App. These are specified when configuring an asset in Splunk SOAR."}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"VARIABLE"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"base_url"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsxs)(t.td,{children:["URL for the Cado Platform e.g. ",(0,i.jsx)(t.code,{children:"https://cadoresponseurl/api/v2"})]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"access_token"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"password"}),(0,i.jsx)(t.td,{children:"Access token"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_project"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"A project ID in Cado that can be used if a project ID is not specified in an action."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_bucket"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"A default bucket in Cado"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_region"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"AWS region, e.g. us-east-1, that can be used if a region is not specified in an action."})]})]})]}),"\n",(0,i.jsx)(t.p,{children:"When running Actions, if the above inputs are required, they would be entered automatically into the response fields, but you are still able to replace them if you wish to use different values."}),"\n",(0,i.jsx)(t.h3,{id:"test-your-connection",children:"Test your connection"}),"\n",(0,i.jsx)(t.p,{children:"When Cado is configured, you can validate your connection to make sure everything is set up correctly."}),"\n",(0,i.jsxs)(t.p,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Home -> Apps -> Cado Asset -> Asset Settings"}),". If you haven't already, Edit and enter the Cado URL and Secret Key. Save and Test Connectivity to ensure everything is connected as expected."]}),"\n",(0,i.jsx)(t.p,{children:"If the following was successful, then you have correctly setup Splunk SOAR to interact with the Cado API."}),"\n",(0,i.jsx)(t.h2,{id:"atomic-actions",children:"Atomic Actions"}),"\n",(0,i.jsxs)(t.p,{children:["Atomic Actions are the basic actions that can be chained together in ",(0,i.jsx)(t.em,{children:"Playbooks"})," that can be run to perform a specific task or workflow."]}),"\n",(0,i.jsx)(t.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list projects"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_projects"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List projects that are currently active in the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsx)(t.p,{children:"No Parameters required for this action."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.case_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-ec2-instances",children:"List EC2 instances"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list instances"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_instances"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List EC2 instances that are currently visible in the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.region"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.instance_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"CadoResponse-Test"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.instance_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"t3a.2xlarge"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-s3-buckets",children:"List S3 buckets"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list buckets"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_buckets"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List S3 buckets that are currently visible to the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsxs)(t.td,{children:["action_result.data.",(0,i.jsx)(t.em,{children:"."}),".bucket_name"]}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-pipelines",children:"List Pipelines"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list pipelines"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_pipelines"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List pipelines for specified project in Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "list pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquiring i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.pipeline_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.evidence_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"4"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.total"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"18"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.failure"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.pending"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.running"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.success"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"18"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.cancelled"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.terminated"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"true"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"get-a-pipeline",children:"Get a pipeline"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"get pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: get_pipeline"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: Get pipeline details for specified pipeline ID in Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "get pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition: Create a processing pipeline for each copied EC2 volume"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.start_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633025565.147805"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.finish_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633031638.334756"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.execution_duration"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6073"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.state"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"SUCCESS"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"loop-until-terminated",children:"Loop Until Terminated"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"loop pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: loop_pipeline"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: Get pipeline details every 60 seconds for specified pipeline ID in Cado platform until it is terminated."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "get pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition: Create a processing pipeline for each copied EC2 volume"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.start_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633025565.147805"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.finish_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633031638.334756"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.execution_duration"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6073"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.state"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"SUCCESS"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"create-project",children:"Create Project"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"create project"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: create_project"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Create a project in Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_name"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"User provided Project name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.msg"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Created"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"capture-ec2-instance",children:"Capture EC2 instance"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"capture instance"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: capture_instance"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Capture a specific EC2 instance for processing and analysis on the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'S3 bucket name as listed in the output of "list bucket" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"region"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'AWS instance region as listed in the output of "list instances" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"instance_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'AWS instance ID as listed in the output of "list instances" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquiring i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.region"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.instance_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.bucket"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"capture-s3-bucket",children:"Capture S3 bucket"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"capture bucket"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: capture_bucket"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Capture contents of a specific S3 bucket processing and analysis on the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'S3 bucket name as listed in the output of "list bucket" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"example-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.pipeline_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.project_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.evidence_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"4"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.pipeline_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"acquisition"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.bucket"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"playbooks",children:"Playbooks"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.em,{children:"If you have a good grasp of the basics of Splunk SOAR, feel free to skip this section."})}),"\n",(0,i.jsxs)(t.p,{children:["To create a new playbook, navigate to Playbooks from the Splunk SOAR dashboard. Click the ",(0,i.jsx)(t.strong,{children:"+ PLAYBOOK"})," button in the top right."]}),"\n",(0,i.jsx)(t.p,{children:"Using the graphic playbook editor, you can drag and drop the required elements into place from the blue nodes, and configure them one by one as you place them, until you have a playbook ready."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Splunk SOAR Playbook",src:n(55032).A+"",width:"1713",height:"474"})}),"\n",(0,i.jsx)(t.p,{children:"Playbooks are made up of multiple blocks that carry out a workflow. There are 3 main types of blocks:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Execute actions (these include the atomic actions detailed above)"}),"\n",(0,i.jsx)(t.li,{children:"Process filters"}),"\n",(0,i.jsx)(t.li,{children:"Human input"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"The example below makes use of both execute actions and human input. Prompts pop up and asks the user for an input. This input can then be passed to the actions as action parameters and act accordingly."}),"\n",(0,i.jsx)(t.h3,{id:"capture-ec2-instance-1",children:"Capture EC2 Instance"}),"\n",(0,i.jsx)(t.p,{children:"This section covers a quick tutorial in creating a basic workflow (or playbook in Splunk SOAR terms) that:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Creates a new Project"}),"\n",(0,i.jsx)(t.li,{children:"Triggers an EC2 Disk Acquisition"}),"\n",(0,i.jsx)(t.li,{children:"Loops over a pipeline until it has been terminated"}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-project-name",children:"Prompt: Set Project Name"}),"\n",(0,i.jsxs)(t.p,{children:["From the START block you can drag the blue node to add a new block. Select the Prompt option. Under the ",(0,i.jsx)(t.strong,{children:"Advance Settings"})," -> ",(0,i.jsx)(t.strong,{children:"General Settings"})," you can set a custom name, i.e. ",(0,i.jsx)(t.code,{children:"Set Project Name"}),". You can include a Message, so the user knows what to include."]}),"\n",(0,i.jsx)(t.h4,{id:"action-creating-the-project",children:"Action: Creating the Project"}),"\n",(0,i.jsxs)(t.p,{children:["Drag the blue node from the prompt you just added to add an action. Select your configured Cado App to view the available actions you can carry out. You will want the ",(0,i.jsx)(t.strong,{children:"create project"})," action. Again here you can change the action name under ",(0,i.jsx)(t.strong,{children:"Advanced Settings"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["You can configure the action by clicking the Cado Asset and entering the output from the previous prompt into the ",(0,i.jsx)(t.strong,{children:"project_name"})," field. Do this by clicking on the field where a sidebar will pop up with a list of blocks currently used in the playbook. Select the prompt you just created, e.g. ",(0,i.jsx)(t.code,{children:"Set_Project_Name"}),". This will open another sidebar with the data path outputs generated from the prompt. Select ",(0,i.jsx)(t.code,{children:"summary.responses.0"}),". SAVE and the action will be created."]}),"\n",(0,i.jsx)(t.h4,{id:"action-list-s3-buckets",children:"Action: List S3 Buckets"}),"\n",(0,i.jsxs)(t.p,{children:["From the last action add the ",(0,i.jsx)(t.strong,{children:"list bucket"})," action. Configure the project_id to be the ID output from the ",(0,i.jsx)(t.strong,{children:"create project"})," action, i.e. ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"})]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-s3-bucket",children:"Prompt: Set S3 Bucket"}),"\n",(0,i.jsxs)(t.p,{children:["Add a new prompt block from the previous action called ",(0,i.jsx)(t.code,{children:"Set S3"}),". Click the ",(0,i.jsx)(t.strong,{children:"ADD MESSAGE PARAMETERS"})," button. This will add ",(0,i.jsx)(t.strong,{children:0})," to the message which acts as a placeholder for a message parameter. In the message parameter field select the list bucket action you just created followed by the bucket_name action results i.e. ",(0,i.jsx)(t.code,{children:"list_bucket_1:action_result.data.*.*.bucket_name"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"action-list-ec2-instances",children:"Action: List EC2 Instances"}),"\n",(0,i.jsxs)(t.p,{children:["Add the list instances action next with the project_id field containing the ID output from the ",(0,i.jsx)(t.strong,{children:"create project"})," action, i.e. ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-ec2-instance",children:"Prompt: Set EC2 Instance"}),"\n",(0,i.jsxs)(t.p,{children:["Similar to the ",(0,i.jsx)(t.strong,{children:"Set S3"})," prompt, add a new prompt block with 2 message parameters. The first being the list instances region (",(0,i.jsx)(t.code,{children:"list_instances_1:action_result.data.*.*.region"}),") and the second being the list instances instance ID (",(0,i.jsx)(t.code,{children:"list_instances_1:action_result.data.*.*.id"}),")."]}),"\n",(0,i.jsxs)(t.p,{children:["In the responses part of the configuration for the action add the first to be ",(0,i.jsx)(t.code,{children:"Region"})," and the second to be ",(0,i.jsx)(t.code,{children:"Instance ID"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"action-capture-ec2-instance",children:"Action: Capture EC2 Instance"}),"\n",(0,i.jsxs)(t.p,{children:["Next add the ",(0,i.jsx)(t.strong,{children:"capture instance"})," action, this will need 4 parameters configured. ",(0,i.jsx)(t.strong,{children:"project_id"})," will take the ID result from the create project action. Instance ID and region will take their respective responses from the previous prompt and bucket will take the response from the set S3 prompt."]}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["project_id: ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"})]}),"\n",(0,i.jsxs)(t.li,{children:["instance_id: ",(0,i.jsx)(t.code,{children:"Set_EC2:action_result.summary.responses.1"})]}),"\n",(0,i.jsxs)(t.li,{children:["region: ",(0,i.jsx)(t.code,{children:"Set_EC2:action_result.summary.responses.0"})]}),"\n",(0,i.jsxs)(t.li,{children:["bucket: ",(0,i.jsx)(t.code,{children:"Set_S3:action_result.summary.responses.0"})]}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"action-loop-pipeline-until-terminated",children:"Action: Loop Pipeline until Terminated"}),"\n",(0,i.jsxs)(t.p,{children:["Add the final action which will be the ",(0,i.jsx)(t.strong,{children:"loop pipeline"})," action. Fill in the ",(0,i.jsx)(t.strong,{children:"pipeline_id"})," field with the name result from the capture instance action: ",(0,i.jsx)(t.code,{children:"capture_instance_1:action_result.data.*.name"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["Connect this final action block to the ",(0,i.jsx)(t.strong,{children:"END"})," block and the playbook is complete. Be sure to ",(0,i.jsx)(t.strong,{children:"SAVE"})," using the top right button, and then you can run your playbook."]})]})}function o(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},55032:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/phantom-playbook-75c99069a3e66ac4d5d564309f5f7045.png"},28453:(e,t,n)=>{n.d(t,{R:()=>d,x:()=>c});var i=n(96540);const s={},r=i.createContext(s);function d(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:d(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9114],{20061:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>d,default:()=>o,frontMatter:()=>r,metadata:()=>c,toc:()=>a});var i=n(74848),s=n(28453);const r={title:"Splunk SOAR",hide_title:!0,sidebar_position:5},d="How to integrate with Splunk SOAR",c={id:"cado/integrations/soar/splunk-soar",title:"Splunk SOAR",description:"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado.",source:"@site/docs/cado/integrations/soar/splunk-soar.md",sourceDirName:"cado/integrations/soar",slug:"/cado/integrations/soar/splunk-soar",permalink:"/cado/integrations/soar/splunk-soar",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/soar/splunk-soar.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"Splunk SOAR",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Tines",permalink:"/cado/integrations/soar/tines"},next:{title:"Cortex XSOAR",permalink:"/cado/integrations/soar/cortex-xsoar"}},l={},a=[{value:"Getting Started",id:"getting-started",level:2},{value:"Create an API Access Key",id:"create-an-api-access-key",level:3},{value:"Install and Configure the Cado App",id:"install-and-configure-the-cado-app",level:3},{value:"Configuration Variables",id:"configuration-variables",level:4},{value:"Test your connection",id:"test-your-connection",level:3},{value:"Atomic Actions",id:"atomic-actions",level:2},{value:"List Projects",id:"list-projects",level:3},{value:"List EC2 instances",id:"list-ec2-instances",level:3},{value:"List S3 buckets",id:"list-s3-buckets",level:3},{value:"List Pipelines",id:"list-pipelines",level:3},{value:"Get a pipeline",id:"get-a-pipeline",level:3},{value:"Loop Until Terminated",id:"loop-until-terminated",level:3},{value:"Create Project",id:"create-project",level:3},{value:"Capture EC2 instance",id:"capture-ec2-instance",level:3},{value:"Capture S3 bucket",id:"capture-s3-bucket",level:3},{value:"Playbooks",id:"playbooks",level:2},{value:"Capture EC2 Instance",id:"capture-ec2-instance-1",level:3},{value:"Prompt: Set Project Name",id:"prompt-set-project-name",level:4},{value:"Action: Creating the Project",id:"action-creating-the-project",level:4},{value:"Action: List S3 Buckets",id:"action-list-s3-buckets",level:4},{value:"Prompt: Set S3 Bucket",id:"prompt-set-s3-bucket",level:4},{value:"Action: List EC2 Instances",id:"action-list-ec2-instances",level:4},{value:"Prompt: Set EC2 Instance",id:"prompt-set-ec2-instance",level:4},{value:"Action: Capture EC2 Instance",id:"action-capture-ec2-instance",level:4},{value:"Action: Loop Pipeline until Terminated",id:"action-loop-pipeline-until-terminated",level:4}];function h(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-integrate-with-splunk-soar",children:"How to integrate with Splunk SOAR"}),"\n",(0,i.jsx)(t.p,{children:"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado."}),"\n",(0,i.jsxs)(t.p,{children:["For more information, see our blog on integrating with ",(0,i.jsx)(t.a,{href:"https://www.cadosecurity.com/cado-response-now-integrates-with-splunk-soar-to-automate-your-cloud-incident-response-workflow/",children:"Splunk SOAR"}),", and the Splunkbase page for the ",(0,i.jsx)(t.a,{href:"https://splunkbase.splunk.com/app/6181",children:"Cado App"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,i.jsxs)(t.p,{children:["Before getting started, please see the ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Integrations Overview >"})})," page for general instructions on setting up the Cado platform for integration with third-party tools."]}),"\n",(0,i.jsx)(t.p,{children:"Below are the instructions for setting up the Cado and Splunk SOAR integration:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#create-an-api-access-key",children:"Create an API Access Key"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#install-and-configure-the-cado-response-app",children:"Install and configure the Cado app in Splunk SOAR"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#configuration-variables",children:"Set your configuration variables"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#test-your-connection",children:"Test your connection"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#playbooks",children:"Setup your Playbooks"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"create-an-api-access-key",children:"Create an API Access Key"}),"\n",(0,i.jsxs)(t.p,{children:["In order to allow third-party services to authenticate and interact with a Cado instance, you will need to ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Create an API Access Key"})})," for use within Splunk SOAR."]}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsx)(t.p,{children:"In addition to the API Access Key, please ensure that the Splunk SOAR platform has access (network, firewall, etc) to make API calls to the Cado platform."})}),"\n",(0,i.jsx)(t.h3,{id:"install-and-configure-the-cado-app",children:"Install and Configure the Cado App"}),"\n",(0,i.jsx)(t.p,{children:"In order to install and configure the Cado Splunk SOAR App, you will need the below information:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["The latest version of the Cado Splunk SOAR App Add-on from the ",(0,i.jsx)(t.a,{href:"https://splunkbase.splunk.com/app/6181/",children:(0,i.jsx)(t.strong,{children:"Splunkbase Marketplace"})})]}),"\n",(0,i.jsxs)(t.li,{children:["The URL to Cado, followed by ",(0,i.jsx)(t.code,{children:"/api/v2"})]}),"\n",(0,i.jsx)(t.li,{children:"The API Access Key"}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["To install the Cado App, from within Splunk SOAR, navigate to ",(0,i.jsx)(t.strong,{children:"Apps"})," and click the ",(0,i.jsx)(t.strong,{children:"INSTALL APP"})," button in the top right of the page, then upload the Cado tarball and click ",(0,i.jsx)(t.strong,{children:"INSTALL"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["If you have successfully installed the Cado App you will see it appear under your ",(0,i.jsx)(t.strong,{children:"Unconfigured Apps"}),". Next, do the following:"]}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"CONFIGURE NEW ASSET"})," on the Cado App."]}),"\n",(0,i.jsx)(t.li,{children:"Fill in the Asset Info fields with a name and description."}),"\n",(0,i.jsx)(t.li,{children:"Navigate to Asset Settings"}),"\n",(0,i.jsx)(t.li,{children:"input your URL for the Cado platform"}),"\n",(0,i.jsxs)(t.li,{children:["input your ",(0,i.jsx)(t.strong,{children:"Access token"})," you generated earlier."]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"SAVE"})," and ",(0,i.jsx)(t.strong,{children:"TEST CONNECTIVITY"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["If all is successful, you should see a ",(0,i.jsx)(t.code,{children:"Test Connectivity Passed"})," message."]}),"\n",(0,i.jsx)(t.h4,{id:"configuration-variables",children:"Configuration Variables"}),"\n",(0,i.jsx)(t.p,{children:"The below configuration variables are required to operate Cado via the Splunk SOAR App. These are specified when configuring an asset in Splunk SOAR."}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"VARIABLE"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"base_url"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsxs)(t.td,{children:["URL for the Cado Platform e.g. ",(0,i.jsx)(t.code,{children:"https://cadoresponseurl/api/v2"})]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"access_token"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"password"}),(0,i.jsx)(t.td,{children:"Access token"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_project"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"A project ID in Cado that can be used if a project ID is not specified in an action."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_bucket"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"A default bucket in Cado"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_region"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"AWS region, e.g. us-east-1, that can be used if a region is not specified in an action."})]})]})]}),"\n",(0,i.jsx)(t.p,{children:"When running Actions, if the above inputs are required, they would be entered automatically into the response fields, but you are still able to replace them if you wish to use different values."}),"\n",(0,i.jsx)(t.h3,{id:"test-your-connection",children:"Test your connection"}),"\n",(0,i.jsx)(t.p,{children:"When Cado is configured, you can validate your connection to make sure everything is set up correctly."}),"\n",(0,i.jsxs)(t.p,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Home -> Apps -> Cado Asset -> Asset Settings"}),". If you haven't already, Edit and enter the Cado URL and Secret Key. Save and Test Connectivity to ensure everything is connected as expected."]}),"\n",(0,i.jsx)(t.p,{children:"If the following was successful, then you have correctly setup Splunk SOAR to interact with the Cado API."}),"\n",(0,i.jsx)(t.h2,{id:"atomic-actions",children:"Atomic Actions"}),"\n",(0,i.jsxs)(t.p,{children:["Atomic Actions are the basic actions that can be chained together in ",(0,i.jsx)(t.em,{children:"Playbooks"})," that can be run to perform a specific task or workflow."]}),"\n",(0,i.jsx)(t.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list projects"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_projects"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List projects that are currently active in the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsx)(t.p,{children:"No Parameters required for this action."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.case_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-ec2-instances",children:"List EC2 instances"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list instances"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_instances"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List EC2 instances that are currently visible in the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.region"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.instance_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"CadoResponse-Test"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.instance_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"t3a.2xlarge"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-s3-buckets",children:"List S3 buckets"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list buckets"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_buckets"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List S3 buckets that are currently visible to the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsxs)(t.td,{children:["action_result.data.",(0,i.jsx)(t.em,{children:"."}),".bucket_name"]}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-pipelines",children:"List Pipelines"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list pipelines"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_pipelines"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List pipelines for specified project in Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "list pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquiring i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.pipeline_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.evidence_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"4"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.total"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"18"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.failure"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.pending"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.running"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.success"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"18"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.cancelled"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.terminated"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"true"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"get-a-pipeline",children:"Get a pipeline"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"get pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: get_pipeline"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: Get pipeline details for specified pipeline ID in Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "get pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition: Create a processing pipeline for each copied EC2 volume"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.start_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633025565.147805"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.finish_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633031638.334756"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.execution_duration"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6073"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.state"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"SUCCESS"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"loop-until-terminated",children:"Loop Until Terminated"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"loop pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: loop_pipeline"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: Get pipeline details every 60 seconds for specified pipeline ID in Cado platform until it is terminated."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "get pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition: Create a processing pipeline for each copied EC2 volume"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.start_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633025565.147805"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.finish_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633031638.334756"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.execution_duration"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6073"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.state"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"SUCCESS"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"create-project",children:"Create Project"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"create project"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: create_project"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Create a project in Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_name"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"User provided Project name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.msg"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Created"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"capture-ec2-instance",children:"Capture EC2 instance"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"capture instance"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: capture_instance"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Capture a specific EC2 instance for processing and analysis on the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'S3 bucket name as listed in the output of "list bucket" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"region"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'AWS instance region as listed in the output of "list instances" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"instance_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'AWS instance ID as listed in the output of "list instances" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquiring i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.region"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.instance_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.bucket"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"capture-s3-bucket",children:"Capture S3 bucket"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"capture bucket"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: capture_bucket"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Capture contents of a specific S3 bucket processing and analysis on the Cado platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'S3 bucket name as listed in the output of "list bucket" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"example-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.pipeline_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.project_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.evidence_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"4"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.pipeline_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"acquisition"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.bucket"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"playbooks",children:"Playbooks"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.em,{children:"If you have a good grasp of the basics of Splunk SOAR, feel free to skip this section."})}),"\n",(0,i.jsxs)(t.p,{children:["To create a new playbook, navigate to Playbooks from the Splunk SOAR dashboard. Click the ",(0,i.jsx)(t.strong,{children:"+ PLAYBOOK"})," button in the top right."]}),"\n",(0,i.jsx)(t.p,{children:"Using the graphic playbook editor, you can drag and drop the required elements into place from the blue nodes, and configure them one by one as you place them, until you have a playbook ready."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Splunk SOAR Playbook",src:n(55032).A+"",width:"1713",height:"474"})}),"\n",(0,i.jsx)(t.p,{children:"Playbooks are made up of multiple blocks that carry out a workflow. There are 3 main types of blocks:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Execute actions (these include the atomic actions detailed above)"}),"\n",(0,i.jsx)(t.li,{children:"Process filters"}),"\n",(0,i.jsx)(t.li,{children:"Human input"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"The example below makes use of both execute actions and human input. Prompts pop up and asks the user for an input. This input can then be passed to the actions as action parameters and act accordingly."}),"\n",(0,i.jsx)(t.h3,{id:"capture-ec2-instance-1",children:"Capture EC2 Instance"}),"\n",(0,i.jsx)(t.p,{children:"This section covers a quick tutorial in creating a basic workflow (or playbook in Splunk SOAR terms) that:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Creates a new Project"}),"\n",(0,i.jsx)(t.li,{children:"Triggers an EC2 Disk Acquisition"}),"\n",(0,i.jsx)(t.li,{children:"Loops over a pipeline until it has been terminated"}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-project-name",children:"Prompt: Set Project Name"}),"\n",(0,i.jsxs)(t.p,{children:["From the START block you can drag the blue node to add a new block. Select the Prompt option. Under the ",(0,i.jsx)(t.strong,{children:"Advance Settings"})," -> ",(0,i.jsx)(t.strong,{children:"General Settings"})," you can set a custom name, i.e. ",(0,i.jsx)(t.code,{children:"Set Project Name"}),". You can include a Message, so the user knows what to include."]}),"\n",(0,i.jsx)(t.h4,{id:"action-creating-the-project",children:"Action: Creating the Project"}),"\n",(0,i.jsxs)(t.p,{children:["Drag the blue node from the prompt you just added to add an action. Select your configured Cado App to view the available actions you can carry out. You will want the ",(0,i.jsx)(t.strong,{children:"create project"})," action. Again here you can change the action name under ",(0,i.jsx)(t.strong,{children:"Advanced Settings"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["You can configure the action by clicking the Cado Asset and entering the output from the previous prompt into the ",(0,i.jsx)(t.strong,{children:"project_name"})," field. Do this by clicking on the field where a sidebar will pop up with a list of blocks currently used in the playbook. Select the prompt you just created, e.g. ",(0,i.jsx)(t.code,{children:"Set_Project_Name"}),". This will open another sidebar with the data path outputs generated from the prompt. Select ",(0,i.jsx)(t.code,{children:"summary.responses.0"}),". SAVE and the action will be created."]}),"\n",(0,i.jsx)(t.h4,{id:"action-list-s3-buckets",children:"Action: List S3 Buckets"}),"\n",(0,i.jsxs)(t.p,{children:["From the last action add the ",(0,i.jsx)(t.strong,{children:"list bucket"})," action. Configure the project_id to be the ID output from the ",(0,i.jsx)(t.strong,{children:"create project"})," action, i.e. ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"})]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-s3-bucket",children:"Prompt: Set S3 Bucket"}),"\n",(0,i.jsxs)(t.p,{children:["Add a new prompt block from the previous action called ",(0,i.jsx)(t.code,{children:"Set S3"}),". Click the ",(0,i.jsx)(t.strong,{children:"ADD MESSAGE PARAMETERS"})," button. This will add ",(0,i.jsx)(t.strong,{children:0})," to the message which acts as a placeholder for a message parameter. In the message parameter field select the list bucket action you just created followed by the bucket_name action results i.e. ",(0,i.jsx)(t.code,{children:"list_bucket_1:action_result.data.*.*.bucket_name"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"action-list-ec2-instances",children:"Action: List EC2 Instances"}),"\n",(0,i.jsxs)(t.p,{children:["Add the list instances action next with the project_id field containing the ID output from the ",(0,i.jsx)(t.strong,{children:"create project"})," action, i.e. ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-ec2-instance",children:"Prompt: Set EC2 Instance"}),"\n",(0,i.jsxs)(t.p,{children:["Similar to the ",(0,i.jsx)(t.strong,{children:"Set S3"})," prompt, add a new prompt block with 2 message parameters. The first being the list instances region (",(0,i.jsx)(t.code,{children:"list_instances_1:action_result.data.*.*.region"}),") and the second being the list instances instance ID (",(0,i.jsx)(t.code,{children:"list_instances_1:action_result.data.*.*.id"}),")."]}),"\n",(0,i.jsxs)(t.p,{children:["In the responses part of the configuration for the action add the first to be ",(0,i.jsx)(t.code,{children:"Region"})," and the second to be ",(0,i.jsx)(t.code,{children:"Instance ID"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"action-capture-ec2-instance",children:"Action: Capture EC2 Instance"}),"\n",(0,i.jsxs)(t.p,{children:["Next add the ",(0,i.jsx)(t.strong,{children:"capture instance"})," action, this will need 4 parameters configured. ",(0,i.jsx)(t.strong,{children:"project_id"})," will take the ID result from the create project action. Instance ID and region will take their respective responses from the previous prompt and bucket will take the response from the set S3 prompt."]}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["project_id: ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"})]}),"\n",(0,i.jsxs)(t.li,{children:["instance_id: ",(0,i.jsx)(t.code,{children:"Set_EC2:action_result.summary.responses.1"})]}),"\n",(0,i.jsxs)(t.li,{children:["region: ",(0,i.jsx)(t.code,{children:"Set_EC2:action_result.summary.responses.0"})]}),"\n",(0,i.jsxs)(t.li,{children:["bucket: ",(0,i.jsx)(t.code,{children:"Set_S3:action_result.summary.responses.0"})]}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"action-loop-pipeline-until-terminated",children:"Action: Loop Pipeline until Terminated"}),"\n",(0,i.jsxs)(t.p,{children:["Add the final action which will be the ",(0,i.jsx)(t.strong,{children:"loop pipeline"})," action. Fill in the ",(0,i.jsx)(t.strong,{children:"pipeline_id"})," field with the name result from the capture instance action: ",(0,i.jsx)(t.code,{children:"capture_instance_1:action_result.data.*.name"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["Connect this final action block to the ",(0,i.jsx)(t.strong,{children:"END"})," block and the playbook is complete. Be sure to ",(0,i.jsx)(t.strong,{children:"SAVE"})," using the top right button, and then you can run your playbook."]})]})}function o(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},55032:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/phantom-playbook-75c99069a3e66ac4d5d564309f5f7045.png"},28453:(e,t,n)=>{n.d(t,{R:()=>d,x:()=>c});var i=n(96540);const s={},r=i.createContext(s);function d(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:d(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a0ecaa82.f61aa0f1.js b/assets/js/a0ecaa82.346c0032.js similarity index 99% rename from assets/js/a0ecaa82.f61aa0f1.js rename to assets/js/a0ecaa82.346c0032.js index 9e1103b78..e021ca333 100644 --- a/assets/js/a0ecaa82.f61aa0f1.js +++ b/assets/js/a0ecaa82.346c0032.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2744],{49697:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>d,contentTitle:()=>o,default:()=>p,frontMatter:()=>r,metadata:()=>l,toc:()=>a});var t=i(74848),n=i(28453);const r={title:"File Types",hide_title:!0,sidebar_position:1},o="What Filetypes Can Cado Process?",l={id:"cado/discovery-import/data-types/filetypes",title:"File Types",description:"The Cado platform supports a wide variety of evidence types for processing, with some differences depending on your cloud platform.",source:"@site/docs/cado/discovery-import/data-types/filetypes.md",sourceDirName:"cado/discovery-import/data-types",slug:"/cado/discovery-import/data-types/filetypes",permalink:"/cado/discovery-import/data-types/filetypes",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/data-types/filetypes.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"File Types",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Chain of custody",permalink:"/cado/discovery-import/chain_of_custody"},next:{title:"Log & artifact types",permalink:"/cado/discovery-import/data-types/logs"}},d={},a=[{value:"AWS Capture Formats",id:"aws-capture-formats",level:3},{value:"Azure Capture Formats",id:"azure-capture-formats",level:3},{value:"GCP Capture Formats",id:"gcp-capture-formats",level:3},{value:"Storage Formats",id:"storage-formats",level:3},{value:"Storage Media",id:"storage-media",level:4},{value:"Limitations and Notes",id:"limitations-and-notes",level:3},{value:"Volume Systems",id:"volume-systems",level:4},{value:"File Systems",id:"file-systems",level:4}];function c(e){const s={a:"a",code:"code",h1:"h1",h3:"h3",h4:"h4",li:"li",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"what-filetypes-can-cado-process",children:"What Filetypes Can Cado Process?"}),"\n",(0,t.jsx)(s.p,{children:"The Cado platform supports a wide variety of evidence types for processing, with some differences depending on your cloud platform."}),"\n",(0,t.jsx)(s.h3,{id:"aws-capture-formats",children:"AWS Capture Formats"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"EC2 (Including AMIs, EBS Snapshots, and Volumes)"}),"\n",(0,t.jsx)(s.li,{children:"S3 Storage (both standard and Glacier)"}),"\n",(0,t.jsx)(s.li,{children:"AWS Kubernetes (ECS and EKS)"}),"\n",(0,t.jsx)(s.li,{children:"AWS Lambda"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"azure-capture-formats",children:"Azure Capture Formats"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Virtual Machines"}),"\n",(0,t.jsx)(s.li,{children:"Disks"}),"\n",(0,t.jsx)(s.li,{children:"Storage Containers"}),"\n",(0,t.jsx)(s.li,{children:"Container Blobs"}),"\n",(0,t.jsx)(s.li,{children:"Kubernetes (AKS)"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"gcp-capture-formats",children:"GCP Capture Formats"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Compute Engine"}),"\n",(0,t.jsx)(s.li,{children:"Disks"}),"\n",(0,t.jsx)(s.li,{children:"Storage Buckets"}),"\n",(0,t.jsx)(s.li,{children:"Kubernetes (GKE)"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"storage-formats",children:"Storage Formats"}),"\n",(0,t.jsx)(s.p,{children:"In addition to native support for cloud-based machines and data, Cado can process the following local evidence formats:"}),"\n",(0,t.jsx)(s.h4,{id:"storage-media",children:"Storage Media"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".E01"})," and split ",(0,t.jsx)(s.code,{children:".E01"})]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".VHD"})," and ",(0,t.jsx)(s.code,{children:".VHDX"})]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".DD"})," (Optionally ",(0,t.jsx)(s.code,{children:".GZ"})," Compressed)"]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".GZ"}),", ",(0,t.jsx)(s.code,{children:".TAR"}),", ",(0,t.jsx)(s.code,{children:".ZIP"})]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".VMDK"})," (Partial Support*)"]}),"\n",(0,t.jsxs)(s.li,{children:["Other forensic artifacts collected by EDR tools or ",(0,t.jsx)(s.a,{href:"/cado/discovery-import/cado-host/intro",children:"Cado Host"})]}),"\n"]}),"\n",(0,t.jsxs)(s.p,{children:["To import a compressed dd image, use Gzip and add the ",(0,t.jsx)(s.code,{children:".gz"})," extension (e.g., ",(0,t.jsx)(s.code,{children:"disk.dd.gz"}),")."]}),"\n",(0,t.jsx)(s.h3,{id:"limitations-and-notes",children:"Limitations and Notes"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"Split E01 disks"})," are currently supported only in AWS. Importing zipped split E01 files is not supported."]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"VMDK"})," files are partially supported, as the format has various sub-formats. For better compatibility, it's recommended to convert VMDK files to ",(0,t.jsx)(s.code,{children:".dd"})," format before importing."]}),"\n",(0,t.jsx)(s.li,{children:"If you import a ZIP file, it will be treated as a container of files unless it contains a single file."}),"\n"]}),"\n",(0,t.jsx)(s.h4,{id:"volume-systems",children:"Volume Systems"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"GPT"}),"\n",(0,t.jsx)(s.li,{children:"LVM"}),"\n",(0,t.jsx)(s.li,{children:"MBR"}),"\n",(0,t.jsx)(s.li,{children:"Volume Shadow Snapshots (VSS)"}),"\n"]}),"\n",(0,t.jsx)(s.h4,{id:"file-systems",children:"File Systems"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"ext2, ext3, ext4"}),"\n",(0,t.jsx)(s.li,{children:"FAT"}),"\n",(0,t.jsx)(s.li,{children:"NTFS (version 3)"}),"\n",(0,t.jsx)(s.li,{children:"XFS (version 4, 5)"}),"\n",(0,t.jsx)(s.li,{children:"Apple File System (APFS)"}),"\n"]}),"\n",(0,t.jsxs)(s.p,{children:["Cado can also handle a variety of other disk images and file formats not listed here, though they may not be officially supported. If you have a specific file type you'd like to see supported, feel free to contact us at ",(0,t.jsx)(s.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"}),"."]})]})}function p(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,s,i)=>{i.d(s,{R:()=>o,x:()=>l});var t=i(96540);const n={},r=t.createContext(n);function o(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function l(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2744],{49697:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>d,contentTitle:()=>o,default:()=>p,frontMatter:()=>r,metadata:()=>l,toc:()=>a});var t=i(74848),n=i(28453);const r={title:"File Types",hide_title:!0,sidebar_position:1},o="What Filetypes Can Cado Process?",l={id:"cado/discovery-import/data-types/filetypes",title:"File Types",description:"The Cado platform supports a wide variety of evidence types for processing, with some differences depending on your cloud platform.",source:"@site/docs/cado/discovery-import/data-types/filetypes.md",sourceDirName:"cado/discovery-import/data-types",slug:"/cado/discovery-import/data-types/filetypes",permalink:"/cado/discovery-import/data-types/filetypes",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/data-types/filetypes.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"File Types",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Chain of custody",permalink:"/cado/discovery-import/chain_of_custody"},next:{title:"Log & artifact types",permalink:"/cado/discovery-import/data-types/logs"}},d={},a=[{value:"AWS Capture Formats",id:"aws-capture-formats",level:3},{value:"Azure Capture Formats",id:"azure-capture-formats",level:3},{value:"GCP Capture Formats",id:"gcp-capture-formats",level:3},{value:"Storage Formats",id:"storage-formats",level:3},{value:"Storage Media",id:"storage-media",level:4},{value:"Limitations and Notes",id:"limitations-and-notes",level:3},{value:"Volume Systems",id:"volume-systems",level:4},{value:"File Systems",id:"file-systems",level:4}];function c(e){const s={a:"a",code:"code",h1:"h1",h3:"h3",h4:"h4",li:"li",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"what-filetypes-can-cado-process",children:"What Filetypes Can Cado Process?"}),"\n",(0,t.jsx)(s.p,{children:"The Cado platform supports a wide variety of evidence types for processing, with some differences depending on your cloud platform."}),"\n",(0,t.jsx)(s.h3,{id:"aws-capture-formats",children:"AWS Capture Formats"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"EC2 (Including AMIs, EBS Snapshots, and Volumes)"}),"\n",(0,t.jsx)(s.li,{children:"S3 Storage (both standard and Glacier)"}),"\n",(0,t.jsx)(s.li,{children:"AWS Kubernetes (ECS and EKS)"}),"\n",(0,t.jsx)(s.li,{children:"AWS Lambda"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"azure-capture-formats",children:"Azure Capture Formats"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Virtual Machines"}),"\n",(0,t.jsx)(s.li,{children:"Disks"}),"\n",(0,t.jsx)(s.li,{children:"Storage Containers"}),"\n",(0,t.jsx)(s.li,{children:"Container Blobs"}),"\n",(0,t.jsx)(s.li,{children:"Kubernetes (AKS)"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"gcp-capture-formats",children:"GCP Capture Formats"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Compute Engine"}),"\n",(0,t.jsx)(s.li,{children:"Disks"}),"\n",(0,t.jsx)(s.li,{children:"Storage Buckets"}),"\n",(0,t.jsx)(s.li,{children:"Kubernetes (GKE)"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"storage-formats",children:"Storage Formats"}),"\n",(0,t.jsx)(s.p,{children:"In addition to native support for cloud-based machines and data, Cado can process the following local evidence formats:"}),"\n",(0,t.jsx)(s.h4,{id:"storage-media",children:"Storage Media"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".E01"})," and split ",(0,t.jsx)(s.code,{children:".E01"})]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".VHD"})," and ",(0,t.jsx)(s.code,{children:".VHDX"})]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".DD"})," (Optionally ",(0,t.jsx)(s.code,{children:".GZ"})," Compressed)"]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".GZ"}),", ",(0,t.jsx)(s.code,{children:".TAR"}),", ",(0,t.jsx)(s.code,{children:".ZIP"})]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.code,{children:".VMDK"})," (Partial Support*)"]}),"\n",(0,t.jsxs)(s.li,{children:["Other forensic artifacts collected by EDR tools or ",(0,t.jsx)(s.a,{href:"/cado/discovery-import/cado-host/intro",children:"Cado Host"})]}),"\n"]}),"\n",(0,t.jsxs)(s.p,{children:["To import a compressed dd image, use Gzip and add the ",(0,t.jsx)(s.code,{children:".gz"})," extension (e.g., ",(0,t.jsx)(s.code,{children:"disk.dd.gz"}),")."]}),"\n",(0,t.jsx)(s.h3,{id:"limitations-and-notes",children:"Limitations and Notes"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"Split E01 disks"})," are currently supported only in AWS. Importing zipped split E01 files is not supported."]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"VMDK"})," files are partially supported, as the format has various sub-formats. For better compatibility, it's recommended to convert VMDK files to ",(0,t.jsx)(s.code,{children:".dd"})," format before importing."]}),"\n",(0,t.jsx)(s.li,{children:"If you import a ZIP file, it will be treated as a container of files unless it contains a single file."}),"\n"]}),"\n",(0,t.jsx)(s.h4,{id:"volume-systems",children:"Volume Systems"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"GPT"}),"\n",(0,t.jsx)(s.li,{children:"LVM"}),"\n",(0,t.jsx)(s.li,{children:"MBR"}),"\n",(0,t.jsx)(s.li,{children:"Volume Shadow Snapshots (VSS)"}),"\n"]}),"\n",(0,t.jsx)(s.h4,{id:"file-systems",children:"File Systems"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"ext2, ext3, ext4"}),"\n",(0,t.jsx)(s.li,{children:"FAT"}),"\n",(0,t.jsx)(s.li,{children:"NTFS (version 3)"}),"\n",(0,t.jsx)(s.li,{children:"XFS (version 4, 5)"}),"\n",(0,t.jsx)(s.li,{children:"Apple File System (APFS)"}),"\n"]}),"\n",(0,t.jsxs)(s.p,{children:["Cado can also handle a variety of other disk images and file formats not listed here, though they may not be officially supported. If you have a specific file type you'd like to see supported, feel free to contact us at ",(0,t.jsx)(s.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"}),"."]})]})}function p(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,s,i)=>{i.d(s,{R:()=>o,x:()=>l});var t=i(96540);const n={},r=t.createContext(n);function o(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function l(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a1c491f4.5e544d72.js b/assets/js/a1c491f4.b51646f8.js similarity index 98% rename from assets/js/a1c491f4.5e544d72.js rename to assets/js/a1c491f4.b51646f8.js index d7b765bee..2a7061dbc 100644 --- a/assets/js/a1c491f4.5e544d72.js +++ b/assets/js/a1c491f4.b51646f8.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8644],{48437:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>c});var i=s(74848),t=s(28453);const r={title:"Azure AD",hide_title:!0,sidebar_position:1},o="How to Set Up the Azure AD OAuth Integration",l={id:"cado/manage/users-authentication/sso/azure-ad",title:"Azure AD",description:"If you encounter any issues during the setup process, please contact support at support@cadosecurity.com and provide detailed information about your configuration.",source:"@site/docs/cado/manage/users-authentication/sso/azure-ad.md",sourceDirName:"cado/manage/users-authentication/sso",slug:"/cado/manage/users-authentication/sso/azure-ad",permalink:"/cado/manage/users-authentication/sso/azure-ad",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/sso/azure-ad.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Azure AD",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Manage users",permalink:"/cado/manage/users-authentication/users"},next:{title:"Okta OAuth",permalink:"/cado/manage/users-authentication/sso/okta"}},a={},c=[{value:"Setting Up Azure AD SSO",id:"setting-up-azure-ad-sso",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-set-up-the-azure-ad-oauth-integration",children:"How to Set Up the Azure AD OAuth Integration"}),"\n",(0,i.jsxs)(n.p,{children:["If you encounter any issues during the setup process, please contact support at ",(0,i.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and provide detailed information about your configuration."]}),"\n",(0,i.jsxs)(n.p,{children:["You can enable the beta version of Azure AD OAuth Integration in Cado by navigating to ",(0,i.jsx)(n.strong,{children:"Settings > SSO > Microsoft OAuth"}),"."]}),"\n",(0,i.jsx)(n.h3,{id:"setting-up-azure-ad-sso",children:"Setting Up Azure AD SSO"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Open the ",(0,i.jsx)(n.strong,{children:"Azure portal"})," and go to ",(0,i.jsx)(n.strong,{children:"Enterprise Applications"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"New Application"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"Create your own application"}),":","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Enter a name (e.g., Cado)."}),"\n",(0,i.jsxs)(n.li,{children:["Choose ",(0,i.jsx)(n.strong,{children:"Integrate any other application you don't find in the gallery (Non-gallery)"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["Make a note of the ",(0,i.jsx)(n.strong,{children:"Application ID"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(n.admonition,{type:"tip",children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.em,{children:"Optional:"})," Create a role to allow Azure AD users to be assigned admin privileges:"]}),(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["From the home page, go to ",(0,i.jsx)(n.strong,{children:"Azure Active Directory"})," and select the ",(0,i.jsx)(n.strong,{children:"App Registrations"})," blade."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Select your application (you may need to switch to the ",(0,i.jsx)(n.strong,{children:"All Applications"})," tab if you're not the owner)."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Go to ",(0,i.jsx)(n.strong,{children:"App roles"})," and click ",(0,i.jsx)(n.strong,{children:"Create app role"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Define a role value (e.g., ",(0,i.jsx)(n.code,{children:"admin"}),"), but you can name this role as you prefer. Make a note of the role name for later use."]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Azure AD Role",src:s(630).A+"",width:"567",height:"501"})}),"\n"]}),"\n"]})]}),"\n",(0,i.jsxs)(n.ol,{start:"5",children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Configure Access Control"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Go to ",(0,i.jsx)(n.strong,{children:"Enterprise Applications"})," and open the ",(0,i.jsx)(n.strong,{children:"Properties"})," blade. Ensure that ",(0,i.jsx)(n.strong,{children:"User assignment required?"})," is set to ",(0,i.jsx)(n.code,{children:"Yes"}),", meaning only assigned users can log in to Cado.\n",(0,i.jsx)(n.img,{alt:"Azure Properties",src:s(43380).A+"",width:"604",height:"497"})]}),"\n",(0,i.jsxs)(n.li,{children:["Navigate to ",(0,i.jsx)(n.strong,{children:"Users and Groups"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Add User/Group"})," to assign users who will have access to the application. If you created an admin role, you can assign users to this role to give them admin access within Cado."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Create a Client Secret"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["From the home page, go to ",(0,i.jsx)(n.strong,{children:"Azure Active Directory"})," and select the ",(0,i.jsx)(n.strong,{children:"App Registrations"})," blade."]}),"\n",(0,i.jsxs)(n.li,{children:["Select your application (you may need to switch to the ",(0,i.jsx)(n.strong,{children:"All Applications"})," tab if you're not the owner)."]}),"\n",(0,i.jsxs)(n.li,{children:["Go to the ",(0,i.jsx)(n.strong,{children:"Certificates & Secrets"})," blade and click ",(0,i.jsx)(n.strong,{children:"New Client Secret"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Make a note of the ",(0,i.jsx)(n.strong,{children:"Value"}),"; you will need this in Cado."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Collect Required Information"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["In the ",(0,i.jsx)(n.strong,{children:"Overview"})," blade, note down the following values:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"Application (Client) ID"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"Directory (Tenant) ID"})}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"Client Secret"})," (from the previous step)."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Whitelist the Redirect URL"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Go to the ",(0,i.jsx)(n.strong,{children:"Authentication"})," blade.\n",(0,i.jsx)(n.img,{alt:"Azure Authentication",src:s(73591).A+"",width:"240",height:"274"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Add a Platform"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"Web"})," and input your redirect URL. This should be the URL you use to access Cado in your browser, including the ",(0,i.jsx)(n.code,{children:"/login"})," path. Example: ",(0,i.jsx)(n.code,{children:"https://my.cado.instance/login"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Add API Permissions"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Go to the ",(0,i.jsx)(n.strong,{children:"API Permissions"})," blade.\n",(0,i.jsx)(n.img,{alt:"Azure API Permissions page",src:s(34094).A+"",width:"1932",height:"872"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Add a permission"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"Microsoft Graph"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Choose ",(0,i.jsx)(n.strong,{children:"Delegated Permissions"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Under ",(0,i.jsx)(n.strong,{children:"OpenId permissions"}),", select ",(0,i.jsx)(n.strong,{children:"email"})," and ",(0,i.jsx)(n.strong,{children:"openid"}),".\n",(0,i.jsx)(n.img,{alt:"Azure API Permissions",src:s(52869).A+"",width:"718",height:"1073"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Add permissions"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Configure SSO in the Cado Platform"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Log in to your Cado instance as an admin user."}),"\n",(0,i.jsxs)(n.li,{children:["Go to ",(0,i.jsx)(n.strong,{children:"Settings > SSO > Microsoft OAuth"}),"."]}),"\n",(0,i.jsx)(n.li,{children:"Enter the Microsoft OAuth details you noted earlier."}),"\n",(0,i.jsxs)(n.li,{children:["In the ",(0,i.jsx)(n.code,{children:"Admin Group Name"})," field, enter the value you configured in Step 4."]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Update"}),"."]}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},34094:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-api-permissions-1-c6773e7a506559b1d5400ea1181b3e02.png"},52869:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-api-permissions-2-4e4a436bf78a84c08496a24f6636db77.png"},73591:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-authentication-f45196cbc1394bf9eda1aadd1e4e95d8.png"},630:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-create-role-a52699b7efa0b967fc0650cb134610f8.png"},43380:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-properties-57e0d66a92abcab515c9f71b4974011b.png"},28453:(e,n,s)=>{s.d(n,{R:()=>o,x:()=>l});var i=s(96540);const t={},r=i.createContext(t);function o(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8644],{48437:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>c});var i=s(74848),t=s(28453);const r={title:"Azure AD",hide_title:!0,sidebar_position:1},o="How to Set Up the Azure AD OAuth Integration",l={id:"cado/manage/users-authentication/sso/azure-ad",title:"Azure AD",description:"If you encounter any issues during the setup process, please contact support at support@cadosecurity.com and provide detailed information about your configuration.",source:"@site/docs/cado/manage/users-authentication/sso/azure-ad.md",sourceDirName:"cado/manage/users-authentication/sso",slug:"/cado/manage/users-authentication/sso/azure-ad",permalink:"/cado/manage/users-authentication/sso/azure-ad",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/users-authentication/sso/azure-ad.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Azure AD",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Manage users",permalink:"/cado/manage/users-authentication/users"},next:{title:"Okta OAuth",permalink:"/cado/manage/users-authentication/sso/okta"}},a={},c=[{value:"Setting Up Azure AD SSO",id:"setting-up-azure-ad-sso",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-set-up-the-azure-ad-oauth-integration",children:"How to Set Up the Azure AD OAuth Integration"}),"\n",(0,i.jsxs)(n.p,{children:["If you encounter any issues during the setup process, please contact support at ",(0,i.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and provide detailed information about your configuration."]}),"\n",(0,i.jsxs)(n.p,{children:["You can enable the beta version of Azure AD OAuth Integration in Cado by navigating to ",(0,i.jsx)(n.strong,{children:"Settings > SSO > Microsoft OAuth"}),"."]}),"\n",(0,i.jsx)(n.h3,{id:"setting-up-azure-ad-sso",children:"Setting Up Azure AD SSO"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Open the ",(0,i.jsx)(n.strong,{children:"Azure portal"})," and go to ",(0,i.jsx)(n.strong,{children:"Enterprise Applications"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"New Application"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"Create your own application"}),":","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Enter a name (e.g., Cado)."}),"\n",(0,i.jsxs)(n.li,{children:["Choose ",(0,i.jsx)(n.strong,{children:"Integrate any other application you don't find in the gallery (Non-gallery)"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["Make a note of the ",(0,i.jsx)(n.strong,{children:"Application ID"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(n.admonition,{type:"tip",children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.em,{children:"Optional:"})," Create a role to allow Azure AD users to be assigned admin privileges:"]}),(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["From the home page, go to ",(0,i.jsx)(n.strong,{children:"Azure Active Directory"})," and select the ",(0,i.jsx)(n.strong,{children:"App Registrations"})," blade."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Select your application (you may need to switch to the ",(0,i.jsx)(n.strong,{children:"All Applications"})," tab if you're not the owner)."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Go to ",(0,i.jsx)(n.strong,{children:"App roles"})," and click ",(0,i.jsx)(n.strong,{children:"Create app role"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Define a role value (e.g., ",(0,i.jsx)(n.code,{children:"admin"}),"), but you can name this role as you prefer. Make a note of the role name for later use."]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Azure AD Role",src:s(630).A+"",width:"567",height:"501"})}),"\n"]}),"\n"]})]}),"\n",(0,i.jsxs)(n.ol,{start:"5",children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Configure Access Control"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Go to ",(0,i.jsx)(n.strong,{children:"Enterprise Applications"})," and open the ",(0,i.jsx)(n.strong,{children:"Properties"})," blade. Ensure that ",(0,i.jsx)(n.strong,{children:"User assignment required?"})," is set to ",(0,i.jsx)(n.code,{children:"Yes"}),", meaning only assigned users can log in to Cado.\n",(0,i.jsx)(n.img,{alt:"Azure Properties",src:s(43380).A+"",width:"604",height:"497"})]}),"\n",(0,i.jsxs)(n.li,{children:["Navigate to ",(0,i.jsx)(n.strong,{children:"Users and Groups"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Add User/Group"})," to assign users who will have access to the application. If you created an admin role, you can assign users to this role to give them admin access within Cado."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Create a Client Secret"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["From the home page, go to ",(0,i.jsx)(n.strong,{children:"Azure Active Directory"})," and select the ",(0,i.jsx)(n.strong,{children:"App Registrations"})," blade."]}),"\n",(0,i.jsxs)(n.li,{children:["Select your application (you may need to switch to the ",(0,i.jsx)(n.strong,{children:"All Applications"})," tab if you're not the owner)."]}),"\n",(0,i.jsxs)(n.li,{children:["Go to the ",(0,i.jsx)(n.strong,{children:"Certificates & Secrets"})," blade and click ",(0,i.jsx)(n.strong,{children:"New Client Secret"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Make a note of the ",(0,i.jsx)(n.strong,{children:"Value"}),"; you will need this in Cado."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Collect Required Information"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["In the ",(0,i.jsx)(n.strong,{children:"Overview"})," blade, note down the following values:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"Application (Client) ID"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"Directory (Tenant) ID"})}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"Client Secret"})," (from the previous step)."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Whitelist the Redirect URL"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Go to the ",(0,i.jsx)(n.strong,{children:"Authentication"})," blade.\n",(0,i.jsx)(n.img,{alt:"Azure Authentication",src:s(73591).A+"",width:"240",height:"274"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Add a Platform"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"Web"})," and input your redirect URL. This should be the URL you use to access Cado in your browser, including the ",(0,i.jsx)(n.code,{children:"/login"})," path. Example: ",(0,i.jsx)(n.code,{children:"https://my.cado.instance/login"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Add API Permissions"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Go to the ",(0,i.jsx)(n.strong,{children:"API Permissions"})," blade.\n",(0,i.jsx)(n.img,{alt:"Azure API Permissions page",src:s(34094).A+"",width:"1932",height:"872"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Add a permission"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"Microsoft Graph"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Choose ",(0,i.jsx)(n.strong,{children:"Delegated Permissions"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Under ",(0,i.jsx)(n.strong,{children:"OpenId permissions"}),", select ",(0,i.jsx)(n.strong,{children:"email"})," and ",(0,i.jsx)(n.strong,{children:"openid"}),".\n",(0,i.jsx)(n.img,{alt:"Azure API Permissions",src:s(52869).A+"",width:"718",height:"1073"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Add permissions"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Configure SSO in the Cado Platform"}),":"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Log in to your Cado instance as an admin user."}),"\n",(0,i.jsxs)(n.li,{children:["Go to ",(0,i.jsx)(n.strong,{children:"Settings > SSO > Microsoft OAuth"}),"."]}),"\n",(0,i.jsx)(n.li,{children:"Enter the Microsoft OAuth details you noted earlier."}),"\n",(0,i.jsxs)(n.li,{children:["In the ",(0,i.jsx)(n.code,{children:"Admin Group Name"})," field, enter the value you configured in Step 4."]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Update"}),"."]}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},34094:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-api-permissions-1-c6773e7a506559b1d5400ea1181b3e02.png"},52869:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-api-permissions-2-4e4a436bf78a84c08496a24f6636db77.png"},73591:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-authentication-f45196cbc1394bf9eda1aadd1e4e95d8.png"},630:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-create-role-a52699b7efa0b967fc0650cb134610f8.png"},43380:(e,n,s)=>{s.d(n,{A:()=>i});const i=s.p+"assets/images/azure-properties-57e0d66a92abcab515c9f71b4974011b.png"},28453:(e,n,s)=>{s.d(n,{R:()=>o,x:()=>l});var i=s(96540);const t={},r=i.createContext(t);function o(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a843c566.64f748c8.js b/assets/js/a843c566.b8c886ab.js similarity index 99% rename from assets/js/a843c566.64f748c8.js rename to assets/js/a843c566.b8c886ab.js index 4850caf2a..b9c630ddf 100644 --- a/assets/js/a843c566.64f748c8.js +++ b/assets/js/a843c566.b8c886ab.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6467],{14539:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>c,default:()=>p,frontMatter:()=>r,metadata:()=>i,toc:()=>l});var t=n(74848),s=n(28453);const r={title:"Adding GCP Projects to Azure/AWS",hide_title:!0,sidebar_position:8},c="How to add GCP projects to Azure or AWS",i={id:"cado/deploy/cross/adding-gcp",title:"Adding GCP Projects to Azure/AWS",description:"To enable cross-cloud access from GCP, you need to designate a primary GCP project where evidence will be stored and managed. A service account within this primary project coordinates IAM access to allow Cado to import evidence from other GCP projects.",source:"@site/docs/cado/deploy/cross/adding-gcp.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/adding-gcp",permalink:"/cado/deploy/cross/adding-gcp",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/adding-gcp.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"Adding GCP Projects to Azure/AWS",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Import from subscriptions and tenants in Azure",permalink:"/cado/deploy/cross/azure-cross-tenancy-subscriptions"},next:{title:"Cross-cloud vs individual deployments",permalink:"/cado/deploy/cross/cross_vs_individual"}},d={},l=[{value:"Required APIs to Enable",id:"required-apis-to-enable",level:3},{value:"Steps to Add a GCP Project",id:"steps-to-add-a-gcp-project",level:3},{value:"Permission list",id:"permission-list",level:3}];function a(e){const o={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h3:"h3",hr:"hr",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-add-gcp-projects-to-azure-or-aws",children:"How to add GCP projects to Azure or AWS"}),"\n",(0,t.jsx)(o.p,{children:"To enable cross-cloud access from GCP, you need to designate a primary GCP project where evidence will be stored and managed. A service account within this primary project coordinates IAM access to allow Cado to import evidence from other GCP projects."}),"\n",(0,t.jsx)(o.admonition,{type:"note",children:(0,t.jsx)(o.p,{children:"You will need permission to create IAM roles, service accounts, and generate keys before continuing."})}),"\n",(0,t.jsx)(o.h3,{id:"required-apis-to-enable",children:"Required APIs to Enable"}),"\n",(0,t.jsxs)(o.p,{children:["Ensure the following ",(0,t.jsx)(o.strong,{children:"APIs"})," are enabled in your primary GCP project. You can enable them from the ",(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/apis/library",children:"Google Cloud Console"}),":"]}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com",children:"Compute Engine API"})}),"\nNeeded for Compute Engine acquisition"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/storage.googleapis.com",children:"Cloud Storage API"})}),"\nNeeded for exporting disks when acquiring Compute Engines, and for GCS acquisition"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/container.googleapis.com",children:"Kubernetes Engine API"})}),"\nNeeded for Kubernetes Engine acquisition"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudbuild.googleapis.com",children:"Cloud Build API"})}),"\nNecessary for export operations when acquiring Compute Engines"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/iamcredentials.googleapis.com",children:"IAM Service Account Credentials API"})}),"\nNeeded to generate keys and allow access to GCP resources"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com",children:"Cloud Resource Manager API"})}),"\nNeeded to navigate projects"]}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"steps-to-add-a-gcp-project",children:"Steps to Add a GCP Project"}),"\n",(0,t.jsxs)(o.admonition,{type:"tip",children:[(0,t.jsx)(o.mdxAdmonitionTitle,{}),(0,t.jsxs)(o.p,{children:["Parts of this process can be automated by using our ",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-auto-setup",children:"GCP Automated Setup Scripts"}),". Those steps will contains links to the relevant scripts when appropriate."]})]}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Sign In to Your Primary GCP Project"}),(0,t.jsx)(o.br,{}),"\n","Start by logging into the GCP project that you will designate as the primary project for storing evidence."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Create a GCS Bucket for Evidence Storage"}),(0,t.jsx)(o.br,{}),"\n","Set up a new ",(0,t.jsx)(o.a,{href:"https://cloud.google.com/storage/docs/creating-buckets",children:"Google Cloud Storage (GCS) bucket"})," to store evidence collected by Cado. You will select this bucket during the import process in the Cado interface."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Create a Cado IAM Role"}),(0,t.jsx)(o.br,{}),"\n","Create a new IAM role for Cado with the required permissions. The permissions for cross-cloud acquisitions are listed ",(0,t.jsx)(o.a,{href:"/cado/deploy/cross/adding-gcp#permissions",children:"below"}),". ",(0,t.jsx)("br",{}),"\n",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-auto-setup#role-creation",children:(0,t.jsx)(o.strong,{children:"Script link"})})]}),"\n",(0,t.jsxs)(o.admonition,{type:"info",children:[(0,t.jsx)(o.mdxAdmonitionTitle,{}),(0,t.jsx)(o.p,{children:"This role can be created at the organization level to provide access to multiple projects using one service account."})]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.strong,{children:"Assign the IAM Role to the Compute Engine Principal"})}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["Go to ",(0,t.jsx)(o.strong,{children:"IAM and Admin"})," > ",(0,t.jsx)(o.strong,{children:"IAM"})," in the Google Cloud Console."]}),"\n",(0,t.jsxs)(o.li,{children:["Locate the principal with the format ",(0,t.jsx)(o.code,{children:"xxxxxxxxxxxx-compute@developer.gserviceaccount.com"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:"You may need to check the box 'Include Google-provided role grants'"}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.li,{children:"Edit this principal to grant it the new Cado IAM role."}),"\n",(0,t.jsx)(o.li,{children:"Note down the principal name, as it will be used to configure access to other GCP projects."}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Create a New Service Account and Grant Role"}),(0,t.jsx)(o.br,{}),"\n","Follow these ",(0,t.jsx)(o.a,{href:"https://cloud.google.com/iam/docs/service-accounts-create",children:"Google instructions"})," to create a new service account in the primary GCP project.\nAssign the newly created Cado IAM role to the service account by following ",(0,t.jsx)(o.a,{href:"https://cloud.google.com/iam/docs/create-service-agents#grant-roles",children:"these Google instructions"}),", making sure to grant it the Cado IAM role. ",(0,t.jsx)("br",{}),"\n",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-auto-setup#service-account-creation",children:(0,t.jsx)(o.strong,{children:"Script link"})})]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Create Service Account Credentials and add to Cado"}),(0,t.jsx)(o.br,{}),"\n","Navigate to the ",(0,t.jsx)(o.strong,{children:"Keys"})," tab of the created service account and ",(0,t.jsx)(o.strong,{children:"Add Key"}),", selecting the ",(0,t.jsx)(o.strong,{children:"JSON"})," option. This is the JSON you will input into the ",(0,t.jsx)(o.strong,{children:"Cloud Accounts"})," settings section in Cado."]}),"\n",(0,t.jsx)(o.admonition,{type:"warning",children:(0,t.jsxs)(o.p,{children:["These credentials are ",(0,t.jsx)(o.strong,{children:"sensitive"})," and should be stored appropriately according to your organization's password/secret management policy"]})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Grant Access to Other GCP Projects"}),(0,t.jsx)(o.br,{}),"\n","To allow Cado to collect evidence from additional GCP projects, follow the ",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-cross-project",children:"Cado documentation"})," for setting up access to each additional project. ",(0,t.jsx)("br",{}),"\n",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-auto-setup#cross-project-access",children:(0,t.jsx)(o.strong,{children:"Script link"})})]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.hr,{}),"\n",(0,t.jsx)(o.h3,{id:"permission-list",children:"Permission list"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"### Required for Compute and GCS acquisition\ncloudbuild.builds.create\ncloudbuild.builds.get\ncompute.disks.create\ncompute.disks.delete\ncompute.disks.get\ncompute.disks.list\ncompute.disks.setLabels\ncompute.disks.use\ncompute.disks.useReadOnly\ncompute.globalOperations.get\ncompute.images.create\ncompute.images.get\ncompute.images.useReadOnly\ncompute.instances.create\ncompute.instances.get\ncompute.instances.list\ncompute.instances.setLabels\ncompute.instances.setMetadata\ncompute.instances.setServiceAccount\ncompute.machineTypes.list\ncompute.networks.get\ncompute.networks.list\ncompute.projects.get\ncompute.subnetworks.use\ncompute.subnetworks.useExternalIp\ncompute.zoneOperations.get\ncompute.zones.list\nstorage.buckets.create\nstorage.buckets.get\nstorage.buckets.list\nstorage.objects.create\nstorage.objects.get\nstorage.objects.list\n\n### Required for GKE acquisition\ncontainer.clusters.get\ncontainer.clusters.list\ncontainer.pods.exec\ncontainer.pods.get\ncontainer.pods.list\niam.serviceAccounts.implicitDelegation\n\n### Required for access to GCP projects, necessary for all acquisitions\niam.serviceAccounts.getAccessToken\nresourcemanager.projects.get\n"})})]})}function p(e={}){const{wrapper:o}={...(0,s.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(a,{...e})}):a(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>c,x:()=>i});var t=n(96540);const s={},r=t.createContext(s);function c(e){const o=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),t.createElement(r.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6467],{14539:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>c,default:()=>p,frontMatter:()=>r,metadata:()=>i,toc:()=>l});var t=n(74848),s=n(28453);const r={title:"Adding GCP Projects to Azure/AWS",hide_title:!0,sidebar_position:8},c="How to add GCP projects to Azure or AWS",i={id:"cado/deploy/cross/adding-gcp",title:"Adding GCP Projects to Azure/AWS",description:"To enable cross-cloud access from GCP, you need to designate a primary GCP project where evidence will be stored and managed. A service account within this primary project coordinates IAM access to allow Cado to import evidence from other GCP projects.",source:"@site/docs/cado/deploy/cross/adding-gcp.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/adding-gcp",permalink:"/cado/deploy/cross/adding-gcp",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/adding-gcp.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"Adding GCP Projects to Azure/AWS",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Import from subscriptions and tenants in Azure",permalink:"/cado/deploy/cross/azure-cross-tenancy-subscriptions"},next:{title:"Cross-cloud vs individual deployments",permalink:"/cado/deploy/cross/cross_vs_individual"}},d={},l=[{value:"Required APIs to Enable",id:"required-apis-to-enable",level:3},{value:"Steps to Add a GCP Project",id:"steps-to-add-a-gcp-project",level:3},{value:"Permission list",id:"permission-list",level:3}];function a(e){const o={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h3:"h3",hr:"hr",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-add-gcp-projects-to-azure-or-aws",children:"How to add GCP projects to Azure or AWS"}),"\n",(0,t.jsx)(o.p,{children:"To enable cross-cloud access from GCP, you need to designate a primary GCP project where evidence will be stored and managed. A service account within this primary project coordinates IAM access to allow Cado to import evidence from other GCP projects."}),"\n",(0,t.jsx)(o.admonition,{type:"note",children:(0,t.jsx)(o.p,{children:"You will need permission to create IAM roles, service accounts, and generate keys before continuing."})}),"\n",(0,t.jsx)(o.h3,{id:"required-apis-to-enable",children:"Required APIs to Enable"}),"\n",(0,t.jsxs)(o.p,{children:["Ensure the following ",(0,t.jsx)(o.strong,{children:"APIs"})," are enabled in your primary GCP project. You can enable them from the ",(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/apis/library",children:"Google Cloud Console"}),":"]}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com",children:"Compute Engine API"})}),"\nNeeded for Compute Engine acquisition"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/storage.googleapis.com",children:"Cloud Storage API"})}),"\nNeeded for exporting disks when acquiring Compute Engines, and for GCS acquisition"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/container.googleapis.com",children:"Kubernetes Engine API"})}),"\nNeeded for Kubernetes Engine acquisition"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudbuild.googleapis.com",children:"Cloud Build API"})}),"\nNecessary for export operations when acquiring Compute Engines"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/iamcredentials.googleapis.com",children:"IAM Service Account Credentials API"})}),"\nNeeded to generate keys and allow access to GCP resources"]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com",children:"Cloud Resource Manager API"})}),"\nNeeded to navigate projects"]}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"steps-to-add-a-gcp-project",children:"Steps to Add a GCP Project"}),"\n",(0,t.jsxs)(o.admonition,{type:"tip",children:[(0,t.jsx)(o.mdxAdmonitionTitle,{}),(0,t.jsxs)(o.p,{children:["Parts of this process can be automated by using our ",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-auto-setup",children:"GCP Automated Setup Scripts"}),". Those steps will contains links to the relevant scripts when appropriate."]})]}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Sign In to Your Primary GCP Project"}),(0,t.jsx)(o.br,{}),"\n","Start by logging into the GCP project that you will designate as the primary project for storing evidence."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Create a GCS Bucket for Evidence Storage"}),(0,t.jsx)(o.br,{}),"\n","Set up a new ",(0,t.jsx)(o.a,{href:"https://cloud.google.com/storage/docs/creating-buckets",children:"Google Cloud Storage (GCS) bucket"})," to store evidence collected by Cado. You will select this bucket during the import process in the Cado interface."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Create a Cado IAM Role"}),(0,t.jsx)(o.br,{}),"\n","Create a new IAM role for Cado with the required permissions. The permissions for cross-cloud acquisitions are listed ",(0,t.jsx)(o.a,{href:"/cado/deploy/cross/adding-gcp#permissions",children:"below"}),". ",(0,t.jsx)("br",{}),"\n",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-auto-setup#role-creation",children:(0,t.jsx)(o.strong,{children:"Script link"})})]}),"\n",(0,t.jsxs)(o.admonition,{type:"info",children:[(0,t.jsx)(o.mdxAdmonitionTitle,{}),(0,t.jsx)(o.p,{children:"This role can be created at the organization level to provide access to multiple projects using one service account."})]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.strong,{children:"Assign the IAM Role to the Compute Engine Principal"})}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["Go to ",(0,t.jsx)(o.strong,{children:"IAM and Admin"})," > ",(0,t.jsx)(o.strong,{children:"IAM"})," in the Google Cloud Console."]}),"\n",(0,t.jsxs)(o.li,{children:["Locate the principal with the format ",(0,t.jsx)(o.code,{children:"xxxxxxxxxxxx-compute@developer.gserviceaccount.com"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:"You may need to check the box 'Include Google-provided role grants'"}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.li,{children:"Edit this principal to grant it the new Cado IAM role."}),"\n",(0,t.jsx)(o.li,{children:"Note down the principal name, as it will be used to configure access to other GCP projects."}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Create a New Service Account and Grant Role"}),(0,t.jsx)(o.br,{}),"\n","Follow these ",(0,t.jsx)(o.a,{href:"https://cloud.google.com/iam/docs/service-accounts-create",children:"Google instructions"})," to create a new service account in the primary GCP project.\nAssign the newly created Cado IAM role to the service account by following ",(0,t.jsx)(o.a,{href:"https://cloud.google.com/iam/docs/create-service-agents#grant-roles",children:"these Google instructions"}),", making sure to grant it the Cado IAM role. ",(0,t.jsx)("br",{}),"\n",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-auto-setup#service-account-creation",children:(0,t.jsx)(o.strong,{children:"Script link"})})]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Create Service Account Credentials and add to Cado"}),(0,t.jsx)(o.br,{}),"\n","Navigate to the ",(0,t.jsx)(o.strong,{children:"Keys"})," tab of the created service account and ",(0,t.jsx)(o.strong,{children:"Add Key"}),", selecting the ",(0,t.jsx)(o.strong,{children:"JSON"})," option. This is the JSON you will input into the ",(0,t.jsx)(o.strong,{children:"Cloud Accounts"})," settings section in Cado."]}),"\n",(0,t.jsx)(o.admonition,{type:"warning",children:(0,t.jsxs)(o.p,{children:["These credentials are ",(0,t.jsx)(o.strong,{children:"sensitive"})," and should be stored appropriately according to your organization's password/secret management policy"]})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Grant Access to Other GCP Projects"}),(0,t.jsx)(o.br,{}),"\n","To allow Cado to collect evidence from additional GCP projects, follow the ",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-cross-project",children:"Cado documentation"})," for setting up access to each additional project. ",(0,t.jsx)("br",{}),"\n",(0,t.jsx)(o.a,{href:"/cado/deploy/gcp/gcp-auto-setup#cross-project-access",children:(0,t.jsx)(o.strong,{children:"Script link"})})]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.hr,{}),"\n",(0,t.jsx)(o.h3,{id:"permission-list",children:"Permission list"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"### Required for Compute and GCS acquisition\ncloudbuild.builds.create\ncloudbuild.builds.get\ncompute.disks.create\ncompute.disks.delete\ncompute.disks.get\ncompute.disks.list\ncompute.disks.setLabels\ncompute.disks.use\ncompute.disks.useReadOnly\ncompute.globalOperations.get\ncompute.images.create\ncompute.images.get\ncompute.images.useReadOnly\ncompute.instances.create\ncompute.instances.get\ncompute.instances.list\ncompute.instances.setLabels\ncompute.instances.setMetadata\ncompute.instances.setServiceAccount\ncompute.machineTypes.list\ncompute.networks.get\ncompute.networks.list\ncompute.projects.get\ncompute.subnetworks.use\ncompute.subnetworks.useExternalIp\ncompute.zoneOperations.get\ncompute.zones.list\nstorage.buckets.create\nstorage.buckets.get\nstorage.buckets.list\nstorage.objects.create\nstorage.objects.get\nstorage.objects.list\n\n### Required for GKE acquisition\ncontainer.clusters.get\ncontainer.clusters.list\ncontainer.pods.exec\ncontainer.pods.get\ncontainer.pods.list\niam.serviceAccounts.implicitDelegation\n\n### Required for access to GCP projects, necessary for all acquisitions\niam.serviceAccounts.getAccessToken\nresourcemanager.projects.get\n"})})]})}function p(e={}){const{wrapper:o}={...(0,s.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(a,{...e})}):a(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>c,x:()=>i});var t=n(96540);const s={},r=t.createContext(s);function c(e){const o=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),t.createElement(r.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a972a79c.fda5bbe6.js b/assets/js/a972a79c.1bdee5af.js similarity index 96% rename from assets/js/a972a79c.fda5bbe6.js rename to assets/js/a972a79c.1bdee5af.js index 83650042d..4098f64eb 100644 --- a/assets/js/a972a79c.fda5bbe6.js +++ b/assets/js/a972a79c.1bdee5af.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[278],{54074:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>u,frontMatter:()=>o,metadata:()=>l,toc:()=>a});var i=n(74848),s=n(28453);const o={title:"Logging best practices",hide_title:!0,sidebar_position:2},r="What are AWS logging best practices?",l={id:"cado/deploy/aws/security/logging",title:"Logging best practices",description:"We recommend customers follow AWS best practices regarding logging which includes the following:",source:"@site/docs/cado/deploy/aws/security/logging.md",sourceDirName:"cado/deploy/aws/security",slug:"/cado/deploy/aws/security/logging",permalink:"/cado/deploy/aws/security/logging",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/security/logging.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Logging best practices",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Endpoint access",permalink:"/cado/deploy/aws/networking/endpoints"},next:{title:"Platform encryption in AWS",permalink:"/cado/deploy/aws/security/data-encryption-overview"}},c={},a=[];function d(e){const t={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"what-are-aws-logging-best-practices",children:"What are AWS logging best practices?"}),"\n",(0,i.jsxs)(t.p,{children:["We recommend customers follow ",(0,i.jsx)(t.a,{href:"https://aws.amazon.com/blogs/security/logging-strategies-for-security-incident-response/",children:"AWS best practices regarding logging"})," which includes the following:"]}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Ensure CloudTrail is enabled in all regions"}),"\n",(0,i.jsx)(t.li,{children:"Ensure CloudTrail log file validation is enabled"}),"\n",(0,i.jsx)(t.li,{children:"Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible"}),"\n",(0,i.jsx)(t.li,{children:"Ensure CloudTrail trails are integrated with CloudWatch Logs"}),"\n",(0,i.jsx)(t.li,{children:"Ensure AWS Config is enabled in all regions"}),"\n",(0,i.jsx)(t.li,{children:"Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket"}),"\n",(0,i.jsx)(t.li,{children:"Ensure CloudTrail logs are encrypted at rest using KMS CMKs"}),"\n",(0,i.jsx)(t.li,{children:"Ensure rotation for customer created CMKs is enabled"}),"\n",(0,i.jsx)(t.li,{children:"Ensure VPC flow logging is enabled in all VPCs"}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["For more see our blog on ",(0,i.jsx)(t.a,{href:"https://www.cadosecurity.com/how-to-be-ir-prepared-in-aws/",children:"How to be IR Prepared in AWS"})]})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>l});var i=n(96540);const s={},o=i.createContext(s);function r(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[278],{54074:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>u,frontMatter:()=>o,metadata:()=>l,toc:()=>a});var i=n(74848),s=n(28453);const o={title:"Logging best practices",hide_title:!0,sidebar_position:2},r="What are AWS logging best practices?",l={id:"cado/deploy/aws/security/logging",title:"Logging best practices",description:"We recommend customers follow AWS best practices regarding logging which includes the following:",source:"@site/docs/cado/deploy/aws/security/logging.md",sourceDirName:"cado/deploy/aws/security",slug:"/cado/deploy/aws/security/logging",permalink:"/cado/deploy/aws/security/logging",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/security/logging.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Logging best practices",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Endpoint access",permalink:"/cado/deploy/aws/networking/endpoints"},next:{title:"Platform encryption in AWS",permalink:"/cado/deploy/aws/security/data-encryption-overview"}},c={},a=[];function d(e){const t={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"what-are-aws-logging-best-practices",children:"What are AWS logging best practices?"}),"\n",(0,i.jsxs)(t.p,{children:["We recommend customers follow ",(0,i.jsx)(t.a,{href:"https://aws.amazon.com/blogs/security/logging-strategies-for-security-incident-response/",children:"AWS best practices regarding logging"})," which includes the following:"]}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Ensure CloudTrail is enabled in all regions"}),"\n",(0,i.jsx)(t.li,{children:"Ensure CloudTrail log file validation is enabled"}),"\n",(0,i.jsx)(t.li,{children:"Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible"}),"\n",(0,i.jsx)(t.li,{children:"Ensure CloudTrail trails are integrated with CloudWatch Logs"}),"\n",(0,i.jsx)(t.li,{children:"Ensure AWS Config is enabled in all regions"}),"\n",(0,i.jsx)(t.li,{children:"Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket"}),"\n",(0,i.jsx)(t.li,{children:"Ensure CloudTrail logs are encrypted at rest using KMS CMKs"}),"\n",(0,i.jsx)(t.li,{children:"Ensure rotation for customer created CMKs is enabled"}),"\n",(0,i.jsx)(t.li,{children:"Ensure VPC flow logging is enabled in all VPCs"}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["For more see our blog on ",(0,i.jsx)(t.a,{href:"https://www.cadosecurity.com/how-to-be-ir-prepared-in-aws/",children:"How to be IR Prepared in AWS"})]})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>r,x:()=>l});var i=n(96540);const s={},o=i.createContext(s);function r(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/aba992ac.e9638327.js b/assets/js/aba992ac.20c5e097.js similarity index 99% rename from assets/js/aba992ac.e9638327.js rename to assets/js/aba992ac.20c5e097.js index dee22cb79..7c49964f8 100644 --- a/assets/js/aba992ac.e9638327.js +++ b/assets/js/aba992ac.20c5e097.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9517],{16332:(e,i,n)=>{n.r(i),n.d(i,{assets:()=>d,contentTitle:()=>t,default:()=>u,frontMatter:()=>o,metadata:()=>c,toc:()=>l});var r=n(74848),s=n(28453);const o={title:"IAM permissions description",hide_title:!0,sidebar_position:6},t="Cado Security - Required Azure Permissions",c={id:"cado/deploy/azure/iam-description",title:"IAM permissions description",description:"Cado Security requires specific permissions to be granted in your Azure environment to function correctly. The permissions described here are based on the Cado Security Azure Terraform Module. Please refer to this link for the latest and most detailed information regarding required permissions.",source:"@site/docs/cado/deploy/azure/iam-description.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/iam-description",permalink:"/cado/deploy/azure/iam-description",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/iam-description.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"IAM permissions description",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Architecture in Azure",permalink:"/cado/deploy/azure/azure-architecture"},next:{title:"Workers",permalink:"/cado/deploy/azure/azure-workers"}},d={},l=[{value:"Required Permissions",id:"required-permissions",level:2},{value:"Optional Permissions",id:"optional-permissions",level:2}];function a(e){const i={a:"a",code:"code",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(i.h1,{id:"cado-security---required-azure-permissions",children:"Cado Security - Required Azure Permissions"}),"\n",(0,r.jsxs)(i.p,{children:["Cado Security requires specific permissions to be granted in your Azure environment to function correctly. The permissions described here are based on the ",(0,r.jsx)(i.a,{href:"https://github.com/cado-security/Deployment-Templates/blob/main/azure/azure_persistent/main.tf",children:"Cado Security Azure Terraform Module"}),". Please refer to this link for the latest and most detailed information regarding required permissions."]}),"\n",(0,r.jsxs)(i.p,{children:["If these permissions are too broad for your environment, or if you have concerns regarding the scope of any permissions, please contact our support team at ",(0,r.jsx)(i.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," for assistance in reducing the permission set while maintaining necessary functionality."]}),"\n",(0,r.jsx)(i.h2,{id:"required-permissions",children:"Required Permissions"}),"\n",(0,r.jsx)(i.p,{children:"The following Azure roles and permissions are required for Cado Security deployment:"}),"\n",(0,r.jsxs)(i.ol,{children:["\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Resource Group"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"The resource group will host the infrastructure for Cado Security."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Contributor"})," on the resource group."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Network Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Cado Security requires a static public IP for provisioning."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": Permissions to create and manage public IPs."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Storage Account Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"The module will create a storage account to store investigation data."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Storage Account Contributor"})," on the resource group (or subscription if acquisition permissions are deployed)."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Disk Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"To manage and attach disks for processing."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Disk Snapshot Contributor"})," at the subscription level (optional, depending on configuration)."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Virtual Machine Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Required for creating, managing, and interacting with virtual machines."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Virtual Machine Contributor"})," at the subscription level (optional, depending on configuration)."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Kubernetes Service Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"If deploying Kubernetes clusters, permissions to interact with Azure Kubernetes Service are needed."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Azure Kubernetes Service Cluster Admin Role"})," at the subscription level (optional, depending on configuration)."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Identity Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"A managed identity will be created to run Cado Security operations."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Contributor"})," role for the managed identity within the resource group."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(i.h2,{id:"optional-permissions",children:"Optional Permissions"}),"\n",(0,r.jsx)(i.p,{children:"You can choose whether or not to grant acquisition-related permissions for local investigations within the same subscription. These include:"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.code,{children:"Storage Account Contributor"})}),"\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.code,{children:"Disk Snapshot Contributor"})}),"\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.code,{children:"Virtual Machine Contributor"})}),"\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.code,{children:"Azure Kubernetes Service Cluster Admin Role"})}),"\n"]})]})}function u(e={}){const{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,r.jsx)(i,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},28453:(e,i,n)=>{n.d(i,{R:()=>t,x:()=>c});var r=n(96540);const s={},o=r.createContext(s);function t(e){const i=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function c(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:t(e.components),r.createElement(o.Provider,{value:i},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9517],{16332:(e,i,n)=>{n.r(i),n.d(i,{assets:()=>d,contentTitle:()=>t,default:()=>u,frontMatter:()=>o,metadata:()=>c,toc:()=>l});var r=n(74848),s=n(28453);const o={title:"IAM permissions description",hide_title:!0,sidebar_position:6},t="Cado Security - Required Azure Permissions",c={id:"cado/deploy/azure/iam-description",title:"IAM permissions description",description:"Cado Security requires specific permissions to be granted in your Azure environment to function correctly. The permissions described here are based on the Cado Security Azure Terraform Module. Please refer to this link for the latest and most detailed information regarding required permissions.",source:"@site/docs/cado/deploy/azure/iam-description.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/iam-description",permalink:"/cado/deploy/azure/iam-description",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/iam-description.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"IAM permissions description",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Architecture in Azure",permalink:"/cado/deploy/azure/azure-architecture"},next:{title:"Workers",permalink:"/cado/deploy/azure/azure-workers"}},d={},l=[{value:"Required Permissions",id:"required-permissions",level:2},{value:"Optional Permissions",id:"optional-permissions",level:2}];function a(e){const i={a:"a",code:"code",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(i.h1,{id:"cado-security---required-azure-permissions",children:"Cado Security - Required Azure Permissions"}),"\n",(0,r.jsxs)(i.p,{children:["Cado Security requires specific permissions to be granted in your Azure environment to function correctly. The permissions described here are based on the ",(0,r.jsx)(i.a,{href:"https://github.com/cado-security/Deployment-Templates/blob/main/azure/azure_persistent/main.tf",children:"Cado Security Azure Terraform Module"}),". Please refer to this link for the latest and most detailed information regarding required permissions."]}),"\n",(0,r.jsxs)(i.p,{children:["If these permissions are too broad for your environment, or if you have concerns regarding the scope of any permissions, please contact our support team at ",(0,r.jsx)(i.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," for assistance in reducing the permission set while maintaining necessary functionality."]}),"\n",(0,r.jsx)(i.h2,{id:"required-permissions",children:"Required Permissions"}),"\n",(0,r.jsx)(i.p,{children:"The following Azure roles and permissions are required for Cado Security deployment:"}),"\n",(0,r.jsxs)(i.ol,{children:["\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Resource Group"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"The resource group will host the infrastructure for Cado Security."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Contributor"})," on the resource group."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Network Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Cado Security requires a static public IP for provisioning."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": Permissions to create and manage public IPs."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Storage Account Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"The module will create a storage account to store investigation data."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Storage Account Contributor"})," on the resource group (or subscription if acquisition permissions are deployed)."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Disk Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"To manage and attach disks for processing."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Disk Snapshot Contributor"})," at the subscription level (optional, depending on configuration)."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Virtual Machine Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Required for creating, managing, and interacting with virtual machines."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Virtual Machine Contributor"})," at the subscription level (optional, depending on configuration)."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Kubernetes Service Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"If deploying Kubernetes clusters, permissions to interact with Azure Kubernetes Service are needed."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Azure Kubernetes Service Cluster Admin Role"})," at the subscription level (optional, depending on configuration)."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(i.li,{children:["\n",(0,r.jsx)(i.p,{children:(0,r.jsx)(i.strong,{children:"Identity Permissions"})}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"A managed identity will be created to run Cado Security operations."}),"\n",(0,r.jsxs)(i.li,{children:[(0,r.jsx)(i.strong,{children:"Permission"}),": ",(0,r.jsx)(i.code,{children:"Contributor"})," role for the managed identity within the resource group."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(i.h2,{id:"optional-permissions",children:"Optional Permissions"}),"\n",(0,r.jsx)(i.p,{children:"You can choose whether or not to grant acquisition-related permissions for local investigations within the same subscription. These include:"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.code,{children:"Storage Account Contributor"})}),"\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.code,{children:"Disk Snapshot Contributor"})}),"\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.code,{children:"Virtual Machine Contributor"})}),"\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.code,{children:"Azure Kubernetes Service Cluster Admin Role"})}),"\n"]})]})}function u(e={}){const{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,r.jsx)(i,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},28453:(e,i,n)=>{n.d(i,{R:()=>t,x:()=>c});var r=n(96540);const s={},o=r.createContext(s);function t(e){const i=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function c(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:t(e.components),r.createElement(o.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/aca7154c.dc149c28.js b/assets/js/aca7154c.1bd2b944.js similarity index 99% rename from assets/js/aca7154c.dc149c28.js rename to assets/js/aca7154c.1bd2b944.js index f176097df..598d50347 100644 --- a/assets/js/aca7154c.dc149c28.js +++ b/assets/js/aca7154c.1bd2b944.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[234],{9473:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>d,contentTitle:()=>s,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>c});var o=t(74848),n=t(28453);const i={title:"Azure Terraform deployment",hide_title:!0,sidebar_position:1},s="How to deploy Cado in Azure with Terraform",a={id:"cado/deploy/azure/azure-deploy",title:"Azure Terraform deployment",description:"To set up Cado in Azure you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack.",source:"@site/docs/cado/deploy/azure/azure-deploy.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-deploy",permalink:"/cado/deploy/azure/azure-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-deploy.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Azure Terraform deployment",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"High availability",permalink:"/cado/deploy/aws/performance-resiliency/high-availability"},next:{title:"Platform encryption in Azure",permalink:"/cado/deploy/azure/data-encryption-overview"}},d={},c=[{value:"Testing the deployment",id:"testing-the-deployment",level:3},{value:"Renaming the Cado Instance",id:"renaming-the-cado-instance",level:3},{value:"If you receive the error "The Cado platform in Azure will not start with the error: The client with object id does not have authorization to perform action 'Microsoft.Storage/storageAccounts/read'"",id:"if-you-receive-the-error-the-cado-platform-in-azure-will-not-start-with-the-error-the-client-with-object-id-does-not-have-authorization-to-perform-action-microsoftstoragestorageaccountsread",level:3}];function l(e){const r={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(r.h1,{id:"how-to-deploy-cado-in-azure-with-terraform",children:"How to deploy Cado in Azure with Terraform"}),"\n",(0,o.jsx)(r.p,{children:"To set up Cado in Azure you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack."}),"\n",(0,o.jsx)(r.p,{children:"If you have signed up for a Free Trial or are working with the Cado Sales team already, you should receive the following pieces of information:"}),"\n",(0,o.jsxs)(r.ul,{children:["\n",(0,o.jsx)(r.li,{children:"a link to the Cado image"}),"\n",(0,o.jsxs)(r.li,{children:["the latest Cado Terraform module (",(0,o.jsx)(r.strong,{children:"azure.zip"}),") for deploying into Azure, or clone from ",(0,o.jsx)(r.a,{href:"https://github.com/cado-security/Deployment-Templates/tree/main/azure",children:"https://github.com/cado-security/Deployment-Templates/tree/main/azure"})]}),"\n"]}),"\n",(0,o.jsxs)(r.p,{children:["If you have not received the above items, reach out to ",(0,o.jsx)(r.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," for more details or retrieve from our ",(0,o.jsx)(r.a,{href:"https://cado-public.s3.amazonaws.com/cado_updates_json_v2.json",children:"public update information"}),".\nOnce you receive them, continue on to the steps below."]}),"\n",(0,o.jsxs)(r.ol,{children:["\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:[(0,o.jsx)(r.strong,{children:(0,o.jsx)(r.a,{href:"https://learn.hashicorp.com/tutorials/terraform/install-cli",children:"Install Terraform"})}),", if you have not already."]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:[(0,o.jsx)(r.strong,{children:(0,o.jsx)(r.a,{href:"https://docs.microsoft.com/en-us/cli/azure/install-azure-cli",children:"Install Azure CLI"})}),", if you have not already."]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsx)(r.p,{children:"Run 'az login'. The account you log in with will be used to deploy. You should store the Cado VHD in your local Azure container for this account as well."}),"\n",(0,o.jsx)(r.admonition,{type:"tip",children:(0,o.jsxs)(r.p,{children:["If you have multiple Subscriptions, please ensure you set the Subscription properly prior to beginning the deployment, as outlined here:",(0,o.jsx)(r.br,{}),"\n",(0,o.jsx)(r.a,{href:"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli#logging-into-the-azure-cli",children:"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli#logging-into-the-azure-cli"})]})}),"\n",(0,o.jsxs)(r.admonition,{type:"tip",children:[(0,o.jsx)(r.p,{children:"Depending on your Azure permissions, you may need to be assigned one or more of the following roles in order to complete the deployment:"}),(0,o.jsxs)(r.ul,{children:["\n",(0,o.jsx)(r.li,{children:"Storage Blob Data Contributor"}),"\n",(0,o.jsx)(r.li,{children:"Storage Blob Data Reader"}),"\n",(0,o.jsx)(r.li,{children:"Storage Queue Data Contributor"}),"\n",(0,o.jsx)(r.li,{children:"Storage Queue Data Reader"}),"\n"]})]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:["Extract ",(0,o.jsx)(r.code,{children:"azure.zip"})," This is the ZIP that was provided by Cado Sales"]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:["Change directories into ",(0,o.jsx)(r.code,{children:"azure/cado"})," which was extracted in the previous step."]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsx)(r.p,{children:"Create a public and private ssh key. Make sure the directory exists before running the command and do not use a passphrase:"}),"\n",(0,o.jsx)(r.admonition,{type:"tip",children:(0,o.jsxs)(r.p,{children:["You will likely need to create the ",(0,o.jsx)(r.code,{children:"keys"})," directory by running ",(0,o.jsx)(r.code,{children:"mkdir ../keys"})," prior to running the next step"]})}),"\n",(0,o.jsx)(r.pre,{children:(0,o.jsx)(r.code,{className:"language-console",children:'ssh-keygen -t rsa -b 4096 -f ../keys/azure_demo_key -q -N ""\n'})}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:["Customize the file ",(0,o.jsx)(r.code,{children:"azure/cado/main.tf"})," by filling in the default values for the following variables:"]}),"\n",(0,o.jsxs)(r.table,{children:[(0,o.jsx)(r.thead,{children:(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.th,{children:"Parameter Name"}),(0,o.jsx)(r.th,{children:"Description"}),(0,o.jsx)(r.th,{children:"Example"})]})}),(0,o.jsxs)(r.tbody,{children:[(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"image_id"})}),(0,o.jsx)(r.td,{children:"Cado Image Gallery URL"}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"/communityGalleries/cadoplatform-1a38e0c7-afa4-4e0d-9c56-433a12cd67b1/images/CadoResponseV2.0/versions/2.209.0"})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"ip_pattern_https"})}),(0,o.jsx)(r.td,{children:"List of incoming IPs permitted to access HTTPS. CIDR or source IP range or * to match any IP. At least one value is required."}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:'["1.2.3.4/32","1.2.3.5/32"]'})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"ip_pattern_all"})}),(0,o.jsx)(r.td,{children:"List of incoming IPs permitted to access HTTPS and SSH. CIDR or source IP range or * to match any IP. At least one value is required. This should be the CIDR of the machine that is running the Terraform deployment script."}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:'["1.2.3.6/32"]'})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"instance_type"})}),(0,o.jsx)(r.td,{children:"Instance type to use for main"}),(0,o.jsxs)(r.td,{children:["Recommended to use ",(0,o.jsx)(r.code,{children:"Standard_D16ds_v4"})," If you have questions on instance sizing, please contact support for guidance."]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"resource_group"})}),(0,o.jsx)(r.td,{children:"Resource group name which will be created. This resource group name must not exist already"}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"resgroup123"})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"region"})}),(0,o.jsxs)(r.td,{children:["Region to deploy in. You can use the Display Name or Name of the region as shown when running ",(0,o.jsx)(r.code,{children:"az account list-locations -o table"})]}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"North Europe"}),", ",(0,o.jsx)(r.code,{children:"northeurope"}),", ",(0,o.jsx)(r.code,{children:"East US"}),", ",(0,o.jsx)(r.code,{children:"eastus"})]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"share_size"})}),(0,o.jsx)(r.td,{children:"Size of network file share"}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"500"})," This value is dependent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"main_size"})}),(0,o.jsx)(r.td,{children:"Size of main instance local disk in GB"}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"30"})," ",(0,o.jsx)(r.em,{children:"Do not change"})]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"main_data_size"})}),(0,o.jsx)(r.td,{children:"Size of main instance local disk in GB"}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"500"})," This value is dependent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"processing_mode"})}),(0,o.jsx)(r.td,{children:"Processing mode to start in"}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"scalable-vm"})," ",(0,o.jsx)(r.em,{children:"Do not change"})]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"ssh_key_public"})}),(0,o.jsx)(r.td,{children:"Path to SSH public key"}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"../keys/azure_demo_key.pub"})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"ssh_key_private"})}),(0,o.jsx)(r.td,{children:"Path to SSH private key"}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"../keys/azure_demo_key"})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"proxy"})}),(0,o.jsxs)(r.td,{children:["(",(0,o.jsx)(r.a,{href:"https://user:pass@1.2.3.4:1234",children:"https://user:pass@1.2.3.4:1234"}),")"]}),(0,o.jsxs)(r.td,{children:["Optional Proxy URL to use for outbound connections in format / User Pass - ",(0,o.jsx)(r.a,{href:"https://user:pass@1.2.3.4:1234",children:"https://user:pass@1.2.3.4:1234"})]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"proxy_cert_url"})}),(0,o.jsx)(r.td,{children:"(url)"}),(0,o.jsx)(r.td,{children:"Optional location of where to download and trust the proxy certificate, leave blank to use proxy without a cert."})]})]})]}),"\n",(0,o.jsx)(r.admonition,{type:"tip",children:(0,o.jsxs)(r.p,{children:["We recommend a minimum setting of 500GB for ",(0,o.jsx)(r.code,{children:"main_data_size"}),". The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Investigations can always be deleted to recover space."]})}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:["Deploy by running the following commands in the directory ",(0,o.jsx)(r.code,{children:"azure/cado/"})]}),"\n",(0,o.jsxs)(r.p,{children:[(0,o.jsx)(r.code,{children:"terraform init"})," followed by ",(0,o.jsx)(r.code,{children:"terraform plan"}),". Once you confirm the plan looks correct, you can then run ",(0,o.jsx)(r.code,{children:"terraform apply"})]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsx)(r.p,{children:"Make a note of the IP Address and the full Resource Id (/subscription/.../cado-main-vm) in the logs e.g.:"}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(r.pre,{children:(0,o.jsx)(r.code,{className:"language-console",children:"module.cado_scalable.azurerm_linux_virtual_machine.vm (remote-exec): public_ip = 1.2.3.4\nmodule.cado_scalable.azurerm_linux_virtual_machine.vm: Creation complete after 1m53s [id=/subscriptions/2f34c608-91b5-4d14-ac36-b8e0377fbcca/resourceGroups/new_res_three/providers/Microsoft.Compute/virtualMachines/cado-main-vm]\n"})}),"\n",(0,o.jsxs)(r.p,{children:["The Resource ID can also be found within your Azure Portal by navigating to ",(0,o.jsx)(r.code,{children:"Home > Virtual Machines"}),", clicking on the Cado VM name, then clicking ",(0,o.jsx)(r.code,{children:"Properties"})," on the left navigation bar. Scroll down to find the ",(0,o.jsx)(r.code,{children:"Resource ID"}),"."]}),"\n",(0,o.jsxs)(r.p,{children:["It will take about 20 minutes to deploy, then you can ",(0,o.jsx)(r.strong,{children:(0,o.jsx)(r.a,{href:"/cado/deploy/logging-in",children:"Log into Cado"})})]}),"\n",(0,o.jsx)(r.h3,{id:"testing-the-deployment",children:"Testing the deployment"}),"\n",(0,o.jsxs)(r.p,{children:["After deployment, you can import Test Data from the ",(0,o.jsx)(r.code,{children:"Help"})," menu to confirm that the deployment was successful.\n:::"]}),"\n",(0,o.jsx)(r.h3,{id:"renaming-the-cado-instance",children:"Renaming the Cado Instance"}),"\n",(0,o.jsxs)(r.p,{children:["When deploying, the main Cado instance will have the name ",(0,o.jsx)(r.code,{children:"CadoResponse"}),". If you rename your Cado instance, please ensure the name ",(0,o.jsx)(r.strong,{children:"starts with"})," ",(0,o.jsx)(r.code,{children:"CadoResponse"}),", otherwise the default update mechanism may not work properly due to how permissions are configured.\n:::"]}),"\n",(0,o.jsx)(r.h3,{id:"if-you-receive-the-error-the-cado-platform-in-azure-will-not-start-with-the-error-the-client-with-object-id-does-not-have-authorization-to-perform-action-microsoftstoragestorageaccountsread",children:"If you receive the error \"The Cado platform in Azure will not start with the error: The client with object id does not have authorization to perform action 'Microsoft.Storage/storageAccounts/read'\""}),"\n",(0,o.jsxs)(r.p,{children:["If you find the Cado platform in Azure will not start with the error:\n",(0,o.jsx)(r.code,{children:"The client $client with object id $object does not have authorization to perform action 'Microsoft.Storage/storageAccounts/read' over scope $subscription or the scope is invalid. If access was recently granted, please refresh your credentials. "})]}),"\n",(0,o.jsx)(r.p,{children:"Please resolve by:"}),"\n",(0,o.jsxs)(r.ul,{children:["\n",(0,o.jsx)(r.li,{children:"Find the cado-main-vm in the azure portal"}),"\n",(0,o.jsx)(r.li,{children:"Go to the Identity section"}),"\n",(0,o.jsx)(r.li,{children:"You should see 'system assigned' is off, and 'user assigned' has a single entry 'cado-identity'"}),"\n",(0,o.jsx)(r.li,{children:"Remove any extra managed and switch system assigned to off"}),"\n",(0,o.jsx)(r.li,{children:"Then, reboot cado-main-vm and it will use the correct policy"}),"\n"]})]})}function h(e={}){const{wrapper:r}={...(0,n.R)(),...e.components};return r?(0,o.jsx)(r,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},28453:(e,r,t)=>{t.d(r,{R:()=>s,x:()=>a});var o=t(96540);const n={},i=o.createContext(n);function s(e){const r=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function a(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:s(e.components),o.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[234],{9473:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>d,contentTitle:()=>s,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>c});var o=t(74848),n=t(28453);const i={title:"Azure Terraform deployment",hide_title:!0,sidebar_position:1},s="How to deploy Cado in Azure with Terraform",a={id:"cado/deploy/azure/azure-deploy",title:"Azure Terraform deployment",description:"To set up Cado in Azure you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack.",source:"@site/docs/cado/deploy/azure/azure-deploy.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-deploy",permalink:"/cado/deploy/azure/azure-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-deploy.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Azure Terraform deployment",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"High availability",permalink:"/cado/deploy/aws/performance-resiliency/high-availability"},next:{title:"Platform encryption in Azure",permalink:"/cado/deploy/azure/data-encryption-overview"}},d={},c=[{value:"Testing the deployment",id:"testing-the-deployment",level:3},{value:"Renaming the Cado Instance",id:"renaming-the-cado-instance",level:3},{value:"If you receive the error "The Cado platform in Azure will not start with the error: The client with object id does not have authorization to perform action 'Microsoft.Storage/storageAccounts/read'"",id:"if-you-receive-the-error-the-cado-platform-in-azure-will-not-start-with-the-error-the-client-with-object-id-does-not-have-authorization-to-perform-action-microsoftstoragestorageaccountsread",level:3}];function l(e){const r={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(r.h1,{id:"how-to-deploy-cado-in-azure-with-terraform",children:"How to deploy Cado in Azure with Terraform"}),"\n",(0,o.jsx)(r.p,{children:"To set up Cado in Azure you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack."}),"\n",(0,o.jsx)(r.p,{children:"If you have signed up for a Free Trial or are working with the Cado Sales team already, you should receive the following pieces of information:"}),"\n",(0,o.jsxs)(r.ul,{children:["\n",(0,o.jsx)(r.li,{children:"a link to the Cado image"}),"\n",(0,o.jsxs)(r.li,{children:["the latest Cado Terraform module (",(0,o.jsx)(r.strong,{children:"azure.zip"}),") for deploying into Azure, or clone from ",(0,o.jsx)(r.a,{href:"https://github.com/cado-security/Deployment-Templates/tree/main/azure",children:"https://github.com/cado-security/Deployment-Templates/tree/main/azure"})]}),"\n"]}),"\n",(0,o.jsxs)(r.p,{children:["If you have not received the above items, reach out to ",(0,o.jsx)(r.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," for more details or retrieve from our ",(0,o.jsx)(r.a,{href:"https://cado-public.s3.amazonaws.com/cado_updates_json_v2.json",children:"public update information"}),".\nOnce you receive them, continue on to the steps below."]}),"\n",(0,o.jsxs)(r.ol,{children:["\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:[(0,o.jsx)(r.strong,{children:(0,o.jsx)(r.a,{href:"https://learn.hashicorp.com/tutorials/terraform/install-cli",children:"Install Terraform"})}),", if you have not already."]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:[(0,o.jsx)(r.strong,{children:(0,o.jsx)(r.a,{href:"https://docs.microsoft.com/en-us/cli/azure/install-azure-cli",children:"Install Azure CLI"})}),", if you have not already."]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsx)(r.p,{children:"Run 'az login'. The account you log in with will be used to deploy. You should store the Cado VHD in your local Azure container for this account as well."}),"\n",(0,o.jsx)(r.admonition,{type:"tip",children:(0,o.jsxs)(r.p,{children:["If you have multiple Subscriptions, please ensure you set the Subscription properly prior to beginning the deployment, as outlined here:",(0,o.jsx)(r.br,{}),"\n",(0,o.jsx)(r.a,{href:"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli#logging-into-the-azure-cli",children:"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli#logging-into-the-azure-cli"})]})}),"\n",(0,o.jsxs)(r.admonition,{type:"tip",children:[(0,o.jsx)(r.p,{children:"Depending on your Azure permissions, you may need to be assigned one or more of the following roles in order to complete the deployment:"}),(0,o.jsxs)(r.ul,{children:["\n",(0,o.jsx)(r.li,{children:"Storage Blob Data Contributor"}),"\n",(0,o.jsx)(r.li,{children:"Storage Blob Data Reader"}),"\n",(0,o.jsx)(r.li,{children:"Storage Queue Data Contributor"}),"\n",(0,o.jsx)(r.li,{children:"Storage Queue Data Reader"}),"\n"]})]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:["Extract ",(0,o.jsx)(r.code,{children:"azure.zip"})," This is the ZIP that was provided by Cado Sales"]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:["Change directories into ",(0,o.jsx)(r.code,{children:"azure/cado"})," which was extracted in the previous step."]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsx)(r.p,{children:"Create a public and private ssh key. Make sure the directory exists before running the command and do not use a passphrase:"}),"\n",(0,o.jsx)(r.admonition,{type:"tip",children:(0,o.jsxs)(r.p,{children:["You will likely need to create the ",(0,o.jsx)(r.code,{children:"keys"})," directory by running ",(0,o.jsx)(r.code,{children:"mkdir ../keys"})," prior to running the next step"]})}),"\n",(0,o.jsx)(r.pre,{children:(0,o.jsx)(r.code,{className:"language-console",children:'ssh-keygen -t rsa -b 4096 -f ../keys/azure_demo_key -q -N ""\n'})}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:["Customize the file ",(0,o.jsx)(r.code,{children:"azure/cado/main.tf"})," by filling in the default values for the following variables:"]}),"\n",(0,o.jsxs)(r.table,{children:[(0,o.jsx)(r.thead,{children:(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.th,{children:"Parameter Name"}),(0,o.jsx)(r.th,{children:"Description"}),(0,o.jsx)(r.th,{children:"Example"})]})}),(0,o.jsxs)(r.tbody,{children:[(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"image_id"})}),(0,o.jsx)(r.td,{children:"Cado Image Gallery URL"}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"/communityGalleries/cadoplatform-1a38e0c7-afa4-4e0d-9c56-433a12cd67b1/images/CadoResponseV2.0/versions/2.209.0"})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"ip_pattern_https"})}),(0,o.jsx)(r.td,{children:"List of incoming IPs permitted to access HTTPS. CIDR or source IP range or * to match any IP. At least one value is required."}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:'["1.2.3.4/32","1.2.3.5/32"]'})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"ip_pattern_all"})}),(0,o.jsx)(r.td,{children:"List of incoming IPs permitted to access HTTPS and SSH. CIDR or source IP range or * to match any IP. At least one value is required. This should be the CIDR of the machine that is running the Terraform deployment script."}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:'["1.2.3.6/32"]'})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"instance_type"})}),(0,o.jsx)(r.td,{children:"Instance type to use for main"}),(0,o.jsxs)(r.td,{children:["Recommended to use ",(0,o.jsx)(r.code,{children:"Standard_D16ds_v4"})," If you have questions on instance sizing, please contact support for guidance."]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"resource_group"})}),(0,o.jsx)(r.td,{children:"Resource group name which will be created. This resource group name must not exist already"}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"resgroup123"})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"region"})}),(0,o.jsxs)(r.td,{children:["Region to deploy in. You can use the Display Name or Name of the region as shown when running ",(0,o.jsx)(r.code,{children:"az account list-locations -o table"})]}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"North Europe"}),", ",(0,o.jsx)(r.code,{children:"northeurope"}),", ",(0,o.jsx)(r.code,{children:"East US"}),", ",(0,o.jsx)(r.code,{children:"eastus"})]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"share_size"})}),(0,o.jsx)(r.td,{children:"Size of network file share"}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"500"})," This value is dependent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"main_size"})}),(0,o.jsx)(r.td,{children:"Size of main instance local disk in GB"}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"30"})," ",(0,o.jsx)(r.em,{children:"Do not change"})]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"main_data_size"})}),(0,o.jsx)(r.td,{children:"Size of main instance local disk in GB"}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"500"})," This value is dependent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"processing_mode"})}),(0,o.jsx)(r.td,{children:"Processing mode to start in"}),(0,o.jsxs)(r.td,{children:[(0,o.jsx)(r.code,{children:"scalable-vm"})," ",(0,o.jsx)(r.em,{children:"Do not change"})]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"ssh_key_public"})}),(0,o.jsx)(r.td,{children:"Path to SSH public key"}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"../keys/azure_demo_key.pub"})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"ssh_key_private"})}),(0,o.jsx)(r.td,{children:"Path to SSH private key"}),(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"../keys/azure_demo_key"})})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"proxy"})}),(0,o.jsxs)(r.td,{children:["(",(0,o.jsx)(r.a,{href:"https://user:pass@1.2.3.4:1234",children:"https://user:pass@1.2.3.4:1234"}),")"]}),(0,o.jsxs)(r.td,{children:["Optional Proxy URL to use for outbound connections in format / User Pass - ",(0,o.jsx)(r.a,{href:"https://user:pass@1.2.3.4:1234",children:"https://user:pass@1.2.3.4:1234"})]})]}),(0,o.jsxs)(r.tr,{children:[(0,o.jsx)(r.td,{children:(0,o.jsx)(r.code,{children:"proxy_cert_url"})}),(0,o.jsx)(r.td,{children:"(url)"}),(0,o.jsx)(r.td,{children:"Optional location of where to download and trust the proxy certificate, leave blank to use proxy without a cert."})]})]})]}),"\n",(0,o.jsx)(r.admonition,{type:"tip",children:(0,o.jsxs)(r.p,{children:["We recommend a minimum setting of 500GB for ",(0,o.jsx)(r.code,{children:"main_data_size"}),". The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Investigations can always be deleted to recover space."]})}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsxs)(r.p,{children:["Deploy by running the following commands in the directory ",(0,o.jsx)(r.code,{children:"azure/cado/"})]}),"\n",(0,o.jsxs)(r.p,{children:[(0,o.jsx)(r.code,{children:"terraform init"})," followed by ",(0,o.jsx)(r.code,{children:"terraform plan"}),". Once you confirm the plan looks correct, you can then run ",(0,o.jsx)(r.code,{children:"terraform apply"})]}),"\n"]}),"\n",(0,o.jsxs)(r.li,{children:["\n",(0,o.jsx)(r.p,{children:"Make a note of the IP Address and the full Resource Id (/subscription/.../cado-main-vm) in the logs e.g.:"}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(r.pre,{children:(0,o.jsx)(r.code,{className:"language-console",children:"module.cado_scalable.azurerm_linux_virtual_machine.vm (remote-exec): public_ip = 1.2.3.4\nmodule.cado_scalable.azurerm_linux_virtual_machine.vm: Creation complete after 1m53s [id=/subscriptions/2f34c608-91b5-4d14-ac36-b8e0377fbcca/resourceGroups/new_res_three/providers/Microsoft.Compute/virtualMachines/cado-main-vm]\n"})}),"\n",(0,o.jsxs)(r.p,{children:["The Resource ID can also be found within your Azure Portal by navigating to ",(0,o.jsx)(r.code,{children:"Home > Virtual Machines"}),", clicking on the Cado VM name, then clicking ",(0,o.jsx)(r.code,{children:"Properties"})," on the left navigation bar. Scroll down to find the ",(0,o.jsx)(r.code,{children:"Resource ID"}),"."]}),"\n",(0,o.jsxs)(r.p,{children:["It will take about 20 minutes to deploy, then you can ",(0,o.jsx)(r.strong,{children:(0,o.jsx)(r.a,{href:"/cado/deploy/logging-in",children:"Log into Cado"})})]}),"\n",(0,o.jsx)(r.h3,{id:"testing-the-deployment",children:"Testing the deployment"}),"\n",(0,o.jsxs)(r.p,{children:["After deployment, you can import Test Data from the ",(0,o.jsx)(r.code,{children:"Help"})," menu to confirm that the deployment was successful.\n:::"]}),"\n",(0,o.jsx)(r.h3,{id:"renaming-the-cado-instance",children:"Renaming the Cado Instance"}),"\n",(0,o.jsxs)(r.p,{children:["When deploying, the main Cado instance will have the name ",(0,o.jsx)(r.code,{children:"CadoResponse"}),". If you rename your Cado instance, please ensure the name ",(0,o.jsx)(r.strong,{children:"starts with"})," ",(0,o.jsx)(r.code,{children:"CadoResponse"}),", otherwise the default update mechanism may not work properly due to how permissions are configured.\n:::"]}),"\n",(0,o.jsx)(r.h3,{id:"if-you-receive-the-error-the-cado-platform-in-azure-will-not-start-with-the-error-the-client-with-object-id-does-not-have-authorization-to-perform-action-microsoftstoragestorageaccountsread",children:"If you receive the error \"The Cado platform in Azure will not start with the error: The client with object id does not have authorization to perform action 'Microsoft.Storage/storageAccounts/read'\""}),"\n",(0,o.jsxs)(r.p,{children:["If you find the Cado platform in Azure will not start with the error:\n",(0,o.jsx)(r.code,{children:"The client $client with object id $object does not have authorization to perform action 'Microsoft.Storage/storageAccounts/read' over scope $subscription or the scope is invalid. If access was recently granted, please refresh your credentials. "})]}),"\n",(0,o.jsx)(r.p,{children:"Please resolve by:"}),"\n",(0,o.jsxs)(r.ul,{children:["\n",(0,o.jsx)(r.li,{children:"Find the cado-main-vm in the azure portal"}),"\n",(0,o.jsx)(r.li,{children:"Go to the Identity section"}),"\n",(0,o.jsx)(r.li,{children:"You should see 'system assigned' is off, and 'user assigned' has a single entry 'cado-identity'"}),"\n",(0,o.jsx)(r.li,{children:"Remove any extra managed and switch system assigned to off"}),"\n",(0,o.jsx)(r.li,{children:"Then, reboot cado-main-vm and it will use the correct policy"}),"\n"]})]})}function h(e={}){const{wrapper:r}={...(0,n.R)(),...e.components};return r?(0,o.jsx)(r,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},28453:(e,r,t)=>{t.d(r,{R:()=>s,x:()=>a});var o=t(96540);const n={},i=o.createContext(n);function s(e){const r=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function a(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:s(e.components),o.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b02f4114.0dbd07d7.js b/assets/js/b02f4114.e52fd607.js similarity index 98% rename from assets/js/b02f4114.0dbd07d7.js rename to assets/js/b02f4114.e52fd607.js index 96a522b51..051f1f41f 100644 --- a/assets/js/b02f4114.0dbd07d7.js +++ b/assets/js/b02f4114.e52fd607.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7483],{82642:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>d,metadata:()=>i,toc:()=>l});var n=r(74848),o=r(28453);const d={title:"Ports and network encryption",hide_title:!0,sidebar_position:8},s="What ports and network encryption does the Cado platform use?",i={id:"cado/deploy/ports",title:"Ports and network encryption",description:"The following ports are required to be open within the VPC or VNet in which the Cado platform is deployed.",source:"@site/docs/cado/deploy/ports.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/ports",permalink:"/cado/deploy/ports",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/ports.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"Ports and network encryption",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Get and apply a license",permalink:"/cado/deploy/licenses"},next:{title:"Set up proxy access",permalink:"/cado/deploy/networking-proxy"}},c={},l=[];function a(e){const t={h1:"h1",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,o.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-ports-and-network-encryption-does-the-cado-platform-use",children:"What ports and network encryption does the Cado platform use?"}),"\n",(0,n.jsx)(t.p,{children:"The following ports are required to be open within the VPC or VNet in which the Cado platform is deployed.\nNote that these ports are allowed by the default Cado Security Group or Network Security Group."}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Port"}),(0,n.jsx)(t.th,{children:"Service"}),(0,n.jsx)(t.th,{children:"Description"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"443"}),(0,n.jsx)(t.td,{children:"API and Frontend"}),(0,n.jsx)(t.td,{children:"TLSv1.2 TLSv1.3 via Nginx"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"2049"}),(0,n.jsx)(t.td,{children:"NFS"}),(0,n.jsx)(t.td,{children:"Cloud specific NFS, over TLS"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"9200"}),(0,n.jsx)(t.td,{children:"ElasticSearch"}),(0,n.jsx)(t.td,{children:"Over TLS"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"6379"}),(0,n.jsx)(t.td,{children:"Redis"}),(0,n.jsx)(t.td,{children:"TLS"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"5432"}),(0,n.jsx)(t.td,{children:"PostGres"}),(0,n.jsx)(t.td,{children:"TLS"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"5000"}),(0,n.jsx)(t.td,{children:"API"}),(0,n.jsx)(t.td,{children:"TLSv1.2 TLSv1.3 via Nginx"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"22*"}),(0,n.jsx)(t.td,{children:"Support"}),(0,n.jsx)(t.td,{children:"Debian SSH Service (*not required for normal operation)"})]})]})]})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(a,{...e})}):a(e)}},28453:(e,t,r)=>{r.d(t,{R:()=>s,x:()=>i});var n=r(96540);const o={},d=n.createContext(o);function s(e){const t=n.useContext(d);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),n.createElement(d.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7483],{82642:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>d,metadata:()=>i,toc:()=>l});var n=r(74848),o=r(28453);const d={title:"Ports and network encryption",hide_title:!0,sidebar_position:8},s="What ports and network encryption does the Cado platform use?",i={id:"cado/deploy/ports",title:"Ports and network encryption",description:"The following ports are required to be open within the VPC or VNet in which the Cado platform is deployed.",source:"@site/docs/cado/deploy/ports.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/ports",permalink:"/cado/deploy/ports",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/ports.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"Ports and network encryption",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Get and apply a license",permalink:"/cado/deploy/licenses"},next:{title:"Set up proxy access",permalink:"/cado/deploy/networking-proxy"}},c={},l=[];function a(e){const t={h1:"h1",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,o.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-ports-and-network-encryption-does-the-cado-platform-use",children:"What ports and network encryption does the Cado platform use?"}),"\n",(0,n.jsx)(t.p,{children:"The following ports are required to be open within the VPC or VNet in which the Cado platform is deployed.\nNote that these ports are allowed by the default Cado Security Group or Network Security Group."}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Port"}),(0,n.jsx)(t.th,{children:"Service"}),(0,n.jsx)(t.th,{children:"Description"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"443"}),(0,n.jsx)(t.td,{children:"API and Frontend"}),(0,n.jsx)(t.td,{children:"TLSv1.2 TLSv1.3 via Nginx"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"2049"}),(0,n.jsx)(t.td,{children:"NFS"}),(0,n.jsx)(t.td,{children:"Cloud specific NFS, over TLS"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"9200"}),(0,n.jsx)(t.td,{children:"ElasticSearch"}),(0,n.jsx)(t.td,{children:"Over TLS"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"6379"}),(0,n.jsx)(t.td,{children:"Redis"}),(0,n.jsx)(t.td,{children:"TLS"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"5432"}),(0,n.jsx)(t.td,{children:"PostGres"}),(0,n.jsx)(t.td,{children:"TLS"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"5000"}),(0,n.jsx)(t.td,{children:"API"}),(0,n.jsx)(t.td,{children:"TLSv1.2 TLSv1.3 via Nginx"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"22*"}),(0,n.jsx)(t.td,{children:"Support"}),(0,n.jsx)(t.td,{children:"Debian SSH Service (*not required for normal operation)"})]})]})]})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(a,{...e})}):a(e)}},28453:(e,t,r)=>{r.d(t,{R:()=>s,x:()=>i});var n=r(96540);const o={},d=n.createContext(o);function s(e){const t=n.useContext(d);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),n.createElement(d.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b16e3aaf.c35ea4e7.js b/assets/js/b16e3aaf.acd81e09.js similarity index 98% rename from assets/js/b16e3aaf.c35ea4e7.js rename to assets/js/b16e3aaf.acd81e09.js index afd32e649..f105b53ce 100644 --- a/assets/js/b16e3aaf.c35ea4e7.js +++ b/assets/js/b16e3aaf.acd81e09.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5146],{57841:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>v,frontMatter:()=>a,metadata:()=>o,toc:()=>d});var n=i(74848),s=i(28453);const a={title:"Overview Tab",hide_title:!0,sidebar_position:3},r="What is the Overview Tab?",o={id:"cado/investigate/overview",title:"Overview Tab",description:"The Overview tab provides a high-level summary of the investigation, including key investigator actions, event counts, potentially compromised users, and significant attacker events.",source:"@site/docs/cado/investigate/overview.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/overview",permalink:"/cado/investigate/overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/overview.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Overview Tab",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Insights Tab",permalink:"/cado/investigate/insights"},next:{title:"Timeline Search",permalink:"/cado/investigate/timeline-search"}},c={},d=[{value:"Investigation Details",id:"investigation-details",level:2},{value:"Investigation AI Summary",id:"investigation-ai-summary",level:2},{value:"Timeline of Key Investigator and Attacker Activities",id:"timeline-of-key-investigator-and-attacker-activities",level:2},{value:"MITRE ATT&CK Categories Observed",id:"mitre-attck-categories-observed",level:2},{value:"Key Events",id:"key-events",level:2},{value:"Potentially Compromised Users and Assets",id:"potentially-compromised-users-and-assets",level:2}];function l(e){const t={h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-is-the-overview-tab",children:"What is the Overview Tab?"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Overview"})," tab provides a high-level summary of the investigation, including key investigator actions, event counts, potentially compromised users, and significant attacker events."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Overview-tab.png",src:i(49946).A+"",width:"960",height:"540"})}),"\n",(0,n.jsx)(t.h2,{id:"investigation-details",children:"Investigation Details"}),"\n",(0,n.jsxs)(t.p,{children:["This section includes key information such as when the investigation began. You can edit the summary by clicking the ",(0,n.jsx)(t.strong,{children:"\u22ee"})," symbol next to the investigation name in the top-left corner."]}),"\n",(0,n.jsx)(t.h2,{id:"investigation-ai-summary",children:"Investigation AI Summary"}),"\n",(0,n.jsxs)(t.p,{children:["If enabled under ",(0,n.jsx)(t.strong,{children:"Settings > Experiments"}),", an AI-generated summary of key attacker events will be displayed here."]}),"\n",(0,n.jsx)(t.h2,{id:"timeline-of-key-investigator-and-attacker-activities",children:"Timeline of Key Investigator and Attacker Activities"}),"\n",(0,n.jsx)(t.p,{children:"Shows important events, including evidence imports and detected malicious activity."}),"\n",(0,n.jsx)(t.h2,{id:"mitre-attck-categories-observed",children:"MITRE ATT&CK Categories Observed"}),"\n",(0,n.jsx)(t.p,{children:"Displays the MITRE ATT&CK categories detected in the investigation. Click on a bar to view related events."}),"\n",(0,n.jsx)(t.h2,{id:"key-events",children:"Key Events"}),"\n",(0,n.jsxs)(t.p,{children:["Highlights detections of malicious and suspicious activity. Click ",(0,n.jsx)(t.strong,{children:'"View More"'})," to see additional events."]}),"\n",(0,n.jsx)(t.h2,{id:"potentially-compromised-users-and-assets",children:"Potentially Compromised Users and Assets"}),"\n",(0,n.jsxs)(t.p,{children:["Shows users and assets that may have been compromised, similar to the ",(0,n.jsx)(t.strong,{children:"Search"}),' tab when filtering by "Users" or "Hostnames."']})]})}function v(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},49946:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/Overview-tab-babce02b8672014575af5cdcc7bef469.png"},28453:(e,t,i)=>{i.d(t,{R:()=>r,x:()=>o});var n=i(96540);const s={},a=n.createContext(s);function r(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5146],{57841:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>v,frontMatter:()=>a,metadata:()=>o,toc:()=>d});var n=i(74848),s=i(28453);const a={title:"Overview Tab",hide_title:!0,sidebar_position:3},r="What is the Overview Tab?",o={id:"cado/investigate/overview",title:"Overview Tab",description:"The Overview tab provides a high-level summary of the investigation, including key investigator actions, event counts, potentially compromised users, and significant attacker events.",source:"@site/docs/cado/investigate/overview.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/overview",permalink:"/cado/investigate/overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/overview.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Overview Tab",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Insights Tab",permalink:"/cado/investigate/insights"},next:{title:"Timeline Search",permalink:"/cado/investigate/timeline-search"}},c={},d=[{value:"Investigation Details",id:"investigation-details",level:2},{value:"Investigation AI Summary",id:"investigation-ai-summary",level:2},{value:"Timeline of Key Investigator and Attacker Activities",id:"timeline-of-key-investigator-and-attacker-activities",level:2},{value:"MITRE ATT&CK Categories Observed",id:"mitre-attck-categories-observed",level:2},{value:"Key Events",id:"key-events",level:2},{value:"Potentially Compromised Users and Assets",id:"potentially-compromised-users-and-assets",level:2}];function l(e){const t={h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-is-the-overview-tab",children:"What is the Overview Tab?"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Overview"})," tab provides a high-level summary of the investigation, including key investigator actions, event counts, potentially compromised users, and significant attacker events."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Overview-tab.png",src:i(49946).A+"",width:"960",height:"540"})}),"\n",(0,n.jsx)(t.h2,{id:"investigation-details",children:"Investigation Details"}),"\n",(0,n.jsxs)(t.p,{children:["This section includes key information such as when the investigation began. You can edit the summary by clicking the ",(0,n.jsx)(t.strong,{children:"\u22ee"})," symbol next to the investigation name in the top-left corner."]}),"\n",(0,n.jsx)(t.h2,{id:"investigation-ai-summary",children:"Investigation AI Summary"}),"\n",(0,n.jsxs)(t.p,{children:["If enabled under ",(0,n.jsx)(t.strong,{children:"Settings > Experiments"}),", an AI-generated summary of key attacker events will be displayed here."]}),"\n",(0,n.jsx)(t.h2,{id:"timeline-of-key-investigator-and-attacker-activities",children:"Timeline of Key Investigator and Attacker Activities"}),"\n",(0,n.jsx)(t.p,{children:"Shows important events, including evidence imports and detected malicious activity."}),"\n",(0,n.jsx)(t.h2,{id:"mitre-attck-categories-observed",children:"MITRE ATT&CK Categories Observed"}),"\n",(0,n.jsx)(t.p,{children:"Displays the MITRE ATT&CK categories detected in the investigation. Click on a bar to view related events."}),"\n",(0,n.jsx)(t.h2,{id:"key-events",children:"Key Events"}),"\n",(0,n.jsxs)(t.p,{children:["Highlights detections of malicious and suspicious activity. Click ",(0,n.jsx)(t.strong,{children:'"View More"'})," to see additional events."]}),"\n",(0,n.jsx)(t.h2,{id:"potentially-compromised-users-and-assets",children:"Potentially Compromised Users and Assets"}),"\n",(0,n.jsxs)(t.p,{children:["Shows users and assets that may have been compromised, similar to the ",(0,n.jsx)(t.strong,{children:"Search"}),' tab when filtering by "Users" or "Hostnames."']})]})}function v(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},49946:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/Overview-tab-babce02b8672014575af5cdcc7bef469.png"},28453:(e,t,i)=>{i.d(t,{R:()=>r,x:()=>o});var n=i(96540);const s={},a=n.createContext(s);function r(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b3261dc0.495f9738.js b/assets/js/b3261dc0.2e1f6226.js similarity index 98% rename from assets/js/b3261dc0.495f9738.js rename to assets/js/b3261dc0.2e1f6226.js index de6c4013b..b17d1c0dd 100644 --- a/assets/js/b3261dc0.495f9738.js +++ b/assets/js/b3261dc0.2e1f6226.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7868],{51476:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>u,frontMatter:()=>a,metadata:()=>o,toc:()=>l});var r=n(74848),s=n(28453);const a={title:"Secret Manager",hide_title:!0,sidebar_position:9},i="Secret Manager",o={id:"cado/deploy/azure/azure-secret-manager",title:"Secret Manager",description:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in Azure Key Vault.",source:"@site/docs/cado/deploy/azure/azure-secret-manager.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-secret-manager",permalink:"/cado/deploy/azure/azure-secret-manager",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-secret-manager.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:9,frontMatter:{title:"Secret Manager",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"NFS",permalink:"/cado/deploy/azure/azure-nfs"},next:{title:"Bucket",permalink:"/cado/deploy/azure/azure-bucket"}},c={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function d(e){const t={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"secret-manager",children:"Secret Manager"}),"\n",(0,r.jsx)(t.p,{children:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in Azure Key Vault."}),"\n",(0,r.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Ability to create a Key Vault"}),"\n",(0,r.jsx)(t.li,{children:"Ability to update Role Assignments"}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["In the resource group click Create and search for \u201c",(0,r.jsx)(t.strong,{children:"Key Vault"}),"\u201d and select \u201c",(0,r.jsx)(t.strong,{children:"Key Vault"}),"\u201d"]}),"\n",(0,r.jsx)(t.li,{children:"Add a Key vault name"}),"\n",(0,r.jsxs)(t.li,{children:["Set Access Configuration to \u201c",(0,r.jsx)(t.strong,{children:"Vault access policy"}),"\u201d"]}),"\n",(0,r.jsxs)(t.li,{children:["On \u201c",(0,r.jsx)(t.strong,{children:"Access policies"}),"\u201d search for \u201c",(0,r.jsx)(t.strong,{children:"cado-identity"}),"\u201d and select. Confirm the Client ID is the correct one."]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Secret Manager",src:n(4455).A+"",width:"512",height:"292"})}),"\n",(0,r.jsxs)(t.ol,{start:"5",children:["\n",(0,r.jsxs)(t.li,{children:["Go to the created resource. Copy the \u201c",(0,r.jsx)(t.strong,{children:"Vault URI"}),"\u201d"]}),"\n",(0,r.jsxs)(t.li,{children:["Enable in the UI: ",(0,r.jsx)(t.strong,{children:"Settings"})," > ",(0,r.jsx)(t.strong,{children:"Advanced"})," > ",(0,r.jsx)(t.strong,{children:"Secret Management"})]}),"\n",(0,r.jsxs)(t.li,{children:["Enter the \u201c",(0,r.jsx)(t.strong,{children:"Vault URI"}),"\u201d from step 5 and click ",(0,r.jsx)(t.strong,{children:"Turn On Secrets Manager"})]}),"\n"]})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},4455:(e,t,n)=>{n.d(t,{A:()=>r});const r=n.p+"assets/images/secret-manager-a067e8b0dde27aa3fd603658054d7e59.png"},28453:(e,t,n)=>{n.d(t,{R:()=>i,x:()=>o});var r=n(96540);const s={},a=r.createContext(s);function i(e){const t=r.useContext(a);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),r.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7868],{51476:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>u,frontMatter:()=>a,metadata:()=>o,toc:()=>l});var r=n(74848),s=n(28453);const a={title:"Secret Manager",hide_title:!0,sidebar_position:9},i="Secret Manager",o={id:"cado/deploy/azure/azure-secret-manager",title:"Secret Manager",description:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in Azure Key Vault.",source:"@site/docs/cado/deploy/azure/azure-secret-manager.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-secret-manager",permalink:"/cado/deploy/azure/azure-secret-manager",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-secret-manager.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:9,frontMatter:{title:"Secret Manager",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"NFS",permalink:"/cado/deploy/azure/azure-nfs"},next:{title:"Bucket",permalink:"/cado/deploy/azure/azure-bucket"}},c={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function d(e){const t={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"secret-manager",children:"Secret Manager"}),"\n",(0,r.jsx)(t.p,{children:"The initial deployment stores the key used to encrypt secrets in Cado locally on the machine. Enabling a Secret Manager allows Cado to instead store the key in Azure Key Vault."}),"\n",(0,r.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Ability to create a Key Vault"}),"\n",(0,r.jsx)(t.li,{children:"Ability to update Role Assignments"}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["In the resource group click Create and search for \u201c",(0,r.jsx)(t.strong,{children:"Key Vault"}),"\u201d and select \u201c",(0,r.jsx)(t.strong,{children:"Key Vault"}),"\u201d"]}),"\n",(0,r.jsx)(t.li,{children:"Add a Key vault name"}),"\n",(0,r.jsxs)(t.li,{children:["Set Access Configuration to \u201c",(0,r.jsx)(t.strong,{children:"Vault access policy"}),"\u201d"]}),"\n",(0,r.jsxs)(t.li,{children:["On \u201c",(0,r.jsx)(t.strong,{children:"Access policies"}),"\u201d search for \u201c",(0,r.jsx)(t.strong,{children:"cado-identity"}),"\u201d and select. Confirm the Client ID is the correct one."]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Secret Manager",src:n(4455).A+"",width:"512",height:"292"})}),"\n",(0,r.jsxs)(t.ol,{start:"5",children:["\n",(0,r.jsxs)(t.li,{children:["Go to the created resource. Copy the \u201c",(0,r.jsx)(t.strong,{children:"Vault URI"}),"\u201d"]}),"\n",(0,r.jsxs)(t.li,{children:["Enable in the UI: ",(0,r.jsx)(t.strong,{children:"Settings"})," > ",(0,r.jsx)(t.strong,{children:"Advanced"})," > ",(0,r.jsx)(t.strong,{children:"Secret Management"})]}),"\n",(0,r.jsxs)(t.li,{children:["Enter the \u201c",(0,r.jsx)(t.strong,{children:"Vault URI"}),"\u201d from step 5 and click ",(0,r.jsx)(t.strong,{children:"Turn On Secrets Manager"})]}),"\n"]})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},4455:(e,t,n)=>{n.d(t,{A:()=>r});const r=n.p+"assets/images/secret-manager-a067e8b0dde27aa3fd603658054d7e59.png"},28453:(e,t,n)=>{n.d(t,{R:()=>i,x:()=>o});var r=n(96540);const s={},a=r.createContext(s);function i(e){const t=r.useContext(a);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),r.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b3760e48.a8d38d4c.js b/assets/js/b3760e48.08c12109.js similarity index 96% rename from assets/js/b3760e48.a8d38d4c.js rename to assets/js/b3760e48.08c12109.js index f6b5bba7f..dfda0a8e9 100644 --- a/assets/js/b3760e48.a8d38d4c.js +++ b/assets/js/b3760e48.08c12109.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7088],{27422:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>d,contentTitle:()=>i,default:()=>p,frontMatter:()=>n,metadata:()=>s,toc:()=>l});var a=t(74848),r=t(28453);const n={title:"Tagging Cado resources",hide_title:!0,sidebar_position:9},i="How to tag Cado resources",s={id:"cado/deploy/tag",title:"Tagging Cado resources",description:"You also have the option to have workers tagged when they are launched. This can be done by specifying the Tag Key and Tag Value which will be assigned when workers are launched. If you wish to apply more than one tag to workers, please see the below options.",source:"@site/docs/cado/deploy/tag.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/tag",permalink:"/cado/deploy/tag",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/tag.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:9,frontMatter:{title:"Tagging Cado resources",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Set up proxy access",permalink:"/cado/deploy/networking-proxy"},next:{title:"Import data",permalink:"/cado/discovery-import/intro"}},d={},l=[{value:"Terraform",id:"terraform",level:4},{value:"CloudFormation",id:"cloudformation",level:4}];function c(e){const o={admonition:"admonition",code:"code",h1:"h1",h4:"h4",p:"p",pre:"pre",strong:"strong",...(0,r.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(o.h1,{id:"how-to-tag-cado-resources",children:"How to tag Cado resources"}),"\n",(0,a.jsxs)(o.p,{children:["You also have the option to have workers tagged when they are launched. This can be done by specifying the ",(0,a.jsx)(o.strong,{children:"Tag Key"})," and ",(0,a.jsx)(o.strong,{children:"Tag Value"})," which will be assigned when workers are launched. If you wish to apply more than one tag to workers, please see the below options."]}),"\n",(0,a.jsx)(o.h4,{id:"terraform",children:"Terraform"}),"\n",(0,a.jsx)(o.p,{children:'If you have deployed via Terraform - You can apply multiple tags to workers in both AWS and Azure by updating the "tags" variable in Terraform. If you deployed via Terraform into Azure add the below snippet into the cado_deploy_azure/azure_transient/main.tf script.\nOr, if you deployed via Terraform into AWS add the below snippet into the cado_deploy_aws/aws/main.tf script.\nPlease also note that you will have to run terraform apply again after saving these changes.'}),"\n",(0,a.jsx)(o.pre,{children:(0,a.jsx)(o.code,{children:'variable "tags" {\n type = map(string)\n default = {}\n}\n'})}),"\n",(0,a.jsx)(o.h4,{id:"cloudformation",children:"CloudFormation"}),"\n",(0,a.jsx)(o.p,{children:'If you deployed via CloudFormation Template you can apply multiple tags to workers by adding them to the "UserData" section of the CloudFormation Template. Please note that deploying via CloudFormation requires you to specify tags prior to deployment. To add a worker tag add the below to the "UserData" field.'}),"\n",(0,a.jsx)(o.pre,{children:(0,a.jsx)(o.code,{children:'"echo CUSTOM_TAG_FOO = BAR >> /home/admin/processor/first_run.cfg",\n"\\n",\n'})}),"\n",(0,a.jsx)(o.admonition,{type:"info",children:(0,a.jsxs)(o.p,{children:["The ",(0,a.jsx)(o.code,{children:"CUSTOM_TAG_"}),' prefix is required. If you would like to apply a tag with key "FOO" and value "BAR" then your line should appear as it does in the above example.']})})]})}function p(e={}){const{wrapper:o}={...(0,r.R)(),...e.components};return o?(0,a.jsx)(o,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},28453:(e,o,t)=>{t.d(o,{R:()=>i,x:()=>s});var a=t(96540);const r={},n=a.createContext(r);function i(e){const o=a.useContext(n);return a.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function s(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),a.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7088],{27422:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>d,contentTitle:()=>i,default:()=>p,frontMatter:()=>n,metadata:()=>s,toc:()=>l});var a=t(74848),r=t(28453);const n={title:"Tagging Cado resources",hide_title:!0,sidebar_position:9},i="How to tag Cado resources",s={id:"cado/deploy/tag",title:"Tagging Cado resources",description:"You also have the option to have workers tagged when they are launched. This can be done by specifying the Tag Key and Tag Value which will be assigned when workers are launched. If you wish to apply more than one tag to workers, please see the below options.",source:"@site/docs/cado/deploy/tag.md",sourceDirName:"cado/deploy",slug:"/cado/deploy/tag",permalink:"/cado/deploy/tag",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/tag.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:9,frontMatter:{title:"Tagging Cado resources",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Set up proxy access",permalink:"/cado/deploy/networking-proxy"},next:{title:"Import data",permalink:"/cado/discovery-import/intro"}},d={},l=[{value:"Terraform",id:"terraform",level:4},{value:"CloudFormation",id:"cloudformation",level:4}];function c(e){const o={admonition:"admonition",code:"code",h1:"h1",h4:"h4",p:"p",pre:"pre",strong:"strong",...(0,r.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(o.h1,{id:"how-to-tag-cado-resources",children:"How to tag Cado resources"}),"\n",(0,a.jsxs)(o.p,{children:["You also have the option to have workers tagged when they are launched. This can be done by specifying the ",(0,a.jsx)(o.strong,{children:"Tag Key"})," and ",(0,a.jsx)(o.strong,{children:"Tag Value"})," which will be assigned when workers are launched. If you wish to apply more than one tag to workers, please see the below options."]}),"\n",(0,a.jsx)(o.h4,{id:"terraform",children:"Terraform"}),"\n",(0,a.jsx)(o.p,{children:'If you have deployed via Terraform - You can apply multiple tags to workers in both AWS and Azure by updating the "tags" variable in Terraform. If you deployed via Terraform into Azure add the below snippet into the cado_deploy_azure/azure_transient/main.tf script.\nOr, if you deployed via Terraform into AWS add the below snippet into the cado_deploy_aws/aws/main.tf script.\nPlease also note that you will have to run terraform apply again after saving these changes.'}),"\n",(0,a.jsx)(o.pre,{children:(0,a.jsx)(o.code,{children:'variable "tags" {\n type = map(string)\n default = {}\n}\n'})}),"\n",(0,a.jsx)(o.h4,{id:"cloudformation",children:"CloudFormation"}),"\n",(0,a.jsx)(o.p,{children:'If you deployed via CloudFormation Template you can apply multiple tags to workers by adding them to the "UserData" section of the CloudFormation Template. Please note that deploying via CloudFormation requires you to specify tags prior to deployment. To add a worker tag add the below to the "UserData" field.'}),"\n",(0,a.jsx)(o.pre,{children:(0,a.jsx)(o.code,{children:'"echo CUSTOM_TAG_FOO = BAR >> /home/admin/processor/first_run.cfg",\n"\\n",\n'})}),"\n",(0,a.jsx)(o.admonition,{type:"info",children:(0,a.jsxs)(o.p,{children:["The ",(0,a.jsx)(o.code,{children:"CUSTOM_TAG_"}),' prefix is required. If you would like to apply a tag with key "FOO" and value "BAR" then your line should appear as it does in the above example.']})})]})}function p(e={}){const{wrapper:o}={...(0,r.R)(),...e.components};return o?(0,a.jsx)(o,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},28453:(e,o,t)=>{t.d(o,{R:()=>i,x:()=>s});var a=t(96540);const r={},n=a.createContext(r);function i(e){const o=a.useContext(n);return a.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function s(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),a.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b3829f87.550911be.js b/assets/js/b3829f87.dcc14db5.js similarity index 98% rename from assets/js/b3829f87.550911be.js rename to assets/js/b3829f87.dcc14db5.js index 04fd459a3..1a43a1f7a 100644 --- a/assets/js/b3829f87.550911be.js +++ b/assets/js/b3829f87.dcc14db5.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7574],{44771:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>i,contentTitle:()=>r,default:()=>d,frontMatter:()=>n,metadata:()=>a,toc:()=>l});var s=o(74848),c=o(28453);const n={title:"Access an AWS account with via AMI Import",hide_title:!0,sidebar_position:6},r="How to access an AWS account cross-account within AWS without a cross-account role via AMI Import",a={id:"cado/deploy/cross/skip-role",title:"Access an AWS account with via AMI Import",description:"While we recommend creating a cross-account role in each AWS account you want Cado to access for seamless, one-click data acquisition, there is an alternative if creating roles is not possible. You can use the AMI Import feature to import EC2 resources from other accounts without needing a cross-account role.",source:"@site/docs/cado/deploy/cross/skip-role.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/skip-role",permalink:"/cado/deploy/cross/skip-role",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/skip-role.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Access an AWS account with via AMI Import",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Temporarily access an AWS account with STS",permalink:"/cado/deploy/cross/aws-sts"},next:{title:"Adding Azure subscriptions to Azure/AWS/GCP",permalink:"/cado/deploy/cross/adding-azure"}},i={},l=[{value:"Steps to Import EC2 Resources via AMI Import",id:"steps-to-import-ec2-resources-via-ami-import",level:3}];function u(t){const e={a:"a",br:"br",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",...(0,c.R)(),...t.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.h1,{id:"how-to-access-an-aws-account-cross-account-within-aws-without-a-cross-account-role-via-ami-import",children:"How to access an AWS account cross-account within AWS without a cross-account role via AMI Import"}),"\n",(0,s.jsxs)(e.p,{children:["While we recommend creating a cross-account role in each AWS account you want Cado to access for seamless, one-click data acquisition, there is an alternative if creating roles is not possible. You can use the ",(0,s.jsx)(e.strong,{children:"AMI Import"})," feature to import EC2 resources from other accounts without needing a cross-account role."]}),"\n",(0,s.jsx)(e.h3,{id:"steps-to-import-ec2-resources-via-ami-import",children:"Steps to Import EC2 Resources via AMI Import"}),"\n",(0,s.jsxs)(e.ol,{children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Create an AMI"}),(0,s.jsx)(e.br,{}),"\n","In the AWS account containing the EC2 instance you want to import, manually create an AMI (Amazon Machine Image) of the instance. For instructions on creating an AMI, refer to the ",(0,s.jsx)(e.a,{href:"https://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/tkv-create-ami-from-instance.html",children:"AWS documentation"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Share the AMI with the Cado AWS Account"}),(0,s.jsx)(e.br,{}),"\n","Once the AMI is created, share it with the AWS account where Cado resides."]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:"By following these steps, you can import EC2 instances from other AWS accounts without needing to create cross-account roles."})]})}function d(t={}){const{wrapper:e}={...(0,c.R)(),...t.components};return e?(0,s.jsx)(e,{...t,children:(0,s.jsx)(u,{...t})}):u(t)}},28453:(t,e,o)=>{o.d(e,{R:()=>r,x:()=>a});var s=o(96540);const c={},n=s.createContext(c);function r(t){const e=s.useContext(n);return s.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function a(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(c):t.components||c:r(t.components),s.createElement(n.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7574],{44771:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>i,contentTitle:()=>r,default:()=>d,frontMatter:()=>n,metadata:()=>a,toc:()=>l});var s=o(74848),c=o(28453);const n={title:"Access an AWS account with via AMI Import",hide_title:!0,sidebar_position:6},r="How to access an AWS account cross-account within AWS without a cross-account role via AMI Import",a={id:"cado/deploy/cross/skip-role",title:"Access an AWS account with via AMI Import",description:"While we recommend creating a cross-account role in each AWS account you want Cado to access for seamless, one-click data acquisition, there is an alternative if creating roles is not possible. You can use the AMI Import feature to import EC2 resources from other accounts without needing a cross-account role.",source:"@site/docs/cado/deploy/cross/skip-role.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/skip-role",permalink:"/cado/deploy/cross/skip-role",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/skip-role.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Access an AWS account with via AMI Import",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Temporarily access an AWS account with STS",permalink:"/cado/deploy/cross/aws-sts"},next:{title:"Adding Azure subscriptions to Azure/AWS/GCP",permalink:"/cado/deploy/cross/adding-azure"}},i={},l=[{value:"Steps to Import EC2 Resources via AMI Import",id:"steps-to-import-ec2-resources-via-ami-import",level:3}];function u(t){const e={a:"a",br:"br",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",...(0,c.R)(),...t.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.h1,{id:"how-to-access-an-aws-account-cross-account-within-aws-without-a-cross-account-role-via-ami-import",children:"How to access an AWS account cross-account within AWS without a cross-account role via AMI Import"}),"\n",(0,s.jsxs)(e.p,{children:["While we recommend creating a cross-account role in each AWS account you want Cado to access for seamless, one-click data acquisition, there is an alternative if creating roles is not possible. You can use the ",(0,s.jsx)(e.strong,{children:"AMI Import"})," feature to import EC2 resources from other accounts without needing a cross-account role."]}),"\n",(0,s.jsx)(e.h3,{id:"steps-to-import-ec2-resources-via-ami-import",children:"Steps to Import EC2 Resources via AMI Import"}),"\n",(0,s.jsxs)(e.ol,{children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Create an AMI"}),(0,s.jsx)(e.br,{}),"\n","In the AWS account containing the EC2 instance you want to import, manually create an AMI (Amazon Machine Image) of the instance. For instructions on creating an AMI, refer to the ",(0,s.jsx)(e.a,{href:"https://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/tkv-create-ami-from-instance.html",children:"AWS documentation"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Share the AMI with the Cado AWS Account"}),(0,s.jsx)(e.br,{}),"\n","Once the AMI is created, share it with the AWS account where Cado resides."]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(e.p,{children:"By following these steps, you can import EC2 instances from other AWS accounts without needing to create cross-account roles."})]})}function d(t={}){const{wrapper:e}={...(0,c.R)(),...t.components};return e?(0,s.jsx)(e,{...t,children:(0,s.jsx)(u,{...t})}):u(t)}},28453:(t,e,o)=>{o.d(e,{R:()=>r,x:()=>a});var s=o(96540);const c={},n=s.createContext(c);function r(t){const e=s.useContext(n);return s.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function a(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(c):t.components||c:r(t.components),s.createElement(n.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/b3d88481.4ca061d7.js b/assets/js/b3d88481.c11892fb.js similarity index 97% rename from assets/js/b3d88481.4ca061d7.js rename to assets/js/b3d88481.c11892fb.js index 7c1fb735e..2ebaec762 100644 --- a/assets/js/b3d88481.4ca061d7.js +++ b/assets/js/b3d88481.c11892fb.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8567],{91253:(e,s,o)=>{o.r(s),o.d(s,{assets:()=>a,contentTitle:()=>i,default:()=>p,frontMatter:()=>r,metadata:()=>c,toc:()=>d});var t=o(74848),n=o(28453);const r={title:"Reduce KMS permissions",hide_title:!0,sidebar_position:7},i="How to reduce KMS permissions in AWS",c={id:"cado/deploy/aws/iam/tighten-kms",title:"Reduce KMS permissions",description:"The Cado platform supports importing EC2 instances with encrypted volumes, provided the appropriate permissions are assigned to the CadoResponseRole. The default Cado IAM roles include the necessary permissions to decrypt AWS default KMS keys out of the box. Custom KMS keys are also supported.",source:"@site/docs/cado/deploy/aws/iam/tighten-kms.md",sourceDirName:"cado/deploy/aws/iam",slug:"/cado/deploy/aws/iam/tighten-kms",permalink:"/cado/deploy/aws/iam/tighten-kms",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/iam/tighten-kms.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"Reduce KMS permissions",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"KMS support",permalink:"/cado/deploy/aws/iam/aws-kms"},next:{title:"How to Tighten IAM Permissions for SSM in AWS",permalink:"/cado/deploy/aws/iam/ssm"}},a={},d=[{value:"KMS Considerations for Custom Keys",id:"kms-considerations-for-custom-keys",level:2},{value:"Tightening KMS Permissions",id:"tightening-kms-permissions",level:2},{value:"KMS Considerations for Cross-Region and Cross-Account",id:"kms-considerations-for-cross-region-and-cross-account",level:2},{value:"Cross-Region",id:"cross-region",level:3},{value:"Cross-Account",id:"cross-account",level:3}];function l(e){const s={code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"how-to-reduce-kms-permissions-in-aws",children:"How to reduce KMS permissions in AWS"}),"\n",(0,t.jsxs)(s.p,{children:["The Cado platform supports importing EC2 instances with encrypted volumes, provided the appropriate permissions are assigned to the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"}),". The default Cado IAM roles include the necessary permissions to decrypt AWS default KMS keys out of the box. Custom KMS keys are also supported."]}),"\n",(0,t.jsx)(s.h2,{id:"kms-considerations-for-custom-keys",children:"KMS Considerations for Custom Keys"}),"\n",(0,t.jsxs)(s.p,{children:["When using custom KMS keys, the following actions must be granted to the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"}),":"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'"kms:Encrypt",\n"kms:Decrypt",\n"kms:ReEncrypt*",\n"kms:GenerateDataKey*",\n"kms:CreateGrant"\n'})}),"\n",(0,t.jsx)(s.p,{children:"When Cado performs a cross-account import of KMS-encrypted EC2 instances, it re-encrypts the snapshot to a temporary key used for cross-account transfer. This key is scoped using an alias with a Cado prefix, and both the alias and key are scheduled for deletion after the import is complete."}),"\n",(0,t.jsx)(s.h2,{id:"tightening-kms-permissions",children:"Tightening KMS Permissions"}),"\n",(0,t.jsxs)(s.p,{children:["To further restrict KMS permissions, you can grant the necessary permissions to the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"})," while withholding ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," for specific resources:"]}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"Limit CreateGrant Permissions:"})," You may choose not to grant ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," to the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"})," itself."]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"Custom Policy:"})," Ensure your IAM policy allows the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"})," to perform the required actions (",(0,t.jsx)(s.code,{children:"kms:Encrypt"}),", ",(0,t.jsx)(s.code,{children:"kms:Decrypt"}),", etc.) but excludes ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," where unnecessary."]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"Tighten Resource Access:"})," Restrict ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," to specific AWS resources only, rather than granting it globally."]}),"\n"]}),"\n",(0,t.jsx)(s.h2,{id:"kms-considerations-for-cross-region-and-cross-account",children:"KMS Considerations for Cross-Region and Cross-Account"}),"\n",(0,t.jsx)(s.h3,{id:"cross-region",children:"Cross-Region"}),"\n",(0,t.jsx)(s.p,{children:"Ensure that your KMS policy statements apply to the region where your Cado platform is deployed. For example, verify that policy conditions do not block access to resources in the platform's region."}),"\n",(0,t.jsx)(s.h3,{id:"cross-account",children:"Cross-Account"}),"\n",(0,t.jsxs)(s.p,{children:["The simplest approach for cross-account operations is to grant ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," permissions to the role being assumed in the ",(0,t.jsx)(s.strong,{children:"target account"}),"."]}),"\n",(0,t.jsxs)(s.p,{children:["Alternatively, the same permissions outlined for custom keys can be applied, but both the primary and secondary account roles must be allowed principals for the required KMS actions (",(0,t.jsx)(s.code,{children:"kms:Encrypt"}),", ",(0,t.jsx)(s.code,{children:"kms:Decrypt"}),", ",(0,t.jsx)(s.code,{children:"kms:ReEncrypt*"}),", ",(0,t.jsx)(s.code,{children:"kms:GenerateDataKey*"}),")."]})]})}function p(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},28453:(e,s,o)=>{o.d(s,{R:()=>i,x:()=>c});var t=o(96540);const n={},r=t.createContext(n);function i(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8567],{91253:(e,s,o)=>{o.r(s),o.d(s,{assets:()=>a,contentTitle:()=>i,default:()=>p,frontMatter:()=>r,metadata:()=>c,toc:()=>d});var t=o(74848),n=o(28453);const r={title:"Reduce KMS permissions",hide_title:!0,sidebar_position:7},i="How to reduce KMS permissions in AWS",c={id:"cado/deploy/aws/iam/tighten-kms",title:"Reduce KMS permissions",description:"The Cado platform supports importing EC2 instances with encrypted volumes, provided the appropriate permissions are assigned to the CadoResponseRole. The default Cado IAM roles include the necessary permissions to decrypt AWS default KMS keys out of the box. Custom KMS keys are also supported.",source:"@site/docs/cado/deploy/aws/iam/tighten-kms.md",sourceDirName:"cado/deploy/aws/iam",slug:"/cado/deploy/aws/iam/tighten-kms",permalink:"/cado/deploy/aws/iam/tighten-kms",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/iam/tighten-kms.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"Reduce KMS permissions",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"KMS support",permalink:"/cado/deploy/aws/iam/aws-kms"},next:{title:"How to Tighten IAM Permissions for SSM in AWS",permalink:"/cado/deploy/aws/iam/ssm"}},a={},d=[{value:"KMS Considerations for Custom Keys",id:"kms-considerations-for-custom-keys",level:2},{value:"Tightening KMS Permissions",id:"tightening-kms-permissions",level:2},{value:"KMS Considerations for Cross-Region and Cross-Account",id:"kms-considerations-for-cross-region-and-cross-account",level:2},{value:"Cross-Region",id:"cross-region",level:3},{value:"Cross-Account",id:"cross-account",level:3}];function l(e){const s={code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"how-to-reduce-kms-permissions-in-aws",children:"How to reduce KMS permissions in AWS"}),"\n",(0,t.jsxs)(s.p,{children:["The Cado platform supports importing EC2 instances with encrypted volumes, provided the appropriate permissions are assigned to the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"}),". The default Cado IAM roles include the necessary permissions to decrypt AWS default KMS keys out of the box. Custom KMS keys are also supported."]}),"\n",(0,t.jsx)(s.h2,{id:"kms-considerations-for-custom-keys",children:"KMS Considerations for Custom Keys"}),"\n",(0,t.jsxs)(s.p,{children:["When using custom KMS keys, the following actions must be granted to the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"}),":"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'"kms:Encrypt",\n"kms:Decrypt",\n"kms:ReEncrypt*",\n"kms:GenerateDataKey*",\n"kms:CreateGrant"\n'})}),"\n",(0,t.jsx)(s.p,{children:"When Cado performs a cross-account import of KMS-encrypted EC2 instances, it re-encrypts the snapshot to a temporary key used for cross-account transfer. This key is scoped using an alias with a Cado prefix, and both the alias and key are scheduled for deletion after the import is complete."}),"\n",(0,t.jsx)(s.h2,{id:"tightening-kms-permissions",children:"Tightening KMS Permissions"}),"\n",(0,t.jsxs)(s.p,{children:["To further restrict KMS permissions, you can grant the necessary permissions to the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"})," while withholding ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," for specific resources:"]}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"Limit CreateGrant Permissions:"})," You may choose not to grant ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," to the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"})," itself."]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"Custom Policy:"})," Ensure your IAM policy allows the ",(0,t.jsx)(s.code,{children:"CadoResponseRole"})," to perform the required actions (",(0,t.jsx)(s.code,{children:"kms:Encrypt"}),", ",(0,t.jsx)(s.code,{children:"kms:Decrypt"}),", etc.) but excludes ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," where unnecessary."]}),"\n",(0,t.jsxs)(s.li,{children:[(0,t.jsx)(s.strong,{children:"Tighten Resource Access:"})," Restrict ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," to specific AWS resources only, rather than granting it globally."]}),"\n"]}),"\n",(0,t.jsx)(s.h2,{id:"kms-considerations-for-cross-region-and-cross-account",children:"KMS Considerations for Cross-Region and Cross-Account"}),"\n",(0,t.jsx)(s.h3,{id:"cross-region",children:"Cross-Region"}),"\n",(0,t.jsx)(s.p,{children:"Ensure that your KMS policy statements apply to the region where your Cado platform is deployed. For example, verify that policy conditions do not block access to resources in the platform's region."}),"\n",(0,t.jsx)(s.h3,{id:"cross-account",children:"Cross-Account"}),"\n",(0,t.jsxs)(s.p,{children:["The simplest approach for cross-account operations is to grant ",(0,t.jsx)(s.code,{children:"kms:CreateGrant"})," permissions to the role being assumed in the ",(0,t.jsx)(s.strong,{children:"target account"}),"."]}),"\n",(0,t.jsxs)(s.p,{children:["Alternatively, the same permissions outlined for custom keys can be applied, but both the primary and secondary account roles must be allowed principals for the required KMS actions (",(0,t.jsx)(s.code,{children:"kms:Encrypt"}),", ",(0,t.jsx)(s.code,{children:"kms:Decrypt"}),", ",(0,t.jsx)(s.code,{children:"kms:ReEncrypt*"}),", ",(0,t.jsx)(s.code,{children:"kms:GenerateDataKey*"}),")."]})]})}function p(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},28453:(e,s,o)=>{o.d(s,{R:()=>i,x:()=>c});var t=o(96540);const n={},r=t.createContext(n);function i(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b3f7620e.b7f8ad6b.js b/assets/js/b3f7620e.5d55dd77.js similarity index 96% rename from assets/js/b3f7620e.b7f8ad6b.js rename to assets/js/b3f7620e.5d55dd77.js index b77ab24d9..db33a1cf3 100644 --- a/assets/js/b3f7620e.b7f8ad6b.js +++ b/assets/js/b3f7620e.5d55dd77.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5754],{63837:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var n=s(74848),i=s(28453);const r={title:"Worker management",hide_title:!0,sidebar_position:6},o="What Are the Settings for Workers?",a={id:"cado/manage/workers",title:"Worker management",description:"This section explains the options available for managing workers that are spun up during processing jobs. You can access these settings under Settings > General Settings.",source:"@site/docs/cado/manage/workers.md",sourceDirName:"cado/manage",slug:"/cado/manage/workers",permalink:"/cado/manage/workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/workers.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Worker management",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Ping SAML",permalink:"/cado/manage/users-authentication/sso/ping_saml"},next:{title:"Manage data",permalink:"/cado/manage/data"}},c={},d=[{value:"Processing",id:"processing",level:2}];function l(e){const t={admonition:"admonition",code:"code",h1:"h1",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-are-the-settings-for-workers",children:"What Are the Settings for Workers?"}),"\n",(0,n.jsxs)(t.p,{children:["This section explains the options available for managing workers that are spun up during processing jobs. You can access these settings under ",(0,n.jsx)(t.strong,{children:"Settings > General Settings"}),"."]}),"\n",(0,n.jsx)(t.h2,{id:"processing",children:"Processing"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Maximum Workers"}),": This setting defines the maximum number of workers (AWS EC2 Instances) that the system can launch for processing. If this limit is reached, the platform will pause before starting additional workers. The default limit is 20. The platform will also pause if AWS VCPU limits in a region are exceeded."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Worker Instance Size"}),": This setting determines the size of the instance used for data processing. The default instance size in AWS (i3.4xlarge) provides 1.9 TB of disk space, which supports the processing of disks up to approximately 1.5 TB. In Azure, the default setting supports disks up to about 800 GB. If you need more working space, select a larger instance size based on your environment (AWS or Azure)."]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["For most AWS use cases, it is recommended to keep the ",(0,n.jsx)(t.strong,{children:"Worker Instance Size"})," set to a storage-optimized instance, such as ",(0,n.jsx)(t.code,{children:"i3.4xlarge"}),"."]})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Worker Shutdown Wait"}),": This setting defines how long (in seconds) a worker will remain active after completing a processing task before shutting down. The default value is 5 minutes (300 seconds) if no value is set."]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>o,x:()=>a});var n=s(96540);const i={},r=n.createContext(i);function o(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5754],{63837:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var n=s(74848),i=s(28453);const r={title:"Worker management",hide_title:!0,sidebar_position:6},o="What Are the Settings for Workers?",a={id:"cado/manage/workers",title:"Worker management",description:"This section explains the options available for managing workers that are spun up during processing jobs. You can access these settings under Settings > General Settings.",source:"@site/docs/cado/manage/workers.md",sourceDirName:"cado/manage",slug:"/cado/manage/workers",permalink:"/cado/manage/workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/workers.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Worker management",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Ping SAML",permalink:"/cado/manage/users-authentication/sso/ping_saml"},next:{title:"Manage data",permalink:"/cado/manage/data"}},c={},d=[{value:"Processing",id:"processing",level:2}];function l(e){const t={admonition:"admonition",code:"code",h1:"h1",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-are-the-settings-for-workers",children:"What Are the Settings for Workers?"}),"\n",(0,n.jsxs)(t.p,{children:["This section explains the options available for managing workers that are spun up during processing jobs. You can access these settings under ",(0,n.jsx)(t.strong,{children:"Settings > General Settings"}),"."]}),"\n",(0,n.jsx)(t.h2,{id:"processing",children:"Processing"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Maximum Workers"}),": This setting defines the maximum number of workers (AWS EC2 Instances) that the system can launch for processing. If this limit is reached, the platform will pause before starting additional workers. The default limit is 20. The platform will also pause if AWS VCPU limits in a region are exceeded."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Worker Instance Size"}),": This setting determines the size of the instance used for data processing. The default instance size in AWS (i3.4xlarge) provides 1.9 TB of disk space, which supports the processing of disks up to approximately 1.5 TB. In Azure, the default setting supports disks up to about 800 GB. If you need more working space, select a larger instance size based on your environment (AWS or Azure)."]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["For most AWS use cases, it is recommended to keep the ",(0,n.jsx)(t.strong,{children:"Worker Instance Size"})," set to a storage-optimized instance, such as ",(0,n.jsx)(t.code,{children:"i3.4xlarge"}),"."]})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Worker Shutdown Wait"}),": This setting defines how long (in seconds) a worker will remain active after completing a processing task before shutting down. The default value is 5 minutes (300 seconds) if no value is set."]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},28453:(e,t,s)=>{s.d(t,{R:()=>o,x:()=>a});var n=s(96540);const i={},r=n.createContext(i);function o(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b58ec3bd.74fff2eb.js b/assets/js/b58ec3bd.56d276d8.js similarity index 99% rename from assets/js/b58ec3bd.74fff2eb.js rename to assets/js/b58ec3bd.56d276d8.js index 3d3f1a27d..944a18566 100644 --- a/assets/js/b58ec3bd.74fff2eb.js +++ b/assets/js/b58ec3bd.56d276d8.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4225],{78406:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>a,contentTitle:()=>i,default:()=>u,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var t=n(74848),r=n(28453);const o={title:"Azure Kubernetes Service",hide_title:!0,sidebar_position:3},i="How to Import Azure Kubernetes Service (AKS) Containers",c={id:"cado/discovery-import/azure/azure-aks",title:"Azure Kubernetes Service",description:"The Cado platform allows you to collect key logs and forensic artifacts from containers running in Azure Kubernetes Service (AKS).",source:"@site/docs/cado/discovery-import/azure/azure-aks.md",sourceDirName:"cado/discovery-import/azure",slug:"/cado/discovery-import/azure/azure-aks",permalink:"/cado/discovery-import/azure/azure-aks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/azure/azure-aks.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Azure Kubernetes Service",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Azure Storage",permalink:"/cado/discovery-import/azure/azure-storage"},next:{title:"Google Compute Engine",permalink:"/cado/discovery-import/gcp/engine-instance"}},a={},d=[{value:"Import Steps",id:"import-steps",level:2},{value:"Private Cluster Support",id:"private-cluster-support",level:3},{value:"Scoping Down the Role for Access to AKS",id:"scoping-down-the-role-for-access-to-aks",level:3}];function l(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,r.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"how-to-import-azure-kubernetes-service-aks-containers",children:"How to Import Azure Kubernetes Service (AKS) Containers"}),"\n",(0,t.jsx)(s.p,{children:"The Cado platform allows you to collect key logs and forensic artifacts from containers running in Azure Kubernetes Service (AKS)."}),"\n",(0,t.jsx)(s.admonition,{type:"info",children:(0,t.jsxs)(s.p,{children:["To acquire distroless containers, please use ",(0,t.jsx)(s.strong,{children:"Cado Host"}),"."]})}),"\n",(0,t.jsx)(s.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Navigate to ",(0,t.jsx)(s.strong,{children:"Import > Cloud"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Cado Import Screen showing the AKS options",src:n(43913).A+"",width:"1522",height:"363"})}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Select the Azure credentials configured under ",(0,t.jsx)(s.strong,{children:(0,t.jsx)(s.a,{href:"/cado/deploy/cross/azure-cross-tenancy-subscriptions",children:"Azure > Cross Subscription and Tenancy"})}),"."]}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"Choose the resource group associated with the AKS cluster."}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Follow the steps to select your ",(0,t.jsx)(s.strong,{children:"Cluster"}),", ",(0,t.jsx)(s.strong,{children:"Pod"}),", and ",(0,t.jsx)(s.strong,{children:"Container"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Cado Import Screen showing the available AKS Clusters",src:n(36094).A+"",width:"1837",height:"497"})}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Confirm the details and click ",(0,t.jsx)(s.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:"Cado will automatically collect all key logs and forensic artifacts from the container for investigation. For most acquisitions, the import and processing will take just a few minutes to complete."}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Cado showing the confirmation screen of a successful AKS container capture",src:n(60787).A+"",width:"1795",height:"698"})}),"\n",(0,t.jsxs)(s.admonition,{type:"info",children:[(0,t.jsx)(s.h3,{id:"private-cluster-support",children:"Private Cluster Support"}),(0,t.jsxs)(s.p,{children:["As of release v2.31.0, the Cado platform supports capturing data from ",(0,t.jsx)(s.strong,{children:"AKS Private Clusters"}),". This functionality is achieved using the ",(0,t.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/azure/aks/command-invoke",children:"Azure Command Invoke APIs"}),"."]}),(0,t.jsx)(s.p,{children:"There are two key considerations with this method:"}),(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsx)(s.li,{children:"Capturing from a private cluster is significantly slower than from a public cluster."}),"\n",(0,t.jsx)(s.li,{children:"The Azure API spins up a pod within the cluster to execute Cado Host. Ensure that your cluster has enough resources and nodes to schedule this command pod."}),"\n"]}),(0,t.jsx)(s.p,{children:"The newly created pod will automatically shut down and remove itself after 1 hour."})]}),"\n",(0,t.jsx)(s.h3,{id:"scoping-down-the-role-for-access-to-aks",children:"Scoping Down the Role for Access to AKS"}),"\n",(0,t.jsx)(s.p,{children:"The Cado platform requires specific permissions to access and execute code in containers. You can use the following role definition to limit the permissions required for Cado to access and acquire data from AKS:"}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Scoped down AKS role",src:n(2467).A+"",width:"2220",height:"1242"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'{\n "id": "",\n "properties": {\n "roleName": "ScopedDownAKSTest",\n "description": "",\n "assignableScopes": [\n ""\n ],\n "permissions": [\n {\n "actions": [\n "Microsoft.Resources/subscriptions/operationresults/read",\n "Microsoft.Resources/subscriptions/read",\n "Microsoft.Resources/subscriptions/resourceGroups/read",\n "Microsoft.ContainerService/managedClusters/read",\n "Microsoft.ContainerService/managedClusters/runCommand/action",\n "Microsoft.ContainerService/managedClusters/commandResults/read",\n "Microsoft.ContainerService/managedClusters/privateEndpointConnections/read",\n "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action"\n ],\n "notActions": [],\n "dataActions": [],\n "notDataActions": []\n }\n ]\n }\n}\n'})})]})}function u(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},36094:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aks-a8db98692b9b481c6fc41df7f42005c1.png"},2467:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aks_role-bc2f3d6620c2a5d836a1c4b9cf3ffeb8.png"},60787:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},43913:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/import-cloud-focus-2430bd09657ad2f5e88391377ba1dc53.png"},28453:(e,s,n)=>{n.d(s,{R:()=>i,x:()=>c});var t=n(96540);const r={},o=t.createContext(r);function i(e){const s=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),t.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4225],{78406:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>a,contentTitle:()=>i,default:()=>u,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var t=n(74848),r=n(28453);const o={title:"Azure Kubernetes Service",hide_title:!0,sidebar_position:3},i="How to Import Azure Kubernetes Service (AKS) Containers",c={id:"cado/discovery-import/azure/azure-aks",title:"Azure Kubernetes Service",description:"The Cado platform allows you to collect key logs and forensic artifacts from containers running in Azure Kubernetes Service (AKS).",source:"@site/docs/cado/discovery-import/azure/azure-aks.md",sourceDirName:"cado/discovery-import/azure",slug:"/cado/discovery-import/azure/azure-aks",permalink:"/cado/discovery-import/azure/azure-aks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/azure/azure-aks.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Azure Kubernetes Service",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Azure Storage",permalink:"/cado/discovery-import/azure/azure-storage"},next:{title:"Google Compute Engine",permalink:"/cado/discovery-import/gcp/engine-instance"}},a={},d=[{value:"Import Steps",id:"import-steps",level:2},{value:"Private Cluster Support",id:"private-cluster-support",level:3},{value:"Scoping Down the Role for Access to AKS",id:"scoping-down-the-role-for-access-to-aks",level:3}];function l(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,r.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"how-to-import-azure-kubernetes-service-aks-containers",children:"How to Import Azure Kubernetes Service (AKS) Containers"}),"\n",(0,t.jsx)(s.p,{children:"The Cado platform allows you to collect key logs and forensic artifacts from containers running in Azure Kubernetes Service (AKS)."}),"\n",(0,t.jsx)(s.admonition,{type:"info",children:(0,t.jsxs)(s.p,{children:["To acquire distroless containers, please use ",(0,t.jsx)(s.strong,{children:"Cado Host"}),"."]})}),"\n",(0,t.jsx)(s.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Navigate to ",(0,t.jsx)(s.strong,{children:"Import > Cloud"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Cado Import Screen showing the AKS options",src:n(43913).A+"",width:"1522",height:"363"})}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Select the Azure credentials configured under ",(0,t.jsx)(s.strong,{children:(0,t.jsx)(s.a,{href:"/cado/deploy/cross/azure-cross-tenancy-subscriptions",children:"Azure > Cross Subscription and Tenancy"})}),"."]}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsx)(s.p,{children:"Choose the resource group associated with the AKS cluster."}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Follow the steps to select your ",(0,t.jsx)(s.strong,{children:"Cluster"}),", ",(0,t.jsx)(s.strong,{children:"Pod"}),", and ",(0,t.jsx)(s.strong,{children:"Container"}),"."]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Cado Import Screen showing the available AKS Clusters",src:n(36094).A+"",width:"1837",height:"497"})}),"\n"]}),"\n",(0,t.jsxs)(s.li,{children:["\n",(0,t.jsxs)(s.p,{children:["Confirm the details and click ",(0,t.jsx)(s.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:"Cado will automatically collect all key logs and forensic artifacts from the container for investigation. For most acquisitions, the import and processing will take just a few minutes to complete."}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Cado showing the confirmation screen of a successful AKS container capture",src:n(60787).A+"",width:"1795",height:"698"})}),"\n",(0,t.jsxs)(s.admonition,{type:"info",children:[(0,t.jsx)(s.h3,{id:"private-cluster-support",children:"Private Cluster Support"}),(0,t.jsxs)(s.p,{children:["As of release v2.31.0, the Cado platform supports capturing data from ",(0,t.jsx)(s.strong,{children:"AKS Private Clusters"}),". This functionality is achieved using the ",(0,t.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/azure/aks/command-invoke",children:"Azure Command Invoke APIs"}),"."]}),(0,t.jsx)(s.p,{children:"There are two key considerations with this method:"}),(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsx)(s.li,{children:"Capturing from a private cluster is significantly slower than from a public cluster."}),"\n",(0,t.jsx)(s.li,{children:"The Azure API spins up a pod within the cluster to execute Cado Host. Ensure that your cluster has enough resources and nodes to schedule this command pod."}),"\n"]}),(0,t.jsx)(s.p,{children:"The newly created pod will automatically shut down and remove itself after 1 hour."})]}),"\n",(0,t.jsx)(s.h3,{id:"scoping-down-the-role-for-access-to-aks",children:"Scoping Down the Role for Access to AKS"}),"\n",(0,t.jsx)(s.p,{children:"The Cado platform requires specific permissions to access and execute code in containers. You can use the following role definition to limit the permissions required for Cado to access and acquire data from AKS:"}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Scoped down AKS role",src:n(2467).A+"",width:"2220",height:"1242"})}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-json",children:'{\n "id": "",\n "properties": {\n "roleName": "ScopedDownAKSTest",\n "description": "",\n "assignableScopes": [\n ""\n ],\n "permissions": [\n {\n "actions": [\n "Microsoft.Resources/subscriptions/operationresults/read",\n "Microsoft.Resources/subscriptions/read",\n "Microsoft.Resources/subscriptions/resourceGroups/read",\n "Microsoft.ContainerService/managedClusters/read",\n "Microsoft.ContainerService/managedClusters/runCommand/action",\n "Microsoft.ContainerService/managedClusters/commandResults/read",\n "Microsoft.ContainerService/managedClusters/privateEndpointConnections/read",\n "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action"\n ],\n "notActions": [],\n "dataActions": [],\n "notDataActions": []\n }\n ]\n }\n}\n'})})]})}function u(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},36094:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aks-a8db98692b9b481c6fc41df7f42005c1.png"},2467:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/aks_role-bc2f3d6620c2a5d836a1c4b9cf3ffeb8.png"},60787:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},43913:(e,s,n)=>{n.d(s,{A:()=>t});const t=n.p+"assets/images/import-cloud-focus-2430bd09657ad2f5e88391377ba1dc53.png"},28453:(e,s,n)=>{n.d(s,{R:()=>i,x:()=>c});var t=n(96540);const r={},o=t.createContext(r);function i(e){const s=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),t.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b89f09e1.259b600b.js b/assets/js/b89f09e1.c20d04de.js similarity index 98% rename from assets/js/b89f09e1.259b600b.js rename to assets/js/b89f09e1.c20d04de.js index d97e753a4..5ba930877 100644 --- a/assets/js/b89f09e1.259b600b.js +++ b/assets/js/b89f09e1.c20d04de.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[455],{26859:(e,o,s)=>{s.r(o),s.d(o,{assets:()=>a,contentTitle:()=>i,default:()=>m,frontMatter:()=>r,metadata:()=>c,toc:()=>l});var t=s(74848),n=s(28453);const r={title:"Memory analysis",hide_title:!0,sidebar_position:3},i="How to Collect Process Memory with Cado",c={id:"cado/discovery-import/data-types/memory",title:"Memory analysis",description:"You can perform a memory acquisition of a Windows or Linux system using Cado Host by navigating to Import > Cado Host within the platform and running the pre-generated script on the host device. For detailed instructions, see here. Note that process memory collection is not currently supported on macOS.",source:"@site/docs/cado/discovery-import/data-types/memory.md",sourceDirName:"cado/discovery-import/data-types",slug:"/cado/discovery-import/data-types/memory",permalink:"/cado/discovery-import/data-types/memory",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/data-types/memory.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Memory analysis",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Log & artifact types",permalink:"/cado/discovery-import/data-types/logs"},next:{title:"Cloud import sources",permalink:"/cado/discovery-import/data-types/import-types"}},a={},l=[{value:"Enabling Memory Collection",id:"enabling-memory-collection",level:3},{value:"Acquiring Memory from AWS EC2",id:"acquiring-memory-from-aws-ec2",level:2},{value:"Collecting Memory from Containers",id:"collecting-memory-from-containers",level:2},{value:"Processed Memory",id:"processed-memory",level:2}];function d(e){const o={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-collect-process-memory-with-cado",children:"How to Collect Process Memory with Cado"}),"\n",(0,t.jsxs)(o.p,{children:["You can perform a memory acquisition of a Windows or Linux system using Cado Host by navigating to ",(0,t.jsx)(o.strong,{children:"Import > Cado Host"})," within the platform and running the pre-generated script on the host device. For detailed instructions, see ",(0,t.jsx)(o.a,{href:"https://docs.cadosecurity.com/cado-host/deploy",children:"here"}),". Note that process memory collection is not currently supported on macOS."]}),"\n",(0,t.jsx)(o.h3,{id:"enabling-memory-collection",children:"Enabling Memory Collection"}),"\n",(0,t.jsxs)(o.p,{children:["In the console and within Cado Host, make sure to enable the options to collect memory. You can also optionally enable ",(0,t.jsx)(o.strong,{children:"Extended Memory Collection"})," to capture larger process memory files, particularly useful on Windows systems, although this can slow down the collection process."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Enable Memory",src:s(77950).A+"",width:"2120",height:"644"})}),"\n",(0,t.jsxs)(o.p,{children:["Cado collects memory from individual processes as ",(0,t.jsx)(o.code,{children:".mem"}),' files, which can be found in the "process_dumps" folder. This method provides more reliable analysis compared to older versions, using the Cado-branded open-source tool ',(0,t.jsx)(o.a,{href:"https://github.com/cado-security/varc",children:"varc"}),"."]}),"\n",(0,t.jsx)(o.h2,{id:"acquiring-memory-from-aws-ec2",children:"Acquiring Memory from AWS EC2"}),"\n",(0,t.jsxs)(o.p,{children:["To acquire memory from Linux systems in EC2, use the ",(0,t.jsx)(o.strong,{children:"Alternate Acquisition"})," option under ",(0,t.jsx)(o.strong,{children:"Import > EC2"}),":"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"AWS Memory",src:s(36010).A+"",width:"1648",height:"284"})}),"\n",(0,t.jsxs)(o.p,{children:["This requires that the AWS SSM agent is running on the EC2 instance and registered within AWS Systems Manager. If the SSM agent is not available, you can still acquire memory by connecting to the machine via SSH or RDP and running Cado Host from ",(0,t.jsx)(o.strong,{children:"Import > Cado Host"}),". This method also works for Windows systems."]}),"\n",(0,t.jsx)(o.h2,{id:"collecting-memory-from-containers",children:"Collecting Memory from Containers"}),"\n",(0,t.jsxs)(o.p,{children:["Cado will attempt to collect memory from containers (e.g., ECS, EKS, AKS) by default. Some specifics from our ",(0,t.jsx)(o.a,{href:"https://github.com/cado-security/varc",children:"testing"}),":"]}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"AWS Lambda"}),": Successfully dumps process memory by default, but requires manual execution within the Lambda function."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"EKS on EC2"}),": Successfully dumps process memory by default."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"ECS on Fargate"}),": Requires enabling ",(0,t.jsx)(o.code,{children:"CAP_SYS_PTRACE"})," in the task definition to collect process memory."]}),"\n"]}),"\n",(0,t.jsx)(o.h2,{id:"processed-memory",children:"Processed Memory"}),"\n",(0,t.jsx)(o.p,{children:"Once the memory collection is complete, you can browse the file system through the Cado UI, view file contents that were in memory at the time, and analyze information on running processes and network connections."}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Collected memory files"}),' are stored in the "process_dumps" folder:']}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Collected Memory",src:s(18274).A+"",width:"1138",height:"1028"})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Running process information"})," is stored in ",(0,t.jsx)(o.code,{children:"processes.json"}),":"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Process Info",src:s(95326).A+"",width:"3144",height:"936"})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Network connections"})," are recorded in ",(0,t.jsx)(o.code,{children:"network.json"}),", open files in ",(0,t.jsx)(o.code,{children:"open_files.json"}),", and files collected from memory are stored in the ",(0,t.jsx)(o.code,{children:"collected_files"})," folder."]}),"\n"]}),"\n"]})]})}function m(e={}){const{wrapper:o}={...(0,n.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},36010:(e,o,s)=>{s.d(o,{A:()=>t});const t=s.p+"assets/images/alternate-ec2-1d44379783163049a09c15fbf9a92565.png"},18274:(e,o,s)=>{s.d(o,{A:()=>t});const t=s.p+"assets/images/collected-memory-ac9e487a30fdc244204f920483edb251.png"},77950:(e,o,s)=>{s.d(o,{A:()=>t});const t=s.p+"assets/images/enable-memory-611c6a142978636715479e16a276acf5.png"},95326:(e,o,s)=>{s.d(o,{A:()=>t});const t=s.p+"assets/images/proccess-info-318e967e706cca9767f7ae2f2533b8c3.png"},28453:(e,o,s)=>{s.d(o,{R:()=>i,x:()=>c});var t=s(96540);const n={},r=t.createContext(n);function i(e){const o=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),t.createElement(r.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[455],{26859:(e,o,s)=>{s.r(o),s.d(o,{assets:()=>a,contentTitle:()=>i,default:()=>m,frontMatter:()=>r,metadata:()=>c,toc:()=>l});var t=s(74848),n=s(28453);const r={title:"Memory analysis",hide_title:!0,sidebar_position:3},i="How to Collect Process Memory with Cado",c={id:"cado/discovery-import/data-types/memory",title:"Memory analysis",description:"You can perform a memory acquisition of a Windows or Linux system using Cado Host by navigating to Import > Cado Host within the platform and running the pre-generated script on the host device. For detailed instructions, see here. Note that process memory collection is not currently supported on macOS.",source:"@site/docs/cado/discovery-import/data-types/memory.md",sourceDirName:"cado/discovery-import/data-types",slug:"/cado/discovery-import/data-types/memory",permalink:"/cado/discovery-import/data-types/memory",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/data-types/memory.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Memory analysis",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Log & artifact types",permalink:"/cado/discovery-import/data-types/logs"},next:{title:"Cloud import sources",permalink:"/cado/discovery-import/data-types/import-types"}},a={},l=[{value:"Enabling Memory Collection",id:"enabling-memory-collection",level:3},{value:"Acquiring Memory from AWS EC2",id:"acquiring-memory-from-aws-ec2",level:2},{value:"Collecting Memory from Containers",id:"collecting-memory-from-containers",level:2},{value:"Processed Memory",id:"processed-memory",level:2}];function d(e){const o={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-collect-process-memory-with-cado",children:"How to Collect Process Memory with Cado"}),"\n",(0,t.jsxs)(o.p,{children:["You can perform a memory acquisition of a Windows or Linux system using Cado Host by navigating to ",(0,t.jsx)(o.strong,{children:"Import > Cado Host"})," within the platform and running the pre-generated script on the host device. For detailed instructions, see ",(0,t.jsx)(o.a,{href:"https://docs.cadosecurity.com/cado-host/deploy",children:"here"}),". Note that process memory collection is not currently supported on macOS."]}),"\n",(0,t.jsx)(o.h3,{id:"enabling-memory-collection",children:"Enabling Memory Collection"}),"\n",(0,t.jsxs)(o.p,{children:["In the console and within Cado Host, make sure to enable the options to collect memory. You can also optionally enable ",(0,t.jsx)(o.strong,{children:"Extended Memory Collection"})," to capture larger process memory files, particularly useful on Windows systems, although this can slow down the collection process."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Enable Memory",src:s(77950).A+"",width:"2120",height:"644"})}),"\n",(0,t.jsxs)(o.p,{children:["Cado collects memory from individual processes as ",(0,t.jsx)(o.code,{children:".mem"}),' files, which can be found in the "process_dumps" folder. This method provides more reliable analysis compared to older versions, using the Cado-branded open-source tool ',(0,t.jsx)(o.a,{href:"https://github.com/cado-security/varc",children:"varc"}),"."]}),"\n",(0,t.jsx)(o.h2,{id:"acquiring-memory-from-aws-ec2",children:"Acquiring Memory from AWS EC2"}),"\n",(0,t.jsxs)(o.p,{children:["To acquire memory from Linux systems in EC2, use the ",(0,t.jsx)(o.strong,{children:"Alternate Acquisition"})," option under ",(0,t.jsx)(o.strong,{children:"Import > EC2"}),":"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"AWS Memory",src:s(36010).A+"",width:"1648",height:"284"})}),"\n",(0,t.jsxs)(o.p,{children:["This requires that the AWS SSM agent is running on the EC2 instance and registered within AWS Systems Manager. If the SSM agent is not available, you can still acquire memory by connecting to the machine via SSH or RDP and running Cado Host from ",(0,t.jsx)(o.strong,{children:"Import > Cado Host"}),". This method also works for Windows systems."]}),"\n",(0,t.jsx)(o.h2,{id:"collecting-memory-from-containers",children:"Collecting Memory from Containers"}),"\n",(0,t.jsxs)(o.p,{children:["Cado will attempt to collect memory from containers (e.g., ECS, EKS, AKS) by default. Some specifics from our ",(0,t.jsx)(o.a,{href:"https://github.com/cado-security/varc",children:"testing"}),":"]}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"AWS Lambda"}),": Successfully dumps process memory by default, but requires manual execution within the Lambda function."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"EKS on EC2"}),": Successfully dumps process memory by default."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"ECS on Fargate"}),": Requires enabling ",(0,t.jsx)(o.code,{children:"CAP_SYS_PTRACE"})," in the task definition to collect process memory."]}),"\n"]}),"\n",(0,t.jsx)(o.h2,{id:"processed-memory",children:"Processed Memory"}),"\n",(0,t.jsx)(o.p,{children:"Once the memory collection is complete, you can browse the file system through the Cado UI, view file contents that were in memory at the time, and analyze information on running processes and network connections."}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Collected memory files"}),' are stored in the "process_dumps" folder:']}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Collected Memory",src:s(18274).A+"",width:"1138",height:"1028"})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Running process information"})," is stored in ",(0,t.jsx)(o.code,{children:"processes.json"}),":"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Process Info",src:s(95326).A+"",width:"3144",height:"936"})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Network connections"})," are recorded in ",(0,t.jsx)(o.code,{children:"network.json"}),", open files in ",(0,t.jsx)(o.code,{children:"open_files.json"}),", and files collected from memory are stored in the ",(0,t.jsx)(o.code,{children:"collected_files"})," folder."]}),"\n"]}),"\n"]})]})}function m(e={}){const{wrapper:o}={...(0,n.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},36010:(e,o,s)=>{s.d(o,{A:()=>t});const t=s.p+"assets/images/alternate-ec2-1d44379783163049a09c15fbf9a92565.png"},18274:(e,o,s)=>{s.d(o,{A:()=>t});const t=s.p+"assets/images/collected-memory-ac9e487a30fdc244204f920483edb251.png"},77950:(e,o,s)=>{s.d(o,{A:()=>t});const t=s.p+"assets/images/enable-memory-611c6a142978636715479e16a276acf5.png"},95326:(e,o,s)=>{s.d(o,{A:()=>t});const t=s.p+"assets/images/proccess-info-318e967e706cca9767f7ae2f2533b8c3.png"},28453:(e,o,s)=>{s.d(o,{R:()=>i,x:()=>c});var t=s(96540);const n={},r=t.createContext(n);function i(e){const o=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),t.createElement(r.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/baefdef6.879cd5b8.js b/assets/js/baefdef6.4bd2fd97.js similarity index 95% rename from assets/js/baefdef6.879cd5b8.js rename to assets/js/baefdef6.4bd2fd97.js index fe51fa59b..559c8a6eb 100644 --- a/assets/js/baefdef6.879cd5b8.js +++ b/assets/js/baefdef6.4bd2fd97.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3056],{36405:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>c,contentTitle:()=>r,default:()=>m,frontMatter:()=>a,metadata:()=>i,toc:()=>l});var n=o(74848),s=o(28453);const a={title:"Cost estimates",hide_title:!0,sidebar_position:11},r="How to Estimate the Cost of the Cado Platform",i={id:"cado/manage/cost-management",title:"Cost estimates",description:"To estimate the cost of using the Cado platform, you can base your calculations on the following typical assumptions:",source:"@site/docs/cado/manage/cost-management.md",sourceDirName:"cado/manage",slug:"/cado/manage/cost-management",permalink:"/cado/manage/cost-management",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/cost-management.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:11,frontMatter:{title:"Cost estimates",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Updating",permalink:"/cado/manage/updating"},next:{title:"Monitor platform health",permalink:"/cado/manage/monitoring"}},c={},l=[];function d(t){const e={h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...t.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{id:"how-to-estimate-the-cost-of-the-cado-platform",children:"How to Estimate the Cost of the Cado Platform"}),"\n",(0,n.jsx)(e.p,{children:"To estimate the cost of using the Cado platform, you can base your calculations on the following typical assumptions:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:["A central platform server running continuously with ",(0,n.jsx)(e.strong,{children:"500 GB of storage"})," for hot data access."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"36.5 hours"})," of worker usage per month (approximately 5% of the time) to process data."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"500 GB of permanent S3 storage"})," used for storing forensic images."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"50 GB of Network File System (NFS) storage"})," for file transfer downloads."]}),"\n"]})]})}function m(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(d,{...t})}):d(t)}},28453:(t,e,o)=>{o.d(e,{R:()=>r,x:()=>i});var n=o(96540);const s={},a=n.createContext(s);function r(t){const e=n.useContext(a);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function i(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:r(t.components),n.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3056],{36405:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>c,contentTitle:()=>r,default:()=>m,frontMatter:()=>a,metadata:()=>i,toc:()=>l});var n=o(74848),s=o(28453);const a={title:"Cost estimates",hide_title:!0,sidebar_position:11},r="How to Estimate the Cost of the Cado Platform",i={id:"cado/manage/cost-management",title:"Cost estimates",description:"To estimate the cost of using the Cado platform, you can base your calculations on the following typical assumptions:",source:"@site/docs/cado/manage/cost-management.md",sourceDirName:"cado/manage",slug:"/cado/manage/cost-management",permalink:"/cado/manage/cost-management",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/cost-management.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:11,frontMatter:{title:"Cost estimates",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Updating",permalink:"/cado/manage/updating"},next:{title:"Monitor platform health",permalink:"/cado/manage/monitoring"}},c={},l=[];function d(t){const e={h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...t.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{id:"how-to-estimate-the-cost-of-the-cado-platform",children:"How to Estimate the Cost of the Cado Platform"}),"\n",(0,n.jsx)(e.p,{children:"To estimate the cost of using the Cado platform, you can base your calculations on the following typical assumptions:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:["A central platform server running continuously with ",(0,n.jsx)(e.strong,{children:"500 GB of storage"})," for hot data access."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"36.5 hours"})," of worker usage per month (approximately 5% of the time) to process data."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"500 GB of permanent S3 storage"})," used for storing forensic images."]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"50 GB of Network File System (NFS) storage"})," for file transfer downloads."]}),"\n"]})]})}function m(t={}){const{wrapper:e}={...(0,s.R)(),...t.components};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(d,{...t})}):d(t)}},28453:(t,e,o)=>{o.d(e,{R:()=>r,x:()=>i});var n=o(96540);const s={},a=n.createContext(s);function r(t){const e=n.useContext(a);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function i(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:r(t.components),n.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/bc75044d.f6aa5ec4.js b/assets/js/bc75044d.9b23bce4.js similarity index 98% rename from assets/js/bc75044d.f6aa5ec4.js rename to assets/js/bc75044d.9b23bce4.js index 714805b1a..84356792c 100644 --- a/assets/js/bc75044d.f6aa5ec4.js +++ b/assets/js/bc75044d.9b23bce4.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1150],{79499:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>i,default:()=>h,frontMatter:()=>o,metadata:()=>d,toc:()=>c});var t=s(74848),r=s(28453);const o={title:"Workers",hide_title:!0,sidebar_position:4},i="Workers",d={id:"cado/deploy/aws/aws-workers",title:"Workers",description:"The initial deployment runs everything on a single EC2 instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures and small artefacts stored in S3. We also limit how many pieces of evidence can be processed at once.",source:"@site/docs/cado/deploy/aws/aws-workers.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/aws-workers",permalink:"/cado/deploy/aws/aws-workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/aws-workers.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Workers",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Secret Manager",permalink:"/cado/deploy/aws/aws-secret-manager"},next:{title:"IAM permissions description",permalink:"/cado/deploy/aws/iam/iam-description"}},a={},c=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function l(e){const n={code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"workers",children:"Workers"}),"\n",(0,t.jsx)(n.p,{children:"The initial deployment runs everything on a single EC2 instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures and small artefacts stored in S3. We also limit how many pieces of evidence can be processed at once."}),"\n",(0,t.jsx)(n.p,{children:"To enable processing data from all sources or to process many items of evidence at once, Cado must be configured to allow it to run imports on additional EC2s."}),"\n",(0,t.jsx)(n.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:'vCPU capacity in your region: we recommend requesting 128 "Running On-Demand All Standard" instances.'}),"\n",(0,t.jsx)(n.li,{children:"The IAM instance role used in the initial deployment, and permission to edit it"}),"\n",(0,t.jsx)(n.li,{children:"The security group you used in the initial deployment, and permission to edit it"}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"steps",children:"Steps"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Add the necessary permissions by adding the following Sid to your IAM instance role:"}),"\n"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'[\n {\n "Sid": "RequiredForWorkers",\n "Effect": "Allow",\n "Action": [\n "ec2:DeleteVolume",\n "ec2:DeleteSnapshot",\n "ec2:TerminateInstances",\n "ec2:AttachVolume",\n "ec2:DetachVolume",\n "ec2:StopInstances",\n "ec2:StartInstances",\n "ec2:RunInstances",\n "ec2:DescribeInstances",\n "ec2:DescribeInstanceStatus",\n "ec2:CreateTags",\n "ec2:DescribeAddresses",\n "ec2:AssociateAddress"\n ],\n "Resource": "*"\n },\n {\n "Sid": "RequiredForWorkersAndUpdatesIAM",\n "Effect": "Allow",\n "Action": [\n "iam:PassRole"\n ],\n "Resource": "arn:aws:iam::*:role/*CadoResponse*"\n }\n]\n'})}),"\n",(0,t.jsxs)(n.ol,{start:"2",children:["\n",(0,t.jsx)(n.li,{children:"Add the following inbound rules to your security group"}),"\n"]}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Type"}),(0,t.jsx)(n.th,{children:"Port"}),(0,t.jsx)(n.th,{children:"Source"}),(0,t.jsx)(n.th,{children:"Reason"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Custom TCP"}),(0,t.jsx)(n.td,{children:"5432"}),(0,t.jsx)(n.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(n.td,{children:"Data Storage"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Custom TCP"}),(0,t.jsx)(n.td,{children:"9200"}),(0,t.jsx)(n.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(n.td,{children:"Data Storage"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Custom TCP"}),(0,t.jsx)(n.td,{children:"6379"}),(0,t.jsx)(n.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(n.td,{children:"Data Storage"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Custom TCP"}),(0,t.jsx)(n.td,{children:"24224"}),(0,t.jsx)(n.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(n.td,{children:"Log Handling"})]})]})]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"AWS Inbound Rules",src:s(40652).A+"",width:"512",height:"219"})}),"\n",(0,t.jsxs)(n.ol,{start:"3",children:["\n",(0,t.jsxs)(n.li,{children:["Enable in the UI: ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Advanced"})," > ",(0,t.jsx)(n.strong,{children:"Deployed Workers"})," > Enable Deployed Workers"]}),"\n",(0,t.jsxs)(n.li,{children:["Got to ",(0,t.jsx)(n.strong,{children:"Platform"})," > ",(0,t.jsx)(n.strong,{children:"Run a Platform Check"})]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},40652:(e,n,s)=>{s.d(n,{A:()=>t});const t=s.p+"assets/images/aws-inbound-rules-5db0f7662633d56c5f63b9874291597f.png"},28453:(e,n,s)=>{s.d(n,{R:()=>i,x:()=>d});var t=s(96540);const r={},o=t.createContext(r);function i(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function d(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1150],{79499:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>i,default:()=>h,frontMatter:()=>o,metadata:()=>d,toc:()=>c});var t=s(74848),r=s(28453);const o={title:"Workers",hide_title:!0,sidebar_position:4},i="Workers",d={id:"cado/deploy/aws/aws-workers",title:"Workers",description:"The initial deployment runs everything on a single EC2 instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures and small artefacts stored in S3. We also limit how many pieces of evidence can be processed at once.",source:"@site/docs/cado/deploy/aws/aws-workers.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/aws-workers",permalink:"/cado/deploy/aws/aws-workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/aws-workers.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Workers",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Secret Manager",permalink:"/cado/deploy/aws/aws-secret-manager"},next:{title:"IAM permissions description",permalink:"/cado/deploy/aws/iam/iam-description"}},a={},c=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function l(e){const n={code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"workers",children:"Workers"}),"\n",(0,t.jsx)(n.p,{children:"The initial deployment runs everything on a single EC2 instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures and small artefacts stored in S3. We also limit how many pieces of evidence can be processed at once."}),"\n",(0,t.jsx)(n.p,{children:"To enable processing data from all sources or to process many items of evidence at once, Cado must be configured to allow it to run imports on additional EC2s."}),"\n",(0,t.jsx)(n.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:'vCPU capacity in your region: we recommend requesting 128 "Running On-Demand All Standard" instances.'}),"\n",(0,t.jsx)(n.li,{children:"The IAM instance role used in the initial deployment, and permission to edit it"}),"\n",(0,t.jsx)(n.li,{children:"The security group you used in the initial deployment, and permission to edit it"}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"steps",children:"Steps"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Add the necessary permissions by adding the following Sid to your IAM instance role:"}),"\n"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'[\n {\n "Sid": "RequiredForWorkers",\n "Effect": "Allow",\n "Action": [\n "ec2:DeleteVolume",\n "ec2:DeleteSnapshot",\n "ec2:TerminateInstances",\n "ec2:AttachVolume",\n "ec2:DetachVolume",\n "ec2:StopInstances",\n "ec2:StartInstances",\n "ec2:RunInstances",\n "ec2:DescribeInstances",\n "ec2:DescribeInstanceStatus",\n "ec2:CreateTags",\n "ec2:DescribeAddresses",\n "ec2:AssociateAddress"\n ],\n "Resource": "*"\n },\n {\n "Sid": "RequiredForWorkersAndUpdatesIAM",\n "Effect": "Allow",\n "Action": [\n "iam:PassRole"\n ],\n "Resource": "arn:aws:iam::*:role/*CadoResponse*"\n }\n]\n'})}),"\n",(0,t.jsxs)(n.ol,{start:"2",children:["\n",(0,t.jsx)(n.li,{children:"Add the following inbound rules to your security group"}),"\n"]}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Type"}),(0,t.jsx)(n.th,{children:"Port"}),(0,t.jsx)(n.th,{children:"Source"}),(0,t.jsx)(n.th,{children:"Reason"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Custom TCP"}),(0,t.jsx)(n.td,{children:"5432"}),(0,t.jsx)(n.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(n.td,{children:"Data Storage"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Custom TCP"}),(0,t.jsx)(n.td,{children:"9200"}),(0,t.jsx)(n.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(n.td,{children:"Data Storage"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Custom TCP"}),(0,t.jsx)(n.td,{children:"6379"}),(0,t.jsx)(n.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(n.td,{children:"Data Storage"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Custom TCP"}),(0,t.jsx)(n.td,{children:"24224"}),(0,t.jsx)(n.td,{children:"Custom - Your Cado security group"}),(0,t.jsx)(n.td,{children:"Log Handling"})]})]})]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"AWS Inbound Rules",src:s(40652).A+"",width:"512",height:"219"})}),"\n",(0,t.jsxs)(n.ol,{start:"3",children:["\n",(0,t.jsxs)(n.li,{children:["Enable in the UI: ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Advanced"})," > ",(0,t.jsx)(n.strong,{children:"Deployed Workers"})," > Enable Deployed Workers"]}),"\n",(0,t.jsxs)(n.li,{children:["Got to ",(0,t.jsx)(n.strong,{children:"Platform"})," > ",(0,t.jsx)(n.strong,{children:"Run a Platform Check"})]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},40652:(e,n,s)=>{s.d(n,{A:()=>t});const t=s.p+"assets/images/aws-inbound-rules-5db0f7662633d56c5f63b9874291597f.png"},28453:(e,n,s)=>{s.d(n,{R:()=>i,x:()=>d});var t=s(96540);const r={},o=t.createContext(r);function i(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function d(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/bcecf3ad.6a7ecfb8.js b/assets/js/bcecf3ad.66568bed.js similarity index 98% rename from assets/js/bcecf3ad.6a7ecfb8.js rename to assets/js/bcecf3ad.66568bed.js index e4f66a5ee..75bbbc6be 100644 --- a/assets/js/bcecf3ad.6a7ecfb8.js +++ b/assets/js/bcecf3ad.66568bed.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8864],{96848:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>l,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var i=o(74848),r=o(28453);const s={title:"AWS Memory Analysis",hide_title:!0,sidebar_position:7},n="How to Import Memory from AWS EC2",a={id:"cado/discovery-import/aws/memory",title:"AWS Memory Analysis",description:"To acquire memory from Linux systems running in EC2, use the Triage Acquisition option under Import > EC2:",source:"@site/docs/cado/discovery-import/aws/memory.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/memory",permalink:"/cado/discovery-import/aws/memory",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/memory.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"AWS Memory Analysis",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Lambda",permalink:"/cado/discovery-import/aws/aws-lambda"},next:{title:"Lightsail",permalink:"/cado/discovery-import/aws/aws-lightsail"}},c={},d=[{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function m(e){const t={a:"a",h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-memory-from-aws-ec2",children:"How to Import Memory from AWS EC2"}),"\n",(0,i.jsxs)(t.p,{children:["To acquire memory from Linux systems running in EC2, use the ",(0,i.jsx)(t.strong,{children:"Triage Acquisition"})," option under ",(0,i.jsx)(t.strong,{children:"Import > EC2"}),":"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS Memory",src:o(36010).A+"",width:"1648",height:"284"})}),"\n",(0,i.jsxs)(t.p,{children:["This method requires the AWS Systems Manager (SSM) agent to be installed and running on the EC2 instance. The instance must also be registered with AWS Systems Manager. If the SSM agent is not available, you can still acquire memory by connecting to the machine via SSH (for Linux) or RDP (for Windows) and running ",(0,i.jsx)(t.strong,{children:"Cado Host"})," from ",(0,i.jsx)(t.strong,{children:"Import > Forensic Artifacts"}),"."]}),"\n",(0,i.jsx)(t.p,{children:"This method can also be used to acquire memory from Windows systems."}),"\n",(0,i.jsx)(t.p,{children:"For ECS and EKS acquisitions, memory will be collected automatically by default."}),"\n",(0,i.jsxs)(t.p,{children:["For additional details, see the ",(0,i.jsx)(t.a,{href:"/cado/discovery-import/data-types/memory",children:"Memory Analysis"})," page."]}),"\n",(0,i.jsx)(t.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,i.jsx)(t.p,{children:"The following diagram illustrates how EC2 SSM memory acquisitions work:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 SSM Data Flow",src:o(13667).A+"",width:"1674",height:"1056"})})]})}function l(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(m,{...e})}):m(e)}},36010:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/alternate-ec2-1d44379783163049a09c15fbf9a92565.png"},13667:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/ec2-ssm-ebcc0f7f19f1db4f515746730c8122a5.png"},28453:(e,t,o)=>{o.d(t,{R:()=>n,x:()=>a});var i=o(96540);const r={},s=i.createContext(r);function n(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:n(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8864],{96848:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>l,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var i=o(74848),r=o(28453);const s={title:"AWS Memory Analysis",hide_title:!0,sidebar_position:7},n="How to Import Memory from AWS EC2",a={id:"cado/discovery-import/aws/memory",title:"AWS Memory Analysis",description:"To acquire memory from Linux systems running in EC2, use the Triage Acquisition option under Import > EC2:",source:"@site/docs/cado/discovery-import/aws/memory.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/memory",permalink:"/cado/discovery-import/aws/memory",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/memory.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"AWS Memory Analysis",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Lambda",permalink:"/cado/discovery-import/aws/aws-lambda"},next:{title:"Lightsail",permalink:"/cado/discovery-import/aws/aws-lightsail"}},c={},d=[{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function m(e){const t={a:"a",h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-memory-from-aws-ec2",children:"How to Import Memory from AWS EC2"}),"\n",(0,i.jsxs)(t.p,{children:["To acquire memory from Linux systems running in EC2, use the ",(0,i.jsx)(t.strong,{children:"Triage Acquisition"})," option under ",(0,i.jsx)(t.strong,{children:"Import > EC2"}),":"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS Memory",src:o(36010).A+"",width:"1648",height:"284"})}),"\n",(0,i.jsxs)(t.p,{children:["This method requires the AWS Systems Manager (SSM) agent to be installed and running on the EC2 instance. The instance must also be registered with AWS Systems Manager. If the SSM agent is not available, you can still acquire memory by connecting to the machine via SSH (for Linux) or RDP (for Windows) and running ",(0,i.jsx)(t.strong,{children:"Cado Host"})," from ",(0,i.jsx)(t.strong,{children:"Import > Forensic Artifacts"}),"."]}),"\n",(0,i.jsx)(t.p,{children:"This method can also be used to acquire memory from Windows systems."}),"\n",(0,i.jsx)(t.p,{children:"For ECS and EKS acquisitions, memory will be collected automatically by default."}),"\n",(0,i.jsxs)(t.p,{children:["For additional details, see the ",(0,i.jsx)(t.a,{href:"/cado/discovery-import/data-types/memory",children:"Memory Analysis"})," page."]}),"\n",(0,i.jsx)(t.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,i.jsx)(t.p,{children:"The following diagram illustrates how EC2 SSM memory acquisitions work:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EC2 SSM Data Flow",src:o(13667).A+"",width:"1674",height:"1056"})})]})}function l(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(m,{...e})}):m(e)}},36010:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/alternate-ec2-1d44379783163049a09c15fbf9a92565.png"},13667:(e,t,o)=>{o.d(t,{A:()=>i});const i=o.p+"assets/images/ec2-ssm-ebcc0f7f19f1db4f515746730c8122a5.png"},28453:(e,t,o)=>{o.d(t,{R:()=>n,x:()=>a});var i=o(96540);const r={},s=i.createContext(r);function n(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:n(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/bd15c322.89fd3622.js b/assets/js/bd15c322.b632d079.js similarity index 97% rename from assets/js/bd15c322.89fd3622.js rename to assets/js/bd15c322.b632d079.js index ef33829e6..eb1b34c19 100644 --- a/assets/js/bd15c322.89fd3622.js +++ b/assets/js/bd15c322.b632d079.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8805],{12730:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>l,contentTitle:()=>s,default:()=>p,frontMatter:()=>i,metadata:()=>r,toc:()=>d});var t=n(74848),a=n(28453);const i={title:"Command line parameters",hide_title:!0,sidebar_position:7},s="What are the Command Line Parameters",r={id:"cado/discovery-import/cado-host/cli",title:"Command line parameters",description:"Below are the command line parameters supported by Cado Host:",source:"@site/docs/cado/discovery-import/cado-host/cli.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/cli",permalink:"/cado/discovery-import/cado-host/cli",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/cli.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"Command line parameters",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Custom location for Cado Host",permalink:"/cado/discovery-import/cado-host/custom-locations"},next:{title:"Upload single file",permalink:"/cado/discovery-import/cado-host/manual-upload"}},l={},d=[{value:"Example Command Line",id:"example-command-line",level:3}];function c(e){const o={admonition:"admonition",code:"code",h1:"h1",h3:"h3",p:"p",pre:"pre",strong:"strong",...(0,a.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"what-are-the-command-line-parameters",children:"What are the Command Line Parameters"}),"\n",(0,t.jsxs)(o.p,{children:["Below are the command line parameters supported by ",(0,t.jsx)(o.strong,{children:"Cado Host"}),":"]}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"usage: cado-host.exe [-h] [--presigned_data PRESIGNED_DATA] [--presigned_url PRESIGNED_URL]\n [--storage {aws,local,gcp,azure}] [--bucket BUCKET] [--access_key ACCESS_KEY]\n [--secret_key SECRET_KEY] [--region REGION] [--sas SAS] [-l]\n [-a ADDITIONAL_FILES [ADDITIONAL_FILES ...]] [-ap ADDITIONAL_FILES_PATH]\n [--only_additional_files] [--single_file_unzipped SINGLE_FILE_UNZIPPED]\n [--include_large_varc] [--skip_linux_memory] [--get_windows_memory] [-v]\n [--verbose] [--verbose_network] [-dd DEFAULT_DRIVE] [-o OUTPUT_PATH]\n [--no_cleanup] [--dev]\n\noptions:\n -h, --help Show this help message and exit.\n --presigned_data PRESIGNED_DATA\n Encoded upload credentials generated by Cado.\n --presigned_url PRESIGNED_URL\n Specify the presigned URL to upload files to.\n --storage {aws,local,gcp,azure}\n Specify the storage provider (AWS, Local, GCP, Azure).\n --bucket BUCKET The bucket to upload files to.\n --access_key ACCESS_KEY\n AWS access key.\n --secret_key SECRET_KEY\n AWS secret key.\n --region REGION AWS region.\n --sas SAS Shared Access Signature for uploading triage or full disk to an Azure container.\n -l, --light_mode Enable light mode to retrieve files smaller than 10 MB.\n -a ADDITIONAL_FILES [ADDITIONAL_FILES ...], --additional_files ADDITIONAL_FILES [ADDITIONAL_FILES ...]\n List of files/folders to collect, separated by space.\n -ap ADDITIONAL_FILES_PATH, --additional_files_path ADDITIONAL_FILES_PATH\n Path to a file containing a list of files/folders to collect, with one per line.\n --only_additional_files\n Only collect files and folders specified in `--additional_files`.\n --single_file_unzipped SINGLE_FILE_UNZIPPED\n Directly upload a single file to storage for import (e.g., for uploading files to Cado).\n --include_large_varc Include open files and memory larger than 1MB (may slow down acquisition).\n --skip_linux_memory Skip memory collection on Linux (faster).\n --get_windows_memory Acquire process memory on Windows systems (disabled by default for speed).\n Implicitly enables `--include_large_varc`.\n -v, --version Show version information.\n --verbose Enable verbose logging.\n --verbose_network Enable verbose network logging.\n -dd DEFAULT_DRIVE, --default_drive DEFAULT_DRIVE\n Specify the default drive for local storage.\n -o OUTPUT_PATH, --output_path OUTPUT_PATH\n Set the output path for local storage.\n --no_cleanup Disable cleanup after triage completion.\n --dev Run Cado Host in development mode.\n"})}),"\n",(0,t.jsx)(o.h3,{id:"example-command-line",children:"Example Command Line"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-console",children:'cado-host.exe --additional_files "C:\\tools\\secretfile.txt" "C:\\SuperSecretFolder"\n'})}),"\n",(0,t.jsx)(o.admonition,{type:"tip",children:(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Note:"})," Folders should NOT have trailing slashes. File and folder paths must be separated by spaces and enclosed in double quotes."]})})]})}function p(e={}){const{wrapper:o}={...(0,a.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>s,x:()=>r});var t=n(96540);const a={},i=t.createContext(a);function s(e){const o=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:s(e.components),t.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8805],{12730:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>l,contentTitle:()=>s,default:()=>p,frontMatter:()=>i,metadata:()=>r,toc:()=>d});var t=n(74848),a=n(28453);const i={title:"Command line parameters",hide_title:!0,sidebar_position:7},s="What are the Command Line Parameters",r={id:"cado/discovery-import/cado-host/cli",title:"Command line parameters",description:"Below are the command line parameters supported by Cado Host:",source:"@site/docs/cado/discovery-import/cado-host/cli.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/cli",permalink:"/cado/discovery-import/cado-host/cli",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/cli.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"Command line parameters",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Custom location for Cado Host",permalink:"/cado/discovery-import/cado-host/custom-locations"},next:{title:"Upload single file",permalink:"/cado/discovery-import/cado-host/manual-upload"}},l={},d=[{value:"Example Command Line",id:"example-command-line",level:3}];function c(e){const o={admonition:"admonition",code:"code",h1:"h1",h3:"h3",p:"p",pre:"pre",strong:"strong",...(0,a.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"what-are-the-command-line-parameters",children:"What are the Command Line Parameters"}),"\n",(0,t.jsxs)(o.p,{children:["Below are the command line parameters supported by ",(0,t.jsx)(o.strong,{children:"Cado Host"}),":"]}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"usage: cado-host.exe [-h] [--presigned_data PRESIGNED_DATA] [--presigned_url PRESIGNED_URL]\n [--storage {aws,local,gcp,azure}] [--bucket BUCKET] [--access_key ACCESS_KEY]\n [--secret_key SECRET_KEY] [--region REGION] [--sas SAS] [-l]\n [-a ADDITIONAL_FILES [ADDITIONAL_FILES ...]] [-ap ADDITIONAL_FILES_PATH]\n [--only_additional_files] [--single_file_unzipped SINGLE_FILE_UNZIPPED]\n [--include_large_varc] [--skip_linux_memory] [--get_windows_memory] [-v]\n [--verbose] [--verbose_network] [-dd DEFAULT_DRIVE] [-o OUTPUT_PATH]\n [--no_cleanup] [--dev]\n\noptions:\n -h, --help Show this help message and exit.\n --presigned_data PRESIGNED_DATA\n Encoded upload credentials generated by Cado.\n --presigned_url PRESIGNED_URL\n Specify the presigned URL to upload files to.\n --storage {aws,local,gcp,azure}\n Specify the storage provider (AWS, Local, GCP, Azure).\n --bucket BUCKET The bucket to upload files to.\n --access_key ACCESS_KEY\n AWS access key.\n --secret_key SECRET_KEY\n AWS secret key.\n --region REGION AWS region.\n --sas SAS Shared Access Signature for uploading triage or full disk to an Azure container.\n -l, --light_mode Enable light mode to retrieve files smaller than 10 MB.\n -a ADDITIONAL_FILES [ADDITIONAL_FILES ...], --additional_files ADDITIONAL_FILES [ADDITIONAL_FILES ...]\n List of files/folders to collect, separated by space.\n -ap ADDITIONAL_FILES_PATH, --additional_files_path ADDITIONAL_FILES_PATH\n Path to a file containing a list of files/folders to collect, with one per line.\n --only_additional_files\n Only collect files and folders specified in `--additional_files`.\n --single_file_unzipped SINGLE_FILE_UNZIPPED\n Directly upload a single file to storage for import (e.g., for uploading files to Cado).\n --include_large_varc Include open files and memory larger than 1MB (may slow down acquisition).\n --skip_linux_memory Skip memory collection on Linux (faster).\n --get_windows_memory Acquire process memory on Windows systems (disabled by default for speed).\n Implicitly enables `--include_large_varc`.\n -v, --version Show version information.\n --verbose Enable verbose logging.\n --verbose_network Enable verbose network logging.\n -dd DEFAULT_DRIVE, --default_drive DEFAULT_DRIVE\n Specify the default drive for local storage.\n -o OUTPUT_PATH, --output_path OUTPUT_PATH\n Set the output path for local storage.\n --no_cleanup Disable cleanup after triage completion.\n --dev Run Cado Host in development mode.\n"})}),"\n",(0,t.jsx)(o.h3,{id:"example-command-line",children:"Example Command Line"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-console",children:'cado-host.exe --additional_files "C:\\tools\\secretfile.txt" "C:\\SuperSecretFolder"\n'})}),"\n",(0,t.jsx)(o.admonition,{type:"tip",children:(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Note:"})," Folders should NOT have trailing slashes. File and folder paths must be separated by spaces and enclosed in double quotes."]})})]})}function p(e={}){const{wrapper:o}={...(0,a.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>s,x:()=>r});var t=n(96540);const a={},i=t.createContext(a);function s(e){const o=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:s(e.components),t.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/be752dd1.f02c4987.js b/assets/js/be752dd1.092f809c.js similarity index 98% rename from assets/js/be752dd1.f02c4987.js rename to assets/js/be752dd1.092f809c.js index 9f79512d7..1c0955fc5 100644 --- a/assets/js/be752dd1.f02c4987.js +++ b/assets/js/be752dd1.092f809c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9327],{76631:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>d,frontMatter:()=>i,metadata:()=>r,toc:()=>l});var n=t(74848),a=t(28453);const i={title:"Import large EC2 instances",hide_title:!0,sidebar_position:10},o="How to Import Large AWS EC2 Instances",r={id:"cado/discovery-import/aws/large-aws-imports",title:"Import large EC2 instances",description:"When importing AWS EC2 instances with disks over 500GB, you may encounter limitations in AWS that result in extended acquisition times. During the acquisition process, you might receive a warning, as shown below:",source:"@site/docs/cado/discovery-import/aws/large-aws-imports.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/large-aws-imports",permalink:"/cado/discovery-import/aws/large-aws-imports",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/large-aws-imports.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:10,frontMatter:{title:"Import large EC2 instances",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"AWS China",permalink:"/cado/discovery-import/aws/aws-china"},next:{title:"EBS Direct Acquisition",permalink:"/cado/discovery-import/aws/ebs-direct-acquisition"}},c={},l=[{value:"Alternate Acquisition via Triage of a Live System",id:"alternate-acquisition-via-triage-of-a-live-system",level:2},{value:"Alternate Manual Acquisition of a Live System",id:"alternate-manual-acquisition-of-a-live-system",level:2},{value:"How Cado Acquires EC2 Instances",id:"how-cado-acquires-ec2-instances",level:2},{value:"Speeding Up Step 1: Create Snapshot",id:"speeding-up-step-1-create-snapshot",level:3},{value:"Speeding Up Step 2: Create Volume with Fast Snapshot Restore",id:"speeding-up-step-2-create-volume-with-fast-snapshot-restore",level:3},{value:"Increasing the Size of the Target Instance for EC2 Acquisition",id:"increasing-the-size-of-the-target-instance-for-ec2-acquisition",level:3},{value:"Alternative Collection Using the AWS EBS Direct API",id:"alternative-collection-using-the-aws-ebs-direct-api",level:2}];function h(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,a.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"how-to-import-large-aws-ec2-instances",children:"How to Import Large AWS EC2 Instances"}),"\n",(0,n.jsx)(s.p,{children:"When importing AWS EC2 instances with disks over 500GB, you may encounter limitations in AWS that result in extended acquisition times. During the acquisition process, you might receive a warning, as shown below:"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Large EC2 Import Warning",src:t(58943).A+"",width:"2062",height:"256"})}),"\n",(0,n.jsx)(s.h2,{id:"alternate-acquisition-via-triage-of-a-live-system",children:"Alternate Acquisition via Triage of a Live System"}),"\n",(0,n.jsxs)(s.p,{children:["If possible, use the ",(0,n.jsx)(s.strong,{children:"Triage"})," option if AWS Systems Manager (SSM) is enabled. This can speed up the acquisition process."]}),"\n",(0,n.jsxs)(s.p,{children:["Alternatively, you can acquire the system using ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-linux-inst-ssh.html",children:"SSH"})," or ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-methods.html",children:"AWS EC2 Instance Connect"}),". In the AWS console, select the instance, then choose ",(0,n.jsx)(s.strong,{children:"Actions > Connect"}),". From there, you can use ",(0,n.jsx)(s.strong,{children:"Cado Host"})," via the Cado UI at ",(0,n.jsx)(s.strong,{children:"Import > Cado Host"}),". You can also collect additional files by using the ",(0,n.jsx)(s.a,{href:"https://docs.cadosecurity.com/cado-host/cli",children:"command line"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"If the system is powered off, consider isolating it at the network and IAM level, then turn it on to capture the necessary data."}),"\n",(0,n.jsx)(s.h2,{id:"alternate-manual-acquisition-of-a-live-system",children:"Alternate Manual Acquisition of a Live System"}),"\n",(0,n.jsx)(s.p,{children:"You can also manually copy individual files or perform a live image by connecting to the system and running a command such as:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"dd if=/dev/source of=/path/to/image.dd bs=block_size count=total_blocks\n"})}),"\n",(0,n.jsx)(s.p,{children:"Alternatively, to upload the disk image directly to S3:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"aws s3 cp /dev/[disk] s3://bucket/image.dd.gz --expected-size [size in bytes]\n"})}),"\n",(0,n.jsx)(s.h2,{id:"how-cado-acquires-ec2-instances",children:"How Cado Acquires EC2 Instances"}),"\n",(0,n.jsx)(s.p,{children:"When acquiring an EC2 instance, the Cado platform follows these steps:"}),"\n",(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Create a snapshot"})," of the volume attached to the instance."]}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Create a volume"})," from the snapshot."]}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Create an image"})," of the volume for processing."]}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:"Below is a diagram showing possible optimizations in this process:"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Cado EC2 Acquisition Process",src:t(371).A+"",width:"1800",height:"554"})}),"\n",(0,n.jsx)(s.h3,{id:"speeding-up-step-1-create-snapshot",children:"Speeding Up Step 1: Create Snapshot"}),"\n",(0,n.jsxs)(s.p,{children:["The ",(0,n.jsx)(s.strong,{children:"snapshot creation"})," process will be faster if there\u2019s an earlier snapshot of the volume, as AWS uses ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/ebs/latest/userguide/ebs-snapshots.html#how_snapshots_work",children:"incremental snapshots"}),". However, creating a snapshot for large volumes can take several hours if no earlier snapshots exist. AWS recommends creating regular snapshots to speed up this process, though this may not be feasible during incident response."]}),"\n",(0,n.jsx)(s.p,{children:"AWS does not provide exact estimates for how long creating a snapshot will take, but volumes larger than 500GB typically require several hours if there are no prior snapshots."}),"\n",(0,n.jsx)(s.h3,{id:"speeding-up-step-2-create-volume-with-fast-snapshot-restore",children:"Speeding Up Step 2: Create Volume with Fast Snapshot Restore"}),"\n",(0,n.jsxs)(s.p,{children:["If you are not using the EBS Direct API for acquisitions (below) you can speed up the ",(0,n.jsx)(s.strong,{children:"Create Volume"})," step by using ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/ebs/latest/userguide/ebs-fast-snapshot-restore.html",children:"Fast Snapshot Restore"}),". Note that this does not affect the time it takes to create a snapshot, and creating a volume still takes time. If you are using the faster EBS Direct API option, this entirely skips the Create Volume operation and is faster."]}),"\n",(0,n.jsx)(s.p,{children:"To create a snapshot and enable Fast Snapshot Restore:"}),"\n",(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Create a Snapshot"}),":\n",(0,n.jsx)(s.img,{alt:"Create Snapshot",src:t(69421).A+"",width:"674",height:"210"})]}),"\n",(0,n.jsx)(s.p,{children:"Using the AWS CLI:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:'aws ec2 create-snapshot --volume-id vol-12345678 --description "My EBS volume snapshot"\n'})}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Enable Fast Snapshot Restore"}),":\n",(0,n.jsx)(s.img,{alt:"Enable Fast Snapshot Restore",src:t(40134).A+"",width:"922",height:"192"})]}),"\n",(0,n.jsx)(s.p,{children:"Using the AWS CLI:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"aws ec2 enable-fast-snapshot-restores --availability-zones us-east-2a us-east-2b --source-snapshot-ids snap-1234567890abcdef0\n"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.p,{children:["AWS estimates that enabling Fast Snapshot Restore will take around ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/ebs/latest/userguide/ebs-fast-snapshot-restore.html#:~:text=View%20the%20fast%20snapshot%20restore%20state%20for%20a%20snapshot,-Fast%20snapshot%20restore&text=optimizing%20%E2%80%94%20Fast%20snapshot%20restore%20is,performance%20benefit%20when%20restoring%20volumes.",children:"60 minutes per terabyte"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"You\u2019ll see the status of Fast Snapshot Restore in the AWS Console as follows:"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Fast Snapshot Restore Enabled",src:t(33034).A+"",width:"314",height:"100"})}),"\n",(0,n.jsx)(s.h3,{id:"increasing-the-size-of-the-target-instance-for-ec2-acquisition",children:"Increasing the Size of the Target Instance for EC2 Acquisition"}),"\n",(0,n.jsxs)(s.p,{children:["Cado matches the instance type of the target system for compatibility when acquiring an instance. However, larger instances offer higher disk, network, and CPU limits, which can speed up the ",(0,n.jsx)(s.strong,{children:"Create Image"})," step."]}),"\n",(0,n.jsx)(s.p,{children:"If possible, changing the target instance to a larger type can speed up acquisition, though this does not affect the time taken for creating a snapshot or volume."}),"\n",(0,n.jsx)(s.h2,{id:"alternative-collection-using-the-aws-ebs-direct-api",children:"Alternative Collection Using the AWS EBS Direct API"}),"\n",(0,n.jsxs)(s.p,{children:["Cado now offers a faster acquisition method using the ",(0,n.jsx)(s.strong,{children:"EBS Direct API"}),". You can enable this feature under ",(0,n.jsx)(s.strong,{children:"Settings > Experiments > EBS Direct Acquisitions"}),"."]}),"\n",(0,n.jsxs)(s.p,{children:["This method is similar to using ",(0,n.jsx)(s.strong,{children:"Coldsnap"}),", which can be executed with a command like:"]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"coldsnap --region us-east-1 download snap-0001 disk.dd\n"})})]})}function d(e={}){const{wrapper:s}={...(0,a.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(h,{...e})}):h(e)}},69421:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/createsnap-2dc80dce785aba2c86f68437baa8d4f6.png"},33034:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/fast-restore-enabled-6138bfe42614a7a8a6a6e615969a8ea3.png"},40134:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/fast-restore-5271538b679f0fd58d1c0916559ac4e4.png"},58943:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/large-disk-warning-1209b985d6a0a3da2afda3b67118dfef.png"},371:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/snapshot-steps-ae7b218dfe5fdbb40d1c1b7a31b5917b.png"},28453:(e,s,t)=>{t.d(s,{R:()=>o,x:()=>r});var n=t(96540);const a={},i=n.createContext(a);function o(e){const s=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function r(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:o(e.components),n.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9327],{76631:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>d,frontMatter:()=>i,metadata:()=>r,toc:()=>l});var n=t(74848),a=t(28453);const i={title:"Import large EC2 instances",hide_title:!0,sidebar_position:10},o="How to Import Large AWS EC2 Instances",r={id:"cado/discovery-import/aws/large-aws-imports",title:"Import large EC2 instances",description:"When importing AWS EC2 instances with disks over 500GB, you may encounter limitations in AWS that result in extended acquisition times. During the acquisition process, you might receive a warning, as shown below:",source:"@site/docs/cado/discovery-import/aws/large-aws-imports.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/large-aws-imports",permalink:"/cado/discovery-import/aws/large-aws-imports",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/large-aws-imports.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:10,frontMatter:{title:"Import large EC2 instances",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"AWS China",permalink:"/cado/discovery-import/aws/aws-china"},next:{title:"EBS Direct Acquisition",permalink:"/cado/discovery-import/aws/ebs-direct-acquisition"}},c={},l=[{value:"Alternate Acquisition via Triage of a Live System",id:"alternate-acquisition-via-triage-of-a-live-system",level:2},{value:"Alternate Manual Acquisition of a Live System",id:"alternate-manual-acquisition-of-a-live-system",level:2},{value:"How Cado Acquires EC2 Instances",id:"how-cado-acquires-ec2-instances",level:2},{value:"Speeding Up Step 1: Create Snapshot",id:"speeding-up-step-1-create-snapshot",level:3},{value:"Speeding Up Step 2: Create Volume with Fast Snapshot Restore",id:"speeding-up-step-2-create-volume-with-fast-snapshot-restore",level:3},{value:"Increasing the Size of the Target Instance for EC2 Acquisition",id:"increasing-the-size-of-the-target-instance-for-ec2-acquisition",level:3},{value:"Alternative Collection Using the AWS EBS Direct API",id:"alternative-collection-using-the-aws-ebs-direct-api",level:2}];function h(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,a.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"how-to-import-large-aws-ec2-instances",children:"How to Import Large AWS EC2 Instances"}),"\n",(0,n.jsx)(s.p,{children:"When importing AWS EC2 instances with disks over 500GB, you may encounter limitations in AWS that result in extended acquisition times. During the acquisition process, you might receive a warning, as shown below:"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Large EC2 Import Warning",src:t(58943).A+"",width:"2062",height:"256"})}),"\n",(0,n.jsx)(s.h2,{id:"alternate-acquisition-via-triage-of-a-live-system",children:"Alternate Acquisition via Triage of a Live System"}),"\n",(0,n.jsxs)(s.p,{children:["If possible, use the ",(0,n.jsx)(s.strong,{children:"Triage"})," option if AWS Systems Manager (SSM) is enabled. This can speed up the acquisition process."]}),"\n",(0,n.jsxs)(s.p,{children:["Alternatively, you can acquire the system using ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-linux-inst-ssh.html",children:"SSH"})," or ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-methods.html",children:"AWS EC2 Instance Connect"}),". In the AWS console, select the instance, then choose ",(0,n.jsx)(s.strong,{children:"Actions > Connect"}),". From there, you can use ",(0,n.jsx)(s.strong,{children:"Cado Host"})," via the Cado UI at ",(0,n.jsx)(s.strong,{children:"Import > Cado Host"}),". You can also collect additional files by using the ",(0,n.jsx)(s.a,{href:"https://docs.cadosecurity.com/cado-host/cli",children:"command line"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"If the system is powered off, consider isolating it at the network and IAM level, then turn it on to capture the necessary data."}),"\n",(0,n.jsx)(s.h2,{id:"alternate-manual-acquisition-of-a-live-system",children:"Alternate Manual Acquisition of a Live System"}),"\n",(0,n.jsx)(s.p,{children:"You can also manually copy individual files or perform a live image by connecting to the system and running a command such as:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"dd if=/dev/source of=/path/to/image.dd bs=block_size count=total_blocks\n"})}),"\n",(0,n.jsx)(s.p,{children:"Alternatively, to upload the disk image directly to S3:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"aws s3 cp /dev/[disk] s3://bucket/image.dd.gz --expected-size [size in bytes]\n"})}),"\n",(0,n.jsx)(s.h2,{id:"how-cado-acquires-ec2-instances",children:"How Cado Acquires EC2 Instances"}),"\n",(0,n.jsx)(s.p,{children:"When acquiring an EC2 instance, the Cado platform follows these steps:"}),"\n",(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Create a snapshot"})," of the volume attached to the instance."]}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Create a volume"})," from the snapshot."]}),"\n",(0,n.jsxs)(s.li,{children:[(0,n.jsx)(s.strong,{children:"Create an image"})," of the volume for processing."]}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:"Below is a diagram showing possible optimizations in this process:"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Cado EC2 Acquisition Process",src:t(371).A+"",width:"1800",height:"554"})}),"\n",(0,n.jsx)(s.h3,{id:"speeding-up-step-1-create-snapshot",children:"Speeding Up Step 1: Create Snapshot"}),"\n",(0,n.jsxs)(s.p,{children:["The ",(0,n.jsx)(s.strong,{children:"snapshot creation"})," process will be faster if there\u2019s an earlier snapshot of the volume, as AWS uses ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/ebs/latest/userguide/ebs-snapshots.html#how_snapshots_work",children:"incremental snapshots"}),". However, creating a snapshot for large volumes can take several hours if no earlier snapshots exist. AWS recommends creating regular snapshots to speed up this process, though this may not be feasible during incident response."]}),"\n",(0,n.jsx)(s.p,{children:"AWS does not provide exact estimates for how long creating a snapshot will take, but volumes larger than 500GB typically require several hours if there are no prior snapshots."}),"\n",(0,n.jsx)(s.h3,{id:"speeding-up-step-2-create-volume-with-fast-snapshot-restore",children:"Speeding Up Step 2: Create Volume with Fast Snapshot Restore"}),"\n",(0,n.jsxs)(s.p,{children:["If you are not using the EBS Direct API for acquisitions (below) you can speed up the ",(0,n.jsx)(s.strong,{children:"Create Volume"})," step by using ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/ebs/latest/userguide/ebs-fast-snapshot-restore.html",children:"Fast Snapshot Restore"}),". Note that this does not affect the time it takes to create a snapshot, and creating a volume still takes time. If you are using the faster EBS Direct API option, this entirely skips the Create Volume operation and is faster."]}),"\n",(0,n.jsx)(s.p,{children:"To create a snapshot and enable Fast Snapshot Restore:"}),"\n",(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Create a Snapshot"}),":\n",(0,n.jsx)(s.img,{alt:"Create Snapshot",src:t(69421).A+"",width:"674",height:"210"})]}),"\n",(0,n.jsx)(s.p,{children:"Using the AWS CLI:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:'aws ec2 create-snapshot --volume-id vol-12345678 --description "My EBS volume snapshot"\n'})}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Enable Fast Snapshot Restore"}),":\n",(0,n.jsx)(s.img,{alt:"Enable Fast Snapshot Restore",src:t(40134).A+"",width:"922",height:"192"})]}),"\n",(0,n.jsx)(s.p,{children:"Using the AWS CLI:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"aws ec2 enable-fast-snapshot-restores --availability-zones us-east-2a us-east-2b --source-snapshot-ids snap-1234567890abcdef0\n"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(s.p,{children:["AWS estimates that enabling Fast Snapshot Restore will take around ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/ebs/latest/userguide/ebs-fast-snapshot-restore.html#:~:text=View%20the%20fast%20snapshot%20restore%20state%20for%20a%20snapshot,-Fast%20snapshot%20restore&text=optimizing%20%E2%80%94%20Fast%20snapshot%20restore%20is,performance%20benefit%20when%20restoring%20volumes.",children:"60 minutes per terabyte"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"You\u2019ll see the status of Fast Snapshot Restore in the AWS Console as follows:"}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Fast Snapshot Restore Enabled",src:t(33034).A+"",width:"314",height:"100"})}),"\n",(0,n.jsx)(s.h3,{id:"increasing-the-size-of-the-target-instance-for-ec2-acquisition",children:"Increasing the Size of the Target Instance for EC2 Acquisition"}),"\n",(0,n.jsxs)(s.p,{children:["Cado matches the instance type of the target system for compatibility when acquiring an instance. However, larger instances offer higher disk, network, and CPU limits, which can speed up the ",(0,n.jsx)(s.strong,{children:"Create Image"})," step."]}),"\n",(0,n.jsx)(s.p,{children:"If possible, changing the target instance to a larger type can speed up acquisition, though this does not affect the time taken for creating a snapshot or volume."}),"\n",(0,n.jsx)(s.h2,{id:"alternative-collection-using-the-aws-ebs-direct-api",children:"Alternative Collection Using the AWS EBS Direct API"}),"\n",(0,n.jsxs)(s.p,{children:["Cado now offers a faster acquisition method using the ",(0,n.jsx)(s.strong,{children:"EBS Direct API"}),". You can enable this feature under ",(0,n.jsx)(s.strong,{children:"Settings > Experiments > EBS Direct Acquisitions"}),"."]}),"\n",(0,n.jsxs)(s.p,{children:["This method is similar to using ",(0,n.jsx)(s.strong,{children:"Coldsnap"}),", which can be executed with a command like:"]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"coldsnap --region us-east-1 download snap-0001 disk.dd\n"})})]})}function d(e={}){const{wrapper:s}={...(0,a.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(h,{...e})}):h(e)}},69421:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/createsnap-2dc80dce785aba2c86f68437baa8d4f6.png"},33034:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/fast-restore-enabled-6138bfe42614a7a8a6a6e615969a8ea3.png"},40134:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/fast-restore-5271538b679f0fd58d1c0916559ac4e4.png"},58943:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/large-disk-warning-1209b985d6a0a3da2afda3b67118dfef.png"},371:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/snapshot-steps-ae7b218dfe5fdbb40d1c1b7a31b5917b.png"},28453:(e,s,t)=>{t.d(s,{R:()=>o,x:()=>r});var n=t(96540);const a={},i=n.createContext(a);function o(e){const s=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function r(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:o(e.components),n.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c04b47d4.931fb44e.js b/assets/js/c04b47d4.dce0ff5b.js similarity index 95% rename from assets/js/c04b47d4.931fb44e.js rename to assets/js/c04b47d4.dce0ff5b.js index a93c7d59e..7a5fd45d9 100644 --- a/assets/js/c04b47d4.931fb44e.js +++ b/assets/js/c04b47d4.dce0ff5b.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[999],{67850:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>d,contentTitle:()=>i,default:()=>u,frontMatter:()=>a,metadata:()=>s,toc:()=>c});var o=r(74848),n=r(28453);const a={title:"Platform encryption in Azure",hide_title:!0,sidebar_position:3},i="What platform encryption does the Cado platform use in Azure?",s={id:"cado/deploy/azure/data-encryption-overview",title:"Platform encryption in Azure",description:"Azure disks and blob storage are server side encrypted by default (see [Azure Storage encryption for data at rest",source:"@site/docs/cado/deploy/azure/data-encryption-overview.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/data-encryption-overview",permalink:"/cado/deploy/azure/data-encryption-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/data-encryption-overview.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Platform encryption in Azure",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Azure Terraform deployment",permalink:"/cado/deploy/azure/azure-deploy"},next:{title:"Endpoint access",permalink:"/cado/deploy/azure/endpoints"}},d={},c=[];function p(e){const t={a:"a",h1:"h1",p:"p",...(0,n.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"what-platform-encryption-does-the-cado-platform-use-in-azure",children:"What platform encryption does the Cado platform use in Azure?"}),"\n",(0,o.jsxs)(t.p,{children:["Azure disks and blob storage are server side encrypted by default (see ",(0,o.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption",children:"Azure Storage encryption for data at rest\n"})," and ",(0,o.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption",children:"Server-side encryption of Azure Disk Storage\n"})," )."]})]})}function u(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(p,{...e})}):p(e)}},28453:(e,t,r)=>{r.d(t,{R:()=>i,x:()=>s});var o=r(96540);const n={},a=o.createContext(n);function i(e){const t=o.useContext(a);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),o.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[999],{67850:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>d,contentTitle:()=>i,default:()=>u,frontMatter:()=>a,metadata:()=>s,toc:()=>c});var o=r(74848),n=r(28453);const a={title:"Platform encryption in Azure",hide_title:!0,sidebar_position:3},i="What platform encryption does the Cado platform use in Azure?",s={id:"cado/deploy/azure/data-encryption-overview",title:"Platform encryption in Azure",description:"Azure disks and blob storage are server side encrypted by default (see [Azure Storage encryption for data at rest",source:"@site/docs/cado/deploy/azure/data-encryption-overview.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/data-encryption-overview",permalink:"/cado/deploy/azure/data-encryption-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/data-encryption-overview.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Platform encryption in Azure",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Azure Terraform deployment",permalink:"/cado/deploy/azure/azure-deploy"},next:{title:"Endpoint access",permalink:"/cado/deploy/azure/endpoints"}},d={},c=[];function p(e){const t={a:"a",h1:"h1",p:"p",...(0,n.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"what-platform-encryption-does-the-cado-platform-use-in-azure",children:"What platform encryption does the Cado platform use in Azure?"}),"\n",(0,o.jsxs)(t.p,{children:["Azure disks and blob storage are server side encrypted by default (see ",(0,o.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption",children:"Azure Storage encryption for data at rest\n"})," and ",(0,o.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption",children:"Server-side encryption of Azure Disk Storage\n"})," )."]})]})}function u(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(p,{...e})}):p(e)}},28453:(e,t,r)=>{r.d(t,{R:()=>i,x:()=>s});var o=r(96540);const n={},a=o.createContext(n);function i(e){const t=o.useContext(a);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),o.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c3746c1b.7488703d.js b/assets/js/c3746c1b.6b27a1d3.js similarity index 97% rename from assets/js/c3746c1b.7488703d.js rename to assets/js/c3746c1b.6b27a1d3.js index 387e5fbad..c7c37e886 100644 --- a/assets/js/c3746c1b.7488703d.js +++ b/assets/js/c3746c1b.6b27a1d3.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9676],{27985:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>a});var i=n(74848),s=n(28453);const r={title:"NFS",hide_title:!0,sidebar_position:9},o="NFS",l={id:"cado/deploy/gcp/gcp-nfs",title:"NFS",description:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis.",source:"@site/docs/cado/deploy/gcp/gcp-nfs.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-nfs",permalink:"/cado/deploy/gcp/gcp-nfs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-nfs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:9,frontMatter:{title:"NFS",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Architecture in GCP",permalink:"/cado/deploy/gcp/gcp-architecture"},next:{title:"Secret Manager",permalink:"/cado/deploy/gcp/gcp-secret-manager"}},d={},a=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function c(e){const t={br:"br",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"nfs",children:"NFS"}),"\n",(0,i.jsx)(t.p,{children:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis."}),"\n",(0,i.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"The VPC and subnet you used in the initial deployment"}),"\n",(0,i.jsx)(t.li,{children:"The security group you used in the initial deployment, and permission to edit it."}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:"Configure inbound firewall rules"}),"\n"]}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Port"}),(0,i.jsx)(t.th,{children:"Protocol"}),(0,i.jsx)(t.th,{children:"Reason"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2049"}),(0,i.jsx)(t.td,{children:"TCP"}),(0,i.jsx)(t.td,{children:"Communicating with NFS"})]})})]}),"\n",(0,i.jsxs)(t.ol,{start:"2",children:["\n",(0,i.jsx)(t.li,{children:"Create a Filestore instance - there are no particular requirements on this fileshare, although we recommend a minimum size of 2 Terabytes."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"GCP Filestore",src:n(76969).A+"",width:"512",height:"376"})}),"\n",(0,i.jsxs)(t.p,{children:["a. Select your VPC from the \u201cVPC network\u201d dropdown",(0,i.jsx)(t.br,{}),"\n","b. Click Create"]}),"\n",(0,i.jsxs)(t.ol,{start:"3",children:["\n",(0,i.jsxs)(t.li,{children:["Once the access point and mount target have finished creation, Mount in the UI (",(0,i.jsx)(t.strong,{children:"Settings"})," > ",(0,i.jsx)(t.strong,{children:"Advanced"})," > ",(0,i.jsx)(t.strong,{children:"NFS"})," > ",(0,i.jsx)(t.strong,{children:"Setup NFS"}),") using the Filestore IP and Filestore Name"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"GCP NFS",src:n(20379).A+"",width:"512",height:"142"})})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},76969:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/gcp-filestore-ecad96904023485f15c5d917e99efd3e.png"},20379:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/gcp-nfs-e71570276334392cf627e8ae4a1e16e8.png"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>l});var i=n(96540);const s={},r=i.createContext(s);function o(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9676],{27985:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>a});var i=n(74848),s=n(28453);const r={title:"NFS",hide_title:!0,sidebar_position:9},o="NFS",l={id:"cado/deploy/gcp/gcp-nfs",title:"NFS",description:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis.",source:"@site/docs/cado/deploy/gcp/gcp-nfs.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-nfs",permalink:"/cado/deploy/gcp/gcp-nfs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-nfs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:9,frontMatter:{title:"NFS",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Architecture in GCP",permalink:"/cado/deploy/gcp/gcp-architecture"},next:{title:"Secret Manager",permalink:"/cado/deploy/gcp/gcp-secret-manager"}},d={},a=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function c(e){const t={br:"br",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"nfs",children:"NFS"}),"\n",(0,i.jsx)(t.p,{children:"The initial deployment deployment deploys without a Network File Share (NFS). Enabling an NFS allows Cado to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis."}),"\n",(0,i.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"The VPC and subnet you used in the initial deployment"}),"\n",(0,i.jsx)(t.li,{children:"The security group you used in the initial deployment, and permission to edit it."}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:"Configure inbound firewall rules"}),"\n"]}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Port"}),(0,i.jsx)(t.th,{children:"Protocol"}),(0,i.jsx)(t.th,{children:"Reason"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2049"}),(0,i.jsx)(t.td,{children:"TCP"}),(0,i.jsx)(t.td,{children:"Communicating with NFS"})]})})]}),"\n",(0,i.jsxs)(t.ol,{start:"2",children:["\n",(0,i.jsx)(t.li,{children:"Create a Filestore instance - there are no particular requirements on this fileshare, although we recommend a minimum size of 2 Terabytes."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"GCP Filestore",src:n(76969).A+"",width:"512",height:"376"})}),"\n",(0,i.jsxs)(t.p,{children:["a. Select your VPC from the \u201cVPC network\u201d dropdown",(0,i.jsx)(t.br,{}),"\n","b. Click Create"]}),"\n",(0,i.jsxs)(t.ol,{start:"3",children:["\n",(0,i.jsxs)(t.li,{children:["Once the access point and mount target have finished creation, Mount in the UI (",(0,i.jsx)(t.strong,{children:"Settings"})," > ",(0,i.jsx)(t.strong,{children:"Advanced"})," > ",(0,i.jsx)(t.strong,{children:"NFS"})," > ",(0,i.jsx)(t.strong,{children:"Setup NFS"}),") using the Filestore IP and Filestore Name"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"GCP NFS",src:n(20379).A+"",width:"512",height:"142"})})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},76969:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/gcp-filestore-ecad96904023485f15c5d917e99efd3e.png"},20379:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/gcp-nfs-e71570276334392cf627e8ae4a1e16e8.png"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>l});var i=n(96540);const s={},r=i.createContext(s);function o(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c5ee0868.eb6fb21b.js b/assets/js/c5ee0868.d7ad53a8.js similarity index 99% rename from assets/js/c5ee0868.eb6fb21b.js rename to assets/js/c5ee0868.d7ad53a8.js index 2c81d4b07..ca41a70a9 100644 --- a/assets/js/c5ee0868.eb6fb21b.js +++ b/assets/js/c5ee0868.d7ad53a8.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9099],{26662:(A,e,g)=>{g.r(e),g.d(e,{assets:()=>I,contentTitle:()=>E,default:()=>i,frontMatter:()=>C,metadata:()=>Q,toc:()=>s});var t=g(74848),B=g(28453);const C={title:"Oracle Cloud Virtual Machines",hide_title:!0,sidebar_position:6},E="How to import Oracle Cloud Virtual Machines",Q={id:"cado/discovery-import/virtual-machine",title:"Oracle Cloud Virtual Machines",description:"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion.",source:"@site/docs/cado/discovery-import/virtual-machine.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/virtual-machine",permalink:"/cado/discovery-import/virtual-machine",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/virtual-machine.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Oracle Cloud Virtual Machines",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Security",permalink:"/cado/discovery-import/cado-host/security"},next:{title:"XDR platforms",permalink:"/cado/discovery-import/xdr"}},I={},s=[];function a(A){const e={code:"code",h1:"h1",img:"img",p:"p",...(0,B.R)(),...A.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"how-to-import-oracle-cloud-virtual-machines",children:"How to import Oracle Cloud Virtual Machines"}),"\n",(0,t.jsx)(e.p,{children:"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion."}),"\n",(0,t.jsx)(e.p,{children:"Open the Oracle Cloud Infrastructure (\u201cOCI\u201d) console, and browse to Compute -> Instances:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(90232).A+"",width:"1919",height:"675"})}),"\n",(0,t.jsx)(e.p,{children:"Select the instance you want to acquire:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(19330).A+"",width:"1908",height:"142"})}),"\n",(0,t.jsxs)(e.p,{children:["From the Resources section, select Boot volume and then click on the Boot volume that is attached to the instance:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(11361).A+"",width:"1893",height:"266"})]}),"\n",(0,t.jsxs)(e.p,{children:["This will take you to the Boot volume's details page -> select Boot Volume Clones from the Resources menu on the left:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(40709).A+"",width:"1908",height:"273"})]}),"\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.code,{children:"Create Clone"})," button -> Give the clone volume an appropriate name -> then click the ",(0,t.jsx)(e.code,{children:"Create Clone"})," button at the bottom of the page:"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(64170).A+"",width:"1917",height:"791"})}),"\n",(0,t.jsx)(e.p,{children:"Deploy your pre-built forensics instance, in this case example Kali Linux:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(77038).A+"",width:"1496",height:"885"})}),"\n",(0,t.jsxs)(e.p,{children:["For ",(0,t.jsx)(e.code,{children:"Kali Linux"}),", the ",(0,t.jsx)(e.code,{children:"SSH"})," daemon is not installed by default and connections to the instance are made using Cloud Shell. Select Console connection from the Resources list on the left of the screen."]}),"\n",(0,t.jsx)(e.p,{children:"Click on Launch Cloud Shell connection:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(12375).A+"",width:"1912",height:"668"})}),"\n",(0,t.jsx)(e.p,{children:"Attach the cloned disk to the forensic instance, selecting Paravirtualized as the attachment type. As this is a Boot volume we are not able to select Read only - shareable as the Access type:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(35772).A+"",width:"1918",height:"916"})}),"\n",(0,t.jsxs)(e.p,{children:["Once the volume is attached you can switch over to your Cloud Shell session to acquire an image. We have used the command ",(0,t.jsx)(e.code,{children:"lsblk"})," to identify the device identified for the attached disk, in this case it is sdb:"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(48338).A+"",width:"1186",height:"330"})}),"\n",(0,t.jsx)(e.p,{children:"To create the disk image, you can use dc3dd:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(19379).A+"",width:"1163",height:"362"})}),"\n",(0,t.jsx)(e.p,{children:"Looking at the size of the image file test-clone.dd, 47GB, it's going to take time to transfer the image out of OCI:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(88444).A+"",width:"740",height:"298"})}),"\n",(0,t.jsxs)(e.p,{children:["To make the process easier, you can use gzip to compress it:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(9835).A+"",width:"985",height:"496"})]}),"\n",(0,t.jsx)(e.p,{children:"As the dd.gz file is less than 5GB in size, you can use our cado-host binary to upload the file directly to an S3 bucket and it will be automatically imported into an investigation for processing and analysis."}),"\n",(0,t.jsx)(e.p,{children:"The first step is to create an investigation in the Cado platform, from there we will use the Cado Host import capability:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(70282).A+"",width:"1912",height:"695"})}),"\n",(0,t.jsx)(e.p,{children:"When you select Cado Host, you are presented with a series of options and in this case as we are using Kali Linux we will select Linux as the Target Operating System. We are not going to using any additional Runtime Options so we can skip that step and you can see that we automatically generate a command block, to be used to transfer the image:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(48837).A+"",width:"1908",height:"883"})}),"\n",(0,t.jsx)(e.p,{children:"The cado-host binary is available from our public s3 bucket so you can use curl to download it onto the Kali instance:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(69883).A+"",width:"1166",height:"173"})}),"\n",(0,t.jsx)(e.p,{children:"One of the switches for cado-host is \u2013single_file_unzipped, which will upload a single file to the Cado bucket using the presigned_data details from the command that\u2019s generated from the import page:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(85843).A+"",width:"1233",height:"271"})}),"\n",(0,t.jsx)(e.p,{children:"Switching over to our Cado platform, you can see that the file has been successfully imported and processing tasks have been started:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(20055).A+"",width:"1867",height:"512"})}),"\n",(0,t.jsx)(e.p,{children:"Once the processing has been completed, you can move onto analyzing the captured image:"}),"\n",(0,t.jsxs)(e.p,{children:[(0,t.jsx)(e.img,{alt:"Oracle",src:g(44888).A+"",width:"1917",height:"862"}),"\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(69520).A+"",width:"1918",height:"917"}),"\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(66425).A+"",width:"1915",height:"895"})]})]})}function i(A={}){const{wrapper:e}={...(0,B.R)(),...A.components};return e?(0,t.jsx)(e,{...A,children:(0,t.jsx)(a,{...A})}):a(A)}},44888:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image1-db1670c8e122124bca18b626f5f38984.png"},70282:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image10-e97bebe4cbf37cd54c2b8e8c4cd1877b.png"},85843:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image11-b4225041547dfbba2826cf50bf93c798.png"},90232:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image12-a7451fd2351f561b35bc1e9d22f39915.png"},11361:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image13-b6dad8e699a0d29db609a041ba78c8f4.png"},12375:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image15-582caeb37debd8d31aa21d045111335b.png"},88444:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image16-c10b46229d70ec1c76088fd9b313ab8e.png"},40709:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image17-a86044dd99972223452a3e92f03615fa.png"},19330:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image18-aae8d90695693ee3975e24f3082d34ae.png"},9835:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image19-40b7785b583e3678b731b5f2e9c5224d.png"},19379:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image2-3c15f313aa86fe6541c5ed99123907f8.png"},69883:(A,e,g)=>{g.d(e,{A:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABI4AAACtCAYAAADWHDQSAAAgAElEQVR4Xu3dO8gl12EH8KPSrUBrbFChwpZkSBHW2CFBTcyCURL1WstslaRQpRAM23h33RhM8FYqklSL7VWvJLJgkZslIZhsG0s2ZAuBjVewjVuDcuc+Z+bOOXPmPr4zZ7/fFnnou3fOmd95zJn/PO5zf/onX/s8+EeAAAECBAgQIECAAAECBAgQIECgJ/Cc4EifIECAAAECBAgQIECAAAECBAgQGBIQHOkXBAgQIECAAAECBAgQIECAAAECgwLP/fznP//82rVreAgQIECAAAECBAgQIECAAAECBAh0BJ77wx/+8PkXvvAFLAQIECBAgAABAgQIECBAgAABAgS6wdEf//hHL8fWKQgQIECAAAECBAgQIECAAAECBPYEnhMc6RUECBAgQIAAAQIECBAgQIAAAQJDAoIj/YIAAQIECBAgQIAAAQIECBAgQGBQQHCkYxAgQIAAAQIECBAgQIAAAQIECAiO9AECBAgQIECAAAECBAgQIECAAIF8AXcc5Vv5JAECBAgQIECAAAECBAgQIEDgUgkIji5Vc9tZAgQIECBAgAABAgQIECBAgEC+gOAo38onCRAgQIAAAQIECBAgQIAAAQKXSkBwdKma284SIECAAAECBAgQIECAAAECBPIFBEf5Vj5JgAABAgQIECBAgAABAgQIELhUAhcWHH35S188CPa3v/v9Qd/zJQIECBAgQIAAAQIECBAgQIAAgeMEBEfH+fk2AQIECBAgQIAAAQIECBAgQOCZFbiw4Ki84Efhe1+6Hn7aqsjVO/8d/u3vXlr/l+bvPw5f+a//CH+7+U+nrPQv/jF8+Tsh/PR3/xT+MrLdX3zvi+Gtn7T++N374bc/+larftdD+Nnvw49iG0jWt71/Z97XU7rZFgECBAgQIECAAAECBAgQIFBM4HIER4//OfzNn38/vNoJXdZB0jacOXOYMhIcLUOj0A6KHod//es/C7e+tvlvq/oKjoqNFQUTIECAAAECBAgQIECAAIFLJ3AJgqNVAPP+G+27i9btvAxzfhXuLO8y6gdH6+Dm0fqzV38Q/vPf/z6sbkYaCHH2gqH2HU5fD3fuvBpu3YrdcRQJrTrbXJd55wfhV7e+H1bVWmy3c4fUWJ03d1SdOSS7dMPIDhMgQIAAAQIECBAgQIAAgWdT4NkPjpZ3G70f3hh9BK0dpvTv9glheUfQ/27Co7HgqB9WbUKk70YeVdsvb7+77W+jW6f9gOzxv/xV+Iv331gHXh5VezaHsL0iQIAAAQIECBAgQIAAAQLnE7iw4KjYr6plvFtoxdsKVkITNv0mvNN5H1E7LBoJjobKHK1H7x1MnTucNvXrParW3ubg9ldh0m/+oXkvkuDofMPIlgkQIECAAAECBAgQIECAwLMpIDjatmsrWHm8eITtx19pPZrWfKh9R8//7b9vqBXcvNS502ddwPLOp34YFetUrRCp8w6meHC0LPPW/wxucPUS8KbOHlV7NoexvSJAgAABAgQIECBAgAABAucRuLDg6DzVz9hq8lG1x+Hx45fCS8sXF80pOGqHTZvH7NJ3OQ2GVR0edxxl9BYfIUCAAAECBAgQIECAAAECBFoCz35w1LlTaPVq6+2/zq+tFXxULfoY25GPxwmODHYCBAgQIECAAAECBAgQIEDgCIFLEBwtdNYBUVg+srUJj9aPg3UeBds8yjX2cuz+3ze/ZrZ5+XX/75kvxw7tX25bVHv5+Nmr6xdq572Q+1Z7G9FfjfOrakeMGV8lQIAAAQIECBAgQIAAAQKXRuByBEfL5uy9fHrxX1bv/mkHSZvgqPl86qft+9v7erjzszfC+99pv8Oo/f3F3++8Gm7dCpFfVVv1t+WvpP2k1fc6L8geC44G6hwW5W5/Tc6japdmVNtRAgQIECBAgAABAgQIECBwIoELC46K/araiaBshgABAgQIECBAgAABAgQIECBw2QQER5etxe0vAQIECBAgQIAAAQIECBAgQCBT4MKCo8z6+BgBAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBJ775je/+flM6qIaBAgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIEAgW+Db3/529LMffvhh9nZ8kACBuIDgSO8gQIAAAQIECBAgQIAAgSoFmuBoKCCK/fcqd1KlCRQWEBz1G+Ctu+GD6yHcf/2d8NNTNc45tnmquuVu51nYh9x9PdXnajGrpZ6nahfbIXCZBYz3y9z69p0AgXMJmFvPJZu1XcFRFpMPEThKYAbB0Vvh7gdXw6PBoOYb4ea92+G1F1b7+Mn918M7yzQn9Z2UR3t7nwyHQ5Mn/nNs86g2Pc+XJ7t0q/GNm/fC2+HdcOOHvzyi/U6za9269LbZ7OfVR+H1VUdL/Mvog0eaJXtyx/NIl5x6ZrscWZfo1xfe914M7934Yfjq3Q/C1UebueBc5cW2mzHeD6jSW+fYp2W7vryuTWS+26vrWL9O/X3suwfAZH4lNaaT4z1z+/tMufPEoQUcOvdk9M+c8X6SaneP3+Gzh+H2Yvw2R4B5/cswO3mFy42Vk+/KJd/gfOeXc/WxvO1Oc2m2eT28HD4LD2/fCMtlYva/zfjNPcYtNtw+Nibmpe4+ZMwTFza3dnGmWWfCnmTNl9dXMmvU+tjwdgVH0yV9g8BUgRkHR6tJ+pWPb7fChmvhyfKgcuxkdOz3h5jPsc2pzTnXz/dtSlqNlJ19sJzxPpyjG2S7nKPwZpub4Oij8K17b4fw7tTF5anrddr2P3lw9I2b4d7tV8LH60V4s7C8/crHGSfuY/s1x+CoQJ2KjoexNlqPl+gFmVOPhbztNX382pPN8TzvOxf7qRzXU9XoIss6VZ1tZ1/gTO14kvnlTHXLunA7oezlsepKePD6o3D1g80aP7+vLY9tV56GTxbXSIYvQPe2tS1v9VRBPHSJ7cOEfcvfjSM+eab6VNgHBUdHdCNfJZApMCE4aoKcxQnbx0/Da6+trmJ/9rC1CExd3Y78rVlIbi+Ibyr8yf3V3R4Dk1Yzwb/56Y3FXUftiXJ9FSDsrmZ2tzt0FWJoos24mpBEnbrN1Ynwk6evhRVn+0pLb1tti6Xl89urMsuD5mtP8x6tS96B0L06vGvbcZexOuwfmFf79+Th84u+1NxO1rvKFKnncjuLBUJ4+eXwwicPw8PnF3YvtNp3uSB4LaxuUBu++jS4SOh8r/nqug82m4luM7UPabN4/0z1iV3nG9+H3b6vFlUPWndQDYydJdiA16Eu0X69BO3cRdiZQyLWq/61vu2wNQZ3dyCmBmasvMQYW9YxMdctizvtYu3UwdF+H1nv02jgFu/Xqfk6OZevQ7/hua6hbN8ZtX/Fefr8MjJWEn0weexIjYdD7+465Biw7nvR+TPaP8fm8sTYTA2xkfZbfXW17SsP8u4UTB/DU/WcPr/sdi0ypqPHgPQ8EduH9FhJHXOSC5DFMGqvp7rHgNRxM3k8Wt4FsvuXt+ZLH8dSLv07STvzYlY/GzJK9IlD1xrrYoZDh3h5Fz6/HLDOWk0fw3PyaN+NuKTXIZs2a8bfxOCoEzrFnlzo9Yn+uUWzjeW1qO7dkNMCpdTcet61vj7YLF9Xa3bBUfoY4a8ETiEwMThaPDb2dHNS3Vpk9RL85UHn2pPV1e3U3xInYG/dvRdefO9G+PTN9WKouZ30wZXw9ovvLe5A+ur28bbF/xGuh9aJfl9lMDU/xxXqqdtsPn89PL8O37oH1tRJ7fqgvnycKiQe8+tBjLTD+NXg+P6lT+yGTlhX+/7yerLv7Huinoszj1VIdvtJuLYIiJ7evx2eXNvcfTJgtumDW4pYXVqLlU5/SW2z236dPr8tLyNc2Csv1ic2G43tQ2vR1B5//YAjezz0FnEHuvQXjPF+NtJ+Tb9489NwY0qfXw6V2F0OY8FRZK6b0rYTZuhTB0dD28srIzE2E/P1aldj/T01VsYDrenzS2qspPpE6gQjMR5Gj3GxjpBySfXPY+ee4XYaPwbETspTdwCu+1Pz1XYgP2Fs9C8ipeo5abzvHR+GXFLz0vpkcWhNNLoOSY2V2Fw+Aa01X2/Hz+Bxc+Skuj3frR8VXj5FlOzzqbVNvLzthcFfb07k23eXjs8T0VEWOwYcvNaoa36Zus765ebCSfQiw9i6JnONsvdKgKnBUTuMHqtTq3d01ker48H15/uP0ab625zW+sP1zJ7L99Z1kbXwkce4i+qDgqMJxwgfJXCgwMTgKLJA3DsZbU2sqb8lTjZu3rsbPn13ERA0Rb4bwtvNSeOjq+HeNjhaXwkbWIzu3aGw95mpE//qdtbdXQ+5dzFtWiVzQbo9kI4ER+sT4uZurf5dF9F6Jtsh56Cb85mBXpgTVPTvqOosKHbl/nrzXp+PvrW+QtRaWH61fYVsXY/+s+tDden/t727u9rXWxfb3W6z75HRxutqxfvneLsP3YnXvTq4v+/twGA4PBio+6lcUoFTu7t0rnAOtN/i79ux3z6BSU58E8Z5p545JynTx0NqDskLdfZ3NrbN44Kj3olrZDzuvwUs82S4FzBtrmLn3UGWe6K7nCQH3leWbrfo2BwbDwmjeLun5pCx4Kh9dT1/7lnpTf18enWR237Lz7Uu8qTGQ/Yc2alaom3H5peYS/J76XkivQ6J1DWrnsPtEStve0fC0HFzkQKNr5ea/XwzfLpI7bdjfsp6ovfZsXq+G94Mb78SwoMb74UXW+Xm9rOuzkifOGStsXn/Tm3zS+Y6q2njtPXIsW/QZbXNzR1l8XVI/h1HyYutIydE7TunPnn4MDy/6G+dO44i+xCfPy9+rb+asio7xp25DwqODkwCfI3ABIHZBkd3790M723uMPr0zeVJ44Mrt9cHntWBa3mrfv+9Hb13e0yfWKefEJY5mNwLV5uCHzWP7mW0+JSF3uDmDnGJLawTJ0WJeo4GR8mXWkfqMumEsJN0dO/2GrzdecAs2T/HgqPMfei3X/tuncHQ5YDgKGo95YS3VdHEQu3mvQ+2L8jffSPnRZjzCo5So/TQ4Ci2zWMfVdu+K2I0+E+Mie2feu3Qv3q5/tz0E8PUiXvm3NOufmpsTponcufKlMuEcZQ798TaIxaaZBxWOq2/flQqGgA2hnt3+QwUMmWO7Hx9SkgwtHMZ82Dna4n+N7oOSQRHWT/O0Kt/orxkcBS670JLvyIgNV+39yfRdzPG2P1mZfMoLP7n4n9cW/0gQvtdydPmiSl9YvfZ5FpjdcvV6nHmvbtyEuVl7Pv2RzkmnGDHh+lh66z2cnLYOjW/jYyJzV3D0XVIfnA0vC7Yv5g6Oo3tHePGLhxNWFcMza2pi2kD66Dm6Yvhtb4+2H+nleBotLf7AIGjBU4THA28bG77ItbU37aT6v7B4ubdm+Gj9xZ3GjXvrPnss/DZCy8s/vfmdtLuAb7z0tdOef1byTdeUyf+HOep2xw7MWi/CHz3WNdyybJ9b03zqFrmgTbZDiun3YvIMxfV649FHyWJPDu+d8W7fbBM1LN5VG35y2yDV04bz4RFrC6d8ppttK1T2+y23/4z/A1OLDhqXgTZXL0dedShv4hIeqb6wfqK8YNmHd486tn/yZKxeh7u0j0RSfWzdPttH2MIU37NKre8/v6NLRwjbZszTUQ+c+rgqP8oybJ/HvJy7MHgKNbXYm2YM1ZWMEPva5g+vyw3NPjeis27dgbnutSxIzVPjB7jYh0j5dK2HBp/uzuOsueebTWGjlXjx4BVO4Tkrx4Ntd/2qJv7cuzkMTxVz9zxntceq0+l5qWx4Cg2z6e2O3Ic2xz/++2QMBsPjhL13F506F2dSvb5seAoUt5yzF4JTz9+FN756MXF/724DSR8vPfumfQ80e+fiT5x8FqjzvmlcyyeMGftj+lEH43Ou8tWW925llyHDB9bxuee4fV33vd6ZSb3YezYP1SPM631KzzGnbsPCo6OWIT6KoFMgdMER9vFzOYFtt27AcYe8+r8ff1Y2fJRtfat0Z0d6k7Eq6siuzJ3t6EuXrT6cPEy7yubn1dfL8Db2+qEUd0XQeb9fPCh20wdTNq3j/f2YXkre9i9DHv5/+9elp1q93Q7dPdj9xLM1P7tTvaGXtAdPxnO3fdm+72XfEaDo2aN331crf0iz9SJ+a6/LMq6H8L19hXf6DZ7Lp3H4tJm6f4Zf0woGS4k9n2z0N4/6cut51SXsUedduMs/rLV7sv3t/u+CI5Wj6zl/l5vrF8nxljyHQ/j4yFz7u3OaP0fCjjBT5d3xnv29tJjc9eX1nN97zHgobl8dfLdmluTY2X/TrJYcDQ2pvsv2t2Bx/tEfGzuHt9Yzkm9eWLsGDfcJ1Iuqf45xXNRcvYxLu6SP4e02y+9vdQ4SbVDvz915pBeX8ubX0bGdHRuTQfM6X3oPSLWHkcHzeXt/tldM4w9qhav5/rCRvt3CVpjN97n03PI2Pps9d7HsPoRhc77o9rrs9g8MRRs5hwDpq010kH/nOaX+LE43X451vvHgLELIMNBzvgxNS8A2n859vD32v16/8cY0uvW2DnC2HlATjtMW+vrg63Xh3g59iHLTt8hcJDAhODooO0f/KXhq6gHb84XL1pg9KrNBVZoTnU5dLefhX04dN99r3KB4avBR+1UajxUM1bO4HIUqi8TIDAqUM38Mronp/3As+BSyz7UUs/T9rDRrbnjaJTIBwgcLTDb4KjZs/YL7GI/r360gA0QIECAwBkFBCTDuFzO2OlsmgABAgQukYDg6BI1tl0tJjDr4KiYioIJECBAgAABAgQIECBAYPYCTXAU+/fhhx/Ovv4qSKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAgQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBARHBdAVSYAAAQIECBAgQIAAAQIECBCoQUBwVEMrqSMBAgQIECBAgAABAgQIECBAoICA4KgAuiIJECBAgAABAgQIECBAgAABAjUICI5qaCV1JECAAAECBAgQIECAAAECBAgUEBAcFUBXJAECBAgQIECAAAECBAgQIECgBgHBUQ2tpI4ECBAgQIAAAQIECBAgQIAAgQICgqMC6IokQIAAAQIECBAgQIAAAQIECNQgIDiqoZXUkQABAgQIECBAgAABAgQIECBQQEBwVABdkQQIECBAgAABAgQIECBAgACBGgQERzW0kjoSIECAAAECBAgQIECAAAECBAoICI4KoCuSAAECBAgQIECAAAECBAgQIFCDgOCohlZSRwIECBAgQIAAAQIECBAgQIBAAQHBUQF0RRIgQIAAAQIECBAgQIAAAQIEahAQHNXQSupIgAABAgQIECBAgAABAgQIECggIDgqgK5IAgQIECBAgAABAgQIECBAgEANAoKjGlpJHQkQIECAAAECBAgQIECAAAECBQQERwXQFUmAAAECBAgQIECAAAECBAgQqEFAcFRDK6kjAQIECBAgQIAAAQIECBAgQKCAgOCoALoiCRAgQIAAAQIECBAgQIAAAQI1CAiOamgldSRAgAABAgQIECBAgAABAgQIFBAQHBVAVyQBAgQIECBAgAABAgQIECBAoAYBwVENraSOBAgQIECAAAECBAgQIECAAIECAoKjAuiKJECAAAECBAgQIECAAAECBAjUICA4qqGV1JEAAQIECBAgQIAAAQIECBAgUEBAcFQAXZEECBAgQIAAAQIECBAgQIAAgRoEBEc1tJI6EiBAgAABAgQIECBAgAABAgQKCAiOCqArkgABAgQIECBAgAABAgQIECBQg4DgqIZWUkcCBAgQIECAAAECBAgQIECAQAEBwVEBdEUSIECAAAECBAgQIECAAAECBGoQEBzV0ErqSIAAAQIECBAgQIAAAQIECBAoICA4KoCuSAIECBAgQIAAAQIECBAgQIBADQKCoxpaSR0JECBAgAABAgQIECBAgAABAgUEBEcF0BVJgAABAgQIECBAgAABAgQIEKhBQHBUQyupIwECBAgQIECAAAECBAgQIECggIDgqAC6IgkQIECAAAECBAgQIECAAAECNQgIjmpoJXUkQIAAAQIECBAgQIAAAQIECBQQEBwVQFckAQIECBAgQIAAAQIECBAgQKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAgQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBARHBdAVSYAAAQIECBAgQIAAAQIECBCoQUBwVEMrqSMBAgQIECBAgAABAgQIECBAoICA4KgAuiIJECBAgAABAgQIECBAgAABAjUICI5qaCV1JECAAAECBAgQIECAAAECBAgUEBAcFUBXJAECBAgQIECAAAECBAgQIECgBgHBUQ2tpI4ECBAgQIAAAQIECBAgQIAAgQICgqMC6IokQIAAAQIECBAgQIAAAQIECNQgIDiqoZXUkQABAgQIECBAgAABAgQIECBQQEBwVABdkQQIECBAgAABAgQIECBAgACBGgQERzW0kjoSIECAAAECBAgQIECAAAECBAoICI4KoCuSAAECBAgQIECAAAECBAgQIFCDgOCohlZSRwIECBAgQIAAAQIECBAgQIBAAQHBUQF0RRIgQIAAAQIECBAgQIAAAQIEahAQHNXQSupIgAABAgQIECBAgAABAgQIECggIDgqgK5IAgQIECBAgAABAgQIECBAgEANAoKjGlpJHQkQIECAAAECBAgQIECAAAECBQQERwXQFUmAAAECBAgQIECAAAECBAgQqEFAcFRDK6kjAQIECBAgQIAAAQIECBAgQKCAgOCoALoiCRAgQIAAAQIECBAgQIAAAQI1CAiOamgldSRAgAABAgQIECBAgAABAgQIFBAQHBVAVyQBAgQIECBAgAABAgQIECBAoAYBwVENraSOBAgQIECAAAECBAgQIECAAIECAoKjAuiKJECAAAECBAgQIECAAAECBAjUICA4qqGV1JEAAQIECBAgQIAAAQIECBAgUEBAcFQAXZEECBAgQIAAAQIECBAgQIAAgRoEBEc1tJI6EiBAgAABAgQIECBAgAABAgQKCAiOCqArkgABAgQIECBAgAABAgQIECBQg4DgqIZWUkcCBAgQIECAAAECBAgQIECAQAEBwVEBdEUSIECAAAECBAgQIECAAAECBGoQEBzV0ErqSIAAAQIECBAgQIAAAQIECBAoICA4KoCuSAIECBAgQIAAAQIECBAgQIBADQKCoxpaSR0JECBAgAABAgQIECBAgAABAgUEBEcF0BVJgAABAgQIECBAgAABAgQIEKhBQHBUQyupIwECBAgQIECAAAECBAgQIECggIDgqAC6IgkQIECAAAECBAgQIECAAAECNQgIjmpoJXUkQIAAAQIECBAgQIAAAQIECBQQEBwVQFckAQIECBAgQIAAAQIECBAgQKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAi/1Ew4AAABdSURBVAQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBP4ftTNCjYAUPqAAAAAASUVORK5CYII="},48338:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image21-3749f63b9af49921d7d969c8ce65de5e.png"},64170:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image3-986d5308b0c11e779bddb07c50e838f3.png"},48837:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image4-0a491ff6ce4726e65d7d8a47d9e276c5.png"},35772:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image5-e0fe3ad4d1c07e0650d288e996910446.png"},20055:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image6-e186bec7ca1a0004681a31020c922531.png"},77038:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image7-167d970e81932cb727a06c6d365b70aa.png"},66425:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image8-0074a10f3660d9e1853f6bf6c6c10914.png"},69520:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image9-efadd6865de74c3c8cec1b9a54390930.png"},28453:(A,e,g)=>{g.d(e,{R:()=>E,x:()=>Q});var t=g(96540);const B={},C=t.createContext(B);function E(A){const e=t.useContext(C);return t.useMemo((function(){return"function"==typeof A?A(e):{...e,...A}}),[e,A])}function Q(A){let e;return e=A.disableParentContext?"function"==typeof A.components?A.components(B):A.components||B:E(A.components),t.createElement(C.Provider,{value:e},A.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9099],{26662:(A,e,g)=>{g.r(e),g.d(e,{assets:()=>I,contentTitle:()=>E,default:()=>i,frontMatter:()=>C,metadata:()=>Q,toc:()=>s});var t=g(74848),B=g(28453);const C={title:"Oracle Cloud Virtual Machines",hide_title:!0,sidebar_position:6},E="How to import Oracle Cloud Virtual Machines",Q={id:"cado/discovery-import/virtual-machine",title:"Oracle Cloud Virtual Machines",description:"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion.",source:"@site/docs/cado/discovery-import/virtual-machine.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/virtual-machine",permalink:"/cado/discovery-import/virtual-machine",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/virtual-machine.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Oracle Cloud Virtual Machines",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Security",permalink:"/cado/discovery-import/cado-host/security"},next:{title:"XDR platforms",permalink:"/cado/discovery-import/xdr"}},I={},s=[];function a(A){const e={code:"code",h1:"h1",img:"img",p:"p",...(0,B.R)(),...A.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"how-to-import-oracle-cloud-virtual-machines",children:"How to import Oracle Cloud Virtual Machines"}),"\n",(0,t.jsx)(e.p,{children:"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion."}),"\n",(0,t.jsx)(e.p,{children:"Open the Oracle Cloud Infrastructure (\u201cOCI\u201d) console, and browse to Compute -> Instances:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(90232).A+"",width:"1919",height:"675"})}),"\n",(0,t.jsx)(e.p,{children:"Select the instance you want to acquire:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(19330).A+"",width:"1908",height:"142"})}),"\n",(0,t.jsxs)(e.p,{children:["From the Resources section, select Boot volume and then click on the Boot volume that is attached to the instance:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(11361).A+"",width:"1893",height:"266"})]}),"\n",(0,t.jsxs)(e.p,{children:["This will take you to the Boot volume's details page -> select Boot Volume Clones from the Resources menu on the left:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(40709).A+"",width:"1908",height:"273"})]}),"\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.code,{children:"Create Clone"})," button -> Give the clone volume an appropriate name -> then click the ",(0,t.jsx)(e.code,{children:"Create Clone"})," button at the bottom of the page:"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(64170).A+"",width:"1917",height:"791"})}),"\n",(0,t.jsx)(e.p,{children:"Deploy your pre-built forensics instance, in this case example Kali Linux:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(77038).A+"",width:"1496",height:"885"})}),"\n",(0,t.jsxs)(e.p,{children:["For ",(0,t.jsx)(e.code,{children:"Kali Linux"}),", the ",(0,t.jsx)(e.code,{children:"SSH"})," daemon is not installed by default and connections to the instance are made using Cloud Shell. Select Console connection from the Resources list on the left of the screen."]}),"\n",(0,t.jsx)(e.p,{children:"Click on Launch Cloud Shell connection:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(12375).A+"",width:"1912",height:"668"})}),"\n",(0,t.jsx)(e.p,{children:"Attach the cloned disk to the forensic instance, selecting Paravirtualized as the attachment type. As this is a Boot volume we are not able to select Read only - shareable as the Access type:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(35772).A+"",width:"1918",height:"916"})}),"\n",(0,t.jsxs)(e.p,{children:["Once the volume is attached you can switch over to your Cloud Shell session to acquire an image. We have used the command ",(0,t.jsx)(e.code,{children:"lsblk"})," to identify the device identified for the attached disk, in this case it is sdb:"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(48338).A+"",width:"1186",height:"330"})}),"\n",(0,t.jsx)(e.p,{children:"To create the disk image, you can use dc3dd:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(19379).A+"",width:"1163",height:"362"})}),"\n",(0,t.jsx)(e.p,{children:"Looking at the size of the image file test-clone.dd, 47GB, it's going to take time to transfer the image out of OCI:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(88444).A+"",width:"740",height:"298"})}),"\n",(0,t.jsxs)(e.p,{children:["To make the process easier, you can use gzip to compress it:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(9835).A+"",width:"985",height:"496"})]}),"\n",(0,t.jsx)(e.p,{children:"As the dd.gz file is less than 5GB in size, you can use our cado-host binary to upload the file directly to an S3 bucket and it will be automatically imported into an investigation for processing and analysis."}),"\n",(0,t.jsx)(e.p,{children:"The first step is to create an investigation in the Cado platform, from there we will use the Cado Host import capability:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(70282).A+"",width:"1912",height:"695"})}),"\n",(0,t.jsx)(e.p,{children:"When you select Cado Host, you are presented with a series of options and in this case as we are using Kali Linux we will select Linux as the Target Operating System. We are not going to using any additional Runtime Options so we can skip that step and you can see that we automatically generate a command block, to be used to transfer the image:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(48837).A+"",width:"1908",height:"883"})}),"\n",(0,t.jsx)(e.p,{children:"The cado-host binary is available from our public s3 bucket so you can use curl to download it onto the Kali instance:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(69883).A+"",width:"1166",height:"173"})}),"\n",(0,t.jsx)(e.p,{children:"One of the switches for cado-host is \u2013single_file_unzipped, which will upload a single file to the Cado bucket using the presigned_data details from the command that\u2019s generated from the import page:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(85843).A+"",width:"1233",height:"271"})}),"\n",(0,t.jsx)(e.p,{children:"Switching over to our Cado platform, you can see that the file has been successfully imported and processing tasks have been started:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(20055).A+"",width:"1867",height:"512"})}),"\n",(0,t.jsx)(e.p,{children:"Once the processing has been completed, you can move onto analyzing the captured image:"}),"\n",(0,t.jsxs)(e.p,{children:[(0,t.jsx)(e.img,{alt:"Oracle",src:g(44888).A+"",width:"1917",height:"862"}),"\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(69520).A+"",width:"1918",height:"917"}),"\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(66425).A+"",width:"1915",height:"895"})]})]})}function i(A={}){const{wrapper:e}={...(0,B.R)(),...A.components};return e?(0,t.jsx)(e,{...A,children:(0,t.jsx)(a,{...A})}):a(A)}},44888:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image1-db1670c8e122124bca18b626f5f38984.png"},70282:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image10-e97bebe4cbf37cd54c2b8e8c4cd1877b.png"},85843:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image11-b4225041547dfbba2826cf50bf93c798.png"},90232:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image12-a7451fd2351f561b35bc1e9d22f39915.png"},11361:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image13-b6dad8e699a0d29db609a041ba78c8f4.png"},12375:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image15-582caeb37debd8d31aa21d045111335b.png"},88444:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image16-c10b46229d70ec1c76088fd9b313ab8e.png"},40709:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image17-a86044dd99972223452a3e92f03615fa.png"},19330:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image18-aae8d90695693ee3975e24f3082d34ae.png"},9835:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image19-40b7785b583e3678b731b5f2e9c5224d.png"},19379:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image2-3c15f313aa86fe6541c5ed99123907f8.png"},69883:(A,e,g)=>{g.d(e,{A:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABI4AAACtCAYAAADWHDQSAAAgAElEQVR4Xu3dO8gl12EH8KPSrUBrbFChwpZkSBHW2CFBTcyCURL1WstslaRQpRAM23h33RhM8FYqklSL7VWvJLJgkZslIZhsG0s2ZAuBjVewjVuDcuc+Z+bOOXPmPr4zZ7/fFnnou3fOmd95zJn/PO5zf/onX/s8+EeAAAECBAgQIECAAAECBAgQIECgJ/Cc4EifIECAAAECBAgQIECAAAECBAgQGBIQHOkXBAgQIECAAAECBAgQIECAAAECgwLP/fznP//82rVreAgQIECAAAECBAgQIECAAAECBAh0BJ77wx/+8PkXvvAFLAQIECBAgAABAgQIECBAgAABAgS6wdEf//hHL8fWKQgQIECAAAECBAgQIECAAAECBPYEnhMc6RUECBAgQIAAAQIECBAgQIAAAQJDAoIj/YIAAQIECBAgQIAAAQIECBAgQGBQQHCkYxAgQIAAAQIECBAgQIAAAQIECAiO9AECBAgQIECAAAECBAgQIECAAIF8AXcc5Vv5JAECBAgQIECAAAECBAgQIEDgUgkIji5Vc9tZAgQIECBAgAABAgQIECBAgEC+gOAo38onCRAgQIAAAQIECBAgQIAAAQKXSkBwdKma284SIECAAAECBAgQIECAAAECBPIFBEf5Vj5JgAABAgQIECBAgAABAgQIELhUAhcWHH35S188CPa3v/v9Qd/zJQIECBAgQIAAAQIECBAgQIAAgeMEBEfH+fk2AQIECBAgQIAAAQIECBAgQOCZFbiw4Ki84Efhe1+6Hn7aqsjVO/8d/u3vXlr/l+bvPw5f+a//CH+7+U+nrPQv/jF8+Tsh/PR3/xT+MrLdX3zvi+Gtn7T++N374bc/+larftdD+Nnvw49iG0jWt71/Z97XU7rZFgECBAgQIECAAAECBAgQIFBM4HIER4//OfzNn38/vNoJXdZB0jacOXOYMhIcLUOj0A6KHod//es/C7e+tvlvq/oKjoqNFQUTIECAAAECBAgQIECAAIFLJ3AJgqNVAPP+G+27i9btvAxzfhXuLO8y6gdH6+Dm0fqzV38Q/vPf/z6sbkYaCHH2gqH2HU5fD3fuvBpu3YrdcRQJrTrbXJd55wfhV7e+H1bVWmy3c4fUWJ03d1SdOSS7dMPIDhMgQIAAAQIECBAgQIAAgWdT4NkPjpZ3G70f3hh9BK0dpvTv9glheUfQ/27Co7HgqB9WbUKk70YeVdsvb7+77W+jW6f9gOzxv/xV+Iv331gHXh5VezaHsL0iQIAAAQIECBAgQIAAAQLnE7iw4KjYr6plvFtoxdsKVkITNv0mvNN5H1E7LBoJjobKHK1H7x1MnTucNvXrParW3ubg9ldh0m/+oXkvkuDofMPIlgkQIECAAAECBAgQIECAwLMpIDjatmsrWHm8eITtx19pPZrWfKh9R8//7b9vqBXcvNS502ddwPLOp34YFetUrRCp8w6meHC0LPPW/wxucPUS8KbOHlV7NoexvSJAgAABAgQIECBAgAABAucRuLDg6DzVz9hq8lG1x+Hx45fCS8sXF80pOGqHTZvH7NJ3OQ2GVR0edxxl9BYfIUCAAAECBAgQIECAAAECBFoCz35w1LlTaPVq6+2/zq+tFXxULfoY25GPxwmODHYCBAgQIECAAAECBAgQIEDgCIFLEBwtdNYBUVg+srUJj9aPg3UeBds8yjX2cuz+3ze/ZrZ5+XX/75kvxw7tX25bVHv5+Nmr6xdq572Q+1Z7G9FfjfOrakeMGV8lQIAAAQIECBAgQIAAAQKXRuByBEfL5uy9fHrxX1bv/mkHSZvgqPl86qft+9v7erjzszfC+99pv8Oo/f3F3++8Gm7dCpFfVVv1t+WvpP2k1fc6L8geC44G6hwW5W5/Tc6japdmVNtRAgQIECBAgAABAgQIECBwIoELC46K/araiaBshgABAgQIECBAgAABAgQIECBw2QQER5etxe0vAQIECBAgQIAAAQIECBAgQCBT4MKCo8z6+BgBAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBJ775je/+flM6qIaBAgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIEAgW+Db3/529LMffvhh9nZ8kACBuIDgSO8gQIAAAQIECBAgQIAAgSoFmuBoKCCK/fcqd1KlCRQWEBz1G+Ctu+GD6yHcf/2d8NNTNc45tnmquuVu51nYh9x9PdXnajGrpZ6nahfbIXCZBYz3y9z69p0AgXMJmFvPJZu1XcFRFpMPEThKYAbB0Vvh7gdXw6PBoOYb4ea92+G1F1b7+Mn918M7yzQn9Z2UR3t7nwyHQ5Mn/nNs86g2Pc+XJ7t0q/GNm/fC2+HdcOOHvzyi/U6za9269LbZ7OfVR+H1VUdL/Mvog0eaJXtyx/NIl5x6ZrscWZfo1xfe914M7934Yfjq3Q/C1UebueBc5cW2mzHeD6jSW+fYp2W7vryuTWS+26vrWL9O/X3suwfAZH4lNaaT4z1z+/tMufPEoQUcOvdk9M+c8X6SaneP3+Gzh+H2Yvw2R4B5/cswO3mFy42Vk+/KJd/gfOeXc/WxvO1Oc2m2eT28HD4LD2/fCMtlYva/zfjNPcYtNtw+Nibmpe4+ZMwTFza3dnGmWWfCnmTNl9dXMmvU+tjwdgVH0yV9g8BUgRkHR6tJ+pWPb7fChmvhyfKgcuxkdOz3h5jPsc2pzTnXz/dtSlqNlJ19sJzxPpyjG2S7nKPwZpub4Oij8K17b4fw7tTF5anrddr2P3lw9I2b4d7tV8LH60V4s7C8/crHGSfuY/s1x+CoQJ2KjoexNlqPl+gFmVOPhbztNX382pPN8TzvOxf7qRzXU9XoIss6VZ1tZ1/gTO14kvnlTHXLunA7oezlsepKePD6o3D1g80aP7+vLY9tV56GTxbXSIYvQPe2tS1v9VRBPHSJ7cOEfcvfjSM+eab6VNgHBUdHdCNfJZApMCE4aoKcxQnbx0/Da6+trmJ/9rC1CExd3Y78rVlIbi+Ibyr8yf3V3R4Dk1Yzwb/56Y3FXUftiXJ9FSDsrmZ2tzt0FWJoos24mpBEnbrN1Ynwk6evhRVn+0pLb1tti6Xl89urMsuD5mtP8x6tS96B0L06vGvbcZexOuwfmFf79+Th84u+1NxO1rvKFKnncjuLBUJ4+eXwwicPw8PnF3YvtNp3uSB4LaxuUBu++jS4SOh8r/nqug82m4luM7UPabN4/0z1iV3nG9+H3b6vFlUPWndQDYydJdiA16Eu0X69BO3cRdiZQyLWq/61vu2wNQZ3dyCmBmasvMQYW9YxMdctizvtYu3UwdF+H1nv02jgFu/Xqfk6OZevQ7/hua6hbN8ZtX/Fefr8MjJWEn0weexIjYdD7+465Biw7nvR+TPaP8fm8sTYTA2xkfZbfXW17SsP8u4UTB/DU/WcPr/sdi0ypqPHgPQ8EduH9FhJHXOSC5DFMGqvp7rHgNRxM3k8Wt4FsvuXt+ZLH8dSLv07STvzYlY/GzJK9IlD1xrrYoZDh3h5Fz6/HLDOWk0fw3PyaN+NuKTXIZs2a8bfxOCoEzrFnlzo9Yn+uUWzjeW1qO7dkNMCpdTcet61vj7YLF9Xa3bBUfoY4a8ETiEwMThaPDb2dHNS3Vpk9RL85UHn2pPV1e3U3xInYG/dvRdefO9G+PTN9WKouZ30wZXw9ovvLe5A+ur28bbF/xGuh9aJfl9lMDU/xxXqqdtsPn89PL8O37oH1tRJ7fqgvnycKiQe8+tBjLTD+NXg+P6lT+yGTlhX+/7yerLv7Huinoszj1VIdvtJuLYIiJ7evx2eXNvcfTJgtumDW4pYXVqLlU5/SW2z236dPr8tLyNc2Csv1ic2G43tQ2vR1B5//YAjezz0FnEHuvQXjPF+NtJ+Tb9489NwY0qfXw6V2F0OY8FRZK6b0rYTZuhTB0dD28srIzE2E/P1aldj/T01VsYDrenzS2qspPpE6gQjMR5Gj3GxjpBySfXPY+ee4XYaPwbETspTdwCu+1Pz1XYgP2Fs9C8ipeo5abzvHR+GXFLz0vpkcWhNNLoOSY2V2Fw+Aa01X2/Hz+Bxc+Skuj3frR8VXj5FlOzzqbVNvLzthcFfb07k23eXjs8T0VEWOwYcvNaoa36Zus765ebCSfQiw9i6JnONsvdKgKnBUTuMHqtTq3d01ker48H15/uP0ab625zW+sP1zJ7L99Z1kbXwkce4i+qDgqMJxwgfJXCgwMTgKLJA3DsZbU2sqb8lTjZu3rsbPn13ERA0Rb4bwtvNSeOjq+HeNjhaXwkbWIzu3aGw95mpE//qdtbdXQ+5dzFtWiVzQbo9kI4ER+sT4uZurf5dF9F6Jtsh56Cb85mBXpgTVPTvqOosKHbl/nrzXp+PvrW+QtRaWH61fYVsXY/+s+tDden/t727u9rXWxfb3W6z75HRxutqxfvneLsP3YnXvTq4v+/twGA4PBio+6lcUoFTu7t0rnAOtN/i79ux3z6BSU58E8Z5p545JynTx0NqDskLdfZ3NrbN44Kj3olrZDzuvwUs82S4FzBtrmLn3UGWe6K7nCQH3leWbrfo2BwbDwmjeLun5pCx4Kh9dT1/7lnpTf18enWR237Lz7Uu8qTGQ/Yc2alaom3H5peYS/J76XkivQ6J1DWrnsPtEStve0fC0HFzkQKNr5ea/XwzfLpI7bdjfsp6ovfZsXq+G94Mb78SwoMb74UXW+Xm9rOuzkifOGStsXn/Tm3zS+Y6q2njtPXIsW/QZbXNzR1l8XVI/h1HyYutIydE7TunPnn4MDy/6G+dO44i+xCfPy9+rb+asio7xp25DwqODkwCfI3ABIHZBkd3790M723uMPr0zeVJ44Mrt9cHntWBa3mrfv+9Hb13e0yfWKefEJY5mNwLV5uCHzWP7mW0+JSF3uDmDnGJLawTJ0WJeo4GR8mXWkfqMumEsJN0dO/2GrzdecAs2T/HgqPMfei3X/tuncHQ5YDgKGo95YS3VdHEQu3mvQ+2L8jffSPnRZjzCo5So/TQ4Ci2zWMfVdu+K2I0+E+Mie2feu3Qv3q5/tz0E8PUiXvm3NOufmpsTponcufKlMuEcZQ798TaIxaaZBxWOq2/flQqGgA2hnt3+QwUMmWO7Hx9SkgwtHMZ82Dna4n+N7oOSQRHWT/O0Kt/orxkcBS670JLvyIgNV+39yfRdzPG2P1mZfMoLP7n4n9cW/0gQvtdydPmiSl9YvfZ5FpjdcvV6nHmvbtyEuVl7Pv2RzkmnGDHh+lh66z2cnLYOjW/jYyJzV3D0XVIfnA0vC7Yv5g6Oo3tHePGLhxNWFcMza2pi2kD66Dm6Yvhtb4+2H+nleBotLf7AIGjBU4THA28bG77ItbU37aT6v7B4ubdm+Gj9xZ3GjXvrPnss/DZCy8s/vfmdtLuAb7z0tdOef1byTdeUyf+HOep2xw7MWi/CHz3WNdyybJ9b03zqFrmgTbZDiun3YvIMxfV649FHyWJPDu+d8W7fbBM1LN5VG35y2yDV04bz4RFrC6d8ppttK1T2+y23/4z/A1OLDhqXgTZXL0dedShv4hIeqb6wfqK8YNmHd486tn/yZKxeh7u0j0RSfWzdPttH2MIU37NKre8/v6NLRwjbZszTUQ+c+rgqP8oybJ/HvJy7MHgKNbXYm2YM1ZWMEPva5g+vyw3NPjeis27dgbnutSxIzVPjB7jYh0j5dK2HBp/uzuOsueebTWGjlXjx4BVO4Tkrx4Ntd/2qJv7cuzkMTxVz9zxntceq0+l5qWx4Cg2z6e2O3Ic2xz/++2QMBsPjhL13F506F2dSvb5seAoUt5yzF4JTz9+FN756MXF/724DSR8vPfumfQ80e+fiT5x8FqjzvmlcyyeMGftj+lEH43Ou8tWW925llyHDB9bxuee4fV33vd6ZSb3YezYP1SPM631KzzGnbsPCo6OWIT6KoFMgdMER9vFzOYFtt27AcYe8+r8ff1Y2fJRtfat0Z0d6k7Eq6siuzJ3t6EuXrT6cPEy7yubn1dfL8Db2+qEUd0XQeb9fPCh20wdTNq3j/f2YXkre9i9DHv5/+9elp1q93Q7dPdj9xLM1P7tTvaGXtAdPxnO3fdm+72XfEaDo2aN331crf0iz9SJ+a6/LMq6H8L19hXf6DZ7Lp3H4tJm6f4Zf0woGS4k9n2z0N4/6cut51SXsUedduMs/rLV7sv3t/u+CI5Wj6zl/l5vrF8nxljyHQ/j4yFz7u3OaP0fCjjBT5d3xnv29tJjc9eX1nN97zHgobl8dfLdmluTY2X/TrJYcDQ2pvsv2t2Bx/tEfGzuHt9Yzkm9eWLsGDfcJ1Iuqf45xXNRcvYxLu6SP4e02y+9vdQ4SbVDvz915pBeX8ubX0bGdHRuTQfM6X3oPSLWHkcHzeXt/tldM4w9qhav5/rCRvt3CVpjN97n03PI2Pps9d7HsPoRhc77o9rrs9g8MRRs5hwDpq010kH/nOaX+LE43X451vvHgLELIMNBzvgxNS8A2n859vD32v16/8cY0uvW2DnC2HlATjtMW+vrg63Xh3g59iHLTt8hcJDAhODooO0f/KXhq6gHb84XL1pg9KrNBVZoTnU5dLefhX04dN99r3KB4avBR+1UajxUM1bO4HIUqi8TIDAqUM38Mronp/3As+BSyz7UUs/T9rDRrbnjaJTIBwgcLTDb4KjZs/YL7GI/r360gA0QIECAwBkFBCTDuFzO2OlsmgABAgQukYDg6BI1tl0tJjDr4KiYioIJECBAgAABAgQIECBAYPYCTXAU+/fhhx/Ovv4qSKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAgQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBARHBdAVSYAAAQIECBAgQIAAAQIECBCoQUBwVEMrqSMBAgQIECBAgAABAgQIECBAoICA4KgAuiIJECBAgAABAgQIECBAgAABAjUICI5qaCV1JECAAAECBAgQIECAAAECBAgUEBAcFUBXJAECBAgQIECAAAECBAgQIECgBgHBUQ2tpI4ECBAgQIAAAQIECBAgQIAAgQICgqMC6IokQIAAAQIECBAgQIAAAQIECNQgIDiqoZXUkQABAgQIECBAgAABAgQIECBQQEBwVABdkQQIECBAgAABAgQIECBAgACBGgQERzW0kjoSIECAAAECBAgQIECAAAECBAoICI4KoCuSAAECBAgQIECAAAECBAgQIFCDgOCohlZSRwIECBAgQIAAAQIECBAgQIBAAQHBUQF0RRIgQIAAAQIECBAgQIAAAQIEahAQHNXQSupIgAABAgQIECBAgAABAgQIECggIDgqgK5IAgQIECBAgAABAgQIECBAgEANAoKjGlpJHQkQIECAAAECBAgQIECAAAECBQQERwXQFUmAAAECBAgQIECAAAECBAgQqEFAcFRDK6kjAQIECBAgQIAAAQIECBAgQKCAgOCoALoiCRAgQIAAAQIECBAgQIAAAQI1CAiOamgldSRAgAABAgQIECBAgAABAgQIFBAQHBVAVyQBAgQIECBAgAABAgQIECBAoAYBwVENraSOBAgQIECAAAECBAgQIECAAIECAoKjAuiKJECAAAECBAgQIECAAAECBAjUICA4qqGV1JEAAQIECBAgQIAAAQIECBAgUEBAcFQAXZEECBAgQIAAAQIECBAgQIAAgRoEBEc1tJI6EiBAgAABAgQIECBAgAABAgQKCAiOCqArkgABAgQIECBAgAABAgQIECBQg4DgqIZWUkcCBAgQIECAAAECBAgQIECAQAEBwVEBdEUSIECAAAECBAgQIECAAAECBGoQEBzV0ErqSIAAAQIECBAgQIAAAQIECBAoICA4KoCuSAIECBAgQIAAAQIECBAgQIBADQKCoxpaSR0JECBAgAABAgQIECBAgAABAgUEBEcF0BVJgAABAgQIECBAgAABAgQIEKhBQHBUQyupIwECBAgQIECAAAECBAgQIECggIDgqAC6IgkQIECAAAECBAgQIECAAAECNQgIjmpoJXUkQIAAAQIECBAgQIAAAQIECBQQEBwVQFckAQIECBAgQIAAAQIECBAgQKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAgQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBARHBdAVSYAAAQIECBAgQIAAAQIECBCoQUBwVEMrqSMBAgQIECBAgAABAgQIECBAoICA4KgAuiIJECBAgAABAgQIECBAgAABAjUICI5qaCV1JECAAAECBAgQIECAAAECBAgUEBAcFUBXJAECBAgQIECAAAECBAgQIECgBgHBUQ2tpI4ECBAgQIAAAQIECBAgQIAAgQICgqMC6IokQIAAAQIECBAgQIAAAQIECNQgIDiqoZXUkQABAgQIECBAgAABAgQIECBQQEBwVABdkQQIECBAgAABAgQIECBAgACBGgQERzW0kjoSIECAAAECBAgQIECAAAECBAoICI4KoCuSAAECBAgQIECAAAECBAgQIFCDgOCohlZSRwIECBAgQIAAAQIECBAgQIBAAQHBUQF0RRIgQIAAAQIECBAgQIAAAQIEahAQHNXQSupIgAABAgQIECBAgAABAgQIECggIDgqgK5IAgQIECBAgAABAgQIECBAgEANAoKjGlpJHQkQIECAAAECBAgQIECAAAECBQQERwXQFUmAAAECBAgQIECAAAECBAgQqEFAcFRDK6kjAQIECBAgQIAAAQIECBAgQKCAgOCoALoiCRAgQIAAAQIECBAgQIAAAQI1CAiOamgldSRAgAABAgQIECBAgAABAgQIFBAQHBVAVyQBAgQIECBAgAABAgQIECBAoAYBwVENraSOBAgQIECAAAECBAgQIECAAIECAoKjAuiKJECAAAECBAgQIECAAAECBAjUICA4qqGV1JEAAQIECBAgQIAAAQIECBAgUEBAcFQAXZEECBAgQIAAAQIECBAgQIAAgRoEBEc1tJI6EiBAgAABAgQIECBAgAABAgQKCAiOCqArkgABAgQIECBAgAABAgQIECBQg4DgqIZWUkcCBAgQIECAAAECBAgQIECAQAEBwVEBdEUSIECAAAECBAgQIECAAAECBGoQEBzV0ErqSIAAAQIECBAgQIAAAQIECBAoICA4KoCuSAIECBAgQIAAAQIECBAgQIBADQKCoxpaSR0JECBAgAABAgQIECBAgAABAgUEBEcF0BVJgAABAgQIECBAgAABAgQIEKhBQHBUQyupIwECBAgQIECAAAECBAgQIECggIDgqAC6IgkQIECAAAECBAgQIECAAAECNQgIjmpoJXUkQIAAAQIECBAgQIAAAQIECBQQEBwVQFckAQIECBAgQIAAAQIECBAgQKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAi/1Ew4AAABdSURBVAQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBP4ftTNCjYAUPqAAAAAASUVORK5CYII="},48338:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image21-3749f63b9af49921d7d969c8ce65de5e.png"},64170:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image3-986d5308b0c11e779bddb07c50e838f3.png"},48837:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image4-0a491ff6ce4726e65d7d8a47d9e276c5.png"},35772:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image5-e0fe3ad4d1c07e0650d288e996910446.png"},20055:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image6-e186bec7ca1a0004681a31020c922531.png"},77038:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image7-167d970e81932cb727a06c6d365b70aa.png"},66425:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image8-0074a10f3660d9e1853f6bf6c6c10914.png"},69520:(A,e,g)=>{g.d(e,{A:()=>t});const t=g.p+"assets/images/image9-efadd6865de74c3c8cec1b9a54390930.png"},28453:(A,e,g)=>{g.d(e,{R:()=>E,x:()=>Q});var t=g(96540);const B={},C=t.createContext(B);function E(A){const e=t.useContext(C);return t.useMemo((function(){return"function"==typeof A?A(e):{...e,...A}}),[e,A])}function Q(A){let e;return e=A.disableParentContext?"function"==typeof A.components?A.components(B):A.components||B:E(A.components),t.createElement(C.Provider,{value:e},A.children)}}}]); \ No newline at end of file diff --git a/assets/js/c6367126.6ffccbfb.js b/assets/js/c6367126.f3a10fe3.js similarity index 99% rename from assets/js/c6367126.6ffccbfb.js rename to assets/js/c6367126.f3a10fe3.js index 4657b53df..51214d039 100644 --- a/assets/js/c6367126.6ffccbfb.js +++ b/assets/js/c6367126.f3a10fe3.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1455],{4554:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>d});var t=i(74848),s=i(28453);const r={title:"Microsoft 365 and Entra ID",hide_title:!0,sidebar_position:10},a="How to Import Microsoft 365 and Entra ID Logs",o={id:"cado/discovery-import/m365-logs",title:"Microsoft 365 and Entra ID",description:"Introduction",source:"@site/docs/cado/discovery-import/m365-logs.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/m365-logs",permalink:"/cado/discovery-import/m365-logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/m365-logs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:10,frontMatter:{title:"Microsoft 365 and Entra ID",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Google Workspace logs",permalink:"/cado/discovery-import/google-workspace-logs"},next:{title:"Third party disk images & triage",permalink:"/cado/discovery-import/third-party"}},c={},d=[{value:"Introduction",id:"introduction",level:2},{value:"Service Principal Setup",id:"service-principal-setup",level:2},{value:"Register an Application with Microsoft Entra ID and Create a Service Principal",id:"register-an-application-with-microsoft-entra-id-and-create-a-service-principal",level:3},{value:"Entra ID Roles and Administrators",id:"entra-id-roles-and-administrators",level:3},{value:"Assign a Role to the Application",id:"assign-a-role-to-the-application",level:3},{value:"Sign In to the Application",id:"sign-in-to-the-application",level:3},{value:"Set Up Authentication",id:"set-up-authentication",level:3},{value:"Grant Tenant-Wide Admin Consent to an Application",id:"grant-tenant-wide-admin-consent-to-an-application",level:3},{value:"Log Acquisition",id:"log-acquisition",level:2},{value:"Log Field Mapping",id:"log-field-mapping",level:2},{value:"Microsoft 365 Unified Audit Log (UAL)",id:"microsoft-365-unified-audit-log-ual",level:3},{value:"Entra ID Audit Logs",id:"entra-id-audit-logs",level:3},{value:"Entra ID Sign-in Logs",id:"entra-id-sign-in-logs",level:3}];function l(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-import-microsoft-365-and-entra-id-logs",children:"How to Import Microsoft 365 and Entra ID Logs"}),"\n",(0,t.jsx)(n.h2,{id:"introduction",children:"Introduction"}),"\n",(0,t.jsx)(n.p,{children:"The Cado platform supports acquiring and processing the following logs from Microsoft 365 and Entra ID:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Microsoft 365 Unified Audit Log (UAL)"}),"\n",(0,t.jsx)(n.li,{children:"Entra ID Audit logs"}),"\n",(0,t.jsx)(n.li,{children:"Entra ID Sign-in logs"}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["Note: This feature is currently in Beta, so you need to enable the 'SaaS Imports' feature in the ",(0,t.jsx)(n.strong,{children:"/settings/experiments"})," page."]}),"\n",(0,t.jsxs)(n.p,{children:["Before acquiring these logs, a Microsoft Entra application and service principal must be set up and configured in the Azure portal. You can refer to the ",(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal",children:"Microsoft documentation"})," for more details."]}),"\n",(0,t.jsx)(n.h2,{id:"service-principal-setup",children:"Service Principal Setup"}),"\n",(0,t.jsx)(n.p,{children:"To support the acquisition of Microsoft 365 and Entra ID logs, follow these steps to set up a service principal:"}),"\n",(0,t.jsx)(n.h3,{id:"register-an-application-with-microsoft-entra-id-and-create-a-service-principal",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#register-an-application-with-microsoft-entra-id-and-create-a-service-principal",children:"Register an Application with Microsoft Entra ID and Create a Service Principal"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"While setting up the service principal, using a redirect URL is optional."}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"entra-id-roles-and-administrators",children:"Entra ID Roles and Administrators"}),"\n",(0,t.jsx)(n.p,{children:"To pull logs from Exchange, follow these steps:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Open Entra ID."}),"\n",(0,t.jsxs)(n.li,{children:["Click on ",(0,t.jsx)(n.strong,{children:"Roles and Administrators"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Roles and administrators",src:i(27921).A+"",width:"257",height:"427"})}),"\n",(0,t.jsxs)(n.ol,{start:"3",children:["\n",(0,t.jsxs)(n.li,{children:["Search for ",(0,t.jsx)(n.strong,{children:"Exchange Admin"}),' and select the "Exchange administrator" role.']}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Roles and administrators - Exchange Admin",src:i(17855).A+"",width:"1213",height:"539"})}),"\n",(0,t.jsxs)(n.ol,{start:"4",children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Add Assignments"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Type the name of the app registration assigned to the Exchange connector and add it."}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Roles and administrators - Exchange Admin - Assignments",src:i(20874).A+"",width:"753",height:"321"})}),"\n",(0,t.jsxs)(n.ol,{start:"6",children:["\n",(0,t.jsx)(n.li,{children:"Save the changes and try the connector again after a few minutes."}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"assign-a-role-to-the-application",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#assign-a-role-to-the-application",children:"Assign a Role to the Application"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Assign the application to one of your subscriptions."}),"\n",(0,t.jsxs)(n.li,{children:["Apply the ",(0,t.jsx)(n.strong,{children:"Security Reader"})," role to the application."]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"sign-in-to-the-application",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#sign-in-to-the-application",children:"Sign In to the Application"})}),"\n",(0,t.jsx)(n.h3,{id:"set-up-authentication",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#option-3-create-a-new-client-secret",children:"Set Up Authentication"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Use ",(0,t.jsx)(n.strong,{children:"Option 3: Create a new client secret"}),"."]}),"\n",(0,t.jsx)(n.li,{children:'Avoid using "Key Vault" and securely store your secret keys elsewhere.'}),"\n",(0,t.jsx)(n.li,{children:"If any changes are made to the service principal, new secret keys must be generated and used."}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"grant-tenant-wide-admin-consent-to-an-application",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal",children:"Grant Tenant-Wide Admin Consent to an Application"})}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Go to the ",(0,t.jsx)(n.a,{href:"https://entra.microsoft.com/#home",children:"Microsoft Entra admin center"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Under ",(0,t.jsx)(n.strong,{children:"Applications > App Registrations"}),", find and select your newly created application."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"API Permissions"})," and select ",(0,t.jsx)(n.strong,{children:"Add a Permission"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["For Microsoft APIs, select ",(0,t.jsx)(n.strong,{children:"Microsoft Graph"})," and add the permission ",(0,t.jsx)(n.code,{children:"AuditLog.Read.All"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Request API Permissions - MS Graph",src:i(78100).A+"",width:"844",height:"475"})}),"\n",(0,t.jsxs)(n.ol,{start:"5",children:["\n",(0,t.jsxs)(n.li,{children:["For Office 365 logs, add the ",(0,t.jsx)(n.code,{children:"ActivityFeed.Read"})," permission from ",(0,t.jsx)(n.strong,{children:"Office 365 Management APIs"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Request API Permissions - Office 365",src:i(559).A+"",width:"841",height:"524"})}),"\n",(0,t.jsxs)(n.ol,{start:"6",children:["\n",(0,t.jsxs)(n.li,{children:["For Office 365 Exchange Online, add the ",(0,t.jsx)(n.code,{children:"full_access_as_app"})," and ",(0,t.jsx)(n.code,{children:"Exchange.ManageAsApp"})," permissions."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Request API Permissions - Office 365 Exchange Online",src:i(15462).A+"",width:"466",height:"370"})}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Request API Permissions - Office 365 Exchange Online",src:i(20441).A+"",width:"841",height:"669"})}),"\n",(0,t.jsxs)(n.ol,{start:"7",children:["\n",(0,t.jsxs)(n.li,{children:["Once the permissions are added, grant admin consent under ",(0,t.jsx)(n.strong,{children:"Entra Admin Center > Enterprise Applications"}),". Refer to ",(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal#grant-tenant-wide-admin-consent-in-enterprise-apps-pane",children:"Grant Tenant-wide Admin Consent"})," for further instructions."]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"log-acquisition",children:"Log Acquisition"}),"\n",(0,t.jsx)(n.p,{children:"Once the Microsoft Entra application and service principal are set up in the Azure portal, you can add the credentials to the Cado platform:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Navigate to ",(0,t.jsx)(n.strong,{children:"Settings > Accounts"})]}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"Create an account"}),", then ",(0,t.jsx)(n.strong,{children:"Microsoft SaaS"})," from the set of providers and enter the following details:","\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Name"}),': A friendly name, such as "MS SaaS."']}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Tenant ID"}),": Found in the ",(0,t.jsx)(n.strong,{children:"Directory (tenant) ID"})," field in Azure app registration."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Client ID"}),": Found in the ",(0,t.jsx)(n.strong,{children:"Application (client) ID"})," field in Azure app registration."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Client Secret"}),": Found in the ",(0,t.jsx)(n.strong,{children:"Client credentials"})," field in Azure app registration."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Organization"}),": Organization value ending in ",(0,t.jsx)(n.strong,{children:".onmicrosoft.com"}),"."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'. Navigate to the 'Accounts' table and the newly created Microsoft SaaS account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,t.jsx)(n.p,{children:"Once the credentials are set, you can acquire Microsoft SaaS logs."}),"\n",(0,t.jsxs)(n.p,{children:["To import logs, use the import wizard within an investigation and select ",(0,t.jsx)(n.strong,{children:"SaaS"}),". You will see options for:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Microsoft 365 Logs"}),"\n",(0,t.jsx)(n.li,{children:"Microsoft Entra ID"}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"MS SaaS - Import",src:i(18824).A+"",width:"1564",height:"1122"})}),"\n",(0,t.jsx)(n.p,{children:"After selecting a SaaS application, choose the credentials entered on the integrations page."}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"MS SaaS - Import - Select Creds",src:i(96031).A+"",width:"5092",height:"1116"})}),"\n",(0,t.jsx)(n.p,{children:"You will be presented with options to refine the acquisition based on the SaaS application. For example, for Microsoft 365 UAL acquisition, you can filter by timeframe, user, IP, or workload."}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"MS SaaS - Import - Config",src:i(69781).A+"",width:"3130",height:"1498"})}),"\n",(0,t.jsx)(n.p,{children:"After reviewing your selections, proceed with the import. Once completed, the logs will be available in the main timeline for viewing and searching."}),"\n",(0,t.jsx)(n.h2,{id:"log-field-mapping",children:"Log Field Mapping"}),"\n",(0,t.jsx)(n.h3,{id:"microsoft-365-unified-audit-log-ual",children:"Microsoft 365 Unified Audit Log (UAL)"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"UAL Field"}),(0,t.jsx)(n.th,{children:"Cado Field"}),(0,t.jsx)(n.th,{children:"Cado Facet Name"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"ClientIP"}),(0,t.jsx)(n.td,{children:"source_hostname"}),(0,t.jsx)(n.td,{children:"Source Hostname"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"UserID"}),(0,t.jsx)(n.td,{children:"user"}),(0,t.jsx)(n.td,{children:"Users"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Workload"}),(0,t.jsx)(n.td,{children:"sourcetype"}),(0,t.jsx)(n.td,{children:"Datatype"})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"entra-id-audit-logs",children:"Entra ID Audit Logs"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Audit Log Field"}),(0,t.jsx)(n.th,{children:"Cado Field"}),(0,t.jsx)(n.th,{children:"Cado Facet Name"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"InitiatedBy.User.IPAddress"}),(0,t.jsx)(n.td,{children:"source_hostname"}),(0,t.jsx)(n.td,{children:"Source Hostname"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"InitiatedBy.User.UserPrincipalName"}),(0,t.jsx)(n.td,{children:"user"}),(0,t.jsx)(n.td,{children:"Users"})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"entra-id-sign-in-logs",children:"Entra ID Sign-in Logs"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Sign-in Log Field"}),(0,t.jsx)(n.th,{children:"Cado Field"}),(0,t.jsx)(n.th,{children:"Cado Facet Name"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"IPAddress"}),(0,t.jsx)(n.td,{children:"source_hostname"}),(0,t.jsx)(n.td,{children:"Source Hostname"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"UserPrincipalName"}),(0,t.jsx)(n.td,{children:"user"}),(0,t.jsx)(n.td,{children:"Users"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"ResourceDisplayName"}),(0,t.jsx)(n.td,{children:"sourcetype"}),(0,t.jsx)(n.td,{children:"Datatype"})]})]})]}),"\n",(0,t.jsxs)(n.p,{children:['For example, you can filter data by the "AzureActiveDirectory" workload by selecting it in the ',(0,t.jsx)(n.strong,{children:"Datatype"})," facet."]})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},78100:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-API-Permissions1-b690ff91c116bb18d10b9cc8e1f2cc7e.png"},559:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-API-Permissions2-4ab86de8aa085cc452da2833c5a7e88a.png"},15462:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-API-Permissions3-62e396a22969073af8924d841c1f9ef3.png"},20441:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-API-Permissions4-21da59f7d85044f656658cf7f19b6d78.png"},20874:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-Roles-Exchange-Assignments-68efa616372baab716ec77428aac0f8a.png"},17855:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-Roles-Exchange-5ceeb6a4ef96c8c10d5d84c44ee1b6b4.png"},27921:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-Roles-d5b08a7de5b8e3667b75fdf9172218ae.png"},69781:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Microsoft-SaaS-Import-Config-a2c3825125a6cdee8f03ee081435349a.png"},96031:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Microsoft-SaaS-Import-Select-Creds-5a80f8c9c3482216d129f61a0d1df90f.png"},18824:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Microsoft-SaaS-Import-8af8aab5ffd9884f43d468ca1966af5e.png"},28453:(e,n,i)=>{i.d(n,{R:()=>a,x:()=>o});var t=i(96540);const s={},r=t.createContext(s);function a(e){const n=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),t.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1455],{4554:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>d});var t=i(74848),s=i(28453);const r={title:"Microsoft 365 and Entra ID",hide_title:!0,sidebar_position:10},a="How to Import Microsoft 365 and Entra ID Logs",o={id:"cado/discovery-import/m365-logs",title:"Microsoft 365 and Entra ID",description:"Introduction",source:"@site/docs/cado/discovery-import/m365-logs.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/m365-logs",permalink:"/cado/discovery-import/m365-logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/m365-logs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:10,frontMatter:{title:"Microsoft 365 and Entra ID",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Google Workspace logs",permalink:"/cado/discovery-import/google-workspace-logs"},next:{title:"Third party disk images & triage",permalink:"/cado/discovery-import/third-party"}},c={},d=[{value:"Introduction",id:"introduction",level:2},{value:"Service Principal Setup",id:"service-principal-setup",level:2},{value:"Register an Application with Microsoft Entra ID and Create a Service Principal",id:"register-an-application-with-microsoft-entra-id-and-create-a-service-principal",level:3},{value:"Entra ID Roles and Administrators",id:"entra-id-roles-and-administrators",level:3},{value:"Assign a Role to the Application",id:"assign-a-role-to-the-application",level:3},{value:"Sign In to the Application",id:"sign-in-to-the-application",level:3},{value:"Set Up Authentication",id:"set-up-authentication",level:3},{value:"Grant Tenant-Wide Admin Consent to an Application",id:"grant-tenant-wide-admin-consent-to-an-application",level:3},{value:"Log Acquisition",id:"log-acquisition",level:2},{value:"Log Field Mapping",id:"log-field-mapping",level:2},{value:"Microsoft 365 Unified Audit Log (UAL)",id:"microsoft-365-unified-audit-log-ual",level:3},{value:"Entra ID Audit Logs",id:"entra-id-audit-logs",level:3},{value:"Entra ID Sign-in Logs",id:"entra-id-sign-in-logs",level:3}];function l(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-import-microsoft-365-and-entra-id-logs",children:"How to Import Microsoft 365 and Entra ID Logs"}),"\n",(0,t.jsx)(n.h2,{id:"introduction",children:"Introduction"}),"\n",(0,t.jsx)(n.p,{children:"The Cado platform supports acquiring and processing the following logs from Microsoft 365 and Entra ID:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Microsoft 365 Unified Audit Log (UAL)"}),"\n",(0,t.jsx)(n.li,{children:"Entra ID Audit logs"}),"\n",(0,t.jsx)(n.li,{children:"Entra ID Sign-in logs"}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["Note: This feature is currently in Beta, so you need to enable the 'SaaS Imports' feature in the ",(0,t.jsx)(n.strong,{children:"/settings/experiments"})," page."]}),"\n",(0,t.jsxs)(n.p,{children:["Before acquiring these logs, a Microsoft Entra application and service principal must be set up and configured in the Azure portal. You can refer to the ",(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal",children:"Microsoft documentation"})," for more details."]}),"\n",(0,t.jsx)(n.h2,{id:"service-principal-setup",children:"Service Principal Setup"}),"\n",(0,t.jsx)(n.p,{children:"To support the acquisition of Microsoft 365 and Entra ID logs, follow these steps to set up a service principal:"}),"\n",(0,t.jsx)(n.h3,{id:"register-an-application-with-microsoft-entra-id-and-create-a-service-principal",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#register-an-application-with-microsoft-entra-id-and-create-a-service-principal",children:"Register an Application with Microsoft Entra ID and Create a Service Principal"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"While setting up the service principal, using a redirect URL is optional."}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"entra-id-roles-and-administrators",children:"Entra ID Roles and Administrators"}),"\n",(0,t.jsx)(n.p,{children:"To pull logs from Exchange, follow these steps:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Open Entra ID."}),"\n",(0,t.jsxs)(n.li,{children:["Click on ",(0,t.jsx)(n.strong,{children:"Roles and Administrators"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Roles and administrators",src:i(27921).A+"",width:"257",height:"427"})}),"\n",(0,t.jsxs)(n.ol,{start:"3",children:["\n",(0,t.jsxs)(n.li,{children:["Search for ",(0,t.jsx)(n.strong,{children:"Exchange Admin"}),' and select the "Exchange administrator" role.']}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Roles and administrators - Exchange Admin",src:i(17855).A+"",width:"1213",height:"539"})}),"\n",(0,t.jsxs)(n.ol,{start:"4",children:["\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Add Assignments"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Type the name of the app registration assigned to the Exchange connector and add it."}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Roles and administrators - Exchange Admin - Assignments",src:i(20874).A+"",width:"753",height:"321"})}),"\n",(0,t.jsxs)(n.ol,{start:"6",children:["\n",(0,t.jsx)(n.li,{children:"Save the changes and try the connector again after a few minutes."}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"assign-a-role-to-the-application",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#assign-a-role-to-the-application",children:"Assign a Role to the Application"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Assign the application to one of your subscriptions."}),"\n",(0,t.jsxs)(n.li,{children:["Apply the ",(0,t.jsx)(n.strong,{children:"Security Reader"})," role to the application."]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"sign-in-to-the-application",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#sign-in-to-the-application",children:"Sign In to the Application"})}),"\n",(0,t.jsx)(n.h3,{id:"set-up-authentication",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#option-3-create-a-new-client-secret",children:"Set Up Authentication"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Use ",(0,t.jsx)(n.strong,{children:"Option 3: Create a new client secret"}),"."]}),"\n",(0,t.jsx)(n.li,{children:'Avoid using "Key Vault" and securely store your secret keys elsewhere.'}),"\n",(0,t.jsx)(n.li,{children:"If any changes are made to the service principal, new secret keys must be generated and used."}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"grant-tenant-wide-admin-consent-to-an-application",children:(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal",children:"Grant Tenant-Wide Admin Consent to an Application"})}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Go to the ",(0,t.jsx)(n.a,{href:"https://entra.microsoft.com/#home",children:"Microsoft Entra admin center"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Under ",(0,t.jsx)(n.strong,{children:"Applications > App Registrations"}),", find and select your newly created application."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"API Permissions"})," and select ",(0,t.jsx)(n.strong,{children:"Add a Permission"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["For Microsoft APIs, select ",(0,t.jsx)(n.strong,{children:"Microsoft Graph"})," and add the permission ",(0,t.jsx)(n.code,{children:"AuditLog.Read.All"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Request API Permissions - MS Graph",src:i(78100).A+"",width:"844",height:"475"})}),"\n",(0,t.jsxs)(n.ol,{start:"5",children:["\n",(0,t.jsxs)(n.li,{children:["For Office 365 logs, add the ",(0,t.jsx)(n.code,{children:"ActivityFeed.Read"})," permission from ",(0,t.jsx)(n.strong,{children:"Office 365 Management APIs"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Request API Permissions - Office 365",src:i(559).A+"",width:"841",height:"524"})}),"\n",(0,t.jsxs)(n.ol,{start:"6",children:["\n",(0,t.jsxs)(n.li,{children:["For Office 365 Exchange Online, add the ",(0,t.jsx)(n.code,{children:"full_access_as_app"})," and ",(0,t.jsx)(n.code,{children:"Exchange.ManageAsApp"})," permissions."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Request API Permissions - Office 365 Exchange Online",src:i(15462).A+"",width:"466",height:"370"})}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Request API Permissions - Office 365 Exchange Online",src:i(20441).A+"",width:"841",height:"669"})}),"\n",(0,t.jsxs)(n.ol,{start:"7",children:["\n",(0,t.jsxs)(n.li,{children:["Once the permissions are added, grant admin consent under ",(0,t.jsx)(n.strong,{children:"Entra Admin Center > Enterprise Applications"}),". Refer to ",(0,t.jsx)(n.a,{href:"https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal#grant-tenant-wide-admin-consent-in-enterprise-apps-pane",children:"Grant Tenant-wide Admin Consent"})," for further instructions."]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"log-acquisition",children:"Log Acquisition"}),"\n",(0,t.jsx)(n.p,{children:"Once the Microsoft Entra application and service principal are set up in the Azure portal, you can add the credentials to the Cado platform:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Navigate to ",(0,t.jsx)(n.strong,{children:"Settings > Accounts"})]}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"Create an account"}),", then ",(0,t.jsx)(n.strong,{children:"Microsoft SaaS"})," from the set of providers and enter the following details:","\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Name"}),': A friendly name, such as "MS SaaS."']}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Tenant ID"}),": Found in the ",(0,t.jsx)(n.strong,{children:"Directory (tenant) ID"})," field in Azure app registration."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Client ID"}),": Found in the ",(0,t.jsx)(n.strong,{children:"Application (client) ID"})," field in Azure app registration."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Client Secret"}),": Found in the ",(0,t.jsx)(n.strong,{children:"Client credentials"})," field in Azure app registration."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Organization"}),": Organization value ending in ",(0,t.jsx)(n.strong,{children:".onmicrosoft.com"}),"."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'. Navigate to the 'Accounts' table and the newly created Microsoft SaaS account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,t.jsx)(n.p,{children:"Once the credentials are set, you can acquire Microsoft SaaS logs."}),"\n",(0,t.jsxs)(n.p,{children:["To import logs, use the import wizard within an investigation and select ",(0,t.jsx)(n.strong,{children:"SaaS"}),". You will see options for:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Microsoft 365 Logs"}),"\n",(0,t.jsx)(n.li,{children:"Microsoft Entra ID"}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"MS SaaS - Import",src:i(18824).A+"",width:"1564",height:"1122"})}),"\n",(0,t.jsx)(n.p,{children:"After selecting a SaaS application, choose the credentials entered on the integrations page."}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"MS SaaS - Import - Select Creds",src:i(96031).A+"",width:"5092",height:"1116"})}),"\n",(0,t.jsx)(n.p,{children:"You will be presented with options to refine the acquisition based on the SaaS application. For example, for Microsoft 365 UAL acquisition, you can filter by timeframe, user, IP, or workload."}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"MS SaaS - Import - Config",src:i(69781).A+"",width:"3130",height:"1498"})}),"\n",(0,t.jsx)(n.p,{children:"After reviewing your selections, proceed with the import. Once completed, the logs will be available in the main timeline for viewing and searching."}),"\n",(0,t.jsx)(n.h2,{id:"log-field-mapping",children:"Log Field Mapping"}),"\n",(0,t.jsx)(n.h3,{id:"microsoft-365-unified-audit-log-ual",children:"Microsoft 365 Unified Audit Log (UAL)"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"UAL Field"}),(0,t.jsx)(n.th,{children:"Cado Field"}),(0,t.jsx)(n.th,{children:"Cado Facet Name"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"ClientIP"}),(0,t.jsx)(n.td,{children:"source_hostname"}),(0,t.jsx)(n.td,{children:"Source Hostname"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"UserID"}),(0,t.jsx)(n.td,{children:"user"}),(0,t.jsx)(n.td,{children:"Users"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Workload"}),(0,t.jsx)(n.td,{children:"sourcetype"}),(0,t.jsx)(n.td,{children:"Datatype"})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"entra-id-audit-logs",children:"Entra ID Audit Logs"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Audit Log Field"}),(0,t.jsx)(n.th,{children:"Cado Field"}),(0,t.jsx)(n.th,{children:"Cado Facet Name"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"InitiatedBy.User.IPAddress"}),(0,t.jsx)(n.td,{children:"source_hostname"}),(0,t.jsx)(n.td,{children:"Source Hostname"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"InitiatedBy.User.UserPrincipalName"}),(0,t.jsx)(n.td,{children:"user"}),(0,t.jsx)(n.td,{children:"Users"})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"entra-id-sign-in-logs",children:"Entra ID Sign-in Logs"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Sign-in Log Field"}),(0,t.jsx)(n.th,{children:"Cado Field"}),(0,t.jsx)(n.th,{children:"Cado Facet Name"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"IPAddress"}),(0,t.jsx)(n.td,{children:"source_hostname"}),(0,t.jsx)(n.td,{children:"Source Hostname"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"UserPrincipalName"}),(0,t.jsx)(n.td,{children:"user"}),(0,t.jsx)(n.td,{children:"Users"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"ResourceDisplayName"}),(0,t.jsx)(n.td,{children:"sourcetype"}),(0,t.jsx)(n.td,{children:"Datatype"})]})]})]}),"\n",(0,t.jsxs)(n.p,{children:['For example, you can filter data by the "AzureActiveDirectory" workload by selecting it in the ',(0,t.jsx)(n.strong,{children:"Datatype"})," facet."]})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},78100:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-API-Permissions1-b690ff91c116bb18d10b9cc8e1f2cc7e.png"},559:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-API-Permissions2-4ab86de8aa085cc452da2833c5a7e88a.png"},15462:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-API-Permissions3-62e396a22969073af8924d841c1f9ef3.png"},20441:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-API-Permissions4-21da59f7d85044f656658cf7f19b6d78.png"},20874:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-Roles-Exchange-Assignments-68efa616372baab716ec77428aac0f8a.png"},17855:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-Roles-Exchange-5ceeb6a4ef96c8c10d5d84c44ee1b6b4.png"},27921:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Entra-Roles-d5b08a7de5b8e3667b75fdf9172218ae.png"},69781:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Microsoft-SaaS-Import-Config-a2c3825125a6cdee8f03ee081435349a.png"},96031:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Microsoft-SaaS-Import-Select-Creds-5a80f8c9c3482216d129f61a0d1df90f.png"},18824:(e,n,i)=>{i.d(n,{A:()=>t});const t=i.p+"assets/images/Microsoft-SaaS-Import-8af8aab5ffd9884f43d468ca1966af5e.png"},28453:(e,n,i)=>{i.d(n,{R:()=>a,x:()=>o});var t=i(96540);const s={},r=t.createContext(s);function a(e){const n=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),t.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ca8eea13.87101ea7.js b/assets/js/ca8eea13.cefb5dbe.js similarity index 99% rename from assets/js/ca8eea13.87101ea7.js rename to assets/js/ca8eea13.cefb5dbe.js index 93fc25d95..f7a15c660 100644 --- a/assets/js/ca8eea13.87101ea7.js +++ b/assets/js/ca8eea13.cefb5dbe.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8180],{81863:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>o,metadata:()=>s,toc:()=>c});var r=n(74848),i=n(28453);const o={title:"Commercial EULA",hide_title:!0,sidebar_position:1},a="DOCUMENT A",s={id:"troubleshooting/eula/commercial-eula",title:"Commercial EULA",description:"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.",source:"@site/docs/troubleshooting/eula/commercial-eula.md",sourceDirName:"troubleshooting/eula",slug:"/troubleshooting/eula/commercial-eula",permalink:"/troubleshooting/eula/commercial-eula",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/eula/commercial-eula.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Commercial EULA",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Forward logs to SIEMs",permalink:"/troubleshooting/logs-cloudwatch"},next:{title:"Community Edition EULA",permalink:"/troubleshooting/eula/community-eula"}},l={},c=[{value:"End User License Agreement",id:"end-user-license-agreement",level:2}];function h(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",hr:"hr",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"document-a",children:"DOCUMENT A"}),"\n",(0,r.jsxs)(t.admonition,{type:"info",children:[(0,r.jsxs)(t.p,{children:["FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, ",(0,r.jsx)(t.a,{href:"/troubleshooting/eula/commercial-eula#end-user-license-agreement",children:(0,r.jsx)(t.strong,{children:"DOCUMENT A - END USER LICENSE AGREEMENT"})})," SHALL APPLY."]}),(0,r.jsxs)(t.p,{children:["FOR ALL COMMUNITY EDITION USERS OF CADO SOFTWARE, ",(0,r.jsx)(t.a,{href:"/troubleshooting/eula/community-eula#community-edition-license-agreement",children:(0,r.jsx)(t.strong,{children:"DOCUMENT B - COMMUNITY EDITION LICENSE AGREEMENT"})})," SHALL APPLY."]})]}),"\n",(0,r.jsx)(t.hr,{}),"\n",(0,r.jsx)(t.h2,{id:"end-user-license-agreement",children:"End User License Agreement"}),"\n",(0,r.jsx)(t.p,{children:'BEFORE USING THE CADO SECURITY SOFTWARE, YOU SHOULD CAREFULLY READ THE FOLLOWING USER AGREEMENT THAT APPLIES TO THE SOFTWARE UNLESS USER AND COMPANY HAVE NEGOTIATED AND ENTERED INTO A SEPARATE, VALID WRITTEN AND MUTUALLY EXECUTED AGREEMENT PERTAINING TO USER\u2019S USE OF THE SOFTWARE. BY PROCEEDING WITH ANY INSTALLATION AND/OR USE OF THE SOFTWARE, YOU FULLY ACCEPT AND AGREE TO ALL OF THE PROVISIONS OF THIS USER AGREEMENT, ESTABLISHING A BINDING AGREEMENT BETWEEN YOU AS THE PERSON USING THE SOFTWARE (THE "USER") AND CADO SECURITY LIMITED, A COMPANY INCORPORATED IN ENGLAND AND WALES (NUMBER 12552987) HAVING ITS REGISTERED OFFICE AT 3RD FLOOR, 1 ASHLEY ROAD, ALTRINCHAM, CHESHIRE, WA14 2DT ("COMPANY").'}),"\n",(0,r.jsx)(t.p,{children:'This End User License Agreement governs use of the Software (as defined below) provided by Cado Security Limited, , a company incorporated in England and Wales (Number 12552987) having its registered office at 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, or its subsidiaries or affiliates (collectively, the \u201cCompany\u201d). This Agreement sets out the terms on which Company makes the Software available to you ("You\u201d or \u201cCustomer\u201d) and your authorized Users (as defined below).'}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Proprietary Rights"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"The Cado Security software including any (a) software that the Company uses to make the Software available; and (b) any published documentation that Company generally makes available to its customers (\u201cDocumentation\u201d) (collectively, the \u201cSoftware\u201d), is subject to the protection of copyright laws, which prohibit unauthorized copying and distribution of copyrighted works. The Software incorporates Company\u2019s proprietary and confidential algorithms and techniques that are subject to legal protection as know-how and trade secrets. All right, title and interest to any intellectual property rights included but not limited to patents, copyright works, know how, trade secrets and trade marks in the Software are owned by the Company. The employees, consultants, or other persons authorized by Customer to use the Software (each a \u201cUser\u201d) are granted only those rights expressly conferred by clause 2 of this Agreement. Customer shall remain liable to Company at all times for any acts or omissions of its Users."}),"\n",(0,r.jsxs)(t.ol,{start:"2",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Grant of Rights; Reservation of Rights"})}),"\n"]}),"\n",(0,r.jsxs)(t.p,{children:["Subject to payment in full by the Customer of the applicable subscription fee as detailed in the applicable invoice (\u201cInvoice\u201d), Company grants the Customer and its authorized Users a limited, non-sublicensable, non-exclusive, non-transferable right during the applicable subscription term stated in the Invoice (\u201cSubscription Plan\u201d) and pursuant to the terms of this Agreement to access, install, download and use the Software in object code form only, exclusively within the Customer\u2019s cloud based environment, for internal business and non-commercial purposes only unless otherwise agreed in writing. The Customer must install the Software as prescribed in the Company\u2019s manual available at ",(0,r.jsx)(t.a,{href:"https://docs.cadosecurity.com",children:"https://docs.cadosecurity.com"}),", unless otherwise agreed by the Company in writing. The Customer is permitted to make one additional copy of the Software solely for back-up or archival purposes only. The Software shall be used or accessed strictly in accordance with, and subject to any restrictions under the User\u2019s Subscription Plan and the applicable Invoice. This Agreement can be updated from time to time in Company's sole discretion and such changes will be made available at ",(0,r.jsx)(t.a,{href:"http://www.cadosecurity.com",children:"www.cadosecurity.com"}),"."]}),"\n",(0,r.jsxs)(t.ol,{start:"3",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Restrictions"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"3.1\tThe Customer and its Users may not:"}),"\n",(0,r.jsx)(t.p,{children:"copy the Software or any part of it, except as expressly permitted in this Agreement;\nrent, sell, lease, sublicense, distribute, pledge, assign or otherwise transfer, or commercially exploit, or encumber rights to, the Software or any part of it in any manner or for any purpose, or make the Software available for use by any third party in any manner including provide commercial hosting services, time-sharing, service bureau or similar arrangement;\naccess the Software for the purpose of building a competitive product or service or copying its features or user interface;\nremove, delete, obscure, alter or add to any copyright or proprietary notices appearing within the Software;\nDisassemble, decrypt, extract, reverse engineer or reverse compile the Software, or otherwise attempt to discover the confidential algorithms and techniques incorporated in the Software, or disclose or use any confidential information of Company in any manner, other than to the extent such actions cannot be prohibited under applicable law; or\nmodify, translate, adapt, or create derivative works from the Software."}),"\n",(0,r.jsx)(t.p,{children:"3.2\tCustomer and its Users have no right under any circumstances to obtain or have access to the source code or systems and programming documentation of the Software or any part thereof."}),"\n",(0,r.jsxs)(t.ol,{start:"4",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Evaluation License"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"If Customer registers for an evaluation version of the Software (\u201cEvaluation Version\u201d), at no additional charge, Company will make the Evaluation Version available to Customer and its authorized Users on a trial basis, free of charge, until the earlier of (a) the end of the 14 day free trial period unless agreed otherwise in writing, or (b) the start date of any license subscription purchased by the Customer corresponding to such Evaluation Version. Notwithstanding anything to the contrary, (i) the Evaluation Version is provided \u201cas-is\u201d without any representation, warranty or indemnity, or any support service, and (ii) the Evaluation Version not intended to house or contain any sensitive or production data. Company shall not be liable or responsible under any circumstances for any sensitive or production data input into such environment by Customer or any resulting loss or damage thereto."}),"\n",(0,r.jsxs)(t.ol,{start:"5",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Support"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Customer will be solely responsible for installing any updates and modifications that the Company may make available from time to time. Company will only support the most recent version of the Software."}),"\n",(0,r.jsxs)(t.ol,{start:"6",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Audit"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"During the term of this Agreement and for a period of one year thereafter, Company may, during normal business hours and upon reasonable prior notice to User, inspect the User\u2019s records, equipment and facilities relating to its use of the Software to verify Customer and its User's compliance with this Agreement."}),"\n",(0,r.jsxs)(t.ol,{start:"7",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Data"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Company may collect, process, aggregate, and use certain information, analysis, statistics, and other data generated by Customer\u2019s use of the Software (a) to confirm that the Software is being used in accordance with the rights granted under this Agreement, and (b) to drive improvements in the Software, and Company will retain ownership of such Software use data. Company agrees not to publish any of this information in a form that identifies Customer or any User. In the event Company processes personal data as a processor, such personal data will be processed by Company in accordance with applicable data protection laws."}),"\n",(0,r.jsxs)(t.ol,{start:"8",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Term"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Unless specified in your Subscription Plan and/or Invoice, this Agreement is effective for one (1) year, unless earlier terminated in accordance with the terms of this Agreement and may be renewed for successive periods of one (1) year upon timely payment of the applicable subscription fee. This Agreement and the User\u2019s right to use the Software will automatically terminate without notice in the event of (a) any failure by the User to pay fees due under this Agreement; (b) any failure by the User to comply with any of the above restrictions or any term of this Agreement. Upon expiration or earlier termination of this Agreement, the User will cease using the Software and expunge and destroy all copies of the Software in the User\u2019s possession. All provisions of clauses 3, 6, 8, 9, 10, 12 and 14 of this Agreement will survive termination."}),"\n",(0,r.jsxs)(t.ol,{start:"9",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Warranty and Disclaimer"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Each party warrants to the other that it has the required authority to enter into this Agreement. The Company warrants the Software shall perform materially in accordance with published specifications in the Documentation upon installation. To the fullest extent permitted by law, Company disclaims all warranties, express or implied, including without limitation any implied warranties of merchantability, fitness for a particular purpose, or title or noninfringement of third parties\u2019 intellectual property rights. No oral or written information or advice given by the Company or any third party in relation to the Software shall create any additional warranty."}),"\n",(0,r.jsxs)(t.ol,{start:"10",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Limitation of Liability"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Subject to the remainder of this clause, the aggregate liability of Company under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, in respect of any and all claims, will not exceed the aggregate of the subscription fees actually paid to Company by the User in the year of the claim. In no event will Company be liable under or in connection with this Agreement for (a) any lost profits, loss of revenue, loss of business, loss of contract, loss of goodwill or loss of anticipated savings (whether direct or indirect); (b) error or interruption of use, loss or inaccuracy or corruption of data; or (c) any incidental, special, punitive, exemplary, indirect or consequential damages, arising out of or related to the Software, or the use thereof, even if Company has been advised, or is otherwise aware, of the possibility of such damages. Nothing in this Agreement will exclude or limit a party\u2019s liability to the other party for: (a) death or personal injury caused by that party\u2019s negligence; (b) wilful misconduct, fraud or fraudulent misrepresentation; (c) payment of fees or any sums due to the other party; or (d) any other matter for which it would be unlawful to exclude or attempt to exclude its liabilities."}),"\n",(0,r.jsxs)(t.ol,{start:"11",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Insurance"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"During the term of this Agreement, Company shall, at all times and at its own expense, and in amounts in accordance with industry standard for the software and services provided under this Agreement, maintain in full force and effect adequate insurance coverages"}),"\n",(0,r.jsxs)(t.ol,{start:"12",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Intellectual Property Rights"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"As between the User and Company, all right, title and interest in and to the Software and Company\u2019s trade marks and service marks are owned exclusively by Company and its licensors. To the extent that the User obtains any ownership interest in or to any derivative work or modification to the Software, the User hereby assigns (including without limitation by way of present assignment of future copyright) to Company all right, title and interest in and to such derivative works and/or modifications upon creation. The User shall, if requested by Company, do all things and execute all documents required to give effect the foregoing assignment. Other than as expressly set forth in this Agreement, no license or other rights in or to the Software thereto are granted to the User, and all such licenses and rights are hereby expressly reserved."}),"\n",(0,r.jsxs)(t.ol,{start:"13",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Publicity"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Customer hereby grants to Company the right to use its logo, service mark, and name in Company\u2019s marketing materials, including on its website. Such use by Company shall be limited to a statement that Customer is a user of specific Company Software. Any other use of a party\u2019s trade names, service marks, logos, or any other Intellectual Property right related thereto, for advertising or any other purposes, requires the express prior written consent of the other party."}),"\n",(0,r.jsxs)(t.ol,{start:"14",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Miscellaneous"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"This Agreement does not create any agency or partnership relationship between the parties hereto. This\nAgreement, and any dispute arising out of or in connection with it or its subject matter, whether of a contractual\nor non-contractual nature, shall be governed by and construed in accordance with the laws of Delaware (if\nCustomer is located in the United States), or England (if Customer is located outside of the United States). The\nsole and exclusive jurisdiction and venue for any litigation arising out of this Agreement shall be the courts of\nDelaware (if Customer is located in the United States), or England (if Customer is located outside of the United\nStates). Except with respect to any current valid written and mutually executed agreement between Customer and Company pertaining to Customer\u2019s use of the Software, this Agreement constitutes the entire agreement between the parties with respect to the subject matter\nhereof and supersedes all prior agreements and understandings whether written or oral, express or implied. If\nany provision of this Agreement is held invalid, illegal or unenforceable by a court of competent jurisdiction,\nsuch shall not affect any other provision of this Agreement, which shall remain in full force and effect. No\namendment or alteration of the terms of this Agreement shall be effective unless made in writing and executed\nby both parties hereto. A failure or delay in exercising any right in respect to this Agreement will not be\npresumed to operate as a waiver, and a single or partial exercise of any right will not be presumed to preclude\nany subsequent or further exercise of that right or the exercise of any other right. Any modification or waiver of\nany provision of this Agreement shall not be effective unless made in writing. Any such waiver shall be\neffective only in the specific instance and for the purpose given."})]})}function d(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>s});var r=n(96540);const i={},o=r.createContext(i);function a(e){const t=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),r.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8180],{81863:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>o,metadata:()=>s,toc:()=>c});var r=n(74848),i=n(28453);const o={title:"Commercial EULA",hide_title:!0,sidebar_position:1},a="DOCUMENT A",s={id:"troubleshooting/eula/commercial-eula",title:"Commercial EULA",description:"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.",source:"@site/docs/troubleshooting/eula/commercial-eula.md",sourceDirName:"troubleshooting/eula",slug:"/troubleshooting/eula/commercial-eula",permalink:"/troubleshooting/eula/commercial-eula",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/eula/commercial-eula.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Commercial EULA",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Forward logs to SIEMs",permalink:"/troubleshooting/logs-cloudwatch"},next:{title:"Community Edition EULA",permalink:"/troubleshooting/eula/community-eula"}},l={},c=[{value:"End User License Agreement",id:"end-user-license-agreement",level:2}];function h(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",hr:"hr",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"document-a",children:"DOCUMENT A"}),"\n",(0,r.jsxs)(t.admonition,{type:"info",children:[(0,r.jsxs)(t.p,{children:["FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, ",(0,r.jsx)(t.a,{href:"/troubleshooting/eula/commercial-eula#end-user-license-agreement",children:(0,r.jsx)(t.strong,{children:"DOCUMENT A - END USER LICENSE AGREEMENT"})})," SHALL APPLY."]}),(0,r.jsxs)(t.p,{children:["FOR ALL COMMUNITY EDITION USERS OF CADO SOFTWARE, ",(0,r.jsx)(t.a,{href:"/troubleshooting/eula/community-eula#community-edition-license-agreement",children:(0,r.jsx)(t.strong,{children:"DOCUMENT B - COMMUNITY EDITION LICENSE AGREEMENT"})})," SHALL APPLY."]})]}),"\n",(0,r.jsx)(t.hr,{}),"\n",(0,r.jsx)(t.h2,{id:"end-user-license-agreement",children:"End User License Agreement"}),"\n",(0,r.jsx)(t.p,{children:'BEFORE USING THE CADO SECURITY SOFTWARE, YOU SHOULD CAREFULLY READ THE FOLLOWING USER AGREEMENT THAT APPLIES TO THE SOFTWARE UNLESS USER AND COMPANY HAVE NEGOTIATED AND ENTERED INTO A SEPARATE, VALID WRITTEN AND MUTUALLY EXECUTED AGREEMENT PERTAINING TO USER\u2019S USE OF THE SOFTWARE. BY PROCEEDING WITH ANY INSTALLATION AND/OR USE OF THE SOFTWARE, YOU FULLY ACCEPT AND AGREE TO ALL OF THE PROVISIONS OF THIS USER AGREEMENT, ESTABLISHING A BINDING AGREEMENT BETWEEN YOU AS THE PERSON USING THE SOFTWARE (THE "USER") AND CADO SECURITY LIMITED, A COMPANY INCORPORATED IN ENGLAND AND WALES (NUMBER 12552987) HAVING ITS REGISTERED OFFICE AT 3RD FLOOR, 1 ASHLEY ROAD, ALTRINCHAM, CHESHIRE, WA14 2DT ("COMPANY").'}),"\n",(0,r.jsx)(t.p,{children:'This End User License Agreement governs use of the Software (as defined below) provided by Cado Security Limited, , a company incorporated in England and Wales (Number 12552987) having its registered office at 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, or its subsidiaries or affiliates (collectively, the \u201cCompany\u201d). This Agreement sets out the terms on which Company makes the Software available to you ("You\u201d or \u201cCustomer\u201d) and your authorized Users (as defined below).'}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Proprietary Rights"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"The Cado Security software including any (a) software that the Company uses to make the Software available; and (b) any published documentation that Company generally makes available to its customers (\u201cDocumentation\u201d) (collectively, the \u201cSoftware\u201d), is subject to the protection of copyright laws, which prohibit unauthorized copying and distribution of copyrighted works. The Software incorporates Company\u2019s proprietary and confidential algorithms and techniques that are subject to legal protection as know-how and trade secrets. All right, title and interest to any intellectual property rights included but not limited to patents, copyright works, know how, trade secrets and trade marks in the Software are owned by the Company. The employees, consultants, or other persons authorized by Customer to use the Software (each a \u201cUser\u201d) are granted only those rights expressly conferred by clause 2 of this Agreement. Customer shall remain liable to Company at all times for any acts or omissions of its Users."}),"\n",(0,r.jsxs)(t.ol,{start:"2",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Grant of Rights; Reservation of Rights"})}),"\n"]}),"\n",(0,r.jsxs)(t.p,{children:["Subject to payment in full by the Customer of the applicable subscription fee as detailed in the applicable invoice (\u201cInvoice\u201d), Company grants the Customer and its authorized Users a limited, non-sublicensable, non-exclusive, non-transferable right during the applicable subscription term stated in the Invoice (\u201cSubscription Plan\u201d) and pursuant to the terms of this Agreement to access, install, download and use the Software in object code form only, exclusively within the Customer\u2019s cloud based environment, for internal business and non-commercial purposes only unless otherwise agreed in writing. The Customer must install the Software as prescribed in the Company\u2019s manual available at ",(0,r.jsx)(t.a,{href:"https://docs.cadosecurity.com",children:"https://docs.cadosecurity.com"}),", unless otherwise agreed by the Company in writing. The Customer is permitted to make one additional copy of the Software solely for back-up or archival purposes only. The Software shall be used or accessed strictly in accordance with, and subject to any restrictions under the User\u2019s Subscription Plan and the applicable Invoice. This Agreement can be updated from time to time in Company's sole discretion and such changes will be made available at ",(0,r.jsx)(t.a,{href:"http://www.cadosecurity.com",children:"www.cadosecurity.com"}),"."]}),"\n",(0,r.jsxs)(t.ol,{start:"3",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Restrictions"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"3.1\tThe Customer and its Users may not:"}),"\n",(0,r.jsx)(t.p,{children:"copy the Software or any part of it, except as expressly permitted in this Agreement;\nrent, sell, lease, sublicense, distribute, pledge, assign or otherwise transfer, or commercially exploit, or encumber rights to, the Software or any part of it in any manner or for any purpose, or make the Software available for use by any third party in any manner including provide commercial hosting services, time-sharing, service bureau or similar arrangement;\naccess the Software for the purpose of building a competitive product or service or copying its features or user interface;\nremove, delete, obscure, alter or add to any copyright or proprietary notices appearing within the Software;\nDisassemble, decrypt, extract, reverse engineer or reverse compile the Software, or otherwise attempt to discover the confidential algorithms and techniques incorporated in the Software, or disclose or use any confidential information of Company in any manner, other than to the extent such actions cannot be prohibited under applicable law; or\nmodify, translate, adapt, or create derivative works from the Software."}),"\n",(0,r.jsx)(t.p,{children:"3.2\tCustomer and its Users have no right under any circumstances to obtain or have access to the source code or systems and programming documentation of the Software or any part thereof."}),"\n",(0,r.jsxs)(t.ol,{start:"4",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Evaluation License"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"If Customer registers for an evaluation version of the Software (\u201cEvaluation Version\u201d), at no additional charge, Company will make the Evaluation Version available to Customer and its authorized Users on a trial basis, free of charge, until the earlier of (a) the end of the 14 day free trial period unless agreed otherwise in writing, or (b) the start date of any license subscription purchased by the Customer corresponding to such Evaluation Version. Notwithstanding anything to the contrary, (i) the Evaluation Version is provided \u201cas-is\u201d without any representation, warranty or indemnity, or any support service, and (ii) the Evaluation Version not intended to house or contain any sensitive or production data. Company shall not be liable or responsible under any circumstances for any sensitive or production data input into such environment by Customer or any resulting loss or damage thereto."}),"\n",(0,r.jsxs)(t.ol,{start:"5",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Support"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Customer will be solely responsible for installing any updates and modifications that the Company may make available from time to time. Company will only support the most recent version of the Software."}),"\n",(0,r.jsxs)(t.ol,{start:"6",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Audit"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"During the term of this Agreement and for a period of one year thereafter, Company may, during normal business hours and upon reasonable prior notice to User, inspect the User\u2019s records, equipment and facilities relating to its use of the Software to verify Customer and its User's compliance with this Agreement."}),"\n",(0,r.jsxs)(t.ol,{start:"7",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Data"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Company may collect, process, aggregate, and use certain information, analysis, statistics, and other data generated by Customer\u2019s use of the Software (a) to confirm that the Software is being used in accordance with the rights granted under this Agreement, and (b) to drive improvements in the Software, and Company will retain ownership of such Software use data. Company agrees not to publish any of this information in a form that identifies Customer or any User. In the event Company processes personal data as a processor, such personal data will be processed by Company in accordance with applicable data protection laws."}),"\n",(0,r.jsxs)(t.ol,{start:"8",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Term"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Unless specified in your Subscription Plan and/or Invoice, this Agreement is effective for one (1) year, unless earlier terminated in accordance with the terms of this Agreement and may be renewed for successive periods of one (1) year upon timely payment of the applicable subscription fee. This Agreement and the User\u2019s right to use the Software will automatically terminate without notice in the event of (a) any failure by the User to pay fees due under this Agreement; (b) any failure by the User to comply with any of the above restrictions or any term of this Agreement. Upon expiration or earlier termination of this Agreement, the User will cease using the Software and expunge and destroy all copies of the Software in the User\u2019s possession. All provisions of clauses 3, 6, 8, 9, 10, 12 and 14 of this Agreement will survive termination."}),"\n",(0,r.jsxs)(t.ol,{start:"9",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Warranty and Disclaimer"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Each party warrants to the other that it has the required authority to enter into this Agreement. The Company warrants the Software shall perform materially in accordance with published specifications in the Documentation upon installation. To the fullest extent permitted by law, Company disclaims all warranties, express or implied, including without limitation any implied warranties of merchantability, fitness for a particular purpose, or title or noninfringement of third parties\u2019 intellectual property rights. No oral or written information or advice given by the Company or any third party in relation to the Software shall create any additional warranty."}),"\n",(0,r.jsxs)(t.ol,{start:"10",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Limitation of Liability"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Subject to the remainder of this clause, the aggregate liability of Company under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, in respect of any and all claims, will not exceed the aggregate of the subscription fees actually paid to Company by the User in the year of the claim. In no event will Company be liable under or in connection with this Agreement for (a) any lost profits, loss of revenue, loss of business, loss of contract, loss of goodwill or loss of anticipated savings (whether direct or indirect); (b) error or interruption of use, loss or inaccuracy or corruption of data; or (c) any incidental, special, punitive, exemplary, indirect or consequential damages, arising out of or related to the Software, or the use thereof, even if Company has been advised, or is otherwise aware, of the possibility of such damages. Nothing in this Agreement will exclude or limit a party\u2019s liability to the other party for: (a) death or personal injury caused by that party\u2019s negligence; (b) wilful misconduct, fraud or fraudulent misrepresentation; (c) payment of fees or any sums due to the other party; or (d) any other matter for which it would be unlawful to exclude or attempt to exclude its liabilities."}),"\n",(0,r.jsxs)(t.ol,{start:"11",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Insurance"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"During the term of this Agreement, Company shall, at all times and at its own expense, and in amounts in accordance with industry standard for the software and services provided under this Agreement, maintain in full force and effect adequate insurance coverages"}),"\n",(0,r.jsxs)(t.ol,{start:"12",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Intellectual Property Rights"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"As between the User and Company, all right, title and interest in and to the Software and Company\u2019s trade marks and service marks are owned exclusively by Company and its licensors. To the extent that the User obtains any ownership interest in or to any derivative work or modification to the Software, the User hereby assigns (including without limitation by way of present assignment of future copyright) to Company all right, title and interest in and to such derivative works and/or modifications upon creation. The User shall, if requested by Company, do all things and execute all documents required to give effect the foregoing assignment. Other than as expressly set forth in this Agreement, no license or other rights in or to the Software thereto are granted to the User, and all such licenses and rights are hereby expressly reserved."}),"\n",(0,r.jsxs)(t.ol,{start:"13",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Publicity"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Customer hereby grants to Company the right to use its logo, service mark, and name in Company\u2019s marketing materials, including on its website. Such use by Company shall be limited to a statement that Customer is a user of specific Company Software. Any other use of a party\u2019s trade names, service marks, logos, or any other Intellectual Property right related thereto, for advertising or any other purposes, requires the express prior written consent of the other party."}),"\n",(0,r.jsxs)(t.ol,{start:"14",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Miscellaneous"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"This Agreement does not create any agency or partnership relationship between the parties hereto. This\nAgreement, and any dispute arising out of or in connection with it or its subject matter, whether of a contractual\nor non-contractual nature, shall be governed by and construed in accordance with the laws of Delaware (if\nCustomer is located in the United States), or England (if Customer is located outside of the United States). The\nsole and exclusive jurisdiction and venue for any litigation arising out of this Agreement shall be the courts of\nDelaware (if Customer is located in the United States), or England (if Customer is located outside of the United\nStates). Except with respect to any current valid written and mutually executed agreement between Customer and Company pertaining to Customer\u2019s use of the Software, this Agreement constitutes the entire agreement between the parties with respect to the subject matter\nhereof and supersedes all prior agreements and understandings whether written or oral, express or implied. If\nany provision of this Agreement is held invalid, illegal or unenforceable by a court of competent jurisdiction,\nsuch shall not affect any other provision of this Agreement, which shall remain in full force and effect. No\namendment or alteration of the terms of this Agreement shall be effective unless made in writing and executed\nby both parties hereto. A failure or delay in exercising any right in respect to this Agreement will not be\npresumed to operate as a waiver, and a single or partial exercise of any right will not be presumed to preclude\nany subsequent or further exercise of that right or the exercise of any other right. Any modification or waiver of\nany provision of this Agreement shall not be effective unless made in writing. Any such waiver shall be\neffective only in the specific instance and for the purpose given."})]})}function d(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>a,x:()=>s});var r=n(96540);const i={},o=r.createContext(i);function a(e){const t=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),r.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cb1d6b9e.9f5ebbb3.js b/assets/js/cb1d6b9e.2df05f05.js similarity index 98% rename from assets/js/cb1d6b9e.9f5ebbb3.js rename to assets/js/cb1d6b9e.2df05f05.js index 7fc574b59..e4932de43 100644 --- a/assets/js/cb1d6b9e.9f5ebbb3.js +++ b/assets/js/cb1d6b9e.2df05f05.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6261],{93398:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>s,metadata:()=>c,toc:()=>d});var r=o(74848),n=o(28453);const s={title:"Google Cloud credentials",hide_title:!0,sidebar_position:3},i="How to Create Secure Google Cloud Credentials",c={id:"cado/discovery-import/cado-host/google-credentials",title:"Google Cloud credentials",description:"To create secure credentials for Google Cloud Storage, follow these steps. You can also watch the embedded video for a walkthrough.",source:"@site/docs/cado/discovery-import/cado-host/google-credentials.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/google-credentials",permalink:"/cado/discovery-import/cado-host/google-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/google-credentials.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Google Cloud credentials",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"AWS credentials",permalink:"/cado/discovery-import/cado-host/aws-credentials"},next:{title:"Azure credentials",permalink:"/cado/discovery-import/cado-host/azure-credentials"}},l={},d=[{value:"Step 1: Creating a Bucket",id:"step-1-creating-a-bucket",level:2},{value:"Step 2: Creating Credentials",id:"step-2-creating-credentials",level:2},{value:"Ready to Go",id:"ready-to-go",level:2}];function a(e){const t={h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"how-to-create-secure-google-cloud-credentials",children:"How to Create Secure Google Cloud Credentials"}),"\n",(0,r.jsx)(t.p,{children:"To create secure credentials for Google Cloud Storage, follow these steps. You can also watch the embedded video for a walkthrough."}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Create a Google Cloud Storage bucket."}),"\n",(0,r.jsx)(t.li,{children:"Create credentials with write-only access to the bucket."}),"\n"]}),"\n",(0,r.jsx)("iframe",{width:"100%",height:"536",src:"https://www.youtube.com/embed/VQxzJ1V8ArE",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,r.jsx)(t.h2,{id:"step-1-creating-a-bucket",children:"Step 1: Creating a Bucket"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Open the ",(0,r.jsx)(t.strong,{children:"Storage Browser"})," in Google Cloud."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Create Bucket"}),"."]}),"\n",(0,r.jsx)(t.li,{children:"Set up the bucket with your desired settings."}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"step-2-creating-credentials",children:"Step 2: Creating Credentials"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Go to ",(0,r.jsx)(t.strong,{children:"Storage Settings"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Select your project, then go to ",(0,r.jsx)(t.strong,{children:"Interoperability"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Create a Key"})," for a service account."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Create a New Account"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Enter a name for the account, then grant it the ",(0,r.jsx)(t.strong,{children:"Storage Object Creator"})," permission.","\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"This permission allows writing objects to the bucket but prevents listing or downloading objects."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["Complete the account creation process, and copy the ",(0,r.jsx)(t.strong,{children:"Access Key"})," and ",(0,r.jsx)(t.strong,{children:"Secret Key"}),"."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"ready-to-go",children:"Ready to Go"}),"\n",(0,r.jsx)(t.p,{children:"Once complete, you'll have:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Access Key"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Secret Key"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Bucket Name"}),"."]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"These credentials will enable secure write-only access to your Google Cloud Storage bucket."})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>i,x:()=>c});var r=o(96540);const n={},s=r.createContext(n);function i(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6261],{93398:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>s,metadata:()=>c,toc:()=>d});var r=o(74848),n=o(28453);const s={title:"Google Cloud credentials",hide_title:!0,sidebar_position:3},i="How to Create Secure Google Cloud Credentials",c={id:"cado/discovery-import/cado-host/google-credentials",title:"Google Cloud credentials",description:"To create secure credentials for Google Cloud Storage, follow these steps. You can also watch the embedded video for a walkthrough.",source:"@site/docs/cado/discovery-import/cado-host/google-credentials.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/google-credentials",permalink:"/cado/discovery-import/cado-host/google-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/google-credentials.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Google Cloud credentials",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"AWS credentials",permalink:"/cado/discovery-import/cado-host/aws-credentials"},next:{title:"Azure credentials",permalink:"/cado/discovery-import/cado-host/azure-credentials"}},l={},d=[{value:"Step 1: Creating a Bucket",id:"step-1-creating-a-bucket",level:2},{value:"Step 2: Creating Credentials",id:"step-2-creating-credentials",level:2},{value:"Ready to Go",id:"ready-to-go",level:2}];function a(e){const t={h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"how-to-create-secure-google-cloud-credentials",children:"How to Create Secure Google Cloud Credentials"}),"\n",(0,r.jsx)(t.p,{children:"To create secure credentials for Google Cloud Storage, follow these steps. You can also watch the embedded video for a walkthrough."}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Create a Google Cloud Storage bucket."}),"\n",(0,r.jsx)(t.li,{children:"Create credentials with write-only access to the bucket."}),"\n"]}),"\n",(0,r.jsx)("iframe",{width:"100%",height:"536",src:"https://www.youtube.com/embed/VQxzJ1V8ArE",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,r.jsx)(t.h2,{id:"step-1-creating-a-bucket",children:"Step 1: Creating a Bucket"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Open the ",(0,r.jsx)(t.strong,{children:"Storage Browser"})," in Google Cloud."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Create Bucket"}),"."]}),"\n",(0,r.jsx)(t.li,{children:"Set up the bucket with your desired settings."}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"step-2-creating-credentials",children:"Step 2: Creating Credentials"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Go to ",(0,r.jsx)(t.strong,{children:"Storage Settings"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Select your project, then go to ",(0,r.jsx)(t.strong,{children:"Interoperability"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Create a Key"})," for a service account."]}),"\n",(0,r.jsxs)(t.li,{children:["Click ",(0,r.jsx)(t.strong,{children:"Create a New Account"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["Enter a name for the account, then grant it the ",(0,r.jsx)(t.strong,{children:"Storage Object Creator"})," permission.","\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"This permission allows writing objects to the bucket but prevents listing or downloading objects."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["Complete the account creation process, and copy the ",(0,r.jsx)(t.strong,{children:"Access Key"})," and ",(0,r.jsx)(t.strong,{children:"Secret Key"}),"."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"ready-to-go",children:"Ready to Go"}),"\n",(0,r.jsx)(t.p,{children:"Once complete, you'll have:"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Access Key"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Secret Key"}),"."]}),"\n",(0,r.jsxs)(t.li,{children:["The ",(0,r.jsx)(t.strong,{children:"Bucket Name"}),"."]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"These credentials will enable secure write-only access to your Google Cloud Storage bucket."})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>i,x:()=>c});var r=o(96540);const n={},s=r.createContext(n);function i(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cbfa239e.2dd1e6ed.js b/assets/js/cbfa239e.60c1997f.js similarity index 97% rename from assets/js/cbfa239e.2dd1e6ed.js rename to assets/js/cbfa239e.60c1997f.js index 4fadcbcfd..99abd1643 100644 --- a/assets/js/cbfa239e.2dd1e6ed.js +++ b/assets/js/cbfa239e.60c1997f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5784],{3916:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>d,toc:()=>r});var t=s(74848),i=s(28453);const a={title:"Expand disk in AWS",hide_title:!0,sidebar_position:8},o="How to Expand Available Data Storage within the Cado Platform in AWS",d={id:"cado/manage/expand-disk",title:"Expand disk in AWS",description:"Below are the steps for expanding the Cado data storage volume after deployment, following AWS's instructions for Extending a Linux file system after resizing a volume.",source:"@site/docs/cado/manage/expand-disk.md",sourceDirName:"cado/manage",slug:"/cado/manage/expand-disk",permalink:"/cado/manage/expand-disk",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/expand-disk.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"Expand disk in AWS",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Manage data",permalink:"/cado/manage/data"},next:{title:"Updating",permalink:"/cado/manage/updating"}},l={},r=[{value:"Steps to Expand Storage",id:"steps-to-expand-storage",level:3}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-expand-available-data-storage-within-the-cado-platform-in-aws",children:"How to Expand Available Data Storage within the Cado Platform in AWS"}),"\n",(0,t.jsxs)(n.p,{children:["Below are the steps for expanding the Cado data storage volume after deployment, following AWS's instructions for ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.html",children:"Extending a Linux file system after resizing a volume"})}),"."]}),"\n",(0,t.jsx)(n.admonition,{type:"warning",children:(0,t.jsxs)(n.p,{children:["Before proceeding, create a snapshot of the ",(0,t.jsx)(n.code,{children:"CadoResponseDataVolume"})," with the device name ",(0,t.jsx)(n.code,{children:"/dev/sdh"}),". This ensures you have a backup of the data volume in case any issues arise. Follow this guide: ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html",children:"Creating an EBS Snapshot"}),"."]})}),"\n",(0,t.jsx)(n.h3,{id:"steps-to-expand-storage",children:"Steps to Expand Storage"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsxs)(n.strong,{children:["Modify the ",(0,t.jsx)(n.code,{children:"/dev/sdh"})," Storage Volume in AWS"]}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Navigate to your Cado instance in the AWS Console."}),"\n",(0,t.jsxs)(n.li,{children:["Click the ",(0,t.jsx)(n.strong,{children:"Storage"})," tab."]}),"\n",(0,t.jsxs)(n.li,{children:["Select the volume with the device name ",(0,t.jsx)(n.code,{children:"/dev/sdh"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Click the volume instance ID for the ",(0,t.jsx)(n.code,{children:"CadoResponseDataVolume"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Actions"})," and select ",(0,t.jsx)(n.strong,{children:"Modify Volume"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Enter the new volume size and click ",(0,t.jsx)(n.strong,{children:"Modify"}),"."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"SSH into the Cado Instance"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Example command: ",(0,t.jsx)(n.code,{children:'ssh -i "us-east-2.pem" admin@ec2-55-234-10-9.compute-1.amazonaws.com'})]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Check Current Available Space"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Run ",(0,t.jsx)(n.code,{children:"df -hT"})," to check the available space on the ",(0,t.jsx)(n.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,t.jsx)(n.code,{children:"/home/admin/data"}),". This should display the old volume size."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Verify New Volume Size"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Run ",(0,t.jsx)(n.code,{children:"lsblk"})," to verify the size of the ",(0,t.jsx)(n.code,{children:"nvme1n1"})," volume mounted on ",(0,t.jsx)(n.code,{children:"/home/admin/data"}),". This should now display the new volume size."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Extend the Volume"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Run the command ",(0,t.jsx)(n.code,{children:"sudo xfs_growfs -d /home/admin/data"})," to extend the volume and make it available to the operating system."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Verify Updated Available Space"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Run ",(0,t.jsx)(n.code,{children:"df -hT"})," again to check the available space on the ",(0,t.jsx)(n.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,t.jsx)(n.code,{children:"/home/admin/data"}),". It should now show the expanded volume size."]}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,n,s)=>{s.d(n,{R:()=>o,x:()=>d});var t=s(96540);const i={},a=t.createContext(i);function o(e){const n=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function d(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),t.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5784],{3916:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>d,toc:()=>r});var t=s(74848),i=s(28453);const a={title:"Expand disk in AWS",hide_title:!0,sidebar_position:8},o="How to Expand Available Data Storage within the Cado Platform in AWS",d={id:"cado/manage/expand-disk",title:"Expand disk in AWS",description:"Below are the steps for expanding the Cado data storage volume after deployment, following AWS's instructions for Extending a Linux file system after resizing a volume.",source:"@site/docs/cado/manage/expand-disk.md",sourceDirName:"cado/manage",slug:"/cado/manage/expand-disk",permalink:"/cado/manage/expand-disk",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/expand-disk.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"Expand disk in AWS",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Manage data",permalink:"/cado/manage/data"},next:{title:"Updating",permalink:"/cado/manage/updating"}},l={},r=[{value:"Steps to Expand Storage",id:"steps-to-expand-storage",level:3}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"how-to-expand-available-data-storage-within-the-cado-platform-in-aws",children:"How to Expand Available Data Storage within the Cado Platform in AWS"}),"\n",(0,t.jsxs)(n.p,{children:["Below are the steps for expanding the Cado data storage volume after deployment, following AWS's instructions for ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.html",children:"Extending a Linux file system after resizing a volume"})}),"."]}),"\n",(0,t.jsx)(n.admonition,{type:"warning",children:(0,t.jsxs)(n.p,{children:["Before proceeding, create a snapshot of the ",(0,t.jsx)(n.code,{children:"CadoResponseDataVolume"})," with the device name ",(0,t.jsx)(n.code,{children:"/dev/sdh"}),". This ensures you have a backup of the data volume in case any issues arise. Follow this guide: ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html",children:"Creating an EBS Snapshot"}),"."]})}),"\n",(0,t.jsx)(n.h3,{id:"steps-to-expand-storage",children:"Steps to Expand Storage"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsxs)(n.strong,{children:["Modify the ",(0,t.jsx)(n.code,{children:"/dev/sdh"})," Storage Volume in AWS"]}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Navigate to your Cado instance in the AWS Console."}),"\n",(0,t.jsxs)(n.li,{children:["Click the ",(0,t.jsx)(n.strong,{children:"Storage"})," tab."]}),"\n",(0,t.jsxs)(n.li,{children:["Select the volume with the device name ",(0,t.jsx)(n.code,{children:"/dev/sdh"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Click the volume instance ID for the ",(0,t.jsx)(n.code,{children:"CadoResponseDataVolume"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Actions"})," and select ",(0,t.jsx)(n.strong,{children:"Modify Volume"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Enter the new volume size and click ",(0,t.jsx)(n.strong,{children:"Modify"}),"."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"SSH into the Cado Instance"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Example command: ",(0,t.jsx)(n.code,{children:'ssh -i "us-east-2.pem" admin@ec2-55-234-10-9.compute-1.amazonaws.com'})]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Check Current Available Space"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Run ",(0,t.jsx)(n.code,{children:"df -hT"})," to check the available space on the ",(0,t.jsx)(n.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,t.jsx)(n.code,{children:"/home/admin/data"}),". This should display the old volume size."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Verify New Volume Size"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Run ",(0,t.jsx)(n.code,{children:"lsblk"})," to verify the size of the ",(0,t.jsx)(n.code,{children:"nvme1n1"})," volume mounted on ",(0,t.jsx)(n.code,{children:"/home/admin/data"}),". This should now display the new volume size."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Extend the Volume"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Run the command ",(0,t.jsx)(n.code,{children:"sudo xfs_growfs -d /home/admin/data"})," to extend the volume and make it available to the operating system."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Verify Updated Available Space"}),":"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Run ",(0,t.jsx)(n.code,{children:"df -hT"})," again to check the available space on the ",(0,t.jsx)(n.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,t.jsx)(n.code,{children:"/home/admin/data"}),". It should now show the expanded volume size."]}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,n,s)=>{s.d(n,{R:()=>o,x:()=>d});var t=s(96540);const i={},a=t.createContext(i);function o(e){const n=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function d(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),t.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cd181b23.72920ade.js b/assets/js/cd181b23.dbc39aa1.js similarity index 98% rename from assets/js/cd181b23.72920ade.js rename to assets/js/cd181b23.dbc39aa1.js index 01c6000f4..b490f9489 100644 --- a/assets/js/cd181b23.72920ade.js +++ b/assets/js/cd181b23.dbc39aa1.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[97],{20618:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>u,frontMatter:()=>a,metadata:()=>r,toc:()=>d});var i=t(74848),s=t(28453);const a={sidebar_position:1,id:"intro",title:"What is Cado"},o="What is the Cado Platform?",r={id:"cado/intro",title:"What is Cado",description:"As data and cyber attackers move to the cloud, investigating security threats in modern environments becomes increasingly complex and time-consuming. The Cado platform leverages the scalability, speed, and automation of the cloud to streamline investigation and response.",source:"@site/docs/cado/intro.md",sourceDirName:"cado",slug:"/cado/intro",permalink:"/cado/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/intro.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{sidebar_position:1,id:"intro",title:"What is Cado"},sidebar:"tutorialSidebar",next:{title:"Deploy with Cloudformation",permalink:"/cado/deploy/aws/cloudformation"}},l={},d=[{value:"Core Features",id:"core-features",level:3},{value:"Benefits",id:"benefits",level:3}];function c(e){const n={h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"what-is-the-cado-platform",children:"What is the Cado Platform?"}),"\n",(0,i.jsx)(n.p,{children:"As data and cyber attackers move to the cloud, investigating security threats in modern environments becomes increasingly complex and time-consuming. The Cado platform leverages the scalability, speed, and automation of the cloud to streamline investigation and response."}),"\n",(0,i.jsx)("p",{align:"center",children:(0,i.jsx)("img",{src:"/img/cado-overall.png",alt:"Cado Platform"})}),"\n",(0,i.jsx)(n.h3,{id:"core-features",children:"Core Features"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Automated Data Capture"}),": Cado enables automated data collection across multi-cloud environments and ephemeral containers, while also supporting investigations on on-premises systems."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Parallel Processing"}),": Powered by a patent-pending cloud-native architecture, Cado automatically scales to provide fast, parallel data processing."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Powerful Analytics"}),": Cado's analytics engine, enhanced by threat intelligence, machine learning, and built-in YARA rules, automatically flags malicious activity and potential risks."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Single Pane of Glass"}),": Cado presents data from multiple sources, including cloud-provider logs, disk, memory, and more, in a unified timeline, helping security teams quickly assess the scope and impact of incidents."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"benefits",children:"Benefits"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Cloud Scale"}),": Automate data capture across complex, multi-cloud environments without the need for agents."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Cloud Speed"}),": Utilize rapid, parallel processing to normalize vast amounts of disparate data in minutes instead of days."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Cloud Visibility"}),": Investigate a wide range of data sources, including cloud-provider logs, disk, memory, and more, all within a single, unified interface."]}),"\n"]}),"\n"]})]})}function u(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>r});var i=t(96540);const s={},a=i.createContext(s);function o(e){const n=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[97],{20618:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>u,frontMatter:()=>a,metadata:()=>r,toc:()=>d});var i=t(74848),s=t(28453);const a={sidebar_position:1,id:"intro",title:"What is Cado"},o="What is the Cado Platform?",r={id:"cado/intro",title:"What is Cado",description:"As data and cyber attackers move to the cloud, investigating security threats in modern environments becomes increasingly complex and time-consuming. The Cado platform leverages the scalability, speed, and automation of the cloud to streamline investigation and response.",source:"@site/docs/cado/intro.md",sourceDirName:"cado",slug:"/cado/intro",permalink:"/cado/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/intro.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{sidebar_position:1,id:"intro",title:"What is Cado"},sidebar:"tutorialSidebar",next:{title:"Deploy with Cloudformation",permalink:"/cado/deploy/aws/cloudformation"}},l={},d=[{value:"Core Features",id:"core-features",level:3},{value:"Benefits",id:"benefits",level:3}];function c(e){const n={h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"what-is-the-cado-platform",children:"What is the Cado Platform?"}),"\n",(0,i.jsx)(n.p,{children:"As data and cyber attackers move to the cloud, investigating security threats in modern environments becomes increasingly complex and time-consuming. The Cado platform leverages the scalability, speed, and automation of the cloud to streamline investigation and response."}),"\n",(0,i.jsx)("p",{align:"center",children:(0,i.jsx)("img",{src:"/img/cado-overall.png",alt:"Cado Platform"})}),"\n",(0,i.jsx)(n.h3,{id:"core-features",children:"Core Features"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Automated Data Capture"}),": Cado enables automated data collection across multi-cloud environments and ephemeral containers, while also supporting investigations on on-premises systems."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Parallel Processing"}),": Powered by a patent-pending cloud-native architecture, Cado automatically scales to provide fast, parallel data processing."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Powerful Analytics"}),": Cado's analytics engine, enhanced by threat intelligence, machine learning, and built-in YARA rules, automatically flags malicious activity and potential risks."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Single Pane of Glass"}),": Cado presents data from multiple sources, including cloud-provider logs, disk, memory, and more, in a unified timeline, helping security teams quickly assess the scope and impact of incidents."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"benefits",children:"Benefits"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Cloud Scale"}),": Automate data capture across complex, multi-cloud environments without the need for agents."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Cloud Speed"}),": Utilize rapid, parallel processing to normalize vast amounts of disparate data in minutes instead of days."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Cloud Visibility"}),": Investigate a wide range of data sources, including cloud-provider logs, disk, memory, and more, all within a single, unified interface."]}),"\n"]}),"\n"]})]})}function u(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},28453:(e,n,t)=>{t.d(n,{R:()=>o,x:()=>r});var i=t(96540);const s={},a=i.createContext(s);function o(e){const n=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cd5b4d7e.83797367.js b/assets/js/cd5b4d7e.332f71e1.js similarity index 98% rename from assets/js/cd5b4d7e.83797367.js rename to assets/js/cd5b4d7e.332f71e1.js index 937e4bbb9..4c30dd74b 100644 --- a/assets/js/cd5b4d7e.83797367.js +++ b/assets/js/cd5b4d7e.332f71e1.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8891],{78886:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>s,contentTitle:()=>o,default:()=>u,frontMatter:()=>i,metadata:()=>d,toc:()=>l});var a=n(74848),r=n(28453);const i={title:"Updating",hide_title:!0,sidebar_position:9},o="How to Update the Cado Platform",d={id:"cado/manage/updating",title:"Updating",description:"You can check version details and initiate updates by selecting Updates from the Settings menu.",source:"@site/docs/cado/manage/updating.md",sourceDirName:"cado/manage",slug:"/cado/manage/updating",permalink:"/cado/manage/updating",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/updating.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:9,frontMatter:{title:"Updating",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Expand disk in AWS",permalink:"/cado/manage/expand-disk"},next:{title:"Cost estimates",permalink:"/cado/manage/cost-management"}},s={},l=[{value:"AWS",id:"aws",level:3},{value:"Azure",id:"azure",level:3},{value:"GCP",id:"gcp",level:3},{value:"Alternative Update Method",id:"alternative-update-method",level:3},{value:"Updating with Terraform",id:"updating-with-terraform",level:3},{value:"Update Details for Terraform and Custom Updates",id:"update-details-for-terraform-and-custom-updates",level:2},{value:"How does the Update Mechanism work?",id:"how-does-the-update-mechanism-work",level:2}];function c(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"how-to-update-the-cado-platform",children:"How to Update the Cado Platform"}),"\n",(0,a.jsxs)(t.p,{children:["You can check version details and initiate updates by selecting ",(0,a.jsx)(t.strong,{children:"Updates"})," from the ",(0,a.jsx)(t.strong,{children:"Settings"})," menu."]}),"\n",(0,a.jsx)(t.h3,{id:"aws",children:"AWS"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["The default update method in AWS requires the Cado instance to have outbound connectivity to ",(0,a.jsx)(t.code,{children:"cado-public.s3.amazonaws.com"}),". It will then deploy a public AMI in the same region as the Cado platform."]}),"\n"]}),"\n",(0,a.jsx)(t.h3,{id:"azure",children:"Azure"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"For Azure, the default update process requires outbound connectivity to a VHD URL. You can update via the UI, but to minimize Terraform state drift, it is recommended to follow the Terraform instructions for updates."}),"\n"]}),"\n",(0,a.jsx)(t.h3,{id:"gcp",children:"GCP"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["Updates in GCP can be performed through the UI or using Terraform. Terraform users should specify the new image in the ",(0,a.jsx)(t.code,{children:"gcpVars.tfvars"})," file."]}),"\n"]}),"\n",(0,a.jsx)(t.h3,{id:"alternative-update-method",children:"Alternative Update Method"}),"\n",(0,a.jsxs)(t.p,{children:["In AWS or Azure, you can manually specify an AMI ID or VHD URL, respectively, using the ",(0,a.jsx)(t.strong,{children:"Alternative Update Method"}),"."]}),"\n",(0,a.jsx)(t.p,{children:"Note that all updates are user-initiated; Cado will not trigger updates automatically."}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Update",src:n(93164).A+"",width:"1470",height:"368"})}),"\n",(0,a.jsx)(t.h3,{id:"updating-with-terraform",children:"Updating with Terraform"}),"\n",(0,a.jsxs)(t.p,{children:["For users deploying with Terraform, update the AMI ID (AWS), VHD URL (Azure), or VMDK URL (GCP) and then run ",(0,a.jsx)(t.code,{children:"terraform apply"}),"."]}),"\n",(0,a.jsx)(t.admonition,{type:"warning",children:(0,a.jsx)(t.p,{children:"When upgrading via Terraform, it is recommended to gracefully stop your currently running instance through the console before starting the upgrade."})}),"\n",(0,a.jsx)(t.h2,{id:"update-details-for-terraform-and-custom-updates",children:"Update Details for Terraform and Custom Updates"}),"\n",(0,a.jsxs)(t.p,{children:["To retrieve the latest AMI IDs and URLs for updating your Cado platform, refer to our public ",(0,a.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cado_updates_json_v2.json",children:"update JSON"}),"."]}),"\n",(0,a.jsx)(t.p,{children:"The latest release information is listed at the bottom of the JSON file:"}),"\n",(0,a.jsx)(t.pre,{children:(0,a.jsx)(t.code,{children:'{\n "release_date": 1709694258, \n "version": "2.119.0", \n "required": false, \n "ami_id": {\n "us-east-1": "ami-xxx"\n }, \n "vhd_uri": "https://xxx", \n "gcp_image": "https://xxx"\n}\n'})}),"\n",(0,a.jsx)(t.h2,{id:"how-does-the-update-mechanism-work",children:"How does the Update Mechanism work?"}),"\n",(0,a.jsx)(t.p,{children:"The update mechanism works by deploying a new instance (via AMI in AWS, or via URL in Azure and GCP) and moving the attatched data-disk. In AWS HA environments, the ASG is updated to use the new AMI."}),"\n",(0,a.jsx)(t.p,{children:"If updating via the User Interface, before the update is performed, a number of checks are performed to ensure any IAM or Infrastructure requirements are met. A warning is issued in the UI if the AMI is not from an official Cado account."}),"\n",(0,a.jsx)(t.p,{children:"If updating manually by Terraform or CloudFormation, these checks cannot be run."})]})}function u(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},93164:(e,t,n)=>{n.d(t,{A:()=>a});const a=n.p+"assets/images/alt-update-8f22a0b2c04708e5bb7ae40e50f1668d.png"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>d});var a=n(96540);const r={},i=a.createContext(r);function o(e){const t=a.useContext(i);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),a.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8891],{78886:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>s,contentTitle:()=>o,default:()=>u,frontMatter:()=>i,metadata:()=>d,toc:()=>l});var a=n(74848),r=n(28453);const i={title:"Updating",hide_title:!0,sidebar_position:9},o="How to Update the Cado Platform",d={id:"cado/manage/updating",title:"Updating",description:"You can check version details and initiate updates by selecting Updates from the Settings menu.",source:"@site/docs/cado/manage/updating.md",sourceDirName:"cado/manage",slug:"/cado/manage/updating",permalink:"/cado/manage/updating",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/updating.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:9,frontMatter:{title:"Updating",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Expand disk in AWS",permalink:"/cado/manage/expand-disk"},next:{title:"Cost estimates",permalink:"/cado/manage/cost-management"}},s={},l=[{value:"AWS",id:"aws",level:3},{value:"Azure",id:"azure",level:3},{value:"GCP",id:"gcp",level:3},{value:"Alternative Update Method",id:"alternative-update-method",level:3},{value:"Updating with Terraform",id:"updating-with-terraform",level:3},{value:"Update Details for Terraform and Custom Updates",id:"update-details-for-terraform-and-custom-updates",level:2},{value:"How does the Update Mechanism work?",id:"how-does-the-update-mechanism-work",level:2}];function c(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"how-to-update-the-cado-platform",children:"How to Update the Cado Platform"}),"\n",(0,a.jsxs)(t.p,{children:["You can check version details and initiate updates by selecting ",(0,a.jsx)(t.strong,{children:"Updates"})," from the ",(0,a.jsx)(t.strong,{children:"Settings"})," menu."]}),"\n",(0,a.jsx)(t.h3,{id:"aws",children:"AWS"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["The default update method in AWS requires the Cado instance to have outbound connectivity to ",(0,a.jsx)(t.code,{children:"cado-public.s3.amazonaws.com"}),". It will then deploy a public AMI in the same region as the Cado platform."]}),"\n"]}),"\n",(0,a.jsx)(t.h3,{id:"azure",children:"Azure"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"For Azure, the default update process requires outbound connectivity to a VHD URL. You can update via the UI, but to minimize Terraform state drift, it is recommended to follow the Terraform instructions for updates."}),"\n"]}),"\n",(0,a.jsx)(t.h3,{id:"gcp",children:"GCP"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["Updates in GCP can be performed through the UI or using Terraform. Terraform users should specify the new image in the ",(0,a.jsx)(t.code,{children:"gcpVars.tfvars"})," file."]}),"\n"]}),"\n",(0,a.jsx)(t.h3,{id:"alternative-update-method",children:"Alternative Update Method"}),"\n",(0,a.jsxs)(t.p,{children:["In AWS or Azure, you can manually specify an AMI ID or VHD URL, respectively, using the ",(0,a.jsx)(t.strong,{children:"Alternative Update Method"}),"."]}),"\n",(0,a.jsx)(t.p,{children:"Note that all updates are user-initiated; Cado will not trigger updates automatically."}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Update",src:n(93164).A+"",width:"1470",height:"368"})}),"\n",(0,a.jsx)(t.h3,{id:"updating-with-terraform",children:"Updating with Terraform"}),"\n",(0,a.jsxs)(t.p,{children:["For users deploying with Terraform, update the AMI ID (AWS), VHD URL (Azure), or VMDK URL (GCP) and then run ",(0,a.jsx)(t.code,{children:"terraform apply"}),"."]}),"\n",(0,a.jsx)(t.admonition,{type:"warning",children:(0,a.jsx)(t.p,{children:"When upgrading via Terraform, it is recommended to gracefully stop your currently running instance through the console before starting the upgrade."})}),"\n",(0,a.jsx)(t.h2,{id:"update-details-for-terraform-and-custom-updates",children:"Update Details for Terraform and Custom Updates"}),"\n",(0,a.jsxs)(t.p,{children:["To retrieve the latest AMI IDs and URLs for updating your Cado platform, refer to our public ",(0,a.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cado_updates_json_v2.json",children:"update JSON"}),"."]}),"\n",(0,a.jsx)(t.p,{children:"The latest release information is listed at the bottom of the JSON file:"}),"\n",(0,a.jsx)(t.pre,{children:(0,a.jsx)(t.code,{children:'{\n "release_date": 1709694258, \n "version": "2.119.0", \n "required": false, \n "ami_id": {\n "us-east-1": "ami-xxx"\n }, \n "vhd_uri": "https://xxx", \n "gcp_image": "https://xxx"\n}\n'})}),"\n",(0,a.jsx)(t.h2,{id:"how-does-the-update-mechanism-work",children:"How does the Update Mechanism work?"}),"\n",(0,a.jsx)(t.p,{children:"The update mechanism works by deploying a new instance (via AMI in AWS, or via URL in Azure and GCP) and moving the attatched data-disk. In AWS HA environments, the ASG is updated to use the new AMI."}),"\n",(0,a.jsx)(t.p,{children:"If updating via the User Interface, before the update is performed, a number of checks are performed to ensure any IAM or Infrastructure requirements are met. A warning is issued in the UI if the AMI is not from an official Cado account."}),"\n",(0,a.jsx)(t.p,{children:"If updating manually by Terraform or CloudFormation, these checks cannot be run."})]})}function u(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},93164:(e,t,n)=>{n.d(t,{A:()=>a});const a=n.p+"assets/images/alt-update-8f22a0b2c04708e5bb7ae40e50f1668d.png"},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>d});var a=n(96540);const r={},i=a.createContext(r);function o(e){const t=a.useContext(i);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),a.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cdeb5142.572883ca.js b/assets/js/cdeb5142.6f57f913.js similarity index 96% rename from assets/js/cdeb5142.572883ca.js rename to assets/js/cdeb5142.6f57f913.js index d6a528827..95e94c169 100644 --- a/assets/js/cdeb5142.572883ca.js +++ b/assets/js/cdeb5142.6f57f913.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8991],{17526:(t,s,e)=>{e.r(s),e.d(s,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>n,metadata:()=>a,toc:()=>l});var i=e(74848),o=e(28453);const n={title:"Lightsail",hide_title:!0,sidebar_position:8},r="How to Import AWS Lightsail",a={id:"cado/discovery-import/aws/aws-lightsail",title:"Lightsail",description:"To import a Lightsail instance into the Cado platform, follow these steps:",source:"@site/docs/cado/discovery-import/aws/aws-lightsail.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-lightsail",permalink:"/cado/discovery-import/aws/aws-lightsail",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-lightsail.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"Lightsail",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"AWS Memory Analysis",permalink:"/cado/discovery-import/aws/memory"},next:{title:"AWS China",permalink:"/cado/discovery-import/aws/aws-china"}},c={},l=[];function d(t){const s={a:"a",br:"br",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,o.R)(),...t.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"how-to-import-aws-lightsail",children:"How to Import AWS Lightsail"}),"\n",(0,i.jsx)(s.p,{children:"To import a Lightsail instance into the Cado platform, follow these steps:"}),"\n",(0,i.jsxs)(s.ol,{children:["\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Create a Snapshot"}),(0,i.jsx)(s.br,{}),"\n","First, create a snapshot of the Lightsail instance you want to import.",(0,i.jsx)(s.br,{}),"\n",(0,i.jsx)(s.img,{alt:"Make Lightsail Snapshot",src:e(39814).A+"",width:"1726",height:"754"})]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Export to Amazon EC2"}),(0,i.jsx)(s.br,{}),"\n","After creating the snapshot, select the option to ",(0,i.jsx)(s.strong,{children:"Export to Amazon EC2"}),".",(0,i.jsx)(s.br,{}),"\n",(0,i.jsx)(s.img,{alt:"Export to EC2",src:e(39296).A+"",width:"792",height:"400"})]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Import the EC2 EBS Snapshot"}),(0,i.jsx)(s.br,{}),"\n","Once the snapshot is exported to EC2, you can import it as an ",(0,i.jsx)(s.a,{href:"/cado/discovery-import/aws/aws-ami",children:"EC2 EBS Snapshot"})," using the usual method."]}),"\n"]}),"\n"]})]})}function h(t={}){const{wrapper:s}={...(0,o.R)(),...t.components};return s?(0,i.jsx)(s,{...t,children:(0,i.jsx)(d,{...t})}):d(t)}},39296:(t,s,e)=>{e.d(s,{A:()=>i});const i=e.p+"assets/images/export-to-ec2-b2fd37635edeb8102479cf1f70fe3f3c.png"},39814:(t,s,e)=>{e.d(s,{A:()=>i});const i=e.p+"assets/images/make-lightsail-snapshot-9894163b91251b110641ff1fd3129e3f.png"},28453:(t,s,e)=>{e.d(s,{R:()=>r,x:()=>a});var i=e(96540);const o={},n=i.createContext(o);function r(t){const s=i.useContext(n);return i.useMemo((function(){return"function"==typeof t?t(s):{...s,...t}}),[s,t])}function a(t){let s;return s=t.disableParentContext?"function"==typeof t.components?t.components(o):t.components||o:r(t.components),i.createElement(n.Provider,{value:s},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8991],{17526:(t,s,e)=>{e.r(s),e.d(s,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>n,metadata:()=>a,toc:()=>l});var i=e(74848),o=e(28453);const n={title:"Lightsail",hide_title:!0,sidebar_position:8},r="How to Import AWS Lightsail",a={id:"cado/discovery-import/aws/aws-lightsail",title:"Lightsail",description:"To import a Lightsail instance into the Cado platform, follow these steps:",source:"@site/docs/cado/discovery-import/aws/aws-lightsail.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-lightsail",permalink:"/cado/discovery-import/aws/aws-lightsail",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-lightsail.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"Lightsail",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"AWS Memory Analysis",permalink:"/cado/discovery-import/aws/memory"},next:{title:"AWS China",permalink:"/cado/discovery-import/aws/aws-china"}},c={},l=[];function d(t){const s={a:"a",br:"br",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,o.R)(),...t.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"how-to-import-aws-lightsail",children:"How to Import AWS Lightsail"}),"\n",(0,i.jsx)(s.p,{children:"To import a Lightsail instance into the Cado platform, follow these steps:"}),"\n",(0,i.jsxs)(s.ol,{children:["\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Create a Snapshot"}),(0,i.jsx)(s.br,{}),"\n","First, create a snapshot of the Lightsail instance you want to import.",(0,i.jsx)(s.br,{}),"\n",(0,i.jsx)(s.img,{alt:"Make Lightsail Snapshot",src:e(39814).A+"",width:"1726",height:"754"})]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Export to Amazon EC2"}),(0,i.jsx)(s.br,{}),"\n","After creating the snapshot, select the option to ",(0,i.jsx)(s.strong,{children:"Export to Amazon EC2"}),".",(0,i.jsx)(s.br,{}),"\n",(0,i.jsx)(s.img,{alt:"Export to EC2",src:e(39296).A+"",width:"792",height:"400"})]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Import the EC2 EBS Snapshot"}),(0,i.jsx)(s.br,{}),"\n","Once the snapshot is exported to EC2, you can import it as an ",(0,i.jsx)(s.a,{href:"/cado/discovery-import/aws/aws-ami",children:"EC2 EBS Snapshot"})," using the usual method."]}),"\n"]}),"\n"]})]})}function h(t={}){const{wrapper:s}={...(0,o.R)(),...t.components};return s?(0,i.jsx)(s,{...t,children:(0,i.jsx)(d,{...t})}):d(t)}},39296:(t,s,e)=>{e.d(s,{A:()=>i});const i=e.p+"assets/images/export-to-ec2-b2fd37635edeb8102479cf1f70fe3f3c.png"},39814:(t,s,e)=>{e.d(s,{A:()=>i});const i=e.p+"assets/images/make-lightsail-snapshot-9894163b91251b110641ff1fd3129e3f.png"},28453:(t,s,e)=>{e.d(s,{R:()=>r,x:()=>a});var i=e(96540);const o={},n=i.createContext(o);function r(t){const s=i.useContext(n);return i.useMemo((function(){return"function"==typeof t?t(s):{...s,...t}}),[s,t])}function a(t){let s;return s=t.disableParentContext?"function"==typeof t.components?t.components(o):t.components||o:r(t.components),i.createElement(n.Provider,{value:s},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/ceeff64a.476c2367.js b/assets/js/ceeff64a.18885a5d.js similarity index 96% rename from assets/js/ceeff64a.476c2367.js rename to assets/js/ceeff64a.18885a5d.js index 7cd7bdad4..a12d74b9d 100644 --- a/assets/js/ceeff64a.476c2367.js +++ b/assets/js/ceeff64a.18885a5d.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9143],{95066:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>u,frontMatter:()=>a,metadata:()=>s,toc:()=>l});var r=o(74848),i=o(28453);const a={title:"Platform security",hide_title:!0,sidebar_position:13},n="How Does Cado Security Keep Your Data Safe?",s={id:"cado/manage/platform-security",title:"Platform security",description:"At Cado Security, we prioritize security throughout the entire development process, from the initial idea to the final product. Every aspect is built with robust security measures to ensure smooth operations and strong protection for your data.",source:"@site/docs/cado/manage/platform-security.md",sourceDirName:"cado/manage",slug:"/cado/manage/platform-security",permalink:"/cado/manage/platform-security",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/platform-security.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:13,frontMatter:{title:"Platform security",hide_title:!0,sidebar_position:13},sidebar:"tutorialSidebar",previous:{title:"Monitor platform health",permalink:"/cado/manage/monitoring"},next:{title:"How to get support",permalink:"/troubleshooting/get-support"}},c={},l=[{value:"Audit Logs",id:"audit-logs",level:2}];function d(e){const t={a:"a",h1:"h1",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"how-does-cado-security-keep-your-data-safe",children:"How Does Cado Security Keep Your Data Safe?"}),"\n",(0,r.jsx)(t.p,{children:"At Cado Security, we prioritize security throughout the entire development process, from the initial idea to the final product. Every aspect is built with robust security measures to ensure smooth operations and strong protection for your data."}),"\n",(0,r.jsxs)(t.p,{children:["For more information, contact ",(0,r.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," to learn more about:"]}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Product Security"}),": Features such as audit logging, role-based access control (RBAC), authentication, and encryption."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Corporate Security"}),": Our approach to hiring checks and employee security training."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Our Policies"}),": Compliance with SOC2, company policies, and vendor management."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Application Security"}),": Practices like secure software development lifecycle (SDLC) and regular penetration testing."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"audit-logs",children:"Audit Logs"}),"\n",(0,r.jsxs)(t.p,{children:["Audit logs are viewable via the user interface at Help > View Audit Logs and can be exported.\nThey are also available via the API, or by forwarding to ",(0,r.jsx)(t.a,{href:"/troubleshooting/logs-cloudwatch",children:"Cloudwatch"})," or another SIEM. They are persisted on disk under /var/log."]})]})}function u(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>n,x:()=>s});var r=o(96540);const i={},a=r.createContext(i);function n(e){const t=r.useContext(a);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),r.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9143],{95066:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>u,frontMatter:()=>a,metadata:()=>s,toc:()=>l});var r=o(74848),i=o(28453);const a={title:"Platform security",hide_title:!0,sidebar_position:13},n="How Does Cado Security Keep Your Data Safe?",s={id:"cado/manage/platform-security",title:"Platform security",description:"At Cado Security, we prioritize security throughout the entire development process, from the initial idea to the final product. Every aspect is built with robust security measures to ensure smooth operations and strong protection for your data.",source:"@site/docs/cado/manage/platform-security.md",sourceDirName:"cado/manage",slug:"/cado/manage/platform-security",permalink:"/cado/manage/platform-security",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/manage/platform-security.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:13,frontMatter:{title:"Platform security",hide_title:!0,sidebar_position:13},sidebar:"tutorialSidebar",previous:{title:"Monitor platform health",permalink:"/cado/manage/monitoring"},next:{title:"How to get support",permalink:"/troubleshooting/get-support"}},c={},l=[{value:"Audit Logs",id:"audit-logs",level:2}];function d(e){const t={a:"a",h1:"h1",h2:"h2",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"how-does-cado-security-keep-your-data-safe",children:"How Does Cado Security Keep Your Data Safe?"}),"\n",(0,r.jsx)(t.p,{children:"At Cado Security, we prioritize security throughout the entire development process, from the initial idea to the final product. Every aspect is built with robust security measures to ensure smooth operations and strong protection for your data."}),"\n",(0,r.jsxs)(t.p,{children:["For more information, contact ",(0,r.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," to learn more about:"]}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Product Security"}),": Features such as audit logging, role-based access control (RBAC), authentication, and encryption."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Corporate Security"}),": Our approach to hiring checks and employee security training."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Our Policies"}),": Compliance with SOC2, company policies, and vendor management."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Application Security"}),": Practices like secure software development lifecycle (SDLC) and regular penetration testing."]}),"\n"]}),"\n",(0,r.jsx)(t.h2,{id:"audit-logs",children:"Audit Logs"}),"\n",(0,r.jsxs)(t.p,{children:["Audit logs are viewable via the user interface at Help > View Audit Logs and can be exported.\nThey are also available via the API, or by forwarding to ",(0,r.jsx)(t.a,{href:"/troubleshooting/logs-cloudwatch",children:"Cloudwatch"})," or another SIEM. They are persisted on disk under /var/log."]})]})}function u(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>n,x:()=>s});var r=o(96540);const i={},a=r.createContext(i);function n(e){const t=r.useContext(a);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),r.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cfa6ff54.5c00df29.js b/assets/js/cfa6ff54.d873c613.js similarity index 95% rename from assets/js/cfa6ff54.5c00df29.js rename to assets/js/cfa6ff54.d873c613.js index 6bc2f059a..e29ca5dd6 100644 --- a/assets/js/cfa6ff54.5c00df29.js +++ b/assets/js/cfa6ff54.d873c613.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[14],{35601:(e,a,i)=>{i.r(a),i.d(a,{assets:()=>s,contentTitle:()=>r,default:()=>p,frontMatter:()=>n,metadata:()=>l,toc:()=>c});var t=i(74848),o=i(28453);const n={title:"High availability",hide_title:!0,sidebar_position:3},r="How does high availability work in Cado?",l={id:"cado/deploy/aws/performance-resiliency/high-availability",title:"High availability",description:"The Cado platform can be deployed in a High Availability (HA) configuration allowing a multi-AZ deployment using managed services and an auto-scaling group with a load balancer. This deployment adds complexity, but may be required in some environments that require high availability due to regulatory or operational requirements. To deploy with HA, please contact the Cado Sales team at sales@cadosecurity.com.",source:"@site/docs/cado/deploy/aws/performance-resiliency/high-availability.md",sourceDirName:"cado/deploy/aws/performance-resiliency",slug:"/cado/deploy/aws/performance-resiliency/high-availability",permalink:"/cado/deploy/aws/performance-resiliency/high-availability",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/performance-resiliency/high-availability.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"High availability",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Backup and recover",permalink:"/cado/deploy/aws/performance-resiliency/aws-backups"},next:{title:"Azure Terraform deployment",permalink:"/cado/deploy/azure/azure-deploy"}},s={},c=[];function d(e){const a={a:"a",h1:"h1",img:"img",p:"p",...(0,o.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(a.h1,{id:"how-does-high-availability-work-in-cado",children:"How does high availability work in Cado?"}),"\n",(0,t.jsxs)(a.p,{children:["The Cado platform can be deployed in a High Availability (HA) configuration allowing a multi-AZ deployment using managed services and an auto-scaling group with a load balancer. This deployment adds complexity, but may be required in some environments that require high availability due to regulatory or operational requirements. To deploy with HA, please contact the Cado Sales team at ",(0,t.jsx)(a.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]}),"\n",(0,t.jsx)(a.p,{children:(0,t.jsx)(a.img,{alt:"High Availability",src:i(43132).A+"",width:"830",height:"470"})})]})}function p(e={}){const{wrapper:a}={...(0,o.R)(),...e.components};return a?(0,t.jsx)(a,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},43132:(e,a,i)=>{i.d(a,{A:()=>t});const t=i.p+"assets/images/ha-8af5d6ec769ce02b13e72e2e503b8f77.png"},28453:(e,a,i)=>{i.d(a,{R:()=>r,x:()=>l});var t=i(96540);const o={},n=t.createContext(o);function r(e){const a=t.useContext(n);return t.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function l(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),t.createElement(n.Provider,{value:a},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[14],{35601:(e,a,i)=>{i.r(a),i.d(a,{assets:()=>s,contentTitle:()=>r,default:()=>p,frontMatter:()=>n,metadata:()=>l,toc:()=>c});var t=i(74848),o=i(28453);const n={title:"High availability",hide_title:!0,sidebar_position:3},r="How does high availability work in Cado?",l={id:"cado/deploy/aws/performance-resiliency/high-availability",title:"High availability",description:"The Cado platform can be deployed in a High Availability (HA) configuration allowing a multi-AZ deployment using managed services and an auto-scaling group with a load balancer. This deployment adds complexity, but may be required in some environments that require high availability due to regulatory or operational requirements. To deploy with HA, please contact the Cado Sales team at sales@cadosecurity.com.",source:"@site/docs/cado/deploy/aws/performance-resiliency/high-availability.md",sourceDirName:"cado/deploy/aws/performance-resiliency",slug:"/cado/deploy/aws/performance-resiliency/high-availability",permalink:"/cado/deploy/aws/performance-resiliency/high-availability",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/performance-resiliency/high-availability.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"High availability",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Backup and recover",permalink:"/cado/deploy/aws/performance-resiliency/aws-backups"},next:{title:"Azure Terraform deployment",permalink:"/cado/deploy/azure/azure-deploy"}},s={},c=[];function d(e){const a={a:"a",h1:"h1",img:"img",p:"p",...(0,o.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(a.h1,{id:"how-does-high-availability-work-in-cado",children:"How does high availability work in Cado?"}),"\n",(0,t.jsxs)(a.p,{children:["The Cado platform can be deployed in a High Availability (HA) configuration allowing a multi-AZ deployment using managed services and an auto-scaling group with a load balancer. This deployment adds complexity, but may be required in some environments that require high availability due to regulatory or operational requirements. To deploy with HA, please contact the Cado Sales team at ",(0,t.jsx)(a.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]}),"\n",(0,t.jsx)(a.p,{children:(0,t.jsx)(a.img,{alt:"High Availability",src:i(43132).A+"",width:"830",height:"470"})})]})}function p(e={}){const{wrapper:a}={...(0,o.R)(),...e.components};return a?(0,t.jsx)(a,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},43132:(e,a,i)=>{i.d(a,{A:()=>t});const t=i.p+"assets/images/ha-8af5d6ec769ce02b13e72e2e503b8f77.png"},28453:(e,a,i)=>{i.d(a,{R:()=>r,x:()=>l});var t=i(96540);const o={},n=t.createContext(o);function r(e){const a=t.useContext(n);return t.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function l(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),t.createElement(n.Provider,{value:a},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d10ed510.f4f2f88d.js b/assets/js/d10ed510.14b8392e.js similarity index 97% rename from assets/js/d10ed510.f4f2f88d.js rename to assets/js/d10ed510.14b8392e.js index d5cfd39d0..1e20d51b3 100644 --- a/assets/js/d10ed510.f4f2f88d.js +++ b/assets/js/d10ed510.14b8392e.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2577],{16640:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var i=s(74848),n=s(28453);const o={title:"Browse Disk",hide_title:!0,sidebar_position:4},r="How to Browse the Disk",c={id:"cado/investigate/browse-disk",title:"Browse Disk",description:"You can explore the disk by either:",source:"@site/docs/cado/investigate/browse-disk.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/browse-disk",permalink:"/cado/investigate/browse-disk",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/browse-disk.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"Browse Disk",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Automated Investigation",permalink:"/cado/investigate/automated-investigation"},next:{title:"Response actions",permalink:"/cado/investigate/response-actions"}},a={},d=[];function l(e){const t={h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-browse-the-disk",children:"How to Browse the Disk"}),"\n",(0,i.jsx)(t.p,{children:"You can explore the disk by either:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Selecting the ",(0,i.jsx)(t.strong,{children:'"Browse Disk"'})," option from the ",(0,i.jsx)(t.strong,{children:"Evidence"})," tab."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Browse Disk",src:s(89150).A+"",width:"3358",height:"526"})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Selecting a specific path while viewing a file."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Browse Disk",src:s(1053).A+"",width:"486",height:"98"})}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Once you select the option, you'll be able to navigate through the disk and choose specific files."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Browse Disk",src:s(26727).A+"",width:"3252",height:"766"})})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},89150:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/evidence-disk-3cdae40d061fc944ea8976388700963d.png"},1053:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/file-disk-fc189fbf5cde191daf5fe6029743c75e.png"},26727:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/tutorial8-9795606cfc0a5b81b0d3b42608904af7.png"},28453:(e,t,s)=>{s.d(t,{R:()=>r,x:()=>c});var i=s(96540);const n={},o=i.createContext(n);function r(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2577],{16640:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var i=s(74848),n=s(28453);const o={title:"Browse Disk",hide_title:!0,sidebar_position:4},r="How to Browse the Disk",c={id:"cado/investigate/browse-disk",title:"Browse Disk",description:"You can explore the disk by either:",source:"@site/docs/cado/investigate/browse-disk.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/browse-disk",permalink:"/cado/investigate/browse-disk",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/browse-disk.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"Browse Disk",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Automated Investigation",permalink:"/cado/investigate/automated-investigation"},next:{title:"Response actions",permalink:"/cado/investigate/response-actions"}},a={},d=[];function l(e){const t={h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-browse-the-disk",children:"How to Browse the Disk"}),"\n",(0,i.jsx)(t.p,{children:"You can explore the disk by either:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:["Selecting the ",(0,i.jsx)(t.strong,{children:'"Browse Disk"'})," option from the ",(0,i.jsx)(t.strong,{children:"Evidence"})," tab."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Browse Disk",src:s(89150).A+"",width:"3358",height:"526"})}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Selecting a specific path while viewing a file."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Browse Disk",src:s(1053).A+"",width:"486",height:"98"})}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Once you select the option, you'll be able to navigate through the disk and choose specific files."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Browse Disk",src:s(26727).A+"",width:"3252",height:"766"})})]})}function h(e={}){const{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},89150:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/evidence-disk-3cdae40d061fc944ea8976388700963d.png"},1053:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/file-disk-fc189fbf5cde191daf5fe6029743c75e.png"},26727:(e,t,s)=>{s.d(t,{A:()=>i});const i=s.p+"assets/images/tutorial8-9795606cfc0a5b81b0d3b42608904af7.png"},28453:(e,t,s)=>{s.d(t,{R:()=>r,x:()=>c});var i=s(96540);const n={},o=i.createContext(n);function r(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d1455ea6.6490c58b.js b/assets/js/d1455ea6.cb9ef66c.js similarity index 98% rename from assets/js/d1455ea6.6490c58b.js rename to assets/js/d1455ea6.cb9ef66c.js index 15d8f7664..4ab706b61 100644 --- a/assets/js/d1455ea6.6490c58b.js +++ b/assets/js/d1455ea6.cb9ef66c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1520],{44628:(t,e,n)=>{n.r(e),n.d(e,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>s,toc:()=>d});var a=n(74848),o=n(28453);const i={title:"AWS China",hide_title:!0,sidebar_position:10},r="How to Import from AWS China",s={id:"cado/discovery-import/aws/aws-china",title:"AWS China",description:"The Cado platform does not currently support direct deployment into AWS China regions. The following guidance should be considered in accordance with your organization\u2019s policies and local regulations regarding cross-border data transfers.",source:"@site/docs/cado/discovery-import/aws/aws-china.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-china",permalink:"/cado/discovery-import/aws/aws-china",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-china.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:10,frontMatter:{title:"AWS China",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Lightsail",permalink:"/cado/discovery-import/aws/aws-lightsail"},next:{title:"Import large EC2 instances",permalink:"/cado/discovery-import/aws/large-aws-imports"}},c={},d=[{value:"Collecting Data Using Cado Host",id:"collecting-data-using-cado-host",level:3},{value:"Manually Acquiring Data from AWS China",id:"manually-acquiring-data-from-aws-china",level:3},{value:"Syncing Data Using External Tools",id:"syncing-data-using-external-tools",level:3}];function l(t){const e={a:"a",h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...t.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(e.h1,{id:"how-to-import-from-aws-china",children:"How to Import from AWS China"}),"\n",(0,a.jsx)(e.p,{children:"The Cado platform does not currently support direct deployment into AWS China regions. The following guidance should be considered in accordance with your organization\u2019s policies and local regulations regarding cross-border data transfers."}),"\n",(0,a.jsx)(e.h3,{id:"collecting-data-using-cado-host",children:"Collecting Data Using Cado Host"}),"\n",(0,a.jsxs)(e.p,{children:["You can use ",(0,a.jsx)(e.strong,{children:"Cado Host"})," to collect data from any system in AWS China, as long as it has an outgoing internet connection. This data can then be transferred to your primary Cado instance in a supported global AWS region."]}),"\n",(0,a.jsx)(e.h3,{id:"manually-acquiring-data-from-aws-china",children:"Manually Acquiring Data from AWS China"}),"\n",(0,a.jsx)(e.p,{children:"To manually transfer data from AWS China regions, you can use the AWS CLI to copy the data to a Cado-supported region. For assistance with transferring data between AWS partitions, contact AWS Support."}),"\n",(0,a.jsx)(e.h3,{id:"syncing-data-using-external-tools",children:"Syncing Data Using External Tools"}),"\n",(0,a.jsx)(e.p,{children:"Several AWS and third-party tools can help sync data between regions. However, these tools are not officially supported or endorsed by Cado Security. Examples include:"}),"\n",(0,a.jsxs)(e.ul,{children:["\n",(0,a.jsx)(e.li,{children:(0,a.jsx)(e.a,{href:"https://github.com/issacg/s3sync",children:"s3sync on GitHub"})}),"\n",(0,a.jsx)(e.li,{children:(0,a.jsx)(e.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-store-restore.html",children:"AWS Guide on AMI Store and Restore"})}),"\n"]})]})}function h(t={}){const{wrapper:e}={...(0,o.R)(),...t.components};return e?(0,a.jsx)(e,{...t,children:(0,a.jsx)(l,{...t})}):l(t)}},28453:(t,e,n)=>{n.d(e,{R:()=>r,x:()=>s});var a=n(96540);const o={},i=a.createContext(o);function r(t){const e=a.useContext(i);return a.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function s(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(o):t.components||o:r(t.components),a.createElement(i.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1520],{44628:(t,e,n)=>{n.r(e),n.d(e,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>s,toc:()=>d});var a=n(74848),o=n(28453);const i={title:"AWS China",hide_title:!0,sidebar_position:10},r="How to Import from AWS China",s={id:"cado/discovery-import/aws/aws-china",title:"AWS China",description:"The Cado platform does not currently support direct deployment into AWS China regions. The following guidance should be considered in accordance with your organization\u2019s policies and local regulations regarding cross-border data transfers.",source:"@site/docs/cado/discovery-import/aws/aws-china.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-china",permalink:"/cado/discovery-import/aws/aws-china",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-china.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:10,frontMatter:{title:"AWS China",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Lightsail",permalink:"/cado/discovery-import/aws/aws-lightsail"},next:{title:"Import large EC2 instances",permalink:"/cado/discovery-import/aws/large-aws-imports"}},c={},d=[{value:"Collecting Data Using Cado Host",id:"collecting-data-using-cado-host",level:3},{value:"Manually Acquiring Data from AWS China",id:"manually-acquiring-data-from-aws-china",level:3},{value:"Syncing Data Using External Tools",id:"syncing-data-using-external-tools",level:3}];function l(t){const e={a:"a",h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...t.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(e.h1,{id:"how-to-import-from-aws-china",children:"How to Import from AWS China"}),"\n",(0,a.jsx)(e.p,{children:"The Cado platform does not currently support direct deployment into AWS China regions. The following guidance should be considered in accordance with your organization\u2019s policies and local regulations regarding cross-border data transfers."}),"\n",(0,a.jsx)(e.h3,{id:"collecting-data-using-cado-host",children:"Collecting Data Using Cado Host"}),"\n",(0,a.jsxs)(e.p,{children:["You can use ",(0,a.jsx)(e.strong,{children:"Cado Host"})," to collect data from any system in AWS China, as long as it has an outgoing internet connection. This data can then be transferred to your primary Cado instance in a supported global AWS region."]}),"\n",(0,a.jsx)(e.h3,{id:"manually-acquiring-data-from-aws-china",children:"Manually Acquiring Data from AWS China"}),"\n",(0,a.jsx)(e.p,{children:"To manually transfer data from AWS China regions, you can use the AWS CLI to copy the data to a Cado-supported region. For assistance with transferring data between AWS partitions, contact AWS Support."}),"\n",(0,a.jsx)(e.h3,{id:"syncing-data-using-external-tools",children:"Syncing Data Using External Tools"}),"\n",(0,a.jsx)(e.p,{children:"Several AWS and third-party tools can help sync data between regions. However, these tools are not officially supported or endorsed by Cado Security. Examples include:"}),"\n",(0,a.jsxs)(e.ul,{children:["\n",(0,a.jsx)(e.li,{children:(0,a.jsx)(e.a,{href:"https://github.com/issacg/s3sync",children:"s3sync on GitHub"})}),"\n",(0,a.jsx)(e.li,{children:(0,a.jsx)(e.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-store-restore.html",children:"AWS Guide on AMI Store and Restore"})}),"\n"]})]})}function h(t={}){const{wrapper:e}={...(0,o.R)(),...t.components};return e?(0,a.jsx)(e,{...t,children:(0,a.jsx)(l,{...t})}):l(t)}},28453:(t,e,n)=>{n.d(e,{R:()=>r,x:()=>s});var a=n(96540);const o={},i=a.createContext(o);function r(t){const e=a.useContext(i);return a.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function s(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(o):t.components||o:r(t.components),a.createElement(i.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/d2273799.59201708.js b/assets/js/d2273799.656ab87e.js similarity index 97% rename from assets/js/d2273799.59201708.js rename to assets/js/d2273799.656ab87e.js index 5b6d7a7f4..0b6952d02 100644 --- a/assets/js/d2273799.59201708.js +++ b/assets/js/d2273799.656ab87e.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8252],{80998:(s,t,e)=>{e.r(t),e.d(t,{assets:()=>d,contentTitle:()=>n,default:()=>l,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var i=e(74848),a=e(28453);const o={title:"AMI, EBS Snapshot and Volume",hide_title:!0,sidebar_position:3},n="How to Import AWS AMIs, EBS Snapshots, and Volumes",r={id:"cado/discovery-import/aws/aws-ami",title:"AMI, EBS Snapshot and Volume",description:"The Cado platform allows you to acquire AWS AMIs, EBS Snapshots, or Volumes using either a cross-account role or by directly sharing the image or snapshot with the Cado AWS account.",source:"@site/docs/cado/discovery-import/aws/aws-ami.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-ami",permalink:"/cado/discovery-import/aws/aws-ami",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-ami.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"AMI, EBS Snapshot and Volume",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"S3",permalink:"/cado/discovery-import/aws/aws-s3"},next:{title:"ECS",permalink:"/cado/discovery-import/aws/aws-ecs"}},d={},c=[{value:"Sharing AMIs and Snapshots",id:"sharing-amis-and-snapshots",level:3},{value:"Steps to Import",id:"steps-to-import",level:3},{value:"Data Flow Diagrams",id:"data-flow-diagrams",level:2},{value:"Original Acquisition via EBS Snapshots",id:"original-acquisition-via-ebs-snapshots",level:3},{value:"Faster Acquisition via EBS Direct API",id:"faster-acquisition-via-ebs-direct-api",level:3}];function h(s){const t={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,a.R)(),...s.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-aws-amis-ebs-snapshots-and-volumes",children:"How to Import AWS AMIs, EBS Snapshots, and Volumes"}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform allows you to acquire AWS AMIs, EBS Snapshots, or Volumes using either a cross-account role or by directly sharing the image or snapshot with the Cado AWS account."}),"\n",(0,i.jsx)(t.h3,{id:"sharing-amis-and-snapshots",children:"Sharing AMIs and Snapshots"}),"\n",(0,i.jsx)(t.p,{children:"If you're sharing an AMI, make sure to also share the underlying snapshots:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Edit AMI Permissions"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Tick the option ",(0,i.jsx)(t.strong,{children:"Add 'Create volume' permission"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["For detailed steps, refer to the official AWS guide: ",(0,i.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html",children:"Share an Amazon EBS Snapshot"}),"."]}),"\n",(0,i.jsx)(t.h3,{id:"steps-to-import",children:"Steps to Import"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Select the Region"})," where your data is stored."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Specify the Identifier"})," for the AMI, Snapshot, or Volume you wish to import."]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Review and confirm the details, then click ",(0,i.jsx)(t.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS AMI",src:e(20678).A+"",width:"952",height:"572"})}),"\n",(0,i.jsx)(t.h2,{id:"data-flow-diagrams",children:"Data Flow Diagrams"}),"\n",(0,i.jsx)(t.h3,{id:"original-acquisition-via-ebs-snapshots",children:"Original Acquisition via EBS Snapshots"}),"\n",(0,i.jsx)(t.p,{children:"The diagram below outlines the traditional method of acquiring data using EBS Snapshots:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EBS Snapshots",src:e(73409).A+"",width:"1958",height:"1024"})}),"\n",(0,i.jsx)(t.h3,{id:"faster-acquisition-via-ebs-direct-api",children:"Faster Acquisition via EBS Direct API"}),"\n",(0,i.jsxs)(t.p,{children:["Cado now supports a faster acquisition method using the ",(0,i.jsx)(t.strong,{children:"EBS Direct API"}),", which speeds up the data acquisition process:"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EBS Direct API",src:e(41330).A+"",width:"1782",height:"806"})})]})}function l(s={}){const{wrapper:t}={...(0,a.R)(),...s.components};return t?(0,i.jsx)(t,{...s,children:(0,i.jsx)(h,{...s})}):h(s)}},20678:(s,t,e)=>{e.d(t,{A:()=>i});const i=e.p+"assets/images/aws-ami-9b219e37b57c6e0439b69c9297fa4467.png"},41330:(s,t,e)=>{e.d(t,{A:()=>i});const i=e.p+"assets/images/aws-snapshot-ebs-b53b07ba95129e304247f717a97f4383.png"},73409:(s,t,e)=>{e.d(t,{A:()=>i});const i=e.p+"assets/images/aws-snapshot-70ce8f8f136d2ea87a7093bf3d3c6fd1.png"},28453:(s,t,e)=>{e.d(t,{R:()=>n,x:()=>r});var i=e(96540);const a={},o=i.createContext(a);function n(s){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof s?s(t):{...t,...s}}),[t,s])}function r(s){let t;return t=s.disableParentContext?"function"==typeof s.components?s.components(a):s.components||a:n(s.components),i.createElement(o.Provider,{value:t},s.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8252],{80998:(s,t,e)=>{e.r(t),e.d(t,{assets:()=>d,contentTitle:()=>n,default:()=>l,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var i=e(74848),a=e(28453);const o={title:"AMI, EBS Snapshot and Volume",hide_title:!0,sidebar_position:3},n="How to Import AWS AMIs, EBS Snapshots, and Volumes",r={id:"cado/discovery-import/aws/aws-ami",title:"AMI, EBS Snapshot and Volume",description:"The Cado platform allows you to acquire AWS AMIs, EBS Snapshots, or Volumes using either a cross-account role or by directly sharing the image or snapshot with the Cado AWS account.",source:"@site/docs/cado/discovery-import/aws/aws-ami.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-ami",permalink:"/cado/discovery-import/aws/aws-ami",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-ami.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"AMI, EBS Snapshot and Volume",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"S3",permalink:"/cado/discovery-import/aws/aws-s3"},next:{title:"ECS",permalink:"/cado/discovery-import/aws/aws-ecs"}},d={},c=[{value:"Sharing AMIs and Snapshots",id:"sharing-amis-and-snapshots",level:3},{value:"Steps to Import",id:"steps-to-import",level:3},{value:"Data Flow Diagrams",id:"data-flow-diagrams",level:2},{value:"Original Acquisition via EBS Snapshots",id:"original-acquisition-via-ebs-snapshots",level:3},{value:"Faster Acquisition via EBS Direct API",id:"faster-acquisition-via-ebs-direct-api",level:3}];function h(s){const t={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,a.R)(),...s.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-aws-amis-ebs-snapshots-and-volumes",children:"How to Import AWS AMIs, EBS Snapshots, and Volumes"}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform allows you to acquire AWS AMIs, EBS Snapshots, or Volumes using either a cross-account role or by directly sharing the image or snapshot with the Cado AWS account."}),"\n",(0,i.jsx)(t.h3,{id:"sharing-amis-and-snapshots",children:"Sharing AMIs and Snapshots"}),"\n",(0,i.jsx)(t.p,{children:"If you're sharing an AMI, make sure to also share the underlying snapshots:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Edit AMI Permissions"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Tick the option ",(0,i.jsx)(t.strong,{children:"Add 'Create volume' permission"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["For detailed steps, refer to the official AWS guide: ",(0,i.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html",children:"Share an Amazon EBS Snapshot"}),"."]}),"\n",(0,i.jsx)(t.h3,{id:"steps-to-import",children:"Steps to Import"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Select the Region"})," where your data is stored."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Specify the Identifier"})," for the AMI, Snapshot, or Volume you wish to import."]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Review and confirm the details, then click ",(0,i.jsx)(t.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"AWS AMI",src:e(20678).A+"",width:"952",height:"572"})}),"\n",(0,i.jsx)(t.h2,{id:"data-flow-diagrams",children:"Data Flow Diagrams"}),"\n",(0,i.jsx)(t.h3,{id:"original-acquisition-via-ebs-snapshots",children:"Original Acquisition via EBS Snapshots"}),"\n",(0,i.jsx)(t.p,{children:"The diagram below outlines the traditional method of acquiring data using EBS Snapshots:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EBS Snapshots",src:e(73409).A+"",width:"1958",height:"1024"})}),"\n",(0,i.jsx)(t.h3,{id:"faster-acquisition-via-ebs-direct-api",children:"Faster Acquisition via EBS Direct API"}),"\n",(0,i.jsxs)(t.p,{children:["Cado now supports a faster acquisition method using the ",(0,i.jsx)(t.strong,{children:"EBS Direct API"}),", which speeds up the data acquisition process:"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"EBS Direct API",src:e(41330).A+"",width:"1782",height:"806"})})]})}function l(s={}){const{wrapper:t}={...(0,a.R)(),...s.components};return t?(0,i.jsx)(t,{...s,children:(0,i.jsx)(h,{...s})}):h(s)}},20678:(s,t,e)=>{e.d(t,{A:()=>i});const i=e.p+"assets/images/aws-ami-9b219e37b57c6e0439b69c9297fa4467.png"},41330:(s,t,e)=>{e.d(t,{A:()=>i});const i=e.p+"assets/images/aws-snapshot-ebs-b53b07ba95129e304247f717a97f4383.png"},73409:(s,t,e)=>{e.d(t,{A:()=>i});const i=e.p+"assets/images/aws-snapshot-70ce8f8f136d2ea87a7093bf3d3c6fd1.png"},28453:(s,t,e)=>{e.d(t,{R:()=>n,x:()=>r});var i=e(96540);const a={},o=i.createContext(a);function n(s){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof s?s(t):{...t,...s}}),[t,s])}function r(s){let t;return t=s.disableParentContext?"function"==typeof s.components?s.components(a):s.components||a:n(s.components),i.createElement(o.Provider,{value:t},s.children)}}}]); \ No newline at end of file diff --git a/assets/js/d2932d7e.c991859c.js b/assets/js/d2932d7e.ca0c38dd.js similarity index 98% rename from assets/js/d2932d7e.c991859c.js rename to assets/js/d2932d7e.ca0c38dd.js index 15d46ff49..d08b01a36 100644 --- a/assets/js/d2932d7e.c991859c.js +++ b/assets/js/d2932d7e.ca0c38dd.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1231],{9115:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>i,default:()=>p,frontMatter:()=>s,metadata:()=>a,toc:()=>l});var r=n(74848),o=n(28453);const s={title:"Workers",hide_title:!0,sidebar_position:7},i="Workers",a={id:"cado/deploy/azure/azure-workers",title:"Workers",description:"The initial deployment runs everything on a single Compute instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures. We also limit how many pieces of evidence can be processed at once.",source:"@site/docs/cado/deploy/azure/azure-workers.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-workers",permalink:"/cado/deploy/azure/azure-workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-workers.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{title:"Workers",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"IAM permissions description",permalink:"/cado/deploy/azure/iam-description"},next:{title:"NFS",permalink:"/cado/deploy/azure/azure-nfs"}},d={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function c(e){const t={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"workers",children:"Workers"}),"\n",(0,r.jsx)(t.p,{children:"The initial deployment runs everything on a single Compute instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures. We also limit how many pieces of evidence can be processed at once."}),"\n",(0,r.jsx)(t.p,{children:"To enable processing data from all sources or to process many items of evidence at once, Cado must be configured to allow it to run imports on additional Compute instances."}),"\n",(0,r.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"A \u201cUser Assigned Managed Identity\u201d named \u201ccado-identity\u201d attached to the VM"}),"\n",(0,r.jsx)(t.li,{children:"The \u201cContributor\u201d Role Assignment scoped to your resource group attached to the identity"}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Enable in the UI: ",(0,r.jsx)(t.strong,{children:"Settings"})," > ",(0,r.jsx)(t.strong,{children:"Advanced"})," > ",(0,r.jsx)(t.strong,{children:"Deployed Workers"})," > Enable Deployed Workers"]}),"\n",(0,r.jsxs)(t.li,{children:["Got to ",(0,r.jsx)(t.strong,{children:"Platform"})," > ",(0,r.jsx)(t.strong,{children:"Run a Platform Check"})]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"EBS Workers",src:n(70951).A+"",width:"1071",height:"181"})})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},70951:(e,t,n)=>{n.d(t,{A:()=>r});const r=n.p+"assets/images/ebs-workers-eafb309374befed993e98677ebdded68.png"},28453:(e,t,n)=>{n.d(t,{R:()=>i,x:()=>a});var r=n(96540);const o={},s=r.createContext(o);function i(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1231],{9115:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>i,default:()=>p,frontMatter:()=>s,metadata:()=>a,toc:()=>l});var r=n(74848),o=n(28453);const s={title:"Workers",hide_title:!0,sidebar_position:7},i="Workers",a={id:"cado/deploy/azure/azure-workers",title:"Workers",description:"The initial deployment runs everything on a single Compute instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures. We also limit how many pieces of evidence can be processed at once.",source:"@site/docs/cado/deploy/azure/azure-workers.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-workers",permalink:"/cado/deploy/azure/azure-workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-workers.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{title:"Workers",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"IAM permissions description",permalink:"/cado/deploy/azure/iam-description"},next:{title:"NFS",permalink:"/cado/deploy/azure/azure-nfs"}},d={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function c(e){const t={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"workers",children:"Workers"}),"\n",(0,r.jsx)(t.p,{children:"The initial deployment runs everything on a single Compute instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures. We also limit how many pieces of evidence can be processed at once."}),"\n",(0,r.jsx)(t.p,{children:"To enable processing data from all sources or to process many items of evidence at once, Cado must be configured to allow it to run imports on additional Compute instances."}),"\n",(0,r.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"A \u201cUser Assigned Managed Identity\u201d named \u201ccado-identity\u201d attached to the VM"}),"\n",(0,r.jsx)(t.li,{children:"The \u201cContributor\u201d Role Assignment scoped to your resource group attached to the identity"}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Enable in the UI: ",(0,r.jsx)(t.strong,{children:"Settings"})," > ",(0,r.jsx)(t.strong,{children:"Advanced"})," > ",(0,r.jsx)(t.strong,{children:"Deployed Workers"})," > Enable Deployed Workers"]}),"\n",(0,r.jsxs)(t.li,{children:["Got to ",(0,r.jsx)(t.strong,{children:"Platform"})," > ",(0,r.jsx)(t.strong,{children:"Run a Platform Check"})]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"EBS Workers",src:n(70951).A+"",width:"1071",height:"181"})})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},70951:(e,t,n)=>{n.d(t,{A:()=>r});const r=n.p+"assets/images/ebs-workers-eafb309374befed993e98677ebdded68.png"},28453:(e,t,n)=>{n.d(t,{R:()=>i,x:()=>a});var r=n(96540);const o={},s=r.createContext(o);function i(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d2d32e4b.594db155.js b/assets/js/d2d32e4b.af2ca81f.js similarity index 96% rename from assets/js/d2d32e4b.594db155.js rename to assets/js/d2d32e4b.af2ca81f.js index a8087bea7..bfa913071 100644 --- a/assets/js/d2d32e4b.594db155.js +++ b/assets/js/d2d32e4b.af2ca81f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1563],{92867:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>l});var i=n(74848),o=n(28453);const a={title:"Wiz",hide_title:!0,sidebar_position:1},s="How to Integrate Wiz with Cado",r={id:"cado/integrations/cnapp/wiz",title:"Wiz",description:"The Cado platform automates the processing and analysis of AWS EC2 EBS volumes acquired through the Wiz platform. By integrating Wiz with Cado, you can seamlessly automate the collection, processing, and analysis of AWS EC2 virtual machines without granting Cado direct access to the environment where the EC2 instances are located.",source:"@site/docs/cado/integrations/cnapp/wiz.md",sourceDirName:"cado/integrations/cnapp",slug:"/cado/integrations/cnapp/wiz",permalink:"/cado/integrations/cnapp/wiz",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/cnapp/wiz.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Wiz",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Cortex XSOAR",permalink:"/cado/integrations/soar/cortex-xsoar"},next:{title:"SentinelOne",permalink:"/cado/integrations/xdr/sentinelone"}},c={},l=[{value:"Setup",id:"setup",level:3}];function d(e){const t={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-integrate-wiz-with-cado",children:"How to Integrate Wiz with Cado"}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform automates the processing and analysis of AWS EC2 EBS volumes acquired through the Wiz platform. By integrating Wiz with Cado, you can seamlessly automate the collection, processing, and analysis of AWS EC2 virtual machines without granting Cado direct access to the environment where the EC2 instances are located."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Wiz",src:n(17078).A+"",width:"796",height:"470"})}),"\n",(0,i.jsx)(t.h3,{id:"setup",children:"Setup"}),"\n",(0,i.jsx)(t.p,{children:"To integrate Wiz with Cado, follow these steps:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Navigate to the ",(0,i.jsx)(t.strong,{children:"Detections > Integrations"})," and select ",(0,i.jsx)(t.strong,{children:"Wiz"})," from the set of source providers."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Wiz Integration",src:n(68373).A+"",width:"2652",height:"1412"})}),"\n",(0,i.jsxs)(t.ol,{start:"2",children:["\n",(0,i.jsxs)(t.li,{children:["Give the rule a ",(0,i.jsx)(t.strong,{children:"Name"})," and ",(0,i.jsx)(t.strong,{children:"Description"})," and select ",(0,i.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Add the ",(0,i.jsx)(t.strong,{children:"EBS Tag Key"})," and ",(0,i.jsx)(t.strong,{children:"EBS Tag Value"})," pair for volumes copied by Wiz."]}),"\n",(0,i.jsx)(t.li,{children:"Navigate to the 'Rules' table and the newly created Wiz integration should be present."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Wiz will copy each Volume individually, so each Volume will have a unique Investigation. The Cado platform will automatically create an Investigation for each Volume copied by Wiz."})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},68373:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/integrations-wiz-95817883e174cb42820229057848a9e3.png"},17078:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/wiz-integration-1f4223ae9cb45dd9b2caa2285d07f2b0.png"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>r});var i=n(96540);const o={},a=i.createContext(o);function s(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1563],{92867:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>l});var i=n(74848),o=n(28453);const a={title:"Wiz",hide_title:!0,sidebar_position:1},s="How to Integrate Wiz with Cado",r={id:"cado/integrations/cnapp/wiz",title:"Wiz",description:"The Cado platform automates the processing and analysis of AWS EC2 EBS volumes acquired through the Wiz platform. By integrating Wiz with Cado, you can seamlessly automate the collection, processing, and analysis of AWS EC2 virtual machines without granting Cado direct access to the environment where the EC2 instances are located.",source:"@site/docs/cado/integrations/cnapp/wiz.md",sourceDirName:"cado/integrations/cnapp",slug:"/cado/integrations/cnapp/wiz",permalink:"/cado/integrations/cnapp/wiz",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/cnapp/wiz.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Wiz",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Cortex XSOAR",permalink:"/cado/integrations/soar/cortex-xsoar"},next:{title:"SentinelOne",permalink:"/cado/integrations/xdr/sentinelone"}},c={},l=[{value:"Setup",id:"setup",level:3}];function d(e){const t={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-integrate-wiz-with-cado",children:"How to Integrate Wiz with Cado"}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform automates the processing and analysis of AWS EC2 EBS volumes acquired through the Wiz platform. By integrating Wiz with Cado, you can seamlessly automate the collection, processing, and analysis of AWS EC2 virtual machines without granting Cado direct access to the environment where the EC2 instances are located."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Wiz",src:n(17078).A+"",width:"796",height:"470"})}),"\n",(0,i.jsx)(t.h3,{id:"setup",children:"Setup"}),"\n",(0,i.jsx)(t.p,{children:"To integrate Wiz with Cado, follow these steps:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Navigate to the ",(0,i.jsx)(t.strong,{children:"Detections > Integrations"})," and select ",(0,i.jsx)(t.strong,{children:"Wiz"})," from the set of source providers."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Wiz Integration",src:n(68373).A+"",width:"2652",height:"1412"})}),"\n",(0,i.jsxs)(t.ol,{start:"2",children:["\n",(0,i.jsxs)(t.li,{children:["Give the rule a ",(0,i.jsx)(t.strong,{children:"Name"})," and ",(0,i.jsx)(t.strong,{children:"Description"})," and select ",(0,i.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Add the ",(0,i.jsx)(t.strong,{children:"EBS Tag Key"})," and ",(0,i.jsx)(t.strong,{children:"EBS Tag Value"})," pair for volumes copied by Wiz."]}),"\n",(0,i.jsx)(t.li,{children:"Navigate to the 'Rules' table and the newly created Wiz integration should be present."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Wiz will copy each Volume individually, so each Volume will have a unique Investigation. The Cado platform will automatically create an Investigation for each Volume copied by Wiz."})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},68373:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/integrations-wiz-95817883e174cb42820229057848a9e3.png"},17078:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/wiz-integration-1f4223ae9cb45dd9b2caa2285d07f2b0.png"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>r});var i=n(96540);const o={},a=i.createContext(o);function s(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d2f06d9d.a6ffd595.js b/assets/js/d2f06d9d.b1846eae.js similarity index 98% rename from assets/js/d2f06d9d.a6ffd595.js rename to assets/js/d2f06d9d.b1846eae.js index 7c636002c..9ee952af0 100644 --- a/assets/js/d2f06d9d.a6ffd595.js +++ b/assets/js/d2f06d9d.b1846eae.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9110],{9565:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>d,contentTitle:()=>a,default:()=>p,frontMatter:()=>s,metadata:()=>n,toc:()=>c});var i=o(74848),r=o(28453);const s={title:"Third party disk images & triage",hide_title:!0,sidebar_position:11},a="How to Import On-Premise Disk Images and Triage Collections from Third-Party Tools",n={id:"cado/discovery-import/third-party",title:"Third party disk images & triage",description:"Full Disk Collections using FTK Imager",source:"@site/docs/cado/discovery-import/third-party.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/third-party",permalink:"/cado/discovery-import/third-party",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/third-party.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:11,frontMatter:{title:"Third party disk images & triage",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Microsoft 365 and Entra ID",permalink:"/cado/discovery-import/m365-logs"},next:{title:"Chain of custody",permalink:"/cado/discovery-import/chain_of_custody"}},d={},c=[{value:"Full Disk Collections using FTK Imager",id:"full-disk-collections-using-ftk-imager",level:3},{value:"KAPE and Velociraptor",id:"kape-and-velociraptor",level:3}];function l(e){const t={a:"a",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-on-premise-disk-images-and-triage-collections-from-third-party-tools",children:"How to Import On-Premise Disk Images and Triage Collections from Third-Party Tools"}),"\n",(0,i.jsx)(t.h3,{id:"full-disk-collections-using-ftk-imager",children:"Full Disk Collections using FTK Imager"}),"\n",(0,i.jsx)(t.p,{children:"While triage collections are recommended for being smaller and faster to process, full disk images can also be imported into Cado. You can create these images using tools like FTK Imager, a free tool widely used for forensic disk imaging."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Steps to create a disk image using FTK Imager:"})}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Download FTK Imager from the ",(0,i.jsx)(t.a,{href:"https://www.exterro.com/ftk-product-downloads/ftk-imager-version-4-7-1",children:"Exterro website"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Follow the ",(0,i.jsx)(t.a,{href:"https://cloudnine.com/ediscoverydaily/electronic-discovery/how-to-create-an-image-using-ftk-imager-ediscovery-best-practices/",children:"tutorial"})," on CloudNine to create a disk image."]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["Cado supports importing full disk images in formats such as ",(0,i.jsx)(t.code,{children:".dd"})," and ",(0,i.jsx)(t.code,{children:".e01"}),"."]}),"\n",(0,i.jsx)(t.h3,{id:"kape-and-velociraptor",children:"KAPE and Velociraptor"}),"\n",(0,i.jsxs)(t.p,{children:["Cado also supports forensic collections in ZIP format from open-source tools like ",(0,i.jsx)(t.a,{href:"https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape",children:"KAPE"})," and ",(0,i.jsx)(t.a,{href:"https://www.rapid7.com/products/velociraptor/",children:"Velociraptor"}),". Simply collect the artifacts and upload the ZIP file to cloud storage for import into Cado."]})]})}function p(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>a,x:()=>n});var i=o(96540);const r={},s=i.createContext(r);function a(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function n(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9110],{9565:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>d,contentTitle:()=>a,default:()=>p,frontMatter:()=>s,metadata:()=>n,toc:()=>c});var i=o(74848),r=o(28453);const s={title:"Third party disk images & triage",hide_title:!0,sidebar_position:11},a="How to Import On-Premise Disk Images and Triage Collections from Third-Party Tools",n={id:"cado/discovery-import/third-party",title:"Third party disk images & triage",description:"Full Disk Collections using FTK Imager",source:"@site/docs/cado/discovery-import/third-party.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/third-party",permalink:"/cado/discovery-import/third-party",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/third-party.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:11,frontMatter:{title:"Third party disk images & triage",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Microsoft 365 and Entra ID",permalink:"/cado/discovery-import/m365-logs"},next:{title:"Chain of custody",permalink:"/cado/discovery-import/chain_of_custody"}},d={},c=[{value:"Full Disk Collections using FTK Imager",id:"full-disk-collections-using-ftk-imager",level:3},{value:"KAPE and Velociraptor",id:"kape-and-velociraptor",level:3}];function l(e){const t={a:"a",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-import-on-premise-disk-images-and-triage-collections-from-third-party-tools",children:"How to Import On-Premise Disk Images and Triage Collections from Third-Party Tools"}),"\n",(0,i.jsx)(t.h3,{id:"full-disk-collections-using-ftk-imager",children:"Full Disk Collections using FTK Imager"}),"\n",(0,i.jsx)(t.p,{children:"While triage collections are recommended for being smaller and faster to process, full disk images can also be imported into Cado. You can create these images using tools like FTK Imager, a free tool widely used for forensic disk imaging."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Steps to create a disk image using FTK Imager:"})}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Download FTK Imager from the ",(0,i.jsx)(t.a,{href:"https://www.exterro.com/ftk-product-downloads/ftk-imager-version-4-7-1",children:"Exterro website"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:["Follow the ",(0,i.jsx)(t.a,{href:"https://cloudnine.com/ediscoverydaily/electronic-discovery/how-to-create-an-image-using-ftk-imager-ediscovery-best-practices/",children:"tutorial"})," on CloudNine to create a disk image."]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["Cado supports importing full disk images in formats such as ",(0,i.jsx)(t.code,{children:".dd"})," and ",(0,i.jsx)(t.code,{children:".e01"}),"."]}),"\n",(0,i.jsx)(t.h3,{id:"kape-and-velociraptor",children:"KAPE and Velociraptor"}),"\n",(0,i.jsxs)(t.p,{children:["Cado also supports forensic collections in ZIP format from open-source tools like ",(0,i.jsx)(t.a,{href:"https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape",children:"KAPE"})," and ",(0,i.jsx)(t.a,{href:"https://www.rapid7.com/products/velociraptor/",children:"Velociraptor"}),". Simply collect the artifacts and upload the ZIP file to cloud storage for import into Cado."]})]})}function p(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>a,x:()=>n});var i=o(96540);const r={},s=i.createContext(r);function a(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function n(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d3a982a8.215d0da1.js b/assets/js/d3a982a8.6de20030.js similarity index 97% rename from assets/js/d3a982a8.215d0da1.js rename to assets/js/d3a982a8.6de20030.js index 298e2b28a..21a6bca54 100644 --- a/assets/js/d3a982a8.215d0da1.js +++ b/assets/js/d3a982a8.6de20030.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9075],{95792:(o,t,e)=>{e.r(t),e.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var n=e(74848),i=e(28453);const s={title:"Custom location for Cado Host",hide_title:!0,sidebar_position:5},r="How to Set a Custom Location to Deploy Cado Host From",a={id:"cado/discovery-import/cado-host/custom-locations",title:"Custom location for Cado Host",description:"You can configure a custom location for deploying Cado Host, whether using the Import > Cado Host option or during container acquisitions that utilize Cado Host.",source:"@site/docs/cado/discovery-import/cado-host/custom-locations.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/custom-locations",permalink:"/cado/discovery-import/cado-host/custom-locations",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/custom-locations.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"Custom location for Cado Host",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Azure credentials",permalink:"/cado/discovery-import/cado-host/azure-credentials"},next:{title:"Command line parameters",permalink:"/cado/discovery-import/cado-host/cli"}},c={},d=[{value:"Important Notes:",id:"important-notes",level:3},{value:"Ensure Binary Availability:",id:"ensure-binary-availability",level:3}];function l(o){const t={admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...o.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-set-a-custom-location-to-deploy-cado-host-from",children:"How to Set a Custom Location to Deploy Cado Host From"}),"\n",(0,n.jsxs)(t.p,{children:["You can configure a custom location for deploying Cado Host, whether using the ",(0,n.jsx)(t.strong,{children:"Import > Cado Host"})," option or during container acquisitions that utilize Cado Host."]}),"\n",(0,n.jsxs)(t.p,{children:["This configuration can be set under ",(0,n.jsx)(t.strong,{children:"Settings > Advanced"}),":"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Custom Cado Host Settings",src:e(52109).A+"",width:"1999",height:"462"})}),"\n",(0,n.jsx)(t.p,{children:"This feature is helpful if you want to:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Deploy Cado Host from your own environment."}),"\n",(0,n.jsx)(t.li,{children:"Allow a specific IP that hosts the binaries through your firewall."}),"\n",(0,n.jsx)(t.li,{children:"Perform static analysis of the binaries before they are deployed."}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"important-notes",children:"Important Notes:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Ensure that the Cado Host binary is the latest version to maintain compatibility with the platform."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"For example:\nIf the latest official URL for the Cado Host Linux binary is:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:"https://official-cado-bucket.s3-accelerate.amazonaws.com/cado-host/v1.5.4/linux/cado-host\n"})}),"\n",(0,n.jsx)(t.p,{children:"And you are hosting the binaries at:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:"http://example.com/my-folder/\n"})}),"\n",(0,n.jsx)(t.p,{children:"Then:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Enter ",(0,n.jsx)(t.code,{children:"http://example.com/my-folder/"})," as the custom URL."]}),"\n",(0,n.jsxs)(t.li,{children:["Ensure the following structure exists: ",(0,n.jsx)(t.code,{children:"http://example.com/my-folder/cado-host/v1.5.4/linux/cado-host"}),"."]}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"ensure-binary-availability",children:"Ensure Binary Availability:"}),"\n",(0,n.jsx)(t.p,{children:"To ensure collections succeed across all environments, binaries for all operating systems must be available:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.code,{children:"/linux/cado-host"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.code,{children:"/windows/cado-host.exe"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.code,{children:"/osx/cado-host"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.code,{children:"/osx/cado-host-x86"})}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Cado Host binaries are typically updated 1-2 times per quarter."}),"\n",(0,n.jsxs)(t.admonition,{type:"warning",children:[(0,n.jsxs)(t.p,{children:["For compatibility, the download uses ",(0,n.jsx)(t.strong,{children:"HTTPS"})," and does not leverage AWS IAM. Therefore, non-public S3 buckets cannot be used to host the binaries. The binaries must be accessible via an HTTPS download link, such as:"]}),(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:"curl https://bucket/cado-host\n"})})]})]})}function h(o={}){const{wrapper:t}={...(0,i.R)(),...o.components};return t?(0,n.jsx)(t,{...o,children:(0,n.jsx)(l,{...o})}):l(o)}},52109:(o,t,e)=>{e.d(t,{A:()=>n});const n=e.p+"assets/images/custom-cado-host-95f4e7809ff05bb85ddfa4595474383c.png"},28453:(o,t,e)=>{e.d(t,{R:()=>r,x:()=>a});var n=e(96540);const i={},s=n.createContext(i);function r(o){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof o?o(t):{...t,...o}}),[t,o])}function a(o){let t;return t=o.disableParentContext?"function"==typeof o.components?o.components(i):o.components||i:r(o.components),n.createElement(s.Provider,{value:t},o.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9075],{95792:(o,t,e)=>{e.r(t),e.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var n=e(74848),i=e(28453);const s={title:"Custom location for Cado Host",hide_title:!0,sidebar_position:5},r="How to Set a Custom Location to Deploy Cado Host From",a={id:"cado/discovery-import/cado-host/custom-locations",title:"Custom location for Cado Host",description:"You can configure a custom location for deploying Cado Host, whether using the Import > Cado Host option or during container acquisitions that utilize Cado Host.",source:"@site/docs/cado/discovery-import/cado-host/custom-locations.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/custom-locations",permalink:"/cado/discovery-import/cado-host/custom-locations",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/custom-locations.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"Custom location for Cado Host",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Azure credentials",permalink:"/cado/discovery-import/cado-host/azure-credentials"},next:{title:"Command line parameters",permalink:"/cado/discovery-import/cado-host/cli"}},c={},d=[{value:"Important Notes:",id:"important-notes",level:3},{value:"Ensure Binary Availability:",id:"ensure-binary-availability",level:3}];function l(o){const t={admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...o.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-set-a-custom-location-to-deploy-cado-host-from",children:"How to Set a Custom Location to Deploy Cado Host From"}),"\n",(0,n.jsxs)(t.p,{children:["You can configure a custom location for deploying Cado Host, whether using the ",(0,n.jsx)(t.strong,{children:"Import > Cado Host"})," option or during container acquisitions that utilize Cado Host."]}),"\n",(0,n.jsxs)(t.p,{children:["This configuration can be set under ",(0,n.jsx)(t.strong,{children:"Settings > Advanced"}),":"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Custom Cado Host Settings",src:e(52109).A+"",width:"1999",height:"462"})}),"\n",(0,n.jsx)(t.p,{children:"This feature is helpful if you want to:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Deploy Cado Host from your own environment."}),"\n",(0,n.jsx)(t.li,{children:"Allow a specific IP that hosts the binaries through your firewall."}),"\n",(0,n.jsx)(t.li,{children:"Perform static analysis of the binaries before they are deployed."}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"important-notes",children:"Important Notes:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Ensure that the Cado Host binary is the latest version to maintain compatibility with the platform."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"For example:\nIf the latest official URL for the Cado Host Linux binary is:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:"https://official-cado-bucket.s3-accelerate.amazonaws.com/cado-host/v1.5.4/linux/cado-host\n"})}),"\n",(0,n.jsx)(t.p,{children:"And you are hosting the binaries at:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:"http://example.com/my-folder/\n"})}),"\n",(0,n.jsx)(t.p,{children:"Then:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Enter ",(0,n.jsx)(t.code,{children:"http://example.com/my-folder/"})," as the custom URL."]}),"\n",(0,n.jsxs)(t.li,{children:["Ensure the following structure exists: ",(0,n.jsx)(t.code,{children:"http://example.com/my-folder/cado-host/v1.5.4/linux/cado-host"}),"."]}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"ensure-binary-availability",children:"Ensure Binary Availability:"}),"\n",(0,n.jsx)(t.p,{children:"To ensure collections succeed across all environments, binaries for all operating systems must be available:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.code,{children:"/linux/cado-host"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.code,{children:"/windows/cado-host.exe"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.code,{children:"/osx/cado-host"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.code,{children:"/osx/cado-host-x86"})}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Cado Host binaries are typically updated 1-2 times per quarter."}),"\n",(0,n.jsxs)(t.admonition,{type:"warning",children:[(0,n.jsxs)(t.p,{children:["For compatibility, the download uses ",(0,n.jsx)(t.strong,{children:"HTTPS"})," and does not leverage AWS IAM. Therefore, non-public S3 buckets cannot be used to host the binaries. The binaries must be accessible via an HTTPS download link, such as:"]}),(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:"curl https://bucket/cado-host\n"})})]})]})}function h(o={}){const{wrapper:t}={...(0,i.R)(),...o.components};return t?(0,n.jsx)(t,{...o,children:(0,n.jsx)(l,{...o})}):l(o)}},52109:(o,t,e)=>{e.d(t,{A:()=>n});const n=e.p+"assets/images/custom-cado-host-95f4e7809ff05bb85ddfa4595474383c.png"},28453:(o,t,e)=>{e.d(t,{R:()=>r,x:()=>a});var n=e(96540);const i={},s=n.createContext(i);function r(o){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof o?o(t):{...t,...o}}),[t,o])}function a(o){let t;return t=o.disableParentContext?"function"==typeof o.components?o.components(i):o.components||i:r(o.components),n.createElement(s.Provider,{value:t},o.children)}}}]); \ No newline at end of file diff --git a/assets/js/d4b22c01.d4c76d73.js b/assets/js/d4b22c01.d8ca9a51.js similarity index 96% rename from assets/js/d4b22c01.d4c76d73.js rename to assets/js/d4b22c01.d8ca9a51.js index 2a4499691..b3c210f18 100644 --- a/assets/js/d4b22c01.d4c76d73.js +++ b/assets/js/d4b22c01.d8ca9a51.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6159],{96232:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>i,contentTitle:()=>r,default:()=>u,frontMatter:()=>a,metadata:()=>d,toc:()=>l});var n=o(74848),s=o(28453);const a={title:"Remove internet routable addresses",hide_title:!0,sidebar_position:2},r="How to remove internet routable addresses",d={id:"cado/deploy/aws/networking/internet-routable-addresses",title:"Remove internet routable addresses",description:"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user.",source:"@site/docs/cado/deploy/aws/networking/internet-routable-addresses.md",sourceDirName:"cado/deploy/aws/networking",slug:"/cado/deploy/aws/networking/internet-routable-addresses",permalink:"/cado/deploy/aws/networking/internet-routable-addresses",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/networking/internet-routable-addresses.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Remove internet routable addresses",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Add a load balancer and HTTPS",permalink:"/cado/deploy/aws/networking/aws-load-balancer"},next:{title:"Endpoint access",permalink:"/cado/deploy/aws/networking/endpoints"}},i={},l=[{value:"Self Managing Network Access with Custom VPCs",id:"self-managing-network-access-with-custom-vpcs",level:2}];function c(e){const t={a:"a",h1:"h1",h2:"h2",p:"p",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-remove-internet-routable-addresses",children:"How to remove internet routable addresses"}),"\n",(0,n.jsx)(t.p,{children:"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user."}),"\n",(0,n.jsx)(t.p,{children:"Public IPv4 addresses are assigned to the main Cado platform to enable a user to connect with their web browser, and are also assigned to workers to allow them to connect to required AWS services e.g. s3.amazonaws.com."}),"\n",(0,n.jsx)(t.p,{children:"We highly recommend using our default CloudFormation template without changes: DeployCloudFormationPrivate.yaml which creates a VPC with the required access."}),"\n",(0,n.jsx)(t.p,{children:"You can remove the Public IP addresses associated with Workers under Settings > Advanced."}),"\n",(0,n.jsx)(t.p,{children:"You can choose a deployment that does not include the Public Elastic IP address on the main Cado web server and set up an Application Load Balancer instead to handle traffic from the user to the platform."}),"\n",(0,n.jsxs)(t.p,{children:["Please see the ",(0,n.jsx)(t.a,{href:"/cado/deploy/aws/cloudformation",children:"AWS deployment overview"})," for more information on how to deploy Cado in a private subnet."]}),"\n",(0,n.jsx)(t.h2,{id:"self-managing-network-access-with-custom-vpcs",children:"Self Managing Network Access with Custom VPCs"}),"\n",(0,n.jsxs)(t.p,{children:["You can remove the requirement for publicly routable IP addresses if you have set up ",(0,n.jsx)(t.a,{href:"https://tomgregory.com/when-to-use-an-aws-s3-vpc-endpoint/",children:"VPC Endpoints"})," or another method such as a Proxy to connect Cado to required AWS Services."]}),"\n",(0,n.jsx)(t.p,{children:"We highly recommend using the Cado default Cloudformation templates without changes, as we cannot support the creation and management of networks inside customer environments."})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>d});var n=o(96540);const s={},a=n.createContext(s);function r(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6159],{96232:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>i,contentTitle:()=>r,default:()=>u,frontMatter:()=>a,metadata:()=>d,toc:()=>l});var n=o(74848),s=o(28453);const a={title:"Remove internet routable addresses",hide_title:!0,sidebar_position:2},r="How to remove internet routable addresses",d={id:"cado/deploy/aws/networking/internet-routable-addresses",title:"Remove internet routable addresses",description:"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user.",source:"@site/docs/cado/deploy/aws/networking/internet-routable-addresses.md",sourceDirName:"cado/deploy/aws/networking",slug:"/cado/deploy/aws/networking/internet-routable-addresses",permalink:"/cado/deploy/aws/networking/internet-routable-addresses",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/networking/internet-routable-addresses.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Remove internet routable addresses",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Add a load balancer and HTTPS",permalink:"/cado/deploy/aws/networking/aws-load-balancer"},next:{title:"Endpoint access",permalink:"/cado/deploy/aws/networking/endpoints"}},i={},l=[{value:"Self Managing Network Access with Custom VPCs",id:"self-managing-network-access-with-custom-vpcs",level:2}];function c(e){const t={a:"a",h1:"h1",h2:"h2",p:"p",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-remove-internet-routable-addresses",children:"How to remove internet routable addresses"}),"\n",(0,n.jsx)(t.p,{children:"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user."}),"\n",(0,n.jsx)(t.p,{children:"Public IPv4 addresses are assigned to the main Cado platform to enable a user to connect with their web browser, and are also assigned to workers to allow them to connect to required AWS services e.g. s3.amazonaws.com."}),"\n",(0,n.jsx)(t.p,{children:"We highly recommend using our default CloudFormation template without changes: DeployCloudFormationPrivate.yaml which creates a VPC with the required access."}),"\n",(0,n.jsx)(t.p,{children:"You can remove the Public IP addresses associated with Workers under Settings > Advanced."}),"\n",(0,n.jsx)(t.p,{children:"You can choose a deployment that does not include the Public Elastic IP address on the main Cado web server and set up an Application Load Balancer instead to handle traffic from the user to the platform."}),"\n",(0,n.jsxs)(t.p,{children:["Please see the ",(0,n.jsx)(t.a,{href:"/cado/deploy/aws/cloudformation",children:"AWS deployment overview"})," for more information on how to deploy Cado in a private subnet."]}),"\n",(0,n.jsx)(t.h2,{id:"self-managing-network-access-with-custom-vpcs",children:"Self Managing Network Access with Custom VPCs"}),"\n",(0,n.jsxs)(t.p,{children:["You can remove the requirement for publicly routable IP addresses if you have set up ",(0,n.jsx)(t.a,{href:"https://tomgregory.com/when-to-use-an-aws-s3-vpc-endpoint/",children:"VPC Endpoints"})," or another method such as a Proxy to connect Cado to required AWS Services."]}),"\n",(0,n.jsx)(t.p,{children:"We highly recommend using the Cado default Cloudformation templates without changes, as we cannot support the creation and management of networks inside customer environments."})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>d});var n=o(96540);const s={},a=n.createContext(s);function r(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d6fae6a2.7cbfed1e.js b/assets/js/d6fae6a2.a876f168.js similarity index 99% rename from assets/js/d6fae6a2.7cbfed1e.js rename to assets/js/d6fae6a2.a876f168.js index 51ea33536..f7ec0da2e 100644 --- a/assets/js/d6fae6a2.7cbfed1e.js +++ b/assets/js/d6fae6a2.a876f168.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9326],{55258:(e,a,s)=>{s.r(a),s.d(a,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>l});var n=s(74848),t=s(28453);const o={title:"Backup and recover",hide_title:!0,sidebar_position:1},i="How to backup and recover Cado in AWS",r={id:"cado/deploy/aws/performance-resiliency/aws-backups",title:"Backup and recover",description:"Cado backs up any imports to S3 which can then be re-imported later to a fresh instance. This is the simplest method for backups.",source:"@site/docs/cado/deploy/aws/performance-resiliency/aws-backups.md",sourceDirName:"cado/deploy/aws/performance-resiliency",slug:"/cado/deploy/aws/performance-resiliency/aws-backups",permalink:"/cado/deploy/aws/performance-resiliency/aws-backups",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/performance-resiliency/aws-backups.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Backup and recover",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Dedicated forensics account",permalink:"/cado/deploy/aws/security/forensics-account"},next:{title:"High availability",permalink:"/cado/deploy/aws/performance-resiliency/high-availability"}},c={},l=[{value:"Backup and Recovery for default non-HA deployments",id:"backup-and-recovery-for-default-non-ha-deployments",level:2},{value:"Scheduling Automated Backups of the Data Volume",id:"scheduling-automated-backups-of-the-data-volume",level:3},{value:"Restoring the Data Volume",id:"restoring-the-data-volume",level:3},{value:"Backups with High Availability",id:"backups-with-high-availability",level:3}];function d(e){const a={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(a.h1,{id:"how-to-backup-and-recover-cado-in-aws",children:"How to backup and recover Cado in AWS"}),"\n",(0,n.jsx)(a.p,{children:"Cado backs up any imports to S3 which can then be re-imported later to a fresh instance. This is the simplest method for backups.\nYou will need to restore the data volume if you want to recover user settings such as user logins, and processed data."}),"\n",(0,n.jsx)(a.h2,{id:"backup-and-recovery-for-default-non-ha-deployments",children:"Backup and Recovery for default non-HA deployments"}),"\n",(0,n.jsx)(a.p,{children:"This section explains how to recover or migrate the Cado platform to a new instance."}),"\n",(0,n.jsx)(a.p,{children:"If a Cado instance fails, you will need to recover and attach the data volume to a new instance. The data volume contains previously imported data as well as user settings."}),"\n",(0,n.jsx)(a.p,{children:"You can also use this approach to migrate Cado to a new availability zone or region."}),"\n",(0,n.jsx)(a.h3,{id:"scheduling-automated-backups-of-the-data-volume",children:"Scheduling Automated Backups of the Data Volume"}),"\n",(0,n.jsx)(a.p,{children:"Amazon EBS Snapshots are stored by AWS in Amazon S3, where it is stored redundantly in multiple Availability Zones."}),"\n",(0,n.jsxs)(a.p,{children:["You can create an ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://us-west-2.console.aws.amazon.com/events/home",children:"EventBridge"})})," rule that regularly (e.g. daily) backs up the CadoResponse EC2 instance:"]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 1",src:s(36281).A+"",width:"551",height:"560"})}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 2",src:s(69698).A+"",width:"571",height:"408"})}),"\n",(0,n.jsxs)(a.p,{children:["For more, see ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-scheduled-snapshot.html",children:"this tutorial"})})," from AWS."]}),"\n",(0,n.jsx)(a.h3,{id:"restoring-the-data-volume",children:"Restoring the Data Volume"}),"\n",(0,n.jsx)(a.p,{children:"To perform a migration or restoration to a new instance, deploy a Cado installation and Stop the Cado EC2 Installation."}),"\n",(0,n.jsxs)(a.p,{children:["The operating system volume will be smaller (typically 10 GB). Detach the larger Data Volume (",(0,n.jsx)(a.code,{children:"/dev/sdh"})," seen below):"]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 3",src:s(60203).A+"",width:"606",height:"104"})}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 4",src:s(93940).A+"",width:"247",height:"270"})}),"\n",(0,n.jsxs)(a.p,{children:["Next, ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/restore.html",children:"restore"})})," the Snapshot backup of your old Cado installation to a Volume in the same availability zone as your new Cado EC2 Instance."]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 5",src:s(31421).A+"",width:"254",height:"64"})}),"\n",(0,n.jsxs)(a.p,{children:["Then, simply ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-attaching-volume.html",children:"attach"})})," the restored Data Volume to your new Cado EC2 Instance and start it."]}),"\n",(0,n.jsx)(a.h3,{id:"backups-with-high-availability",children:"Backups with High Availability"}),"\n",(0,n.jsx)(a.p,{children:"If you have opted for the High Availability deployment in AWS, back-ups need to be enabled for the native AWS services used in the deployment:"}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsx)(a.li,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html",children:"https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html"})}),"\n",(0,n.jsx)(a.li,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html",children:"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html"})}),"\n",(0,n.jsx)(a.li,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/efs/latest/ug/awsbackup.html",children:"https://docs.aws.amazon.com/efs/latest/ug/awsbackup.html"})}),"\n",(0,n.jsx)(a.li,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups.html",children:"https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups.html"})}),"\n"]}),"\n",(0,n.jsx)(a.p,{children:"You can also enable automated back-ups in the CloudFormation or Terraform deployment template, for example with:"}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsx)(a.li,{children:"ElastiCache:"}),"\n"]}),"\n",(0,n.jsx)(a.pre,{children:(0,n.jsx)(a.code,{className:"language-yaml",children:'SnapshotRetentionLimit: 7\nSnapshotWindow: "03:00-04:00"\n'})}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsx)(a.li,{children:"RDS:"}),"\n"]}),"\n",(0,n.jsx)(a.pre,{children:(0,n.jsx)(a.code,{className:"language-yaml",children:'BackupRetentionPeriod: 7\nPreferredBackupWindow: "03:00-04:00"\n'})}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsx)(a.li,{children:"OpenSearch:"}),"\n"]}),"\n",(0,n.jsx)(a.pre,{children:(0,n.jsx)(a.code,{className:"language-yaml",children:"SnapshotOptions:\n AutomatedSnapshotStartHour: 3\n"})}),"\n",(0,n.jsx)(a.p,{children:"Snapshots are not enabled by default for cost reasons."})]})}function h(e={}){const{wrapper:a}={...(0,t.R)(),...e.components};return a?(0,n.jsx)(a,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},36281:(e,a,s)=>{s.d(a,{A:()=>n});const n=s.p+"assets/images/aws-backup-1-0ea6616ad39ba74e1380d878606d4e9a.png"},69698:(e,a,s)=>{s.d(a,{A:()=>n});const n=s.p+"assets/images/aws-backup-2-5704a0f85c843e2bac5efef40f42d14b.png"},60203:(e,a,s)=>{s.d(a,{A:()=>n});const n=s.p+"assets/images/aws-backup-3-aa9c09491fe25218da52c4c56e163e32.png"},93940:(e,a,s)=>{s.d(a,{A:()=>n});const n=s.p+"assets/images/aws-backup-4-5504cf261e4c5a3680ed3e026c7928a8.png"},31421:(e,a,s)=>{s.d(a,{A:()=>n});const n="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAP4AAABACAYAAAA6VspUAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABgZSURBVHhe7Z3pU1xXmqef3MiFJJMEMiHZNwFCSEKbte+StdmtcnS7eiq6oiPmL5jpLz2faqK+zIeJmJmIiZilumuiqruqXba7u1y22tZqW2hBktkkJLGIRawCkoRcyYTc52SSkhFGEiCpCon7oAxJ5977nuWe3znve7h5jywYDMaQkJBYVbwy4Y/ZxrnX1oFtfIJIJJJMlVjpqFQqykuLWVu5hrQ0fTJV4m3nlQn/7IVvmJh0kJWZkehMEm8G/ukZRsds7N+zIyF+idXBKxP+L/7fb6gSHWf/np2kpEjCf1Pw+af5+1/9li2bNrDznS3JVIm3HXny75cmHA6j0agl0b9hpOq0yGUyotFoMkViNfDKhC8hIfHmIAlfQmIVIglfQmIVIglfQmIVsmqFH/I5sU868c2EkikSEquHN0P4ETvdDVf46g+f803rIBO+l1yBDo3Sdu0bfv/xV9x4MIpb0r7EKuONEH5o/AE3r3/L52cv8Ydrd+mf9LFo6c8M03L5HL+71ELvhG82TSYj4p/E4XDhC0WJyWaTVxqhcJiGptt8/uV5hh+NJFMlJF6eN0D4QWzdD+kf8xNRxXA97KR/1I5vgaeCo+EZPC4nbt80oUhyaHD10/zddb5s6GDQ7iYQChORmyjfspuT7x9ka0kWesXsqXGiQS+O8WFGxicTYUD0yeNNUaKhAMFgiEhU/Dtx3hjjLh+B8JxhKBrG57ExNjKC3eMn+Lgcy6D3YT8Xv7nCma8ucP1mAw6nK3lEQuLlUPzsZz/7efLfL0V8ZsrNzaGoID+Z8ooIDtNU10CzI531ZRpibiF6QwmlBTmYNMlxK+xl6N4tLl+9yfWGVlrbOhkMaNH6+2i5dYtrbcKd904z7RBCDeswZYCzvYu2Ngcqq5msDD2qqB9bewN1V65x5btW7tzvov2hjbDGSLpRj1oxSdfVeuqaHtDX10lrSzM3Gu+KvHpxKdPJNBnQhR9x58Z1vqm7xXd32rnf2Y1LYSLDlI5uic81uVxuLlyq487d+0z5fAnvJDvbTLbFjFI5Z6R6BXzX2EJOtoXC/LxkisTbzoqf8YPjvXSPTUBuGZs3raPQpGCgd5DRSS/hxBlRnL1NXL50gYvNPbhkQthpGmSxMOFQkGm/j1AoHsQLF0GkxeI/MS8j7Xepr2ulx+YhII76Ht3hyuWLwjMYwJ+SgVnlobvlGp9dbOTBqIsQyWsu1dPycIKgLg1dZILe1puca+hkyDmDs6+Z61eu0uFUkJFfRIk5VQwYooRLfCg64eI33+a2EL3P70+k2cbtXKu/xcjoWOL/EhIvwwoXvp+R7n5GJ2IUFlrJq1xLWZYJxVAPA7ZJphLKd9Lf2sb97gDW9Ts5+d4J/uzUcY7UFlNQWsOmqgKs6WK6NZewdd8h3t1USrZembD+PTOMPRAzdO8EqeVbOHTsBKdP7+OdXC2ue/doH7LjnR1lIKAiu6KWfUePcXx7CTnpcibcHhEWiDDA68Y1Pc0UKWQWVbJr/yF2VFpJVyevXSRxF/9mQzMTk5PJlFnahQfxXVOL5PJLvDQrW/j+Idq7x7A5gzge3ubylWYe2LyEfCN0DYxh9wbFSV5cE35mfAaKi4spzs3EYEgnI02PLtVIml6HWiUDtR5DhoUsg/i/cv5qXoAp9zSBaRX5hfnkZmdiyhXhhDUdY8SFd2qGmcfCR0t6uhFjmgGDXktKinzWixA/xuJattUUoZns5OqFs3x6tp77Q04CSwjz4y5+/Y0GEU4MEpm3PjAzM8N1cay9s4tAIF53CYnlsaKF7xvppXdsErdwtG19HTTcaKHT7hHz8wz93YOMTIhBACHihI6DBMNR5q6zLR45SoUMhTxERBiIxhcOo2HxJyrCAnFMLkO+iJbSWKrYeeg9fnL6CNvzIgy01vPFjXYGHbPu+mJout36lIs/H8nll3gVrGDhe3nUNYTNHqRg0y5Onv6AD390mh//xSF2FptRCne/f3QCTzCD7DwDeqOH9tY7QjTtYrZ8QPewHfd0WMzIaiFo4dpPjjI80EvPqIOpmfm/EtCQZTWhT4P+zg7aH3TQdf82d4WL79JnYzbpSV3Eepp3bBhHUIa1cgPbN4qQQhdm2ObA5Vv87Dxun0gs5j2PwaFHCc9AQmK5rNxVfW8316+0cGdITe3Ro7y7dwvrSoooKbKisgtPoL+fSUMx5YVFFGWnEPHa6O7qo69/iN7uHh5FjFhzLJjTYjgGhhgaGGXMNsqEPFO48io8bZ10Dkcp2LaONQVmjKkaZNMOcW0fD/sH6OnoosutZs2OvezfXE623sdAY9ucazKR2dppah9gJKWQ7evKSBv/jsvXbnKztY+ungEGHEpKN25iR3UhJu38dYWF0Wo0FIo23FCzlk0baxb81K5fR1lZMampuuRVL4e0qr/6eGUv4vhfv/gVW7fUsnfX9mTKS+Ifob1jgCGXmtKaMiFuIymJA1Fcg0KA/eP408uoKc3DkhrFOdjDg74R7FNhYjIVpuJKqkusZGqDjPcIEQ9O4BITb2p+hbgmjUDvQ3pHo+RsWEOxiOXVRPCN9dLRM8Soa4ZITIEqzULl2nIKzQZS5B6G73Y/dQ0T3dzrHmFcZaV2TSFG/0Nx/TCjbhEyxK/XZbKmeo0ou7C/gn2r//m/f8nGDevYvWNbMkXibWflCn85xCKE40G+XCHce3n8Ab3viYnYPSYTafFPMm0hEjYixEQUpFAoRGz/vJMX4GWv/xMgCX/1sbJX9ZeKTIFSpUKpmCf6ODJ5QoTPFX2chI0UVCrl8kT7stdLSPwReLuELyEhsSgk4UtIrEIk4UtIrEIk4UtIrEJemfDjm2j4/dPMBOJfeZF4U/B4pxKv1o7/FkRi9fDKfp33bd11evsHEgOA1IneHOLfBIyEIxzct4vyspJkqsTbjsxmn4g9HBzA7fUmk5aHw+nmYd8ATpdL2pzhDUKhUJIXf+KyMB+dVpNMlXhbqSorI8dsRiZm6dj1xkbS9HosmZnJwxISEm8bnb29VJSWsL6q6nvhr6uoSCRKSEi8nVy8dg29LpXa6mppVV9CYjURjcbfQBV/oFxCQmLVIQlfQmIVIglfQmIVIglfQmIVIglfQmIVIglfQmIVIgn/FRGZdmEbseOcCsS37lgRRHx2BjtbaWnt5pHDT0h6oFI0ygwu2yjjjqk5r0xffbx+4c/Y6b9znTO//xd++9Hv+OTzczR02/C+Zd/lCYzc5vPfXeVGxyTTybQ/KVMD3PzXz/jsiyvcaumg3+5hWhI+TI/Q9Pmn1N3sZHJF3Kg/Da9V+DNjd/n6nz7i0z/U0z44icc3jWv8IY/GXSzhjdOLx9HFZ3W3aRqMb3n1xyXsHuJO40N6x/yshK0ugvYuvq4bwaEpoWZzFYVZqaRIbwKL3yiGWpvo6bPhW+6M/yfsZ6+K1yf8gI17Fz+nrtOLad1OTpw6yen3TnHq3SNsLreQNm9bqUgoRDgSebL9dSQ0u1GkZyqISP6eSIig34V9wolr3rHgRDd1zZ08sPt+4G4/094SiYRmcDucuD3CdX6JnXDnkrDpcuP1i7LFTUYjBH1OJl0+poPz8nhyzMNUQLTXM75bGfRMMj5jJKt0LTUbKyjITEMzd2+AsGjHUGQ2P8Fi6rWkcj7F92X2TH+f5xOeYyfeL6YcdiadbvyivD/MZU57BOcfX36+z2vn5/WzN4XX9qx+cOgK/+O/nCWw7QQ//XA3ZYb528U66PzDFcbUBqanHtHVE6Ts8FF2bzDiaL3G9fsjwhWTIRc327JxD/u2VZE1dZ+LV1p55PQTjoWYdsnJ3XqAAztLiHVe4PzZc3zSGiInP59yy1YOfbCHbVUqRpsWtpc/t0yBEZrPNOPNrRYzZBlZWpEWsnHni0bc1rWs21xItO8W395sZ8wbJhbxIcvexP4D21mXb2Cm5Tf8p/9qY+1PP+Cn75ejG2rgTGeE0sq1bCxMR8UMQw1f0R4uYW31eize25y5bycy5SI4M43H4cEdzKJibTZKnwu3cwK73Yu2ci/HD26mzKwl5uqjoa6euyMOpuVyImELG/fsZtu6PIxPqjKbz9kzX/DJZT8ZlWVUlaxlz/HDVGpaaHFoMPq9DHf1ECg7wrHd60gdbXpmvaLxeiyxnE/NJtOiDesv0Ng9wRQGUiJGavbupFZ0tY7zbThVUXwBD17XrB1Z6Q5OHd5KVU6Y3osXuNnrwCM0GQmI2TWtit0H91JbmoW/6wsu900RHA8TnZli0uclqF/DzoP72FxqRhd8Rr55dj77z/+djrQNFJUXJTY+fTpfPTHvALcvf0vzgBM/SvxhPRXb97O/NpfA/bML97MakWeyyiuV+LP6Oo2OTete47P60+ODDEQzMeXnYdIvtEe0l6FrX3PhXAMPvQpMORZMwg3w9tZztuUBE8oMytaUUpLmofmbFm53TxJQasm0WCkoKqNizRpylMNcbrzDvZEpFGlZZJlS0ejTyMjJpbAoi/RUFZ6eZ9t7KsQTQvKIwaqu5TYDjtkjwdE2zjd38cA5IzrYPS581UinI4XssnLKi01Md1zkmxu3GXT+0LkP2ju53NQ2Z1YIYe+4SmNbFzafmE3ix8/c4u5wFH12AWUl6QTuXOHqjU7cSiPW4nKKUh00nG+i4YEQOi56rp6nuWsSZWapGKSLSPO28E1LKz0Tc2siRy3awmI2oRODanqWlfyibDJE2/qH6rlw/gK3hGAUplyyTXoU9vvPrdfSy/k0MyN3RPsPMabMobS0mFJRFpNejTJkp6PuS6429RNUZ5Ir7JQavLRcukNTl1PYUZJiMJOTV0BJ+RoqSox4b12ipbErEZt7B0VdrjbS61eTWVhORVkOssErfF3fSJ844Zn5JsOdYERBavpC+Yp2vi4GlTuDRIxFwm4pucpRbpyt51bnBCH9wv3s9S+WvVpen/CnxgkZZegMalTPzCVEICWDil3H+PCvTrK9Ss1Ey3UmQhY27zrEkQN7OHJ4G7mTdsb67cwY14gR/ygn3j3EgQPHOHGgUtzIaRxCSBlr93N47xYKq2vZcfxH/NVf72WjmFVGG55tzzM3QFNlUb29ghmng/6xeAcIMdrZhCs7g4LyLIK931LvVlC29yinTx7j/R/9JR9sNTDQ20PbiGd5cb2Yfc3F29h/+BgnTx1kl0WGWmGiatte3j1+jA9O7sEUkgs3d5qAa4Dvrk0QMdey9/AhDu07zLvbrDgmxhhI7CH4mBQsj9vCLLyNve/xl399QrSthfgmwaGgioyKHZz8i3/He9tLkYnB7oX1Wko5E2X4ntiMH4dTiNhUzqYd4vz39rGhzJzcksyJypRD7e4DHBN2fnRiF5aoCpc7IOzoyd8m7tmpExw9eIB3Tx3lnbQAkUkxCycbOxRLp3DzbvaLa0+8/2NO78rH9ugRD8a8BJ6bLxhySnln/wL5xtu5bpigeQeHTr7PqZPv8ZMPD1DhbKX33gDywoX6WTpv2psMXpvwlSoNcneEsF+4Ysm0hdAYjaQb9GjVSpTyKZxiJva03ePmxTN88vEnfHLxNuOhMBpxx+QBG80Xfs+vfvUP/Pqjj/n4XCMDtqmkpYXw4nievacWu5RkrdtBtVzEk4OPRGw3xoPGEPkZhZTlqHGPDeNKU2EUo70u3nkUBuHq5REa9DI6NiUc7OWQglKpjO//IezJxSAmZmuVSItvxBE/qklFoUwuhngcdE96abv7HefP/DMfffzPnLttJxDWiPLIZ/cNXQzaNNJNaeh1KaiUQRy2xdRrCeWcR0reZk7UWqDtIr/8v3/Hr/9NeHh2/5PYWKMRdlSz24spU0SfUTz2DiO4em/yxT/9I7/+9W/57UdnuNQ/ylMbh4syKZXy2fso12HOziH2aJpxYT+63Hzj7WwX4UpqFvrU2b2bNOZcilPceEZtuHxv6nLe07w24RvMRWTPuHEMT+DxP0/6c1GhEoLUmoxYhBuVL2Ko/LKNHPrJUXZszGLqnnAN2x4S1JkpyM3BmmVAm/K8PemeZy8Pw7xLFemlbK6IMTo5TM/9O9xVFGItKcMq3GSlcFvmv1Es/vVGUkS68B9f+4K5EJpWoRGiNWPNFfUQdSmtPcBP3n2HjXlpYthaDvHNP15vvRTpRew+eoSTh7ezPl8jPLozXGm4x6j3Bctizm4ufd7EfZsMY24uVquFDI3wHpOHFyIWEaLUykVTic9y8020s2I2nycLerHE5CUXg578hTuyvBm8NuGnWGvYuTHGUOu3fH2rixF3MPFut2BwCs/UNMHQQsvR6VgqcwmZMsmq2MS+Q0c4Jm7esX0bKDWn4HzYxoTawqa9Rzh1dD97asvJFKHEE2RiShK2p2dChBPmn2dPv0An0lO0cT3qsRFuXrqMrzCTghKLcA9TyClai9nlZWzYkdiDDxGjPnzQiypHT0G2GIAS18c7VXKQi5dl0oPHPUNAJMcf8HG4RNmWFRMI0rOozA1jysyiQri3R+L1EJ+D60uwiBhzeSy2Xi+BuOcaYx7r9xzlzz88zub0cWwjwzhfNBl4HnG7M4C2dBsHTxzjyP6trDcbxR2aw5QbV3xFPv5k0oyNns4e1FYjBTlGNMvNN93K+mIfPscAY65ZD8E32Mvd6Qy0ebmY4vHSD/rZm8fyJorFoM9nx+lTuM5dpeX8P9DxrXAlhVsWjSmwbhVx+h5j8sS5aMjbdoSN4/U0ffp3dOWY0QSFs6ktE/HUVjKLKtG2tnLu4yma0jPIlk3gDWcnrxVXW4qp0XbQ8vtf0le/leN/tkfEoc+yt4v1pZk/6NhphVvYbGjkdw0+andZKciaXaVOrzjM8bIvqb/4G/7bVQ0pshl8UyrWHVzPujw9ekd8hbeZu1+JvEpMvGMpoFLWQNO//ILB6/kUFeUicwsX9PviLg1tHtuPrcd+rZlP/083V8wa4lXRlb7D8b01lGYtJ8pUvLBeyu7kqcvE23eDr+vaGI6oUURtDNkslB8sISvtBYoxWakpucbNW1/wj2PXMGel4lRMI0tLHo8TneTBrTP8/e0YAbcHr09F9dFq1lpTmV5uvtpcth3dzNDlVv71F218KcKBoBhgfEXv8P6mcuLNrFign22tMr/8IPlHRPEf/uPf/HxwZCTxvr1MkymZ/CqQo83Ioygvmwy9FnWKGo0ulfTMbArLyii2ZmA0ZpJTWUVJQSZ64Z7FURvMIq4WM408hkKrQ6vRYzQLOyV55OXlYRJ2UnRCaEYzxeVrKK+ooKbYQpaIx1RaAxaTOKbVkmrIobjUSl5BAcUL2ssR5RKdIpHrHFQ6Ee+mYCraxMaaSgoyNInRUa4RsW+2mHGEaywT8aDGaKViyz72bKsiL10IRsTOWVlpok7ZFIh8c6xmckw6UjUaNPoMcgrKqKouZ82aaoqzM0nTajBk57O2Oh+rKZ6HcE91pqfbQ65Cl2mhskqENSYDGaLcGQYdsqgIX1K14mPAnF9ISa4JvfrpmsiEl/K0/bg5LRk5lVQV5yfaK97iL6qX8gd2XlTO2bweEwl4cU8FiaaI8or7k7d2J9s3VZEr2kZrsFBQVSVmaBOJXcTn2snJJC9Lh06rRqeLr6CXUFFTQUV1NbmZJgIDl6gbVlNYspbSzFTUqdlUbBVe4NZKctPVxJabr+g/6Zm5wpNMRR6TifhfR1bROvYd3M6mUhH3q2SiH/2wn5mNT9d7JdI7OIhKqcJqmfOyzdf9zr1I/DXO0ajoXIrZXWST6c8kEiYszo/E49D4NY8vSKSLji0CU8WTxEXwLHtLJRoR3quwI5OjTOzKm0xfkPjOufE8F3Pu4nnSlnGb8bZ8FWHnkuq1RB7bjrfDEts+UVeE2OaVqf/i3/LzqwaOfvDv+fPabJTxnZDnl/sl8o0z285idhQXLqmvrVD+KL/Hn49CqSQlRczK8Y6aTHsuCiXxXWfVqnk3LJGuXPqNeJa9pSI6V3xHXrVyMXbEuWKEXdy5i+dJWwq7r0T0cZZUryXy2PYy2j5R1wXKJFdlYUlNJ1UcS9zbhcr9EvnGmW3nZfS1N4C3r0YSqwJT5Ul+fOIQm/INK97FXolIwpd4I0nLrWFrbTVFmTpJ+MtAEr6ExCpEEr6ExCpEEr6ExCpEEr6ExCpEEr6ExCrkyQM8CqWCdIMhmSwhIfG2MTQyQlFeQeIBnoTwXR4P0dgLvrwgISHxxqOQK2cf2XW5PTG1OgWNeuHvU0tISLw9eKemkMsVyGKJL19LSEisHuD/A51YNghCpMniAAAAAElFTkSuQmCC"},28453:(e,a,s)=>{s.d(a,{R:()=>i,x:()=>r});var n=s(96540);const t={},o=n.createContext(t);function i(e){const a=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function r(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),n.createElement(o.Provider,{value:a},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9326],{55258:(e,a,s)=>{s.r(a),s.d(a,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>l});var n=s(74848),t=s(28453);const o={title:"Backup and recover",hide_title:!0,sidebar_position:1},i="How to backup and recover Cado in AWS",r={id:"cado/deploy/aws/performance-resiliency/aws-backups",title:"Backup and recover",description:"Cado backs up any imports to S3 which can then be re-imported later to a fresh instance. This is the simplest method for backups.",source:"@site/docs/cado/deploy/aws/performance-resiliency/aws-backups.md",sourceDirName:"cado/deploy/aws/performance-resiliency",slug:"/cado/deploy/aws/performance-resiliency/aws-backups",permalink:"/cado/deploy/aws/performance-resiliency/aws-backups",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/performance-resiliency/aws-backups.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Backup and recover",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Dedicated forensics account",permalink:"/cado/deploy/aws/security/forensics-account"},next:{title:"High availability",permalink:"/cado/deploy/aws/performance-resiliency/high-availability"}},c={},l=[{value:"Backup and Recovery for default non-HA deployments",id:"backup-and-recovery-for-default-non-ha-deployments",level:2},{value:"Scheduling Automated Backups of the Data Volume",id:"scheduling-automated-backups-of-the-data-volume",level:3},{value:"Restoring the Data Volume",id:"restoring-the-data-volume",level:3},{value:"Backups with High Availability",id:"backups-with-high-availability",level:3}];function d(e){const a={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(a.h1,{id:"how-to-backup-and-recover-cado-in-aws",children:"How to backup and recover Cado in AWS"}),"\n",(0,n.jsx)(a.p,{children:"Cado backs up any imports to S3 which can then be re-imported later to a fresh instance. This is the simplest method for backups.\nYou will need to restore the data volume if you want to recover user settings such as user logins, and processed data."}),"\n",(0,n.jsx)(a.h2,{id:"backup-and-recovery-for-default-non-ha-deployments",children:"Backup and Recovery for default non-HA deployments"}),"\n",(0,n.jsx)(a.p,{children:"This section explains how to recover or migrate the Cado platform to a new instance."}),"\n",(0,n.jsx)(a.p,{children:"If a Cado instance fails, you will need to recover and attach the data volume to a new instance. The data volume contains previously imported data as well as user settings."}),"\n",(0,n.jsx)(a.p,{children:"You can also use this approach to migrate Cado to a new availability zone or region."}),"\n",(0,n.jsx)(a.h3,{id:"scheduling-automated-backups-of-the-data-volume",children:"Scheduling Automated Backups of the Data Volume"}),"\n",(0,n.jsx)(a.p,{children:"Amazon EBS Snapshots are stored by AWS in Amazon S3, where it is stored redundantly in multiple Availability Zones."}),"\n",(0,n.jsxs)(a.p,{children:["You can create an ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://us-west-2.console.aws.amazon.com/events/home",children:"EventBridge"})})," rule that regularly (e.g. daily) backs up the CadoResponse EC2 instance:"]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 1",src:s(36281).A+"",width:"551",height:"560"})}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 2",src:s(69698).A+"",width:"571",height:"408"})}),"\n",(0,n.jsxs)(a.p,{children:["For more, see ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-scheduled-snapshot.html",children:"this tutorial"})})," from AWS."]}),"\n",(0,n.jsx)(a.h3,{id:"restoring-the-data-volume",children:"Restoring the Data Volume"}),"\n",(0,n.jsx)(a.p,{children:"To perform a migration or restoration to a new instance, deploy a Cado installation and Stop the Cado EC2 Installation."}),"\n",(0,n.jsxs)(a.p,{children:["The operating system volume will be smaller (typically 10 GB). Detach the larger Data Volume (",(0,n.jsx)(a.code,{children:"/dev/sdh"})," seen below):"]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 3",src:s(60203).A+"",width:"606",height:"104"})}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 4",src:s(93940).A+"",width:"247",height:"270"})}),"\n",(0,n.jsxs)(a.p,{children:["Next, ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/restore.html",children:"restore"})})," the Snapshot backup of your old Cado installation to a Volume in the same availability zone as your new Cado EC2 Instance."]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 5",src:s(31421).A+"",width:"254",height:"64"})}),"\n",(0,n.jsxs)(a.p,{children:["Then, simply ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-attaching-volume.html",children:"attach"})})," the restored Data Volume to your new Cado EC2 Instance and start it."]}),"\n",(0,n.jsx)(a.h3,{id:"backups-with-high-availability",children:"Backups with High Availability"}),"\n",(0,n.jsx)(a.p,{children:"If you have opted for the High Availability deployment in AWS, back-ups need to be enabled for the native AWS services used in the deployment:"}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsx)(a.li,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html",children:"https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html"})}),"\n",(0,n.jsx)(a.li,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html",children:"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html"})}),"\n",(0,n.jsx)(a.li,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/efs/latest/ug/awsbackup.html",children:"https://docs.aws.amazon.com/efs/latest/ug/awsbackup.html"})}),"\n",(0,n.jsx)(a.li,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups.html",children:"https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups.html"})}),"\n"]}),"\n",(0,n.jsx)(a.p,{children:"You can also enable automated back-ups in the CloudFormation or Terraform deployment template, for example with:"}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsx)(a.li,{children:"ElastiCache:"}),"\n"]}),"\n",(0,n.jsx)(a.pre,{children:(0,n.jsx)(a.code,{className:"language-yaml",children:'SnapshotRetentionLimit: 7\nSnapshotWindow: "03:00-04:00"\n'})}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsx)(a.li,{children:"RDS:"}),"\n"]}),"\n",(0,n.jsx)(a.pre,{children:(0,n.jsx)(a.code,{className:"language-yaml",children:'BackupRetentionPeriod: 7\nPreferredBackupWindow: "03:00-04:00"\n'})}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsx)(a.li,{children:"OpenSearch:"}),"\n"]}),"\n",(0,n.jsx)(a.pre,{children:(0,n.jsx)(a.code,{className:"language-yaml",children:"SnapshotOptions:\n AutomatedSnapshotStartHour: 3\n"})}),"\n",(0,n.jsx)(a.p,{children:"Snapshots are not enabled by default for cost reasons."})]})}function h(e={}){const{wrapper:a}={...(0,t.R)(),...e.components};return a?(0,n.jsx)(a,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},36281:(e,a,s)=>{s.d(a,{A:()=>n});const n=s.p+"assets/images/aws-backup-1-0ea6616ad39ba74e1380d878606d4e9a.png"},69698:(e,a,s)=>{s.d(a,{A:()=>n});const n=s.p+"assets/images/aws-backup-2-5704a0f85c843e2bac5efef40f42d14b.png"},60203:(e,a,s)=>{s.d(a,{A:()=>n});const n=s.p+"assets/images/aws-backup-3-aa9c09491fe25218da52c4c56e163e32.png"},93940:(e,a,s)=>{s.d(a,{A:()=>n});const n=s.p+"assets/images/aws-backup-4-5504cf261e4c5a3680ed3e026c7928a8.png"},31421:(e,a,s)=>{s.d(a,{A:()=>n});const n="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAP4AAABACAYAAAA6VspUAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABgZSURBVHhe7Z3pU1xXmqef3MiFJJMEMiHZNwFCSEKbte+StdmtcnS7eiq6oiPmL5jpLz2faqK+zIeJmJmIiZilumuiqruqXba7u1y22tZqW2hBktkkJLGIRawCkoRcyYTc52SSkhFGEiCpCon7oAxJ5977nuWe3znve7h5jywYDMaQkJBYVbwy4Y/ZxrnX1oFtfIJIJJJMlVjpqFQqykuLWVu5hrQ0fTJV4m3nlQn/7IVvmJh0kJWZkehMEm8G/ukZRsds7N+zIyF+idXBKxP+L/7fb6gSHWf/np2kpEjCf1Pw+af5+1/9li2bNrDznS3JVIm3HXny75cmHA6j0agl0b9hpOq0yGUyotFoMkViNfDKhC8hIfHmIAlfQmIVIglfQmIVIglfQmIVsmqFH/I5sU868c2EkikSEquHN0P4ETvdDVf46g+f803rIBO+l1yBDo3Sdu0bfv/xV9x4MIpb0r7EKuONEH5o/AE3r3/L52cv8Ydrd+mf9LFo6c8M03L5HL+71ELvhG82TSYj4p/E4XDhC0WJyWaTVxqhcJiGptt8/uV5hh+NJFMlJF6eN0D4QWzdD+kf8xNRxXA97KR/1I5vgaeCo+EZPC4nbt80oUhyaHD10/zddb5s6GDQ7iYQChORmyjfspuT7x9ka0kWesXsqXGiQS+O8WFGxicTYUD0yeNNUaKhAMFgiEhU/Dtx3hjjLh+B8JxhKBrG57ExNjKC3eMn+Lgcy6D3YT8Xv7nCma8ucP1mAw6nK3lEQuLlUPzsZz/7efLfL0V8ZsrNzaGoID+Z8ooIDtNU10CzI531ZRpibiF6QwmlBTmYNMlxK+xl6N4tLl+9yfWGVlrbOhkMaNH6+2i5dYtrbcKd904z7RBCDeswZYCzvYu2Ngcqq5msDD2qqB9bewN1V65x5btW7tzvov2hjbDGSLpRj1oxSdfVeuqaHtDX10lrSzM3Gu+KvHpxKdPJNBnQhR9x58Z1vqm7xXd32rnf2Y1LYSLDlI5uic81uVxuLlyq487d+0z5fAnvJDvbTLbFjFI5Z6R6BXzX2EJOtoXC/LxkisTbzoqf8YPjvXSPTUBuGZs3raPQpGCgd5DRSS/hxBlRnL1NXL50gYvNPbhkQthpGmSxMOFQkGm/j1AoHsQLF0GkxeI/MS8j7Xepr2ulx+YhII76Ht3hyuWLwjMYwJ+SgVnlobvlGp9dbOTBqIsQyWsu1dPycIKgLg1dZILe1puca+hkyDmDs6+Z61eu0uFUkJFfRIk5VQwYooRLfCg64eI33+a2EL3P70+k2cbtXKu/xcjoWOL/EhIvwwoXvp+R7n5GJ2IUFlrJq1xLWZYJxVAPA7ZJphLKd9Lf2sb97gDW9Ts5+d4J/uzUcY7UFlNQWsOmqgKs6WK6NZewdd8h3t1USrZembD+PTOMPRAzdO8EqeVbOHTsBKdP7+OdXC2ue/doH7LjnR1lIKAiu6KWfUePcXx7CTnpcibcHhEWiDDA68Y1Pc0UKWQWVbJr/yF2VFpJVyevXSRxF/9mQzMTk5PJlFnahQfxXVOL5PJLvDQrW/j+Idq7x7A5gzge3ubylWYe2LyEfCN0DYxh9wbFSV5cE35mfAaKi4spzs3EYEgnI02PLtVIml6HWiUDtR5DhoUsg/i/cv5qXoAp9zSBaRX5hfnkZmdiyhXhhDUdY8SFd2qGmcfCR0t6uhFjmgGDXktKinzWixA/xuJattUUoZns5OqFs3x6tp77Q04CSwjz4y5+/Y0GEU4MEpm3PjAzM8N1cay9s4tAIF53CYnlsaKF7xvppXdsErdwtG19HTTcaKHT7hHz8wz93YOMTIhBACHihI6DBMNR5q6zLR45SoUMhTxERBiIxhcOo2HxJyrCAnFMLkO+iJbSWKrYeeg9fnL6CNvzIgy01vPFjXYGHbPu+mJout36lIs/H8nll3gVrGDhe3nUNYTNHqRg0y5Onv6AD390mh//xSF2FptRCne/f3QCTzCD7DwDeqOH9tY7QjTtYrZ8QPewHfd0WMzIaiFo4dpPjjI80EvPqIOpmfm/EtCQZTWhT4P+zg7aH3TQdf82d4WL79JnYzbpSV3Eepp3bBhHUIa1cgPbN4qQQhdm2ObA5Vv87Dxun0gs5j2PwaFHCc9AQmK5rNxVfW8316+0cGdITe3Ro7y7dwvrSoooKbKisgtPoL+fSUMx5YVFFGWnEPHa6O7qo69/iN7uHh5FjFhzLJjTYjgGhhgaGGXMNsqEPFO48io8bZ10Dkcp2LaONQVmjKkaZNMOcW0fD/sH6OnoosutZs2OvezfXE623sdAY9ucazKR2dppah9gJKWQ7evKSBv/jsvXbnKztY+ungEGHEpKN25iR3UhJu38dYWF0Wo0FIo23FCzlk0baxb81K5fR1lZMampuuRVL4e0qr/6eGUv4vhfv/gVW7fUsnfX9mTKS+Ifob1jgCGXmtKaMiFuIymJA1Fcg0KA/eP408uoKc3DkhrFOdjDg74R7FNhYjIVpuJKqkusZGqDjPcIEQ9O4BITb2p+hbgmjUDvQ3pHo+RsWEOxiOXVRPCN9dLRM8Soa4ZITIEqzULl2nIKzQZS5B6G73Y/dQ0T3dzrHmFcZaV2TSFG/0Nx/TCjbhEyxK/XZbKmeo0ou7C/gn2r//m/f8nGDevYvWNbMkXibWflCn85xCKE40G+XCHce3n8Ab3viYnYPSYTafFPMm0hEjYixEQUpFAoRGz/vJMX4GWv/xMgCX/1sbJX9ZeKTIFSpUKpmCf6ODJ5QoTPFX2chI0UVCrl8kT7stdLSPwReLuELyEhsSgk4UtIrEIk4UtIrEIk4UtIrEJemfDjm2j4/dPMBOJfeZF4U/B4pxKv1o7/FkRi9fDKfp33bd11evsHEgOA1IneHOLfBIyEIxzct4vyspJkqsTbjsxmn4g9HBzA7fUmk5aHw+nmYd8ATpdL2pzhDUKhUJIXf+KyMB+dVpNMlXhbqSorI8dsRiZm6dj1xkbS9HosmZnJwxISEm8bnb29VJSWsL6q6nvhr6uoSCRKSEi8nVy8dg29LpXa6mppVV9CYjURjcbfQBV/oFxCQmLVIQlfQmIVIglfQmIVIglfQmIVIglfQmIVIglfQmIVIgn/FRGZdmEbseOcCsS37lgRRHx2BjtbaWnt5pHDT0h6oFI0ygwu2yjjjqk5r0xffbx+4c/Y6b9znTO//xd++9Hv+OTzczR02/C+Zd/lCYzc5vPfXeVGxyTTybQ/KVMD3PzXz/jsiyvcaumg3+5hWhI+TI/Q9Pmn1N3sZHJF3Kg/Da9V+DNjd/n6nz7i0z/U0z44icc3jWv8IY/GXSzhjdOLx9HFZ3W3aRqMb3n1xyXsHuJO40N6x/yshK0ugvYuvq4bwaEpoWZzFYVZqaRIbwKL3yiGWpvo6bPhW+6M/yfsZ6+K1yf8gI17Fz+nrtOLad1OTpw6yen3TnHq3SNsLreQNm9bqUgoRDgSebL9dSQ0u1GkZyqISP6eSIig34V9wolr3rHgRDd1zZ08sPt+4G4/094SiYRmcDucuD3CdX6JnXDnkrDpcuP1i7LFTUYjBH1OJl0+poPz8nhyzMNUQLTXM75bGfRMMj5jJKt0LTUbKyjITEMzd2+AsGjHUGQ2P8Fi6rWkcj7F92X2TH+f5xOeYyfeL6YcdiadbvyivD/MZU57BOcfX36+z2vn5/WzN4XX9qx+cOgK/+O/nCWw7QQ//XA3ZYb528U66PzDFcbUBqanHtHVE6Ts8FF2bzDiaL3G9fsjwhWTIRc327JxD/u2VZE1dZ+LV1p55PQTjoWYdsnJ3XqAAztLiHVe4PzZc3zSGiInP59yy1YOfbCHbVUqRpsWtpc/t0yBEZrPNOPNrRYzZBlZWpEWsnHni0bc1rWs21xItO8W395sZ8wbJhbxIcvexP4D21mXb2Cm5Tf8p/9qY+1PP+Cn75ejG2rgTGeE0sq1bCxMR8UMQw1f0R4uYW31eize25y5bycy5SI4M43H4cEdzKJibTZKnwu3cwK73Yu2ci/HD26mzKwl5uqjoa6euyMOpuVyImELG/fsZtu6PIxPqjKbz9kzX/DJZT8ZlWVUlaxlz/HDVGpaaHFoMPq9DHf1ECg7wrHd60gdbXpmvaLxeiyxnE/NJtOiDesv0Ng9wRQGUiJGavbupFZ0tY7zbThVUXwBD17XrB1Z6Q5OHd5KVU6Y3osXuNnrwCM0GQmI2TWtit0H91JbmoW/6wsu900RHA8TnZli0uclqF/DzoP72FxqRhd8Rr55dj77z/+djrQNFJUXJTY+fTpfPTHvALcvf0vzgBM/SvxhPRXb97O/NpfA/bML97MakWeyyiuV+LP6Oo2OTete47P60+ODDEQzMeXnYdIvtEe0l6FrX3PhXAMPvQpMORZMwg3w9tZztuUBE8oMytaUUpLmofmbFm53TxJQasm0WCkoKqNizRpylMNcbrzDvZEpFGlZZJlS0ejTyMjJpbAoi/RUFZ6eZ9t7KsQTQvKIwaqu5TYDjtkjwdE2zjd38cA5IzrYPS581UinI4XssnLKi01Md1zkmxu3GXT+0LkP2ju53NQ2Z1YIYe+4SmNbFzafmE3ix8/c4u5wFH12AWUl6QTuXOHqjU7cSiPW4nKKUh00nG+i4YEQOi56rp6nuWsSZWapGKSLSPO28E1LKz0Tc2siRy3awmI2oRODanqWlfyibDJE2/qH6rlw/gK3hGAUplyyTXoU9vvPrdfSy/k0MyN3RPsPMabMobS0mFJRFpNejTJkp6PuS6429RNUZ5Ir7JQavLRcukNTl1PYUZJiMJOTV0BJ+RoqSox4b12ipbErEZt7B0VdrjbS61eTWVhORVkOssErfF3fSJ844Zn5JsOdYERBavpC+Yp2vi4GlTuDRIxFwm4pucpRbpyt51bnBCH9wv3s9S+WvVpen/CnxgkZZegMalTPzCVEICWDil3H+PCvTrK9Ss1Ey3UmQhY27zrEkQN7OHJ4G7mTdsb67cwY14gR/ygn3j3EgQPHOHGgUtzIaRxCSBlr93N47xYKq2vZcfxH/NVf72WjmFVGG55tzzM3QFNlUb29ghmng/6xeAcIMdrZhCs7g4LyLIK931LvVlC29yinTx7j/R/9JR9sNTDQ20PbiGd5cb2Yfc3F29h/+BgnTx1kl0WGWmGiatte3j1+jA9O7sEUkgs3d5qAa4Dvrk0QMdey9/AhDu07zLvbrDgmxhhI7CH4mBQsj9vCLLyNve/xl399QrSthfgmwaGgioyKHZz8i3/He9tLkYnB7oX1Wko5E2X4ntiMH4dTiNhUzqYd4vz39rGhzJzcksyJypRD7e4DHBN2fnRiF5aoCpc7IOzoyd8m7tmpExw9eIB3Tx3lnbQAkUkxCycbOxRLp3DzbvaLa0+8/2NO78rH9ugRD8a8BJ6bLxhySnln/wL5xtu5bpigeQeHTr7PqZPv8ZMPD1DhbKX33gDywoX6WTpv2psMXpvwlSoNcneEsF+4Ysm0hdAYjaQb9GjVSpTyKZxiJva03ePmxTN88vEnfHLxNuOhMBpxx+QBG80Xfs+vfvUP/Pqjj/n4XCMDtqmkpYXw4nievacWu5RkrdtBtVzEk4OPRGw3xoPGEPkZhZTlqHGPDeNKU2EUo70u3nkUBuHq5REa9DI6NiUc7OWQglKpjO//IezJxSAmZmuVSItvxBE/qklFoUwuhngcdE96abv7HefP/DMfffzPnLttJxDWiPLIZ/cNXQzaNNJNaeh1KaiUQRy2xdRrCeWcR0reZk7UWqDtIr/8v3/Hr/9NeHh2/5PYWKMRdlSz24spU0SfUTz2DiO4em/yxT/9I7/+9W/57UdnuNQ/ylMbh4syKZXy2fso12HOziH2aJpxYT+63Hzj7WwX4UpqFvrU2b2bNOZcilPceEZtuHxv6nLe07w24RvMRWTPuHEMT+DxP0/6c1GhEoLUmoxYhBuVL2Ko/LKNHPrJUXZszGLqnnAN2x4S1JkpyM3BmmVAm/K8PemeZy8Pw7xLFemlbK6IMTo5TM/9O9xVFGItKcMq3GSlcFvmv1Es/vVGUkS68B9f+4K5EJpWoRGiNWPNFfUQdSmtPcBP3n2HjXlpYthaDvHNP15vvRTpRew+eoSTh7ezPl8jPLozXGm4x6j3Bctizm4ufd7EfZsMY24uVquFDI3wHpOHFyIWEaLUykVTic9y8020s2I2nycLerHE5CUXg578hTuyvBm8NuGnWGvYuTHGUOu3fH2rixF3MPFut2BwCs/UNMHQQsvR6VgqcwmZMsmq2MS+Q0c4Jm7esX0bKDWn4HzYxoTawqa9Rzh1dD97asvJFKHEE2RiShK2p2dChBPmn2dPv0An0lO0cT3qsRFuXrqMrzCTghKLcA9TyClai9nlZWzYkdiDDxGjPnzQiypHT0G2GIAS18c7VXKQi5dl0oPHPUNAJMcf8HG4RNmWFRMI0rOozA1jysyiQri3R+L1EJ+D60uwiBhzeSy2Xi+BuOcaYx7r9xzlzz88zub0cWwjwzhfNBl4HnG7M4C2dBsHTxzjyP6trDcbxR2aw5QbV3xFPv5k0oyNns4e1FYjBTlGNMvNN93K+mIfPscAY65ZD8E32Mvd6Qy0ebmY4vHSD/rZm8fyJorFoM9nx+lTuM5dpeX8P9DxrXAlhVsWjSmwbhVx+h5j8sS5aMjbdoSN4/U0ffp3dOWY0QSFs6ktE/HUVjKLKtG2tnLu4yma0jPIlk3gDWcnrxVXW4qp0XbQ8vtf0le/leN/tkfEoc+yt4v1pZk/6NhphVvYbGjkdw0+andZKciaXaVOrzjM8bIvqb/4G/7bVQ0pshl8UyrWHVzPujw9ekd8hbeZu1+JvEpMvGMpoFLWQNO//ILB6/kUFeUicwsX9PviLg1tHtuPrcd+rZlP/083V8wa4lXRlb7D8b01lGYtJ8pUvLBeyu7kqcvE23eDr+vaGI6oUURtDNkslB8sISvtBYoxWakpucbNW1/wj2PXMGel4lRMI0tLHo8TneTBrTP8/e0YAbcHr09F9dFq1lpTmV5uvtpcth3dzNDlVv71F218KcKBoBhgfEXv8P6mcuLNrFign22tMr/8IPlHRPEf/uPf/HxwZCTxvr1MkymZ/CqQo83Ioygvmwy9FnWKGo0ulfTMbArLyii2ZmA0ZpJTWUVJQSZ64Z7FURvMIq4WM408hkKrQ6vRYzQLOyV55OXlYRJ2UnRCaEYzxeVrKK+ooKbYQpaIx1RaAxaTOKbVkmrIobjUSl5BAcUL2ssR5RKdIpHrHFQ6Ee+mYCraxMaaSgoyNInRUa4RsW+2mHGEaywT8aDGaKViyz72bKsiL10IRsTOWVlpok7ZFIh8c6xmckw6UjUaNPoMcgrKqKouZ82aaoqzM0nTajBk57O2Oh+rKZ6HcE91pqfbQ65Cl2mhskqENSYDGaLcGQYdsqgIX1K14mPAnF9ISa4JvfrpmsiEl/K0/bg5LRk5lVQV5yfaK97iL6qX8gd2XlTO2bweEwl4cU8FiaaI8or7k7d2J9s3VZEr2kZrsFBQVSVmaBOJXcTn2snJJC9Lh06rRqeLr6CXUFFTQUV1NbmZJgIDl6gbVlNYspbSzFTUqdlUbBVe4NZKctPVxJabr+g/6Zm5wpNMRR6TifhfR1bROvYd3M6mUhH3q2SiH/2wn5mNT9d7JdI7OIhKqcJqmfOyzdf9zr1I/DXO0ajoXIrZXWST6c8kEiYszo/E49D4NY8vSKSLji0CU8WTxEXwLHtLJRoR3quwI5OjTOzKm0xfkPjOufE8F3Pu4nnSlnGb8bZ8FWHnkuq1RB7bjrfDEts+UVeE2OaVqf/i3/LzqwaOfvDv+fPabJTxnZDnl/sl8o0z285idhQXLqmvrVD+KL/Hn49CqSQlRczK8Y6aTHsuCiXxXWfVqnk3LJGuXPqNeJa9pSI6V3xHXrVyMXbEuWKEXdy5i+dJWwq7r0T0cZZUryXy2PYy2j5R1wXKJFdlYUlNJ1UcS9zbhcr9EvnGmW3nZfS1N4C3r0YSqwJT5Ul+fOIQm/INK97FXolIwpd4I0nLrWFrbTVFmTpJ+MtAEr6ExCpEEr6ExCpEEr6ExCpEEr6ExCpEEr6ExCrkyQM8CqWCdIMhmSwhIfG2MTQyQlFeQeIBnoTwXR4P0dgLvrwgISHxxqOQK2cf2XW5PTG1OgWNeuHvU0tISLw9eKemkMsVyGKJL19LSEisHuD/A51YNghCpMniAAAAAElFTkSuQmCC"},28453:(e,a,s)=>{s.d(a,{R:()=>i,x:()=>r});var n=s(96540);const t={},o=n.createContext(t);function i(e){const a=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function r(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),n.createElement(o.Provider,{value:a},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d86b7bf0.5e4ae219.js b/assets/js/d86b7bf0.ea5ad87c.js similarity index 96% rename from assets/js/d86b7bf0.5e4ae219.js rename to assets/js/d86b7bf0.ea5ad87c.js index e2e53ecd6..10f2726f5 100644 --- a/assets/js/d86b7bf0.5e4ae219.js +++ b/assets/js/d86b7bf0.ea5ad87c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8670],{12652:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>l,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var i=n(74848),r=n(28453);const o={title:"Bucket",hide_title:!0,sidebar_position:10},s="Bucket",a={id:"cado/deploy/azure/azure-bucket",title:"Bucket",description:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions.",source:"@site/docs/cado/deploy/azure/azure-bucket.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-bucket",permalink:"/cado/deploy/azure/azure-bucket",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-bucket.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:10,frontMatter:{title:"Bucket",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Secret Manager",permalink:"/cado/deploy/azure/azure-secret-manager"},next:{title:"GCP Terraform deployment",permalink:"/cado/deploy/gcp/gcp-deploy"}},c={},d=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function u(e){const t={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"bucket",children:"Bucket"}),"\n",(0,i.jsx)(t.p,{children:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions."}),"\n",(0,i.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"The Managed Identity used in the initial deployment and permission to edit it"}),"\n",(0,i.jsx)(t.li,{children:"Permission to create a Storage Account and Blob Storage container in the Azure console"}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Add the necessary permissions by adding the following to your Cado managed identity:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Storage Account Contributor scoped to your resource group"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Create a Storage Account in your Cado resource group"}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Create a Blob container in the Storage Account above"}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Enter the Storage Account and Container name in the Setup Wizard - if the configured permissions are insufficient you will be notified and asked to correct before logging into the platform."}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Azure Bucket",src:n(56849).A+"",width:"512",height:"256"})})]})}function l(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(u,{...e})}):u(e)}},56849:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/azure-bucket-e823c57060037255b3832cae5174ab3b.png"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>a});var i=n(96540);const r={},o=i.createContext(r);function s(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:s(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8670],{12652:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>l,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var i=n(74848),r=n(28453);const o={title:"Bucket",hide_title:!0,sidebar_position:10},s="Bucket",a={id:"cado/deploy/azure/azure-bucket",title:"Bucket",description:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions.",source:"@site/docs/cado/deploy/azure/azure-bucket.md",sourceDirName:"cado/deploy/azure",slug:"/cado/deploy/azure/azure-bucket",permalink:"/cado/deploy/azure/azure-bucket",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/azure/azure-bucket.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:10,frontMatter:{title:"Bucket",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Secret Manager",permalink:"/cado/deploy/azure/azure-secret-manager"},next:{title:"GCP Terraform deployment",permalink:"/cado/deploy/gcp/gcp-deploy"}},c={},d=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function u(e){const t={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"bucket",children:"Bucket"}),"\n",(0,i.jsx)(t.p,{children:"The Cado deployment requires a storage bucket for various functionality including evidence preservation, health checks and Cado host based acquisitions."}),"\n",(0,i.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"The Managed Identity used in the initial deployment and permission to edit it"}),"\n",(0,i.jsx)(t.li,{children:"Permission to create a Storage Account and Blob Storage container in the Azure console"}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Add the necessary permissions by adding the following to your Cado managed identity:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Storage Account Contributor scoped to your resource group"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Create a Storage Account in your Cado resource group"}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Create a Blob container in the Storage Account above"}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:"Enter the Storage Account and Container name in the Setup Wizard - if the configured permissions are insufficient you will be notified and asked to correct before logging into the platform."}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Azure Bucket",src:n(56849).A+"",width:"512",height:"256"})})]})}function l(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(u,{...e})}):u(e)}},56849:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/azure-bucket-e823c57060037255b3832cae5174ab3b.png"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>a});var i=n(96540);const r={},o=i.createContext(r);function s(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:s(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d89fafa7.857b4144.js b/assets/js/d89fafa7.45e6c79e.js similarity index 98% rename from assets/js/d89fafa7.857b4144.js rename to assets/js/d89fafa7.45e6c79e.js index aa3755064..8ca0ec679 100644 --- a/assets/js/d89fafa7.857b4144.js +++ b/assets/js/d89fafa7.45e6c79e.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3027],{80051:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>i,default:()=>p,frontMatter:()=>r,metadata:()=>c,toc:()=>l});var s=n(74848),o=n(28453);const r={title:"Workers",hide_title:!0,sidebar_position:11},i="Workers",c={id:"cado/deploy/gcp/gcp-workers",title:"Workers",description:"The initial deployment runs everything on a single Compute instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures and small artefacts stored in GCS. We also limit how many pieces of evidence can be processed at once.",source:"@site/docs/cado/deploy/gcp/gcp-workers.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-workers",permalink:"/cado/deploy/gcp/gcp-workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-workers.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:11,frontMatter:{title:"Workers",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Bucket",permalink:"/cado/deploy/gcp/gcp-bucket"},next:{title:"GCP Logging Best Practices",permalink:"/cado/deploy/gcp/logs"}},d={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function a(e){const t={code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,o.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"workers",children:"Workers"}),"\n",(0,s.jsx)(t.p,{children:"The initial deployment runs everything on a single Compute instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures and small artefacts stored in GCS. We also limit how many pieces of evidence can be processed at once."}),"\n",(0,s.jsx)(t.p,{children:"To enable processing data from all sources or to process many items of evidence at once, Cado must be configured to allow it to run imports on additional Compute instances."}),"\n",(0,s.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"vCPU capacity in your region: we recommend requesting 128"}),"\n",(0,s.jsx)(t.li,{children:"The IAM instance role used in the initial deployment, and permission to edit it"}),"\n",(0,s.jsx)(t.li,{children:"The firewall you used in the initial deployment, and permission to edit it"}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"Add the necessary permissions by adding the following to your IAM role:"}),"\n"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-json",children:'// Worker Permissions\n"compute.disks.create"\n"compute.instances.create"\n"compute.instances.setMetadata"\n"compute.instances.setServiceAccount"\n"compute.addresses.use"\n"compute.instances.addAccessConfig"\n"compute.instances.delete"\n"compute.instances.setLabels"\n"compute.subnetworks.use"\n"compute.networks.get"\n"compute.networks.list"\n"compute.instances.setTags"\n"compute.instances.get"\n\n// Adjusting Worker Settings\n"compute.machineTypes.get"\n"compute.machineTypes.list"\n"compute.regions.get"\n'})}),"\n",(0,s.jsxs)(t.ol,{start:"2",children:["\n",(0,s.jsx)(t.li,{children:"Add the following inbound rules to your firewall"}),"\n"]}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Port"}),(0,s.jsx)(t.th,{children:"Protocol"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"5432"}),(0,s.jsx)(t.td,{children:"TCP"}),(0,s.jsx)(t.td,{children:"Data Storage"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"9200"}),(0,s.jsx)(t.td,{children:"TCP"}),(0,s.jsx)(t.td,{children:"Data Storage"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"6379"}),(0,s.jsx)(t.td,{children:"TCP"}),(0,s.jsx)(t.td,{children:"Data Storage"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"24224"}),(0,s.jsx)(t.td,{children:"TCP"}),(0,s.jsx)(t.td,{children:"Log Handling"})]})]})]}),"\n",(0,s.jsxs)(t.ol,{start:"3",children:["\n",(0,s.jsxs)(t.li,{children:["Enable in the UI: ",(0,s.jsx)(t.strong,{children:"Settings"})," > ",(0,s.jsx)(t.strong,{children:"Advanced"})," > ",(0,s.jsx)(t.strong,{children:"Deployed Workers"})," > Enable Deployed Workers"]}),"\n",(0,s.jsxs)(t.li,{children:["Got to ",(0,s.jsx)(t.strong,{children:"Platform"})," > ",(0,s.jsx)(t.strong,{children:"Run a Platform Check"})]}),"\n"]})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(a,{...e})}):a(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>i,x:()=>c});var s=n(96540);const o={},r=s.createContext(o);function i(e){const t=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3027],{80051:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>i,default:()=>p,frontMatter:()=>r,metadata:()=>c,toc:()=>l});var s=n(74848),o=n(28453);const r={title:"Workers",hide_title:!0,sidebar_position:11},i="Workers",c={id:"cado/deploy/gcp/gcp-workers",title:"Workers",description:"The initial deployment runs everything on a single Compute instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures and small artefacts stored in GCS. We also limit how many pieces of evidence can be processed at once.",source:"@site/docs/cado/deploy/gcp/gcp-workers.md",sourceDirName:"cado/deploy/gcp",slug:"/cado/deploy/gcp/gcp-workers",permalink:"/cado/deploy/gcp/gcp-workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/gcp/gcp-workers.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:11,frontMatter:{title:"Workers",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Bucket",permalink:"/cado/deploy/gcp/gcp-bucket"},next:{title:"GCP Logging Best Practices",permalink:"/cado/deploy/gcp/logs"}},d={},l=[{value:"Prerequisites",id:"prerequisites",level:3},{value:"Steps",id:"steps",level:3}];function a(e){const t={code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,o.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"workers",children:"Workers"}),"\n",(0,s.jsx)(t.p,{children:"The initial deployment runs everything on a single Compute instance. In order to limit load on this instance and ensure the platform remains stable we limit types of imports that can be run to those based around Cado Host captures and small artefacts stored in GCS. We also limit how many pieces of evidence can be processed at once."}),"\n",(0,s.jsx)(t.p,{children:"To enable processing data from all sources or to process many items of evidence at once, Cado must be configured to allow it to run imports on additional Compute instances."}),"\n",(0,s.jsx)(t.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"vCPU capacity in your region: we recommend requesting 128"}),"\n",(0,s.jsx)(t.li,{children:"The IAM instance role used in the initial deployment, and permission to edit it"}),"\n",(0,s.jsx)(t.li,{children:"The firewall you used in the initial deployment, and permission to edit it"}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"steps",children:"Steps"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"Add the necessary permissions by adding the following to your IAM role:"}),"\n"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-json",children:'// Worker Permissions\n"compute.disks.create"\n"compute.instances.create"\n"compute.instances.setMetadata"\n"compute.instances.setServiceAccount"\n"compute.addresses.use"\n"compute.instances.addAccessConfig"\n"compute.instances.delete"\n"compute.instances.setLabels"\n"compute.subnetworks.use"\n"compute.networks.get"\n"compute.networks.list"\n"compute.instances.setTags"\n"compute.instances.get"\n\n// Adjusting Worker Settings\n"compute.machineTypes.get"\n"compute.machineTypes.list"\n"compute.regions.get"\n'})}),"\n",(0,s.jsxs)(t.ol,{start:"2",children:["\n",(0,s.jsx)(t.li,{children:"Add the following inbound rules to your firewall"}),"\n"]}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Port"}),(0,s.jsx)(t.th,{children:"Protocol"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"5432"}),(0,s.jsx)(t.td,{children:"TCP"}),(0,s.jsx)(t.td,{children:"Data Storage"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"9200"}),(0,s.jsx)(t.td,{children:"TCP"}),(0,s.jsx)(t.td,{children:"Data Storage"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"6379"}),(0,s.jsx)(t.td,{children:"TCP"}),(0,s.jsx)(t.td,{children:"Data Storage"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"24224"}),(0,s.jsx)(t.td,{children:"TCP"}),(0,s.jsx)(t.td,{children:"Log Handling"})]})]})]}),"\n",(0,s.jsxs)(t.ol,{start:"3",children:["\n",(0,s.jsxs)(t.li,{children:["Enable in the UI: ",(0,s.jsx)(t.strong,{children:"Settings"})," > ",(0,s.jsx)(t.strong,{children:"Advanced"})," > ",(0,s.jsx)(t.strong,{children:"Deployed Workers"})," > Enable Deployed Workers"]}),"\n",(0,s.jsxs)(t.li,{children:["Got to ",(0,s.jsx)(t.strong,{children:"Platform"})," > ",(0,s.jsx)(t.strong,{children:"Run a Platform Check"})]}),"\n"]})]})}function p(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(a,{...e})}):a(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>i,x:()=>c});var s=n(96540);const o={},r=s.createContext(o);function i(e){const t=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d97f3d64.40dc9a91.js b/assets/js/d97f3d64.f89c046a.js similarity index 98% rename from assets/js/d97f3d64.40dc9a91.js rename to assets/js/d97f3d64.f89c046a.js index 20f6cb26a..71badfb81 100644 --- a/assets/js/d97f3d64.40dc9a91.js +++ b/assets/js/d97f3d64.f89c046a.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6222],{71788:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>u,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var r=i(74848),s=i(28453);const o={title:"Security",hide_title:!0,sidebar_position:8},n="Security Considerations for Cado Host",a={id:"cado/discovery-import/cado-host/security",title:"Security",description:"- Static Analysis: Cado Host releases undergo the same static analysis as the primary Cado platform in our release pipeline, ensuring thorough security checks.",source:"@site/docs/cado/discovery-import/cado-host/security.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/security",permalink:"/cado/discovery-import/cado-host/security",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/security.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:8,frontMatter:{title:"Security",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Script operation",permalink:"/cado/discovery-import/cado-host/script-operation"},next:{title:"Oracle Cloud Virtual Machines",permalink:"/cado/discovery-import/virtual-machine"}},c={},d=[{value:"Privilege Requirements",id:"privilege-requirements",level:3}];function l(e){const t={h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"security-considerations-for-cado-host",children:"Security Considerations for Cado Host"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Static Analysis"}),": Cado Host releases undergo the same static analysis as the primary Cado platform in our release pipeline, ensuring thorough security checks."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Code Signing"}),": Cado Host Windows binaries are signed with an EV (Extended Validation) code signing certificate, ensuring authenticity and integrity."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Custom Storage Options"}),": Customers can configure their own storage bucket or web server to host the Cado Host binary. This allows for scanning the binary with their own security tools, though it requires maintaining the latest version."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Temporary Write-Only Credentials"}),": Cado Host uses limited-time, write-only credentials generated by the Cado platform for accessing cloud storage, minimizing security risks."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Encrypted Communication"}),": All communication between Cado Host and cloud storage is encrypted using TLS, ensuring data security during transfer."]}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"privilege-requirements",children:"Privilege Requirements"}),"\n",(0,r.jsxs)(t.p,{children:["Cado Host requires ",(0,r.jsx)(t.strong,{children:"elevated privileges"})," to access raw disk and memory for full forensic collection. Running without elevated privileges will limit its ability to access these resources, preventing a complete forensic investigation."]})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},28453:(e,t,i)=>{i.d(t,{R:()=>n,x:()=>a});var r=i(96540);const s={},o=r.createContext(s);function n(e){const t=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6222],{71788:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>u,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var r=i(74848),s=i(28453);const o={title:"Security",hide_title:!0,sidebar_position:8},n="Security Considerations for Cado Host",a={id:"cado/discovery-import/cado-host/security",title:"Security",description:"- Static Analysis: Cado Host releases undergo the same static analysis as the primary Cado platform in our release pipeline, ensuring thorough security checks.",source:"@site/docs/cado/discovery-import/cado-host/security.md",sourceDirName:"cado/discovery-import/cado-host",slug:"/cado/discovery-import/cado-host/security",permalink:"/cado/discovery-import/cado-host/security",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/cado-host/security.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:8,frontMatter:{title:"Security",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Script operation",permalink:"/cado/discovery-import/cado-host/script-operation"},next:{title:"Oracle Cloud Virtual Machines",permalink:"/cado/discovery-import/virtual-machine"}},c={},d=[{value:"Privilege Requirements",id:"privilege-requirements",level:3}];function l(e){const t={h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"security-considerations-for-cado-host",children:"Security Considerations for Cado Host"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Static Analysis"}),": Cado Host releases undergo the same static analysis as the primary Cado platform in our release pipeline, ensuring thorough security checks."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Code Signing"}),": Cado Host Windows binaries are signed with an EV (Extended Validation) code signing certificate, ensuring authenticity and integrity."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Custom Storage Options"}),": Customers can configure their own storage bucket or web server to host the Cado Host binary. This allows for scanning the binary with their own security tools, though it requires maintaining the latest version."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Temporary Write-Only Credentials"}),": Cado Host uses limited-time, write-only credentials generated by the Cado platform for accessing cloud storage, minimizing security risks."]}),"\n",(0,r.jsxs)(t.li,{children:[(0,r.jsx)(t.strong,{children:"Encrypted Communication"}),": All communication between Cado Host and cloud storage is encrypted using TLS, ensuring data security during transfer."]}),"\n"]}),"\n",(0,r.jsx)(t.h3,{id:"privilege-requirements",children:"Privilege Requirements"}),"\n",(0,r.jsxs)(t.p,{children:["Cado Host requires ",(0,r.jsx)(t.strong,{children:"elevated privileges"})," to access raw disk and memory for full forensic collection. Running without elevated privileges will limit its ability to access these resources, preventing a complete forensic investigation."]})]})}function u(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},28453:(e,t,i)=>{i.d(t,{R:()=>n,x:()=>a});var r=i(96540);const s={},o=r.createContext(s);function n(e){const t=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/daba58e6.6249c756.js b/assets/js/daba58e6.8cb18243.js similarity index 96% rename from assets/js/daba58e6.6249c756.js rename to assets/js/daba58e6.8cb18243.js index b2a0cdccc..ad2d4999c 100644 --- a/assets/js/daba58e6.6249c756.js +++ b/assets/js/daba58e6.8cb18243.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1443],{21709:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>r,contentTitle:()=>a,default:()=>p,frontMatter:()=>o,metadata:()=>d,toc:()=>i});var n=t(74848),c=t(28453);const o={title:"Access an AWS account with keys",hide_title:!0,sidebar_position:6},a="How to access an AWS Account Using Access Keys",d={id:"cado/deploy/cross/adding-keys",title:"Access an AWS account with keys",description:"You can add key-based credentials to the Cado platform for either temporary, just-in-time access or permanent cross-cloud access.",source:"@site/docs/cado/deploy/cross/adding-keys.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/adding-keys",permalink:"/cado/deploy/cross/adding-keys",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/adding-keys.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Access an AWS account with keys",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Adding AWS accounts to Azure/AWS/GCP via Keys",permalink:"/cado/deploy/cross/adding-aws"},next:{title:"Temporarily access an AWS account with STS",permalink:"/cado/deploy/cross/aws-sts"}},r={},i=[{value:"Steps to Add AWS Key-Based Credentials",id:"steps-to-add-aws-key-based-credentials",level:3}];function l(e){const s={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,c.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"how-to-access-an-aws-account-using-access-keys",children:"How to access an AWS Account Using Access Keys"}),"\n",(0,n.jsx)(s.p,{children:"You can add key-based credentials to the Cado platform for either temporary, just-in-time access or permanent cross-cloud access."}),"\n",(0,n.jsx)(s.h3,{id:"steps-to-add-aws-key-based-credentials",children:"Steps to Add AWS Key-Based Credentials"}),"\n",(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:["In the Cado platform, go to ",(0,n.jsx)(s.strong,{children:"Settings"})," > ",(0,n.jsx)(s.strong,{children:"Accounts"})," and click ",(0,n.jsx)(s.strong,{children:"Create an account"}),"."]}),"\n",(0,n.jsxs)(s.li,{children:["Select ",(0,n.jsx)(s.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,n.jsxs)(s.li,{children:["Select the ",(0,n.jsx)(s.strong,{children:"AWS Keys"})," option, then provide an ",(0,n.jsx)(s.strong,{children:"Account Name"}),"."]}),"\n",(0,n.jsx)(s.li,{children:"Enter the access key and secret key."}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"AWS Account Keys",src:t(7853).A+"",width:"2682",height:"1148"})}),"\n",(0,n.jsx)(s.p,{children:"This method allows Cado to access your AWS account securely using the provided credentials."})]})}function p(e={}){const{wrapper:s}={...(0,c.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},7853:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/Accounts-AWSKeys-dcf3b89f41cc21728f4f412e5ad158a5.png"},28453:(e,s,t)=>{t.d(s,{R:()=>a,x:()=>d});var n=t(96540);const c={},o=n.createContext(c);function a(e){const s=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function d(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:a(e.components),n.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1443],{21709:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>r,contentTitle:()=>a,default:()=>p,frontMatter:()=>o,metadata:()=>d,toc:()=>i});var n=t(74848),c=t(28453);const o={title:"Access an AWS account with keys",hide_title:!0,sidebar_position:6},a="How to access an AWS Account Using Access Keys",d={id:"cado/deploy/cross/adding-keys",title:"Access an AWS account with keys",description:"You can add key-based credentials to the Cado platform for either temporary, just-in-time access or permanent cross-cloud access.",source:"@site/docs/cado/deploy/cross/adding-keys.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/adding-keys",permalink:"/cado/deploy/cross/adding-keys",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/adding-keys.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Access an AWS account with keys",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Adding AWS accounts to Azure/AWS/GCP via Keys",permalink:"/cado/deploy/cross/adding-aws"},next:{title:"Temporarily access an AWS account with STS",permalink:"/cado/deploy/cross/aws-sts"}},r={},i=[{value:"Steps to Add AWS Key-Based Credentials",id:"steps-to-add-aws-key-based-credentials",level:3}];function l(e){const s={h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,c.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"how-to-access-an-aws-account-using-access-keys",children:"How to access an AWS Account Using Access Keys"}),"\n",(0,n.jsx)(s.p,{children:"You can add key-based credentials to the Cado platform for either temporary, just-in-time access or permanent cross-cloud access."}),"\n",(0,n.jsx)(s.h3,{id:"steps-to-add-aws-key-based-credentials",children:"Steps to Add AWS Key-Based Credentials"}),"\n",(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:["In the Cado platform, go to ",(0,n.jsx)(s.strong,{children:"Settings"})," > ",(0,n.jsx)(s.strong,{children:"Accounts"})," and click ",(0,n.jsx)(s.strong,{children:"Create an account"}),"."]}),"\n",(0,n.jsxs)(s.li,{children:["Select ",(0,n.jsx)(s.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,n.jsxs)(s.li,{children:["Select the ",(0,n.jsx)(s.strong,{children:"AWS Keys"})," option, then provide an ",(0,n.jsx)(s.strong,{children:"Account Name"}),"."]}),"\n",(0,n.jsx)(s.li,{children:"Enter the access key and secret key."}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"AWS Account Keys",src:t(7853).A+"",width:"2682",height:"1148"})}),"\n",(0,n.jsx)(s.p,{children:"This method allows Cado to access your AWS account securely using the provided credentials."})]})}function p(e={}){const{wrapper:s}={...(0,c.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},7853:(e,s,t)=>{t.d(s,{A:()=>n});const n=t.p+"assets/images/Accounts-AWSKeys-dcf3b89f41cc21728f4f412e5ad158a5.png"},28453:(e,s,t)=>{t.d(s,{R:()=>a,x:()=>d});var n=t(96540);const c={},o=n.createContext(c);function a(e){const s=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function d(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(c):e.components||c:a(e.components),n.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/dd15f4d2.c43583a6.js b/assets/js/dd15f4d2.46746d35.js similarity index 99% rename from assets/js/dd15f4d2.c43583a6.js rename to assets/js/dd15f4d2.46746d35.js index 137fdca12..181bbe19c 100644 --- a/assets/js/dd15f4d2.c43583a6.js +++ b/assets/js/dd15f4d2.46746d35.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3325],{59823:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>l});var i=t(74848),o=t(28453);const s={title:"SentinelOne",hide_title:!0,sidebar_position:3},r="How to Collect Data from SentinelOne",a={id:"cado/integrations/xdr/sentinelone",title:"SentinelOne",description:"SentinelOne Singularity provides comprehensive visibility across your environment, allowing you to detect malicious activity as soon as it occurs. Cado enhances forensic analysis, quickly delivering historical context and depth to your investigation, helping you identify the root cause efficiently. Together, the SentinelOne and Cado integration enables organizations to detect, investigate, and remediate breaches with unparalleled speed.",source:"@site/docs/cado/integrations/xdr/sentinelone.md",sourceDirName:"cado/integrations/xdr",slug:"/cado/integrations/xdr/sentinelone",permalink:"/cado/integrations/xdr/sentinelone",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/xdr/sentinelone.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"SentinelOne",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Wiz",permalink:"/cado/integrations/cnapp/wiz"},next:{title:"CrowdStrike",permalink:"/cado/integrations/xdr/crowdstrike"}},c={},l=[{value:"Using the Cado & SentinelOne Integration",id:"using-the-cado--sentinelone-integration",level:2}];function d(e){const n={a:"a",admonition:"admonition",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-collect-data-from-sentinelone",children:"How to Collect Data from SentinelOne"}),"\n",(0,i.jsx)(n.p,{children:"SentinelOne Singularity provides comprehensive visibility across your environment, allowing you to detect malicious activity as soon as it occurs. Cado enhances forensic analysis, quickly delivering historical context and depth to your investigation, helping you identify the root cause efficiently. Together, the SentinelOne and Cado integration enables organizations to detect, investigate, and remediate breaches with unparalleled speed."}),"\n",(0,i.jsxs)(n.p,{children:["For more information, see the SentinelOne and Cado Security ",(0,i.jsx)(n.a,{href:"https://assets.sentinelone.com/cado-jointsb",children:"Joint Solution Brief"}),"."]}),"\n",(0,i.jsx)(n.admonition,{type:"tip",children:(0,i.jsxs)(n.p,{children:["To use the integration between SentinelOne and Cado, you need the SentinelOne Remote Script Orchestration (RSO) feature enabled, along with access to the Cado platform. To gain access to Cado, contact the Cado Security team ",(0,i.jsx)(n.strong,{children:(0,i.jsx)(n.a,{href:"http://offers.cadosecurity.com/cado-s1-integration-get-in-touch",children:"here"})}),". Note that the RemoteOps feature must be enabled ",(0,i.jsx)(n.strong,{children:"for each site"})," in your SentinelOne management console."]})}),"\n",(0,i.jsx)(n.h2,{id:"using-the-cado--sentinelone-integration",children:"Using the Cado & SentinelOne Integration"}),"\n",(0,i.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/iIJjp28G6sk",title:"Integrating SentinelOne with Cado",frameborder:"0",allowfullscreen:!0}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["In the SentinelOne console, go to ",(0,i.jsx)(n.strong,{children:"Settings > Users > Service Users > Actions > Create New Service User"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Ensure that your service user has ",(0,i.jsx)(n.strong,{children:"Global Account scope"}),", not ",(0,i.jsx)(n.strong,{children:"Site scope"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Assign the following additional permissions to the service user:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"RemoteOps > View"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > View Output"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Upload"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Run Scripts > Run Data Collection Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Run Scripts > Run Artifact Collection Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Run Scripts > Run Action Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Delete"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Cancel Scripts > Cancel Data Collection Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Cancel Scripts > Cancel Artifact Collection Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Cancel Scripts > Cancel Action Script"}),"\n",(0,i.jsx)(n.li,{children:"Task Management > View"}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.li,{children:"Specify a name and the expiration period for the integration."}),"\n",(0,i.jsx)(n.li,{children:"Copy or download the API Token."}),"\n",(0,i.jsxs)(n.li,{children:["In the Cado platform, Navigate to ",(0,i.jsx)(n.strong,{children:"Settings > Accounts"})," and click ",(0,i.jsx)(n.strong,{children:"Create an account"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"SentinelOne"})," from the set of providers."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"SentinelOne Integration",src:t(56654).A+"",width:"3866",height:"1486"})}),"\n",(0,i.jsxs)(n.ol,{start:"8",children:["\n",(0,i.jsxs)(n.li,{children:["Give the account a ",(0,i.jsx)(n.strong,{children:"Name"})," and enter the ",(0,i.jsx)(n.strong,{children:"Endpoint"})," and ",(0,i.jsx)(n.strong,{children:"Token"}),". Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'."]}),"\n",(0,i.jsx)(n.li,{children:"Navigate to the 'Accounts' table and the newly created SentinelOne account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,i.jsxs)(n.li,{children:["An alternative way to check the account has been set up correctly is to browse to any investigation, and click ",(0,i.jsx)(n.strong,{children:"Import > XDR > SentinelOne"}),". If configured correctly, a paginated list of hosts with the SentinelOne agent installed will appear."]}),"\n"]}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsx)(n.p,{children:"Currently, Windows and Linux operating systems are supported with the SentinelOne integration."})})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},56654:(e,n,t)=>{t.d(n,{A:()=>i});const i=t.p+"assets/images/Accounts-SentinelOne-394bb3f09ef08c2117970147ab1e9ac7.png"},28453:(e,n,t)=>{t.d(n,{R:()=>r,x:()=>a});var i=t(96540);const o={},s=i.createContext(o);function r(e){const n=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),i.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3325],{59823:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>l});var i=t(74848),o=t(28453);const s={title:"SentinelOne",hide_title:!0,sidebar_position:3},r="How to Collect Data from SentinelOne",a={id:"cado/integrations/xdr/sentinelone",title:"SentinelOne",description:"SentinelOne Singularity provides comprehensive visibility across your environment, allowing you to detect malicious activity as soon as it occurs. Cado enhances forensic analysis, quickly delivering historical context and depth to your investigation, helping you identify the root cause efficiently. Together, the SentinelOne and Cado integration enables organizations to detect, investigate, and remediate breaches with unparalleled speed.",source:"@site/docs/cado/integrations/xdr/sentinelone.md",sourceDirName:"cado/integrations/xdr",slug:"/cado/integrations/xdr/sentinelone",permalink:"/cado/integrations/xdr/sentinelone",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/integrations/xdr/sentinelone.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"SentinelOne",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Wiz",permalink:"/cado/integrations/cnapp/wiz"},next:{title:"CrowdStrike",permalink:"/cado/integrations/xdr/crowdstrike"}},c={},l=[{value:"Using the Cado & SentinelOne Integration",id:"using-the-cado--sentinelone-integration",level:2}];function d(e){const n={a:"a",admonition:"admonition",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-collect-data-from-sentinelone",children:"How to Collect Data from SentinelOne"}),"\n",(0,i.jsx)(n.p,{children:"SentinelOne Singularity provides comprehensive visibility across your environment, allowing you to detect malicious activity as soon as it occurs. Cado enhances forensic analysis, quickly delivering historical context and depth to your investigation, helping you identify the root cause efficiently. Together, the SentinelOne and Cado integration enables organizations to detect, investigate, and remediate breaches with unparalleled speed."}),"\n",(0,i.jsxs)(n.p,{children:["For more information, see the SentinelOne and Cado Security ",(0,i.jsx)(n.a,{href:"https://assets.sentinelone.com/cado-jointsb",children:"Joint Solution Brief"}),"."]}),"\n",(0,i.jsx)(n.admonition,{type:"tip",children:(0,i.jsxs)(n.p,{children:["To use the integration between SentinelOne and Cado, you need the SentinelOne Remote Script Orchestration (RSO) feature enabled, along with access to the Cado platform. To gain access to Cado, contact the Cado Security team ",(0,i.jsx)(n.strong,{children:(0,i.jsx)(n.a,{href:"http://offers.cadosecurity.com/cado-s1-integration-get-in-touch",children:"here"})}),". Note that the RemoteOps feature must be enabled ",(0,i.jsx)(n.strong,{children:"for each site"})," in your SentinelOne management console."]})}),"\n",(0,i.jsx)(n.h2,{id:"using-the-cado--sentinelone-integration",children:"Using the Cado & SentinelOne Integration"}),"\n",(0,i.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/iIJjp28G6sk",title:"Integrating SentinelOne with Cado",frameborder:"0",allowfullscreen:!0}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["In the SentinelOne console, go to ",(0,i.jsx)(n.strong,{children:"Settings > Users > Service Users > Actions > Create New Service User"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Ensure that your service user has ",(0,i.jsx)(n.strong,{children:"Global Account scope"}),", not ",(0,i.jsx)(n.strong,{children:"Site scope"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Assign the following additional permissions to the service user:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"RemoteOps > View"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > View Output"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Upload"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Run Scripts > Run Data Collection Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Run Scripts > Run Artifact Collection Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Run Scripts > Run Action Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Delete"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Cancel Scripts > Cancel Data Collection Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Cancel Scripts > Cancel Artifact Collection Script"}),"\n",(0,i.jsx)(n.li,{children:"RemoteOps > Cancel Scripts > Cancel Action Script"}),"\n",(0,i.jsx)(n.li,{children:"Task Management > View"}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.li,{children:"Specify a name and the expiration period for the integration."}),"\n",(0,i.jsx)(n.li,{children:"Copy or download the API Token."}),"\n",(0,i.jsxs)(n.li,{children:["In the Cado platform, Navigate to ",(0,i.jsx)(n.strong,{children:"Settings > Accounts"})," and click ",(0,i.jsx)(n.strong,{children:"Create an account"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Select ",(0,i.jsx)(n.strong,{children:"SentinelOne"})," from the set of providers."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"SentinelOne Integration",src:t(56654).A+"",width:"3866",height:"1486"})}),"\n",(0,i.jsxs)(n.ol,{start:"8",children:["\n",(0,i.jsxs)(n.li,{children:["Give the account a ",(0,i.jsx)(n.strong,{children:"Name"})," and enter the ",(0,i.jsx)(n.strong,{children:"Endpoint"})," and ",(0,i.jsx)(n.strong,{children:"Token"}),". Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'."]}),"\n",(0,i.jsx)(n.li,{children:"Navigate to the 'Accounts' table and the newly created SentinelOne account should present. If configured correctly, you will see a green coloured health status."}),"\n",(0,i.jsxs)(n.li,{children:["An alternative way to check the account has been set up correctly is to browse to any investigation, and click ",(0,i.jsx)(n.strong,{children:"Import > XDR > SentinelOne"}),". If configured correctly, a paginated list of hosts with the SentinelOne agent installed will appear."]}),"\n"]}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsx)(n.p,{children:"Currently, Windows and Linux operating systems are supported with the SentinelOne integration."})})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},56654:(e,n,t)=>{t.d(n,{A:()=>i});const i=t.p+"assets/images/Accounts-SentinelOne-394bb3f09ef08c2117970147ab1e9ac7.png"},28453:(e,n,t)=>{t.d(n,{R:()=>r,x:()=>a});var i=t(96540);const o={},s=i.createContext(o);function r(e){const n=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),i.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/dddd1328.f5812091.js b/assets/js/dddd1328.231c49dd.js similarity index 99% rename from assets/js/dddd1328.f5812091.js rename to assets/js/dddd1328.231c49dd.js index 719608e94..d7a33cbf0 100644 --- a/assets/js/dddd1328.f5812091.js +++ b/assets/js/dddd1328.231c49dd.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3357],{71132:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>l,contentTitle:()=>n,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var o=t(74848),i=t(28453);const r={title:"Add cross-account roles in AWS to Cado with the API",hide_title:!0,sidebar_position:5},n="How to add cross-account roles in AWS to Cado with the API",a={id:"cado/deploy/cross/cross-account-creation-api",title:"Add cross-account roles in AWS to Cado with the API",description:"This Python script automates the process of adding AWS roles to the Cado platform. Roles are added via the Cado API, and the script reads the roles from a CSV file, saving them with an alias in the platform. This is useful for managing AWS access credentials across multiple roles in your AWS environment.",source:"@site/docs/cado/deploy/cross/cross-account-creation-api.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/cross-account-creation-api",permalink:"/cado/deploy/cross/cross-account-creation-api",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/cross-account-creation-api.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"Add cross-account roles in AWS to Cado with the API",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Automatically add cross-account roles to Cado with AWS Organizations",permalink:"/cado/deploy/cross/aws-organizations"},next:{title:"Adding AWS accounts to Azure/AWS/GCP via Keys",permalink:"/cado/deploy/cross/adding-aws"}},l={},c=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Steps to Use the Script",id:"steps-to-use-the-script",level:2},{value:"1. Configure API URL and Secret Key",id:"1-configure-api-url-and-secret-key",level:3},{value:"2. Prepare the CSV File",id:"2-prepare-the-csv-file",level:3},{value:"3. Run the Script",id:"3-run-the-script",level:3},{value:"4. Example Script Output",id:"4-example-script-output",level:3}];function d(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-to-add-cross-account-roles-in-aws-to-cado-with-the-api",children:"How to add cross-account roles in AWS to Cado with the API"}),"\n",(0,o.jsx)(s.p,{children:"This Python script automates the process of adding AWS roles to the Cado platform. Roles are added via the Cado API, and the script reads the roles from a CSV file, saving them with an alias in the platform. This is useful for managing AWS access credentials across multiple roles in your AWS environment."}),"\n",(0,o.jsxs)(s.p,{children:["Alternatively you can use ",(0,o.jsx)(s.a,{href:"/cado/deploy/cross/aws-organizations",children:"AWS Organizations"})," to automatically add cross-account roles to Cado."]}),"\n",(0,o.jsx)(s.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Python 3.x"}),": Make sure you have Python 3.x installed on your system."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Cado Platform API Access"}),": You will need an API key and the platform URL to interact with the Cado API."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"CSV File of Roles"}),": The roles you wish to add should be stored in a CSV file (explained below)."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Clone the Cado API Examples Repository"}),": Clone the ",(0,o.jsx)(s.a,{href:"https://github.com/cado-security/cado-api-examples/tree/main",children:"Cado API Examples repository"})," to access the script examples/saving_credentials.py ."]}),"\n"]}),"\n",(0,o.jsx)(s.h2,{id:"steps-to-use-the-script",children:"Steps to Use the Script"}),"\n",(0,o.jsx)(s.h3,{id:"1-configure-api-url-and-secret-key",children:"1. Configure API URL and Secret Key"}),"\n",(0,o.jsxs)(s.p,{children:["First, you need to set the ",(0,o.jsx)(s.code,{children:"API_URL"})," and ",(0,o.jsx)(s.code,{children:"API_KEY"})," in the ",(0,o.jsx)(s.code,{children:"config.py"})," file. Create this file if it doesn't already exist and ensure it includes the following variables:"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-python",children:'# config.py\nAPI_URL = "https://" # Replace with your Cado platform URL\nAPI_KEY = "" # Replace with your Cado platform API key\n'})}),"\n",(0,o.jsxs)(s.p,{children:["See the ",(0,o.jsx)(s.a,{href:"/cado/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Cado API documentation"})," for more information on how to obtain your API key."]}),"\n",(0,o.jsx)(s.h3,{id:"2-prepare-the-csv-file",children:"2. Prepare the CSV File"}),"\n",(0,o.jsxs)(s.p,{children:["The script reads AWS roles from a CSV file named ",(0,o.jsx)(s.code,{children:"roles.csv"}),". This file should be formatted as follows:"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{children:"arn:aws:iam::000000000001:role/CadoResponseRole1,MyRoleAlias1\narn:aws:iam::000000000002:role/CadoResponseRole2,MyRoleAlias2\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Role"}),": This should be the full ARN of the AWS role."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Alias"}),": This is the name that will appear in the Cado UI to represent the role."]}),"\n"]}),"\n",(0,o.jsx)(s.p,{children:"Ensure your CSV file is in the same directory as the script."}),"\n",(0,o.jsx)(s.h3,{id:"3-run-the-script",children:"3. Run the Script"}),"\n",(0,o.jsx)(s.p,{children:"To add AWS roles to the Cado platform:"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsx)(s.li,{children:"Navigate to the directory where the script is saved."}),"\n",(0,o.jsx)(s.li,{children:"Run the script from your terminal using the following command:"}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"python saving_credentials.py\n"})}),"\n",(0,o.jsxs)(s.p,{children:["The script will read the ",(0,o.jsx)(s.code,{children:"roles.csv"})," file and add each role to the platform."]}),"\n",(0,o.jsx)(s.h3,{id:"4-example-script-output",children:"4. Example Script Output"}),"\n",(0,o.jsx)(s.p,{children:"As the script runs, it will output the status of each role being added, including the HTTP status code and the API response. Example output:"}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{children:'Add Role: [arn:aws:iam::000000000001:role/CadoResponseRole1] with Alias [MyRoleAlias1], Status: 200, Response: {"message": "Role added successfully"}\nAdd Role: [arn:aws:iam::000000000002:role/CadoResponseRole2] with Alias [MyRoleAlias2], Status: 200, Response: {"message": "Role added successfully"}\n'})})]})}function h(e={}){const{wrapper:s}={...(0,i.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},28453:(e,s,t)=>{t.d(s,{R:()=>n,x:()=>a});var o=t(96540);const i={},r=o.createContext(i);function n(e){const s=o.useContext(r);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),o.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3357],{71132:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>l,contentTitle:()=>n,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var o=t(74848),i=t(28453);const r={title:"Add cross-account roles in AWS to Cado with the API",hide_title:!0,sidebar_position:5},n="How to add cross-account roles in AWS to Cado with the API",a={id:"cado/deploy/cross/cross-account-creation-api",title:"Add cross-account roles in AWS to Cado with the API",description:"This Python script automates the process of adding AWS roles to the Cado platform. Roles are added via the Cado API, and the script reads the roles from a CSV file, saving them with an alias in the platform. This is useful for managing AWS access credentials across multiple roles in your AWS environment.",source:"@site/docs/cado/deploy/cross/cross-account-creation-api.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/cross-account-creation-api",permalink:"/cado/deploy/cross/cross-account-creation-api",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/cross-account-creation-api.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"Add cross-account roles in AWS to Cado with the API",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Automatically add cross-account roles to Cado with AWS Organizations",permalink:"/cado/deploy/cross/aws-organizations"},next:{title:"Adding AWS accounts to Azure/AWS/GCP via Keys",permalink:"/cado/deploy/cross/adding-aws"}},l={},c=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Steps to Use the Script",id:"steps-to-use-the-script",level:2},{value:"1. Configure API URL and Secret Key",id:"1-configure-api-url-and-secret-key",level:3},{value:"2. Prepare the CSV File",id:"2-prepare-the-csv-file",level:3},{value:"3. Run the Script",id:"3-run-the-script",level:3},{value:"4. Example Script Output",id:"4-example-script-output",level:3}];function d(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-to-add-cross-account-roles-in-aws-to-cado-with-the-api",children:"How to add cross-account roles in AWS to Cado with the API"}),"\n",(0,o.jsx)(s.p,{children:"This Python script automates the process of adding AWS roles to the Cado platform. Roles are added via the Cado API, and the script reads the roles from a CSV file, saving them with an alias in the platform. This is useful for managing AWS access credentials across multiple roles in your AWS environment."}),"\n",(0,o.jsxs)(s.p,{children:["Alternatively you can use ",(0,o.jsx)(s.a,{href:"/cado/deploy/cross/aws-organizations",children:"AWS Organizations"})," to automatically add cross-account roles to Cado."]}),"\n",(0,o.jsx)(s.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Python 3.x"}),": Make sure you have Python 3.x installed on your system."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Cado Platform API Access"}),": You will need an API key and the platform URL to interact with the Cado API."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"CSV File of Roles"}),": The roles you wish to add should be stored in a CSV file (explained below)."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Clone the Cado API Examples Repository"}),": Clone the ",(0,o.jsx)(s.a,{href:"https://github.com/cado-security/cado-api-examples/tree/main",children:"Cado API Examples repository"})," to access the script examples/saving_credentials.py ."]}),"\n"]}),"\n",(0,o.jsx)(s.h2,{id:"steps-to-use-the-script",children:"Steps to Use the Script"}),"\n",(0,o.jsx)(s.h3,{id:"1-configure-api-url-and-secret-key",children:"1. Configure API URL and Secret Key"}),"\n",(0,o.jsxs)(s.p,{children:["First, you need to set the ",(0,o.jsx)(s.code,{children:"API_URL"})," and ",(0,o.jsx)(s.code,{children:"API_KEY"})," in the ",(0,o.jsx)(s.code,{children:"config.py"})," file. Create this file if it doesn't already exist and ensure it includes the following variables:"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-python",children:'# config.py\nAPI_URL = "https://" # Replace with your Cado platform URL\nAPI_KEY = "" # Replace with your Cado platform API key\n'})}),"\n",(0,o.jsxs)(s.p,{children:["See the ",(0,o.jsx)(s.a,{href:"/cado/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Cado API documentation"})," for more information on how to obtain your API key."]}),"\n",(0,o.jsx)(s.h3,{id:"2-prepare-the-csv-file",children:"2. Prepare the CSV File"}),"\n",(0,o.jsxs)(s.p,{children:["The script reads AWS roles from a CSV file named ",(0,o.jsx)(s.code,{children:"roles.csv"}),". This file should be formatted as follows:"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{children:"arn:aws:iam::000000000001:role/CadoResponseRole1,MyRoleAlias1\narn:aws:iam::000000000002:role/CadoResponseRole2,MyRoleAlias2\n"})}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Role"}),": This should be the full ARN of the AWS role."]}),"\n",(0,o.jsxs)(s.li,{children:[(0,o.jsx)(s.strong,{children:"Alias"}),": This is the name that will appear in the Cado UI to represent the role."]}),"\n"]}),"\n",(0,o.jsx)(s.p,{children:"Ensure your CSV file is in the same directory as the script."}),"\n",(0,o.jsx)(s.h3,{id:"3-run-the-script",children:"3. Run the Script"}),"\n",(0,o.jsx)(s.p,{children:"To add AWS roles to the Cado platform:"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsx)(s.li,{children:"Navigate to the directory where the script is saved."}),"\n",(0,o.jsx)(s.li,{children:"Run the script from your terminal using the following command:"}),"\n"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-bash",children:"python saving_credentials.py\n"})}),"\n",(0,o.jsxs)(s.p,{children:["The script will read the ",(0,o.jsx)(s.code,{children:"roles.csv"})," file and add each role to the platform."]}),"\n",(0,o.jsx)(s.h3,{id:"4-example-script-output",children:"4. Example Script Output"}),"\n",(0,o.jsx)(s.p,{children:"As the script runs, it will output the status of each role being added, including the HTTP status code and the API response. Example output:"}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{children:'Add Role: [arn:aws:iam::000000000001:role/CadoResponseRole1] with Alias [MyRoleAlias1], Status: 200, Response: {"message": "Role added successfully"}\nAdd Role: [arn:aws:iam::000000000002:role/CadoResponseRole2] with Alias [MyRoleAlias2], Status: 200, Response: {"message": "Role added successfully"}\n'})})]})}function h(e={}){const{wrapper:s}={...(0,i.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},28453:(e,s,t)=>{t.d(s,{R:()=>n,x:()=>a});var o=t(96540);const i={},r=o.createContext(i);function n(e){const s=o.useContext(r);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),o.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/de0e4cc9.175a1b9d.js b/assets/js/de0e4cc9.4a470e2a.js similarity index 97% rename from assets/js/de0e4cc9.175a1b9d.js rename to assets/js/de0e4cc9.4a470e2a.js index 97341fc2f..023c53f15 100644 --- a/assets/js/de0e4cc9.175a1b9d.js +++ b/assets/js/de0e4cc9.4a470e2a.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2628],{40179:(e,i,t)=>{t.r(i),t.d(i,{assets:()=>l,contentTitle:()=>o,default:()=>u,frontMatter:()=>n,metadata:()=>r,toc:()=>d});var a=t(74848),s=t(28453);const n={title:"AI Investigator",hide_title:!0,sidebar_position:10},o="What is Cado AI Investigator?",r={id:"cado/investigate/ai investigator",title:"AI Investigator",description:"Cado AI Investigator currently performs two main tasks:",source:"@site/docs/cado/investigate/ai investigator.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/ai investigator",permalink:"/cado/investigate/ai investigator",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/ai investigator.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:10,frontMatter:{title:"AI Investigator",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Adding detections",permalink:"/cado/investigate/detections"},next:{title:"Community edition",permalink:"/cado/community-intro"}},l={},d=[{value:"1. Investigation Summarization",id:"1-investigation-summarization",level:3},{value:"2. Malicious File Analysis",id:"2-malicious-file-analysis",level:3},{value:"Availability",id:"availability",level:3},{value:"Privacy",id:"privacy",level:2},{value:"How It Works:",id:"how-it-works",level:3}];function c(e){const i={h1:"h1",h2:"h2",h3:"h3",img:"img",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(i.h1,{id:"what-is-cado-ai-investigator",children:"What is Cado AI Investigator?"}),"\n",(0,a.jsx)(i.p,{children:"Cado AI Investigator currently performs two main tasks:"}),"\n",(0,a.jsx)(i.h3,{id:"1-investigation-summarization",children:"1. Investigation Summarization"}),"\n",(0,a.jsx)(i.p,{children:"It generates a concise, informative summary of your investigation, displayed on the investigation overview tab. This summary highlights key findings to help you quickly understand critical details:"}),"\n",(0,a.jsx)(i.p,{children:(0,a.jsx)(i.img,{alt:"File Details 1",src:t(91888).A+"",width:"1399",height:"606"})}),"\n",(0,a.jsx)(i.h3,{id:"2-malicious-file-analysis",children:"2. Malicious File Analysis"}),"\n",(0,a.jsx)(i.p,{children:"It analyzes malicious files\u2014such as scripts, executables, or documents\u2014and explains their behavior. For example, it can identify if a script downloads and executes a payload, modifies registry keys, or establishes persistence mechanisms:"}),"\n",(0,a.jsx)(i.p,{children:(0,a.jsx)(i.img,{alt:"File Details 2",src:t(79531).A+"",width:"1999",height:"685"})}),"\n",(0,a.jsx)(i.h3,{id:"availability",children:"Availability"}),"\n",(0,a.jsxs)(i.p,{children:["Cado AI Investigator is available for customers using version v2.107.0 or later. This feature is currently in beta and can be enabled under ",(0,a.jsx)(i.strong,{children:"Settings > Experiments"}),". It will be applied to all new data imports."]}),"\n",(0,a.jsx)(i.h2,{id:"privacy",children:"Privacy"}),"\n",(0,a.jsx)(i.p,{children:"The Cado AI feature is powered by a locally hosted large language model (LLM) that runs exclusively within your Cado platform in your environment. It does not send any data to external APIs or back to Cado for training purposes."}),"\n",(0,a.jsx)(i.p,{children:"This feature is optional and disabled by default."}),"\n",(0,a.jsx)(i.h3,{id:"how-it-works",children:"How It Works:"}),"\n",(0,a.jsx)(i.p,{children:"The Cado AI feature processes data that has already been imported into the platform, such as malicious events and the contents of malicious files, all managed by your Cado administrator."}),"\n",(0,a.jsx)(i.p,{children:"Like other features in the product, Cado AI follows strict processes for testing, release, and security. We validate all outputs against predefined schemas and apply technical controls to mitigate risks such as cross-site scripting for any rendered output."}),"\n",(0,a.jsx)(i.p,{children:(0,a.jsx)(i.img,{alt:"File Details 3",src:t(29996).A+"",width:"1640",height:"570"})})]})}function u(e={}){const{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,a.jsx)(i,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},91888:(e,i,t)=>{t.d(i,{A:()=>a});const a=t.p+"assets/images/ai_image1-bcaa16c4657b36777e0dd1ca6099f933.png"},79531:(e,i,t)=>{t.d(i,{A:()=>a});const a=t.p+"assets/images/ai_image2-0ea1dba118e2a7287c5cb47cb1459a57.png"},29996:(e,i,t)=>{t.d(i,{A:()=>a});const a=t.p+"assets/images/llm-dc68f24c37c4e5370c236defaaf59d9b.png"},28453:(e,i,t)=>{t.d(i,{R:()=>o,x:()=>r});var a=t(96540);const s={},n=a.createContext(s);function o(e){const i=a.useContext(n);return a.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function r(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),a.createElement(n.Provider,{value:i},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2628],{40179:(e,i,t)=>{t.r(i),t.d(i,{assets:()=>l,contentTitle:()=>o,default:()=>u,frontMatter:()=>n,metadata:()=>r,toc:()=>d});var a=t(74848),s=t(28453);const n={title:"AI Investigator",hide_title:!0,sidebar_position:10},o="What is Cado AI Investigator?",r={id:"cado/investigate/ai investigator",title:"AI Investigator",description:"Cado AI Investigator currently performs two main tasks:",source:"@site/docs/cado/investigate/ai investigator.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/ai investigator",permalink:"/cado/investigate/ai investigator",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/ai investigator.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:10,frontMatter:{title:"AI Investigator",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Adding detections",permalink:"/cado/investigate/detections"},next:{title:"Community edition",permalink:"/cado/community-intro"}},l={},d=[{value:"1. Investigation Summarization",id:"1-investigation-summarization",level:3},{value:"2. Malicious File Analysis",id:"2-malicious-file-analysis",level:3},{value:"Availability",id:"availability",level:3},{value:"Privacy",id:"privacy",level:2},{value:"How It Works:",id:"how-it-works",level:3}];function c(e){const i={h1:"h1",h2:"h2",h3:"h3",img:"img",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(i.h1,{id:"what-is-cado-ai-investigator",children:"What is Cado AI Investigator?"}),"\n",(0,a.jsx)(i.p,{children:"Cado AI Investigator currently performs two main tasks:"}),"\n",(0,a.jsx)(i.h3,{id:"1-investigation-summarization",children:"1. Investigation Summarization"}),"\n",(0,a.jsx)(i.p,{children:"It generates a concise, informative summary of your investigation, displayed on the investigation overview tab. This summary highlights key findings to help you quickly understand critical details:"}),"\n",(0,a.jsx)(i.p,{children:(0,a.jsx)(i.img,{alt:"File Details 1",src:t(91888).A+"",width:"1399",height:"606"})}),"\n",(0,a.jsx)(i.h3,{id:"2-malicious-file-analysis",children:"2. Malicious File Analysis"}),"\n",(0,a.jsx)(i.p,{children:"It analyzes malicious files\u2014such as scripts, executables, or documents\u2014and explains their behavior. For example, it can identify if a script downloads and executes a payload, modifies registry keys, or establishes persistence mechanisms:"}),"\n",(0,a.jsx)(i.p,{children:(0,a.jsx)(i.img,{alt:"File Details 2",src:t(79531).A+"",width:"1999",height:"685"})}),"\n",(0,a.jsx)(i.h3,{id:"availability",children:"Availability"}),"\n",(0,a.jsxs)(i.p,{children:["Cado AI Investigator is available for customers using version v2.107.0 or later. This feature is currently in beta and can be enabled under ",(0,a.jsx)(i.strong,{children:"Settings > Experiments"}),". It will be applied to all new data imports."]}),"\n",(0,a.jsx)(i.h2,{id:"privacy",children:"Privacy"}),"\n",(0,a.jsx)(i.p,{children:"The Cado AI feature is powered by a locally hosted large language model (LLM) that runs exclusively within your Cado platform in your environment. It does not send any data to external APIs or back to Cado for training purposes."}),"\n",(0,a.jsx)(i.p,{children:"This feature is optional and disabled by default."}),"\n",(0,a.jsx)(i.h3,{id:"how-it-works",children:"How It Works:"}),"\n",(0,a.jsx)(i.p,{children:"The Cado AI feature processes data that has already been imported into the platform, such as malicious events and the contents of malicious files, all managed by your Cado administrator."}),"\n",(0,a.jsx)(i.p,{children:"Like other features in the product, Cado AI follows strict processes for testing, release, and security. We validate all outputs against predefined schemas and apply technical controls to mitigate risks such as cross-site scripting for any rendered output."}),"\n",(0,a.jsx)(i.p,{children:(0,a.jsx)(i.img,{alt:"File Details 3",src:t(29996).A+"",width:"1640",height:"570"})})]})}function u(e={}){const{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,a.jsx)(i,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},91888:(e,i,t)=>{t.d(i,{A:()=>a});const a=t.p+"assets/images/ai_image1-bcaa16c4657b36777e0dd1ca6099f933.png"},79531:(e,i,t)=>{t.d(i,{A:()=>a});const a=t.p+"assets/images/ai_image2-0ea1dba118e2a7287c5cb47cb1459a57.png"},29996:(e,i,t)=>{t.d(i,{A:()=>a});const a=t.p+"assets/images/llm-dc68f24c37c4e5370c236defaaf59d9b.png"},28453:(e,i,t)=>{t.d(i,{R:()=>o,x:()=>r});var a=t(96540);const s={},n=a.createContext(s);function o(e){const i=a.useContext(n);return a.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function r(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),a.createElement(n.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e311a61b.43141ee0.js b/assets/js/e311a61b.db482e00.js similarity index 97% rename from assets/js/e311a61b.43141ee0.js rename to assets/js/e311a61b.db482e00.js index 72baade94..533b99d30 100644 --- a/assets/js/e311a61b.43141ee0.js +++ b/assets/js/e311a61b.db482e00.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1329],{61289:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>p,frontMatter:()=>s,metadata:()=>c,toc:()=>d});var n=o(74848),i=o(28453);const s={title:"Google Cloud Kubernetes Engine",hide_title:!0,sidebar_position:5},r="How to Import from Google Cloud Kubernetes Engine",c={id:"cado/discovery-import/gcp/kubernetes-engine",title:"Google Cloud Kubernetes Engine",description:"The Cado platform allows you to collect key logs and forensic artifacts from Google Cloud Kubernetes Engine (GKE) containers.",source:"@site/docs/cado/discovery-import/gcp/kubernetes-engine.md",sourceDirName:"cado/discovery-import/gcp",slug:"/cado/discovery-import/gcp/kubernetes-engine",permalink:"/cado/discovery-import/gcp/kubernetes-engine",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/gcp/kubernetes-engine.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"Google Cloud Kubernetes Engine",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Storage",permalink:"/cado/discovery-import/gcp/storage"},next:{title:"What is Cado Host",permalink:"/cado/discovery-import/cado-host/intro"}},a={},d=[{value:"Import Steps",id:"import-steps",level:2}];function l(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-import-from-google-cloud-kubernetes-engine",children:"How to Import from Google Cloud Kubernetes Engine"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform allows you to collect key logs and forensic artifacts from Google Cloud Kubernetes Engine (GKE) containers."}),"\n",(0,n.jsx)(t.admonition,{type:"info",children:(0,n.jsx)(t.p,{children:"For distroless containers, please use Cado Host to perform the acquisition."})}),"\n",(0,n.jsx)(t.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Go to Import > Cloud"}),(0,n.jsx)(t.br,{}),"\n","Navigate to the cloud import screen."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado Import Screen showing the Kubernetes Engine options",src:o(43913).A+"",width:"1522",height:"363"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Select Cluster, Pod, and Container"}),(0,n.jsx)(t.br,{}),"\n","Follow the prompts to choose your ",(0,n.jsx)(t.strong,{children:"Cluster"}),", ",(0,n.jsx)(t.strong,{children:"Pod"}),", and ",(0,n.jsx)(t.strong,{children:"Container"}),"."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado Import Screen showing the available Kubernetes Engine Clusters",src:o(73674).A+"",width:"1837",height:"477"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Confirm and Start Import"}),(0,n.jsx)(t.br,{}),"\n","Review the details, then click ",(0,n.jsx)(t.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Cado will automatically collect all relevant logs and forensic artifacts from the container to support your investigation. For most acquisitions, the import and processing will complete within a few minutes."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado showing the confirmation screen of a successful Kubernetes Engine container capture",src:o(60787).A+"",width:"1795",height:"698"})}),"\n",(0,n.jsx)(t.admonition,{type:"info",children:(0,n.jsxs)(t.p,{children:["To import GKE containers, ensure the ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.code,{children:"iam.serviceAccounts.implicitDelegation"})})," IAM permission is added to the Service Account.",(0,n.jsx)(t.br,{}),"\n","Currently, GKE imports are supported only for GCP accounts configured with ",(0,n.jsx)(t.strong,{children:"Workload Identity Federation"}),". See more details on the ",(0,n.jsx)(t.a,{href:"/cado/deploy/gcp/gcp-settings#workload-identity-federation",children:"GCP Import Settings"})," page."]})}),"\n",(0,n.jsx)(t.h1,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Data Flow Diagram for GKE Acquisition",src:o(9946).A+"",width:"960",height:"540"})})]})}function p(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},60787:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},73674:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gke-8354716bca9bc18f39cbf9caa850c641.png"},9946:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gke_acquisition-8f606a71d5be85030f1bf87b7863e8fb.png"},43913:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/import-cloud-focus-2430bd09657ad2f5e88391377ba1dc53.png"},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>c});var n=o(96540);const i={},s=n.createContext(i);function r(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1329],{61289:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>p,frontMatter:()=>s,metadata:()=>c,toc:()=>d});var n=o(74848),i=o(28453);const s={title:"Google Cloud Kubernetes Engine",hide_title:!0,sidebar_position:5},r="How to Import from Google Cloud Kubernetes Engine",c={id:"cado/discovery-import/gcp/kubernetes-engine",title:"Google Cloud Kubernetes Engine",description:"The Cado platform allows you to collect key logs and forensic artifacts from Google Cloud Kubernetes Engine (GKE) containers.",source:"@site/docs/cado/discovery-import/gcp/kubernetes-engine.md",sourceDirName:"cado/discovery-import/gcp",slug:"/cado/discovery-import/gcp/kubernetes-engine",permalink:"/cado/discovery-import/gcp/kubernetes-engine",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/gcp/kubernetes-engine.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"Google Cloud Kubernetes Engine",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Storage",permalink:"/cado/discovery-import/gcp/storage"},next:{title:"What is Cado Host",permalink:"/cado/discovery-import/cado-host/intro"}},a={},d=[{value:"Import Steps",id:"import-steps",level:2}];function l(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-import-from-google-cloud-kubernetes-engine",children:"How to Import from Google Cloud Kubernetes Engine"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform allows you to collect key logs and forensic artifacts from Google Cloud Kubernetes Engine (GKE) containers."}),"\n",(0,n.jsx)(t.admonition,{type:"info",children:(0,n.jsx)(t.p,{children:"For distroless containers, please use Cado Host to perform the acquisition."})}),"\n",(0,n.jsx)(t.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Go to Import > Cloud"}),(0,n.jsx)(t.br,{}),"\n","Navigate to the cloud import screen."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado Import Screen showing the Kubernetes Engine options",src:o(43913).A+"",width:"1522",height:"363"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Select Cluster, Pod, and Container"}),(0,n.jsx)(t.br,{}),"\n","Follow the prompts to choose your ",(0,n.jsx)(t.strong,{children:"Cluster"}),", ",(0,n.jsx)(t.strong,{children:"Pod"}),", and ",(0,n.jsx)(t.strong,{children:"Container"}),"."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado Import Screen showing the available Kubernetes Engine Clusters",src:o(73674).A+"",width:"1837",height:"477"})}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Confirm and Start Import"}),(0,n.jsx)(t.br,{}),"\n","Review the details, then click ",(0,n.jsx)(t.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Cado will automatically collect all relevant logs and forensic artifacts from the container to support your investigation. For most acquisitions, the import and processing will complete within a few minutes."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado showing the confirmation screen of a successful Kubernetes Engine container capture",src:o(60787).A+"",width:"1795",height:"698"})}),"\n",(0,n.jsx)(t.admonition,{type:"info",children:(0,n.jsxs)(t.p,{children:["To import GKE containers, ensure the ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.code,{children:"iam.serviceAccounts.implicitDelegation"})})," IAM permission is added to the Service Account.",(0,n.jsx)(t.br,{}),"\n","Currently, GKE imports are supported only for GCP accounts configured with ",(0,n.jsx)(t.strong,{children:"Workload Identity Federation"}),". See more details on the ",(0,n.jsx)(t.a,{href:"/cado/deploy/gcp/gcp-settings#workload-identity-federation",children:"GCP Import Settings"})," page."]})}),"\n",(0,n.jsx)(t.h1,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Data Flow Diagram for GKE Acquisition",src:o(9946).A+"",width:"960",height:"540"})})]})}function p(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},60787:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},73674:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gke-8354716bca9bc18f39cbf9caa850c641.png"},9946:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gke_acquisition-8f606a71d5be85030f1bf87b7863e8fb.png"},43913:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/import-cloud-focus-2430bd09657ad2f5e88391377ba1dc53.png"},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>c});var n=o(96540);const i={},s=n.createContext(i);function r(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e6705af2.d926fb2f.js b/assets/js/e6705af2.4ef214f2.js similarity index 98% rename from assets/js/e6705af2.d926fb2f.js rename to assets/js/e6705af2.4ef214f2.js index 6fcae7254..4887c5ed7 100644 --- a/assets/js/e6705af2.d926fb2f.js +++ b/assets/js/e6705af2.4ef214f2.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[637],{65341:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>d,contentTitle:()=>r,default:()=>u,frontMatter:()=>t,metadata:()=>a,toc:()=>l});var i=o(74848),s=o(28453);const t={title:"Cross-cloud vs individual deployments",hide_title:!0,sidebar_position:13},r="What are the considerations for Cross-Cloud vs Individual deployments",a={id:"cado/deploy/cross/cross_vs_individual",title:"Cross-cloud vs individual deployments",description:"Cado offers flexibility when deploying across multiple cloud environments.",source:"@site/docs/cado/deploy/cross/cross_vs_individual.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/cross_vs_individual",permalink:"/cado/deploy/cross/cross_vs_individual",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/cross_vs_individual.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:13,frontMatter:{title:"Cross-cloud vs individual deployments",hide_title:!0,sidebar_position:13},sidebar:"tutorialSidebar",previous:{title:"Adding GCP Projects to Azure/AWS",permalink:"/cado/deploy/cross/adding-gcp"},next:{title:"Log in",permalink:"/cado/deploy/logging-in"}},d={},l=[{value:"Key Considerations",id:"key-considerations",level:2},{value:"Infrastructure Costs",id:"infrastructure-costs",level:3},{value:"Network Set-Up Complexity",id:"network-set-up-complexity",level:3},{value:"Proxy Support",id:"proxy-support",level:3},{value:"Proof of Value or Trial Deployments",id:"proof-of-value-or-trial-deployments",level:3},{value:"Data Transfer Costs and Speeds",id:"data-transfer-costs-and-speeds",level:3},{value:"Data Residency Requirements",id:"data-residency-requirements",level:3},{value:"Maintenance and Management",id:"maintenance-and-management",level:3},{value:"Licensing",id:"licensing",level:3}];function c(e){const n={a:"a",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"what-are-the-considerations-for-cross-cloud-vs-individual-deployments",children:"What are the considerations for Cross-Cloud vs Individual deployments"}),"\n",(0,i.jsx)(n.p,{children:"Cado offers flexibility when deploying across multiple cloud environments."}),"\n",(0,i.jsx)(n.p,{children:"There are two primary deployment models available:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Centralized Deployment in a Single Cloud (Cross-Cloud Access)"}),": Deploy Cado in one cloud environment (AWS, Azure, or GCP) and configure cross-cloud access to communicate with other cloud environments."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Individual Deployments in Each Cloud"}),": Deploy separate instances of Cado in AWS, Azure, and GCP."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"This document outlines key considerations to help you choose between these two deployment strategies."}),"\n",(0,i.jsx)(n.h2,{id:"key-considerations",children:"Key Considerations"}),"\n",(0,i.jsx)(n.h3,{id:"infrastructure-costs",children:"Infrastructure Costs"}),"\n",(0,i.jsxs)(n.p,{children:["While deploying Cado in multiple cloud environments incurs additional infrastructure costs, these are relatively small. For more information on pricing, please refer to our ",(0,i.jsx)(n.a,{href:"/cado/manage/cost-management",children:"pricing documentation page"}),"."]}),"\n",(0,i.jsx)(n.h3,{id:"network-set-up-complexity",children:"Network Set-Up Complexity"}),"\n",(0,i.jsx)(n.p,{children:"The primary consideration when deciding between cross-cloud and individual deployments is the complexity of your network set-up. If you have a simple network configuration that enables seamless communication across all your cloud environments from a single location, a cross-cloud deployment is likely the best option."}),"\n",(0,i.jsx)(n.p,{children:"However, if your network is more complex, with strict security boundaries or multiple network zones, individual deployments in each cloud might be more appropriate to avoid complications in setting up cross-cloud access."}),"\n",(0,i.jsx)(n.h3,{id:"proxy-support",children:"Proxy Support"}),"\n",(0,i.jsxs)(n.p,{children:["We support various proxy configurations to facilitate communication with your cloud environments. Please see the ",(0,i.jsx)(n.a,{href:"/cado/deploy/networking-proxy",children:"proxy documentation page"})," for more details. However, if your network setup is highly complex or requires sophisticated routing, individual deployments may be more practical, as there are limits to the proxy configurations we support."]}),"\n",(0,i.jsx)(n.h3,{id:"proof-of-value-or-trial-deployments",children:"Proof of Value or Trial Deployments"}),"\n",(0,i.jsx)(n.p,{children:"If you are in a proof of value or trial phase, we recommend setting up a single deployment in the cloud environment you are most familiar with. This allows for quicker and easier initial setup. Once you decide to proceed with a full deployment of Cado, you can then expand to additional deployments in other cloud environments if necessary."}),"\n",(0,i.jsx)(n.h3,{id:"data-transfer-costs-and-speeds",children:"Data Transfer Costs and Speeds"}),"\n",(0,i.jsx)(n.p,{children:"There are some speed and cost considerations when copying data between cloud environments, such as egress fees and data transfer speeds. However, these generally are not significant concerns. For more details, consult your cloud provider's documentation regarding egress fees."}),"\n",(0,i.jsx)(n.h3,{id:"data-residency-requirements",children:"Data Residency Requirements"}),"\n",(0,i.jsx)(n.p,{children:"If you have data residency requirements mandating that certain data remain in a specific cloud environment or geographical location, you should set up individual deployments in each cloud environment to ensure compliance."}),"\n",(0,i.jsx)(n.h3,{id:"maintenance-and-management",children:"Maintenance and Management"}),"\n",(0,i.jsx)(n.p,{children:"Maintaining and updating individual Cado deployments across multiple clouds can be more time-consuming and resource-intensive compared to managing a single centralized deployment. Additionally, users will need to log into separate environments for each cloud."}),"\n",(0,i.jsx)(n.h3,{id:"licensing",children:"Licensing"}),"\n",(0,i.jsxs)(n.p,{children:["For specific licensing information, please refer to your contract or consult with your sales representative (",(0,i.jsx)(n.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),") to confirm the requirements based on your use case."]})]})}function u(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},28453:(e,n,o)=>{o.d(n,{R:()=>r,x:()=>a});var i=o(96540);const s={},t=i.createContext(s);function r(e){const n=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[637],{65341:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>d,contentTitle:()=>r,default:()=>u,frontMatter:()=>t,metadata:()=>a,toc:()=>l});var i=o(74848),s=o(28453);const t={title:"Cross-cloud vs individual deployments",hide_title:!0,sidebar_position:13},r="What are the considerations for Cross-Cloud vs Individual deployments",a={id:"cado/deploy/cross/cross_vs_individual",title:"Cross-cloud vs individual deployments",description:"Cado offers flexibility when deploying across multiple cloud environments.",source:"@site/docs/cado/deploy/cross/cross_vs_individual.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/cross_vs_individual",permalink:"/cado/deploy/cross/cross_vs_individual",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/cross_vs_individual.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:13,frontMatter:{title:"Cross-cloud vs individual deployments",hide_title:!0,sidebar_position:13},sidebar:"tutorialSidebar",previous:{title:"Adding GCP Projects to Azure/AWS",permalink:"/cado/deploy/cross/adding-gcp"},next:{title:"Log in",permalink:"/cado/deploy/logging-in"}},d={},l=[{value:"Key Considerations",id:"key-considerations",level:2},{value:"Infrastructure Costs",id:"infrastructure-costs",level:3},{value:"Network Set-Up Complexity",id:"network-set-up-complexity",level:3},{value:"Proxy Support",id:"proxy-support",level:3},{value:"Proof of Value or Trial Deployments",id:"proof-of-value-or-trial-deployments",level:3},{value:"Data Transfer Costs and Speeds",id:"data-transfer-costs-and-speeds",level:3},{value:"Data Residency Requirements",id:"data-residency-requirements",level:3},{value:"Maintenance and Management",id:"maintenance-and-management",level:3},{value:"Licensing",id:"licensing",level:3}];function c(e){const n={a:"a",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"what-are-the-considerations-for-cross-cloud-vs-individual-deployments",children:"What are the considerations for Cross-Cloud vs Individual deployments"}),"\n",(0,i.jsx)(n.p,{children:"Cado offers flexibility when deploying across multiple cloud environments."}),"\n",(0,i.jsx)(n.p,{children:"There are two primary deployment models available:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Centralized Deployment in a Single Cloud (Cross-Cloud Access)"}),": Deploy Cado in one cloud environment (AWS, Azure, or GCP) and configure cross-cloud access to communicate with other cloud environments."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Individual Deployments in Each Cloud"}),": Deploy separate instances of Cado in AWS, Azure, and GCP."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"This document outlines key considerations to help you choose between these two deployment strategies."}),"\n",(0,i.jsx)(n.h2,{id:"key-considerations",children:"Key Considerations"}),"\n",(0,i.jsx)(n.h3,{id:"infrastructure-costs",children:"Infrastructure Costs"}),"\n",(0,i.jsxs)(n.p,{children:["While deploying Cado in multiple cloud environments incurs additional infrastructure costs, these are relatively small. For more information on pricing, please refer to our ",(0,i.jsx)(n.a,{href:"/cado/manage/cost-management",children:"pricing documentation page"}),"."]}),"\n",(0,i.jsx)(n.h3,{id:"network-set-up-complexity",children:"Network Set-Up Complexity"}),"\n",(0,i.jsx)(n.p,{children:"The primary consideration when deciding between cross-cloud and individual deployments is the complexity of your network set-up. If you have a simple network configuration that enables seamless communication across all your cloud environments from a single location, a cross-cloud deployment is likely the best option."}),"\n",(0,i.jsx)(n.p,{children:"However, if your network is more complex, with strict security boundaries or multiple network zones, individual deployments in each cloud might be more appropriate to avoid complications in setting up cross-cloud access."}),"\n",(0,i.jsx)(n.h3,{id:"proxy-support",children:"Proxy Support"}),"\n",(0,i.jsxs)(n.p,{children:["We support various proxy configurations to facilitate communication with your cloud environments. Please see the ",(0,i.jsx)(n.a,{href:"/cado/deploy/networking-proxy",children:"proxy documentation page"})," for more details. However, if your network setup is highly complex or requires sophisticated routing, individual deployments may be more practical, as there are limits to the proxy configurations we support."]}),"\n",(0,i.jsx)(n.h3,{id:"proof-of-value-or-trial-deployments",children:"Proof of Value or Trial Deployments"}),"\n",(0,i.jsx)(n.p,{children:"If you are in a proof of value or trial phase, we recommend setting up a single deployment in the cloud environment you are most familiar with. This allows for quicker and easier initial setup. Once you decide to proceed with a full deployment of Cado, you can then expand to additional deployments in other cloud environments if necessary."}),"\n",(0,i.jsx)(n.h3,{id:"data-transfer-costs-and-speeds",children:"Data Transfer Costs and Speeds"}),"\n",(0,i.jsx)(n.p,{children:"There are some speed and cost considerations when copying data between cloud environments, such as egress fees and data transfer speeds. However, these generally are not significant concerns. For more details, consult your cloud provider's documentation regarding egress fees."}),"\n",(0,i.jsx)(n.h3,{id:"data-residency-requirements",children:"Data Residency Requirements"}),"\n",(0,i.jsx)(n.p,{children:"If you have data residency requirements mandating that certain data remain in a specific cloud environment or geographical location, you should set up individual deployments in each cloud environment to ensure compliance."}),"\n",(0,i.jsx)(n.h3,{id:"maintenance-and-management",children:"Maintenance and Management"}),"\n",(0,i.jsx)(n.p,{children:"Maintaining and updating individual Cado deployments across multiple clouds can be more time-consuming and resource-intensive compared to managing a single centralized deployment. Additionally, users will need to log into separate environments for each cloud."}),"\n",(0,i.jsx)(n.h3,{id:"licensing",children:"Licensing"}),"\n",(0,i.jsxs)(n.p,{children:["For specific licensing information, please refer to your contract or consult with your sales representative (",(0,i.jsx)(n.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),") to confirm the requirements based on your use case."]})]})}function u(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},28453:(e,n,o)=>{o.d(n,{R:()=>r,x:()=>a});var i=o(96540);const s={},t=i.createContext(s);function r(e){const n=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e752eb53.f99c069a.js b/assets/js/e752eb53.188e7d57.js similarity index 95% rename from assets/js/e752eb53.f99c069a.js rename to assets/js/e752eb53.188e7d57.js index ac291d290..8fdad5a3f 100644 --- a/assets/js/e752eb53.f99c069a.js +++ b/assets/js/e752eb53.188e7d57.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2391],{45443:(o,t,e)=>{e.r(t),e.d(t,{assets:()=>i,contentTitle:()=>a,default:()=>u,frontMatter:()=>r,metadata:()=>l,toc:()=>d});var n=e(74848),s=e(28453);const r={title:"Forward logs to SIEMs",hide_title:!0,sidebar_position:3},a="How to Forward Cado System and Processing Logs to SIEMs",l={id:"troubleshooting/logs-cloudwatch",title:"Forward logs to SIEMs",description:"Log Location",source:"@site/docs/troubleshooting/logs-cloudwatch.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/logs-cloudwatch",permalink:"/troubleshooting/logs-cloudwatch",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/logs-cloudwatch.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Forward logs to SIEMs",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"How to send logs to Cado",permalink:"/troubleshooting/send-logs"},next:{title:"Commercial EULA",permalink:"/troubleshooting/eula/commercial-eula"}},i={},d=[{value:"Log Location",id:"log-location",level:2},{value:"CloudWatch in AWS",id:"cloudwatch-in-aws",level:2}];function c(o){const t={code:"code",h1:"h1",h2:"h2",p:"p",pre:"pre",...(0,s.R)(),...o.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-forward-cado-system-and-processing-logs-to-siems",children:"How to Forward Cado System and Processing Logs to SIEMs"}),"\n",(0,n.jsx)(t.h2,{id:"log-location",children:"Log Location"}),"\n",(0,n.jsx)(t.p,{children:"Cado logs live under /var/logs/cado - A forwarding agent (e.g. Splunk Universal Forwarder) can be installed to forward logs from this location."}),"\n",(0,n.jsx)(t.h2,{id:"cloudwatch-in-aws",children:"CloudWatch in AWS"}),"\n",(0,n.jsx)(t.p,{children:"If the platform has the necessary IAM and network permissions to send logs to CloudWatch, both application and operating system logs are forwarded to the following locations:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:'"log_group_name": "/var/logs/cado",\n"log_stream_name": "cado-logs-all"\n'})})]})}function u(o={}){const{wrapper:t}={...(0,s.R)(),...o.components};return t?(0,n.jsx)(t,{...o,children:(0,n.jsx)(c,{...o})}):c(o)}},28453:(o,t,e)=>{e.d(t,{R:()=>a,x:()=>l});var n=e(96540);const s={},r=n.createContext(s);function a(o){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof o?o(t):{...t,...o}}),[t,o])}function l(o){let t;return t=o.disableParentContext?"function"==typeof o.components?o.components(s):o.components||s:a(o.components),n.createElement(r.Provider,{value:t},o.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2391],{45443:(o,t,e)=>{e.r(t),e.d(t,{assets:()=>i,contentTitle:()=>a,default:()=>u,frontMatter:()=>r,metadata:()=>l,toc:()=>d});var n=e(74848),s=e(28453);const r={title:"Forward logs to SIEMs",hide_title:!0,sidebar_position:3},a="How to Forward Cado System and Processing Logs to SIEMs",l={id:"troubleshooting/logs-cloudwatch",title:"Forward logs to SIEMs",description:"Log Location",source:"@site/docs/troubleshooting/logs-cloudwatch.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/logs-cloudwatch",permalink:"/troubleshooting/logs-cloudwatch",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/logs-cloudwatch.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Forward logs to SIEMs",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"How to send logs to Cado",permalink:"/troubleshooting/send-logs"},next:{title:"Commercial EULA",permalink:"/troubleshooting/eula/commercial-eula"}},i={},d=[{value:"Log Location",id:"log-location",level:2},{value:"CloudWatch in AWS",id:"cloudwatch-in-aws",level:2}];function c(o){const t={code:"code",h1:"h1",h2:"h2",p:"p",pre:"pre",...(0,s.R)(),...o.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-forward-cado-system-and-processing-logs-to-siems",children:"How to Forward Cado System and Processing Logs to SIEMs"}),"\n",(0,n.jsx)(t.h2,{id:"log-location",children:"Log Location"}),"\n",(0,n.jsx)(t.p,{children:"Cado logs live under /var/logs/cado - A forwarding agent (e.g. Splunk Universal Forwarder) can be installed to forward logs from this location."}),"\n",(0,n.jsx)(t.h2,{id:"cloudwatch-in-aws",children:"CloudWatch in AWS"}),"\n",(0,n.jsx)(t.p,{children:"If the platform has the necessary IAM and network permissions to send logs to CloudWatch, both application and operating system logs are forwarded to the following locations:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:'"log_group_name": "/var/logs/cado",\n"log_stream_name": "cado-logs-all"\n'})})]})}function u(o={}){const{wrapper:t}={...(0,s.R)(),...o.components};return t?(0,n.jsx)(t,{...o,children:(0,n.jsx)(c,{...o})}):c(o)}},28453:(o,t,e)=>{e.d(t,{R:()=>a,x:()=>l});var n=e(96540);const s={},r=n.createContext(s);function a(o){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof o?o(t):{...t,...o}}),[t,o])}function l(o){let t;return t=o.disableParentContext?"function"==typeof o.components?o.components(s):o.components||s:a(o.components),n.createElement(r.Provider,{value:t},o.children)}}}]); \ No newline at end of file diff --git a/assets/js/ea7d3df8.60a88914.js b/assets/js/ea7d3df8.4dda4bcc.js similarity index 97% rename from assets/js/ea7d3df8.60a88914.js rename to assets/js/ea7d3df8.4dda4bcc.js index d67b09c37..89e73bc62 100644 --- a/assets/js/ea7d3df8.60a88914.js +++ b/assets/js/ea7d3df8.4dda4bcc.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[91],{26095:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>o,contentTitle:()=>c,default:()=>h,frontMatter:()=>a,metadata:()=>d,toc:()=>r});var n=i(74848),s=i(28453);const a={title:"Evidence",hide_title:!0,sidebar_position:2},c="What is the Evidence Tab?",d={id:"cado/investigate/evidence",title:"Evidence",description:"The Evidence tab provides a focused view of the data collected during an investigation and displays the current processing status of that data.",source:"@site/docs/cado/investigate/evidence.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/evidence",permalink:"/cado/investigate/evidence",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/evidence.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Evidence",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Getting started example",permalink:"/cado/investigate/ctf-tutorial"},next:{title:"Insights Tab",permalink:"/cado/investigate/insights"}},o={},r=[];function l(e){const t={h1:"h1",img:"img",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-is-the-evidence-tab",children:"What is the Evidence Tab?"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Evidence"})," tab provides a focused view of the data collected during an investigation and displays the current processing status of that data."]}),"\n",(0,n.jsx)(t.p,{children:"You can manage evidence by clicking the menu icon to the right of each piece of evidence, where you\u2019ll have the option to delete it if needed."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Evidence List",src:i(22282).A+"",width:"1827",height:"518"})}),"\n",(0,n.jsx)(t.p,{children:"Expanding a piece of evidence will show you its detailed processing history, allowing you to track the steps and progress of the analysis."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Evidence Details",src:i(53987).A+"",width:"1581",height:"658"})})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},53987:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/evidence-details-9245076940ad96fdbc3bf127e86c4b27.png"},22282:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/evidence-9aa81b10443f0c9144d5235c4aa651de.png"},28453:(e,t,i)=>{i.d(t,{R:()=>c,x:()=>d});var n=i(96540);const s={},a=n.createContext(s);function c(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[91],{26095:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>o,contentTitle:()=>c,default:()=>h,frontMatter:()=>a,metadata:()=>d,toc:()=>r});var n=i(74848),s=i(28453);const a={title:"Evidence",hide_title:!0,sidebar_position:2},c="What is the Evidence Tab?",d={id:"cado/investigate/evidence",title:"Evidence",description:"The Evidence tab provides a focused view of the data collected during an investigation and displays the current processing status of that data.",source:"@site/docs/cado/investigate/evidence.md",sourceDirName:"cado/investigate",slug:"/cado/investigate/evidence",permalink:"/cado/investigate/evidence",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/investigate/evidence.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Evidence",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Getting started example",permalink:"/cado/investigate/ctf-tutorial"},next:{title:"Insights Tab",permalink:"/cado/investigate/insights"}},o={},r=[];function l(e){const t={h1:"h1",img:"img",p:"p",strong:"strong",...(0,s.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"what-is-the-evidence-tab",children:"What is the Evidence Tab?"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Evidence"})," tab provides a focused view of the data collected during an investigation and displays the current processing status of that data."]}),"\n",(0,n.jsx)(t.p,{children:"You can manage evidence by clicking the menu icon to the right of each piece of evidence, where you\u2019ll have the option to delete it if needed."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Evidence List",src:i(22282).A+"",width:"1827",height:"518"})}),"\n",(0,n.jsx)(t.p,{children:"Expanding a piece of evidence will show you its detailed processing history, allowing you to track the steps and progress of the analysis."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Evidence Details",src:i(53987).A+"",width:"1581",height:"658"})})]})}function h(e={}){const{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},53987:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/evidence-details-9245076940ad96fdbc3bf127e86c4b27.png"},22282:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/evidence-9aa81b10443f0c9144d5235c4aa651de.png"},28453:(e,t,i)=>{i.d(t,{R:()=>c,x:()=>d});var n=i(96540);const s={},a=n.createContext(s);function c(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ebdbcfed.cadf8404.js b/assets/js/ebdbcfed.6c5dda34.js similarity index 98% rename from assets/js/ebdbcfed.cadf8404.js rename to assets/js/ebdbcfed.6c5dda34.js index dc280be12..6109b78b2 100644 --- a/assets/js/ebdbcfed.cadf8404.js +++ b/assets/js/ebdbcfed.6c5dda34.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3752],{76570:(t,e,i)=>{i.r(e),i.d(e,{assets:()=>c,contentTitle:()=>d,default:()=>h,frontMatter:()=>a,metadata:()=>s,toc:()=>r});var o=i(74848),n=i(28453);const a={title:"Chain of custody",hide_title:!0,sidebar_position:12},d="How is Chain of Custody Maintained in Cado?",s={id:"cado/discovery-import/chain_of_custody",title:"Chain of custody",description:"Cado maintains the chain of custody by tracking details of imported evidence. You can view this information by navigating to Import > Evidence, where you will find metadata related to the imported evidence.",source:"@site/docs/cado/discovery-import/chain_of_custody.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/chain_of_custody",permalink:"/cado/discovery-import/chain_of_custody",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/chain_of_custody.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:12,frontMatter:{title:"Chain of custody",hide_title:!0,sidebar_position:12},sidebar:"tutorialSidebar",previous:{title:"Third party disk images & triage",permalink:"/cado/discovery-import/third-party"},next:{title:"File Types",permalink:"/cado/discovery-import/data-types/filetypes"}},c={},r=[];function p(t){const e={h1:"h1",img:"img",p:"p",strong:"strong",...(0,n.R)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{id:"how-is-chain-of-custody-maintained-in-cado",children:"How is Chain of Custody Maintained in Cado?"}),"\n",(0,o.jsxs)(e.p,{children:["Cado maintains the chain of custody by tracking details of imported evidence. You can view this information by navigating to ",(0,o.jsx)(e.strong,{children:"Import > Evidence"}),", where you will find metadata related to the imported evidence."]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Evidence",src:i(78216).A+"",width:"3306",height:"374"})}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Audit Logs",src:i(69878).A+"",width:"1407",height:"576"})}),"\n",(0,o.jsxs)(e.p,{children:["Information about which user imported the evidence and when it was imported is available under ",(0,o.jsx)(e.strong,{children:"Help > Audit Logs"}),"."]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Audit Logs",src:i(24962).A+"",width:"3342",height:"708"})})]})}function h(t={}){const{wrapper:e}={...(0,n.R)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(p,{...t})}):p(t)}},24962:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/audit-logs-caa6aa1676ef0979e405f697d12eb93a.png"},78216:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/coc_audit-5b9c3b4ca93860f0d86bdd1b1ef61aa3.png"},69878:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/coc_evidence-ad8a4bcff16d40a7a071b1c08d1dd79c.png"},28453:(t,e,i)=>{i.d(e,{R:()=>d,x:()=>s});var o=i(96540);const n={},a=o.createContext(n);function d(t){const e=o.useContext(a);return o.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function s(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(n):t.components||n:d(t.components),o.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3752],{76570:(t,e,i)=>{i.r(e),i.d(e,{assets:()=>c,contentTitle:()=>d,default:()=>h,frontMatter:()=>a,metadata:()=>s,toc:()=>r});var o=i(74848),n=i(28453);const a={title:"Chain of custody",hide_title:!0,sidebar_position:12},d="How is Chain of Custody Maintained in Cado?",s={id:"cado/discovery-import/chain_of_custody",title:"Chain of custody",description:"Cado maintains the chain of custody by tracking details of imported evidence. You can view this information by navigating to Import > Evidence, where you will find metadata related to the imported evidence.",source:"@site/docs/cado/discovery-import/chain_of_custody.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/chain_of_custody",permalink:"/cado/discovery-import/chain_of_custody",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/chain_of_custody.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:12,frontMatter:{title:"Chain of custody",hide_title:!0,sidebar_position:12},sidebar:"tutorialSidebar",previous:{title:"Third party disk images & triage",permalink:"/cado/discovery-import/third-party"},next:{title:"File Types",permalink:"/cado/discovery-import/data-types/filetypes"}},c={},r=[];function p(t){const e={h1:"h1",img:"img",p:"p",strong:"strong",...(0,n.R)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{id:"how-is-chain-of-custody-maintained-in-cado",children:"How is Chain of Custody Maintained in Cado?"}),"\n",(0,o.jsxs)(e.p,{children:["Cado maintains the chain of custody by tracking details of imported evidence. You can view this information by navigating to ",(0,o.jsx)(e.strong,{children:"Import > Evidence"}),", where you will find metadata related to the imported evidence."]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Evidence",src:i(78216).A+"",width:"3306",height:"374"})}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Audit Logs",src:i(69878).A+"",width:"1407",height:"576"})}),"\n",(0,o.jsxs)(e.p,{children:["Information about which user imported the evidence and when it was imported is available under ",(0,o.jsx)(e.strong,{children:"Help > Audit Logs"}),"."]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Audit Logs",src:i(24962).A+"",width:"3342",height:"708"})})]})}function h(t={}){const{wrapper:e}={...(0,n.R)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(p,{...t})}):p(t)}},24962:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/audit-logs-caa6aa1676ef0979e405f697d12eb93a.png"},78216:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/coc_audit-5b9c3b4ca93860f0d86bdd1b1ef61aa3.png"},69878:(t,e,i)=>{i.d(e,{A:()=>o});const o=i.p+"assets/images/coc_evidence-ad8a4bcff16d40a7a071b1c08d1dd79c.png"},28453:(t,e,i)=>{i.d(e,{R:()=>d,x:()=>s});var o=i(96540);const n={},a=o.createContext(n);function d(t){const e=o.useContext(a);return o.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function s(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(n):t.components||n:d(t.components),o.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/ec12427e.e81cb884.js b/assets/js/ec12427e.cd19b540.js similarity index 98% rename from assets/js/ec12427e.e81cb884.js rename to assets/js/ec12427e.cd19b540.js index e684b7f24..24f3a5664 100644 --- a/assets/js/ec12427e.e81cb884.js +++ b/assets/js/ec12427e.cd19b540.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4316],{72610:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var i=t(74848),n=t(28453);const r={title:"ECS",hide_title:!0,sidebar_position:4},o="How to Import ECS from AWS",a={id:"cado/discovery-import/aws/aws-ecs",title:"ECS",description:"The Cado platform enables the collection of key logs and forensic artifacts from AWS ECS systems.",source:"@site/docs/cado/discovery-import/aws/aws-ecs.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-ecs",permalink:"/cado/discovery-import/aws/aws-ecs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-ecs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:4,frontMatter:{title:"ECS",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"AMI, EBS Snapshot and Volume",permalink:"/cado/discovery-import/aws/aws-ami"},next:{title:"EKS",permalink:"/cado/discovery-import/aws/aws-eks"}},c={},l=[{value:"Steps to Import ECS Data",id:"steps-to-import-ecs-data",level:3},{value:"ECS Import Requirements",id:"ecs-import-requirements",level:3},{value:"Debugging ECS Exec Permissions",id:"debugging-ecs-exec-permissions",level:3},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function d(e){const s={a:"a",code:"code",h1:"h1",h3:"h3",hr:"hr",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"how-to-import-ecs-from-aws",children:"How to Import ECS from AWS"}),"\n",(0,i.jsx)(s.p,{children:"The Cado platform enables the collection of key logs and forensic artifacts from AWS ECS systems."}),"\n",(0,i.jsx)(s.h3,{id:"steps-to-import-ecs-data",children:"Steps to Import ECS Data"}),"\n",(0,i.jsxs)(s.ol,{children:["\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:["Navigate to ",(0,i.jsx)(s.strong,{children:"Import > Cloud"}),".\n",(0,i.jsx)(s.img,{alt:"Import ECS 1",src:t(43913).A+"",width:"1522",height:"363"})]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:["Select the target ",(0,i.jsx)(s.strong,{children:"Cluster"})," and ",(0,i.jsx)(s.strong,{children:"Task"}),".\n",(0,i.jsx)(s.img,{alt:"Import ECS 2",src:t(45589).A+"",width:"1837",height:"500"})]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:["Click ",(0,i.jsx)(s.strong,{children:"Acquire Container"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:["Review the details and click ",(0,i.jsx)(s.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"Cado will automatically collect key logs and forensic artifacts from the container to facilitate your investigation."}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Import ECS 3",src:t(33964).A+"",width:"1838",height:"397"})}),"\n",(0,i.jsx)(s.p,{children:"For a typical acquisition, the import and processing will complete within a few minutes."}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsx)(s.h3,{id:"ecs-import-requirements",children:"ECS Import Requirements"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"enableExecuteCommand"})," must be enabled on your ECS task. This is a requirement from AWS, and there is no way to modify this for existing tasks."]}),"\n",(0,i.jsxs)(s.li,{children:["Currently, ECS acquisitions are supported only for ",(0,i.jsx)(s.strong,{children:"Linux-based containers"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["If you encounter an error like this:\n",(0,i.jsx)(s.img,{alt:"ECS Error",src:t(42229).A+"",width:"1796",height:"476"})]}),"\n",(0,i.jsx)(s.p,{children:"It may be due to one of the following:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Your IAM role lacks the necessary ECS permissions, which include:","\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:'"ecs:ListClusters",\n"ecs:DescribeClusters",\n"ecs:ListServices",\n"ecs:DescribeServices",\n"ecs:ListTasks",\n"ecs:DescribeTasks",\n"ecs:ExecuteCommand"\n'})}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["The ECS ",(0,i.jsx)(s.strong,{children:"Cluster"})," and ",(0,i.jsx)(s.strong,{children:"Task"})," do not have ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html",children:"enableExecuteCommand"})," enabled."]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsx)(s.h3,{id:"debugging-ecs-exec-permissions",children:"Debugging ECS Exec Permissions"}),"\n",(0,i.jsxs)(s.p,{children:["AWS provides a helpful tool for debugging ECS Exec issues, available on ",(0,i.jsx)(s.a,{href:"https://github.com/aws-containers/amazon-ecs-exec-checker",children:"GitHub"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,i.jsx)(s.p,{children:"The following diagram illustrates how ECS acquisitions operate:"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"ECS Data Flow",src:t(79309).A+"",width:"1794",height:"1096"})})]})}function h(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},79309:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/ecs-collection-26fb92c57a139958dc94b2665617e98e.png"},45589:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/ecs_2-ddea443833f7163d0055ffe587d79e5c.png"},33964:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/ecs_3-1e10eeaa4f63181ff0cd5875d2e5b8f2.png"},42229:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/ecs_error-0f87edd56a3f111531fa1a915ee6e13b.png"},43913:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/import-cloud-focus-2430bd09657ad2f5e88391377ba1dc53.png"},28453:(e,s,t)=>{t.d(s,{R:()=>o,x:()=>a});var i=t(96540);const n={},r=i.createContext(n);function o(e){const s=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),i.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4316],{72610:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var i=t(74848),n=t(28453);const r={title:"ECS",hide_title:!0,sidebar_position:4},o="How to Import ECS from AWS",a={id:"cado/discovery-import/aws/aws-ecs",title:"ECS",description:"The Cado platform enables the collection of key logs and forensic artifacts from AWS ECS systems.",source:"@site/docs/cado/discovery-import/aws/aws-ecs.md",sourceDirName:"cado/discovery-import/aws",slug:"/cado/discovery-import/aws/aws-ecs",permalink:"/cado/discovery-import/aws/aws-ecs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/aws/aws-ecs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:4,frontMatter:{title:"ECS",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"AMI, EBS Snapshot and Volume",permalink:"/cado/discovery-import/aws/aws-ami"},next:{title:"EKS",permalink:"/cado/discovery-import/aws/aws-eks"}},c={},l=[{value:"Steps to Import ECS Data",id:"steps-to-import-ecs-data",level:3},{value:"ECS Import Requirements",id:"ecs-import-requirements",level:3},{value:"Debugging ECS Exec Permissions",id:"debugging-ecs-exec-permissions",level:3},{value:"Data Flow Diagram",id:"data-flow-diagram",level:3}];function d(e){const s={a:"a",code:"code",h1:"h1",h3:"h3",hr:"hr",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"how-to-import-ecs-from-aws",children:"How to Import ECS from AWS"}),"\n",(0,i.jsx)(s.p,{children:"The Cado platform enables the collection of key logs and forensic artifacts from AWS ECS systems."}),"\n",(0,i.jsx)(s.h3,{id:"steps-to-import-ecs-data",children:"Steps to Import ECS Data"}),"\n",(0,i.jsxs)(s.ol,{children:["\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:["Navigate to ",(0,i.jsx)(s.strong,{children:"Import > Cloud"}),".\n",(0,i.jsx)(s.img,{alt:"Import ECS 1",src:t(43913).A+"",width:"1522",height:"363"})]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:["Select the target ",(0,i.jsx)(s.strong,{children:"Cluster"})," and ",(0,i.jsx)(s.strong,{children:"Task"}),".\n",(0,i.jsx)(s.img,{alt:"Import ECS 2",src:t(45589).A+"",width:"1837",height:"500"})]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:["Click ",(0,i.jsx)(s.strong,{children:"Acquire Container"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.p,{children:["Review the details and click ",(0,i.jsx)(s.strong,{children:"Start Import"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"Cado will automatically collect key logs and forensic artifacts from the container to facilitate your investigation."}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Import ECS 3",src:t(33964).A+"",width:"1838",height:"397"})}),"\n",(0,i.jsx)(s.p,{children:"For a typical acquisition, the import and processing will complete within a few minutes."}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsx)(s.h3,{id:"ecs-import-requirements",children:"ECS Import Requirements"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"enableExecuteCommand"})," must be enabled on your ECS task. This is a requirement from AWS, and there is no way to modify this for existing tasks."]}),"\n",(0,i.jsxs)(s.li,{children:["Currently, ECS acquisitions are supported only for ",(0,i.jsx)(s.strong,{children:"Linux-based containers"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["If you encounter an error like this:\n",(0,i.jsx)(s.img,{alt:"ECS Error",src:t(42229).A+"",width:"1796",height:"476"})]}),"\n",(0,i.jsx)(s.p,{children:"It may be due to one of the following:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Your IAM role lacks the necessary ECS permissions, which include:","\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:'"ecs:ListClusters",\n"ecs:DescribeClusters",\n"ecs:ListServices",\n"ecs:DescribeServices",\n"ecs:ListTasks",\n"ecs:DescribeTasks",\n"ecs:ExecuteCommand"\n'})}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["The ECS ",(0,i.jsx)(s.strong,{children:"Cluster"})," and ",(0,i.jsx)(s.strong,{children:"Task"})," do not have ",(0,i.jsx)(s.a,{href:"https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html",children:"enableExecuteCommand"})," enabled."]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsx)(s.h3,{id:"debugging-ecs-exec-permissions",children:"Debugging ECS Exec Permissions"}),"\n",(0,i.jsxs)(s.p,{children:["AWS provides a helpful tool for debugging ECS Exec issues, available on ",(0,i.jsx)(s.a,{href:"https://github.com/aws-containers/amazon-ecs-exec-checker",children:"GitHub"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,i.jsx)(s.p,{children:"The following diagram illustrates how ECS acquisitions operate:"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"ECS Data Flow",src:t(79309).A+"",width:"1794",height:"1096"})})]})}function h(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},79309:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/ecs-collection-26fb92c57a139958dc94b2665617e98e.png"},45589:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/ecs_2-ddea443833f7163d0055ffe587d79e5c.png"},33964:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/ecs_3-1e10eeaa4f63181ff0cd5875d2e5b8f2.png"},42229:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/ecs_error-0f87edd56a3f111531fa1a915ee6e13b.png"},43913:(e,s,t)=>{t.d(s,{A:()=>i});const i=t.p+"assets/images/import-cloud-focus-2430bd09657ad2f5e88391377ba1dc53.png"},28453:(e,s,t)=>{t.d(s,{R:()=>o,x:()=>a});var i=t(96540);const n={},r=i.createContext(n);function o(e){const s=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),i.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ee649c4c.1640b4f8.js b/assets/js/ee649c4c.a215f8a9.js similarity index 99% rename from assets/js/ee649c4c.1640b4f8.js rename to assets/js/ee649c4c.a215f8a9.js index 6dd80ec0e..24f4c9de7 100644 --- a/assets/js/ee649c4c.1640b4f8.js +++ b/assets/js/ee649c4c.a215f8a9.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7720],{72951:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>l});var o=n(74848),t=n(28453);const i={title:"KMS support",hide_title:!0,sidebar_position:5},r="How does Cado support KMS in AWS?",a={id:"cado/deploy/aws/iam/aws-kms",title:"KMS support",description:"The Cado platform supports importing EC2 instances with encrypted volumes, provided the appropriate permissions are granted to the CadoResponseRole.",source:"@site/docs/cado/deploy/aws/iam/aws-kms.md",sourceDirName:"cado/deploy/aws/iam",slug:"/cado/deploy/aws/iam/aws-kms",permalink:"/cado/deploy/aws/iam/aws-kms",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/iam/aws-kms.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:5,frontMatter:{title:"KMS support",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"IAM permissions description",permalink:"/cado/deploy/aws/iam/iam-description"},next:{title:"Reduce KMS permissions",permalink:"/cado/deploy/aws/iam/tighten-kms"}},c={},l=[{value:"Using Customer Managed Keys (CMK)",id:"using-customer-managed-keys-cmk",level:2},{value:"Recommended Permissions Configuration",id:"recommended-permissions-configuration",level:3},{value:"Cross-Region Support",id:"cross-region-support",level:2},{value:"Cross-Account Using Customer Managed Keys",id:"cross-account-using-customer-managed-keys",level:2},{value:"Cross-Account Using AWS Default Keys",id:"cross-account-using-aws-default-keys",level:2},{value:"Resolving KMS Support Issues",id:"resolving-kms-support-issues",level:2},{value:"How KMS-Encypted EBS Volumes Are Processed",id:"how-kms-encypted-ebs-volumes-are-processed",level:3},{value:"Using Cado Host to Bypass KMS",id:"using-cado-host-to-bypass-kms",level:3},{value:"Creating an Unencrypted Volume to Bypass KMS",id:"creating-an-unencrypted-volume-to-bypass-kms",level:3},{value:"Debugging KMS IAM Permissions",id:"debugging-kms-iam-permissions",level:3}];function d(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-does-cado-support-kms-in-aws",children:"How does Cado support KMS in AWS?"}),"\n",(0,o.jsxs)(s.p,{children:["The Cado platform supports importing EC2 instances with encrypted volumes, provided the appropriate permissions are granted to the ",(0,o.jsx)(s.code,{children:"CadoResponseRole"}),"."]}),"\n",(0,o.jsxs)(s.p,{children:["By default, AWS provides keys in your account, which allow access based on the default policy below. This setup is supported by the Cado platform out of the box. For more information on KMS, refer to the ",(0,o.jsx)(s.a,{href:"https://aws.amazon.com/kms/",children:"AWS Key Management Service (KMS)"})," documentation."]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'{\n "Sid": "Allow access through EBS for all principals in the account that are authorized to use EBS",\n "Effect": "Allow",\n "Principal": {\n "AWS": "*"\n },\n "Action": [\n "kms:Encrypt",\n "kms:Decrypt",\n "kms:ReEncrypt*",\n "kms:GenerateDataKey*",\n "kms:CreateGrant",\n "kms:DescribeKey"\n ],\n "Resource": "*",\n "Condition": {\n "StringEquals": {\n "kms:ViaService": "ec2.eu-west-3.amazonaws.com",\n "kms:CallerAccount": "012345678910"\n }\n }\n}\n'})}),"\n",(0,o.jsxs)(s.p,{children:["This policy allows all ",(0,o.jsx)(s.code,{children:"Principals"})," (users, roles, etc.) in the account and region specified in the ",(0,o.jsx)(s.code,{children:"Condition"})," to perform the listed actions."]}),"\n",(0,o.jsx)(s.h2,{id:"using-customer-managed-keys-cmk",children:"Using Customer Managed Keys (CMK)"}),"\n",(0,o.jsxs)(s.p,{children:["When using CMK KMS keys, the following actions must be granted to ",(0,o.jsx)(s.code,{children:"CadoResponseRole"}),":"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'"kms:Encrypt",\n"kms:Decrypt",\n"kms:ReEncrypt*",\n"kms:GenerateDataKey*",\n"kms:CreateGrant"\n'})}),"\n",(0,o.jsx)(s.h3,{id:"recommended-permissions-configuration",children:"Recommended Permissions Configuration"}),"\n",(0,o.jsxs)(s.p,{children:["The recommended approach is to grant permissions to ",(0,o.jsx)(s.code,{children:"myCadoResponseRole"})," directly while withholding ",(0,o.jsx)(s.code,{children:'"CreateGrant"'})," for specific resources:"]}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:["You may choose not to grant ",(0,o.jsx)(s.code,{children:"kms:CreateGrant"})," to ",(0,o.jsx)(s.code,{children:"CadoResponseRole"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:["Your policy should provide access to ",(0,o.jsx)(s.code,{children:"CadoResponseRole"})," for the necessary permissions (excluding ",(0,o.jsx)(s.code,{children:"CreateGrant"}),")."]}),"\n",(0,o.jsxs)(s.li,{children:["Limit the policy to allow ",(0,o.jsx)(s.code,{children:"CreateGrant"})," permission only for AWS resources."]}),"\n"]}),"\n",(0,o.jsxs)(s.p,{children:["A sample policy is shown below (adjust the ",(0,o.jsx)(s.code,{children:"Principal"})," and add ",(0,o.jsx)(s.code,{children:"Condition"})," as needed):"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'[\n {\n "Sid": "Allow required KMS permissions",\n "Effect": "Allow",\n "Principal": {\n "AWS": "arn:aws:iam::012345678910:role/myCadoResponseRole"\n },\n "Action": [\n "kms:Encrypt",\n "kms:Decrypt",\n "kms:ReEncrypt*",\n "kms:GenerateDataKey*"\n ],\n "Resource": "*"\n },\n {\n "Sid": "Allow attachment of persistent resources",\n "Effect": "Allow",\n "Principal": {\n "AWS": "arn:aws:iam::012345678910:role/myCadoResponseRole"\n },\n "Action": [\n "kms:CreateGrant"\n ],\n "Resource": "*",\n "Condition": {\n "Bool": {\n "kms:GrantIsForAWSResource": true\n }\n }\n }\n]\n'})}),"\n",(0,o.jsx)(s.h2,{id:"cross-region-support",children:"Cross-Region Support"}),"\n",(0,o.jsxs)(s.p,{children:["When performing cross-region acquisitions, ensure that the relevant policy statements apply to the region where your Cado platform is located. Check that the policy ",(0,o.jsx)(s.code,{children:"Conditions"})," do not block the platform's access."]}),"\n",(0,o.jsx)(s.h2,{id:"cross-account-using-customer-managed-keys",children:"Cross-Account Using Customer Managed Keys"}),"\n",(0,o.jsx)(s.p,{children:"When acquiring cross-account resources, follow these guidelines:"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:["Grant ",(0,o.jsx)(s.code,{children:"kms:CreateGrant"})," permissions to the role being assumed in the ",(0,o.jsx)(s.strong,{children:"target account"})," from which EC2 instances are being acquired. For more details, refer to the ",(0,o.jsx)(s.a,{href:"/cado/deploy/cross/cross-account-creation",children:"Cross-Account Acquisition"})," documentation."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:['Alternatively, you can use the permissions in the "Custom Keys" section. Ensure that both the primary and secondary account roles are allowed principals for the required actions: ',(0,o.jsx)(s.code,{children:"kms:Encrypt"}),", ",(0,o.jsx)(s.code,{children:"kms:Decrypt"}),", ",(0,o.jsx)(s.code,{children:"kms:ReEncrypt*"}),", and ",(0,o.jsx)(s.code,{children:"kms:GenerateDataKey*"}),"."]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(s.h2,{id:"cross-account-using-aws-default-keys",children:"Cross-Account Using AWS Default Keys"}),"\n",(0,o.jsxs)(s.p,{children:["When importing EC2 instances with default KMS-encrypted volumes for the first time, it is recommended to include the following permission in the ",(0,o.jsx)(s.code,{children:"myCadoResponseRole"})," in the ",(0,o.jsx)(s.strong,{children:"account where the Cado platform is deployed"}),". Failure to do so may result in IAM errors until this permission is added. Once the import is successful, the permission can be removed."]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'{\n\t"Sid": "RequiredForFirstTimeKMSDefaultencryptedImportCanBeDeletedAfter",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"iam:CreateServiceLinkedRole"\n\t],\n\t"Resource": "arn:aws:iam::*:role/aws-service-role/mrk.kms.amazonaws.com/AWSServiceRoleForKeyManagementServiceMultiRegionKeys",\n\t"Condition": {\n\t\t"StringLike": {\n\t\t\t"iam:AWSServiceName": "mrk.kms.amazonaws.com"\n\t\t}\n\t}\n}\n'})}),"\n",(0,o.jsxs)(s.p,{children:["More information can be found in the ",(0,o.jsx)(s.a,{href:"https://docs.aws.amazon.com/kms/latest/developerguide/using-service-linked-roles.html#slr-permissions-multi-region",children:"AWS KMS documentation"}),"."]}),"\n",(0,o.jsxs)(s.p,{children:["To import KMS-encrypted EC2 instances across accounts, the following permissions are required in ",(0,o.jsx)(s.code,{children:"myCadoResponseRole"})," in the ",(0,o.jsx)(s.strong,{children:"account where the Cado platform is deployed"}),". There is no need to modify the cross-account role."]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'{\n\t"Sid": "RequiredForKmsEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:Encrypt",\n\t\t"kms:Decrypt",\n\t\t"kms:ReEncrypt*",\n\t\t"kms:GenerateDataKey*",\n\t\t"kms:CreateGrant"\n\t],\n\t"Resource": "*"\n},\n{\n\t"Sid": "RequiredForCrossAccountDefaultKmsEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:CreateKey",\n\t\t"kms:CreateAlias",\n\t\t"kms:DescribeKey",\n\t\t"kms:ListAliases"\n\t],\n\t"Resource": "*"\n},\n{\n\t"Sid": "RequiredForOperationsOnTemporaryKMSResourcesduringDefaultEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:DeleteAlias",\n\t\t"kms:ReplicateKey",\n\t\t"kms:ScheduleKeyDeletion"\n\t],\n\t"Resource": "*",\n\t"Condition": {\n\t\t "ForAllValues:StringLike": {\n\t\t "kms:ResourceAliases": [\n\t\t "alias/CadoResponse-KMS-Alias*"\n\t\t ]\n\t\t },\n\t\t "ForAnyValue:StringLike": {\n\t\t "kms:ResourceAliases": [\n\t\t "alias/CadoResponse-KMS-Alias*"\n\t\t ]\n\t\t }\n\t}\n}\n'})}),"\n",(0,o.jsx)(s.h2,{id:"resolving-kms-support-issues",children:"Resolving KMS Support Issues"}),"\n",(0,o.jsx)(s.p,{children:"Configuring KMS policies can be challenging, especially for cross-account acquisitions or custom setups."}),"\n",(0,o.jsx)(s.h3,{id:"how-kms-encypted-ebs-volumes-are-processed",children:"How KMS-Encypted EBS Volumes Are Processed"}),"\n",(0,o.jsxs)(s.p,{children:["When acquiring KMS-encrypted volumes, the platform attempts to access a snapshot of the volume using its IAM permissions. If access fails, the platform generates a temporary key to re-encrypt the snapshot and create a new volume for processing. The exact steps depend on your KMS key policy and IAM role permissions. Errors will be displayed if the necessary permissions are missing. For more information, refer to the ",(0,o.jsx)(s.a,{href:"https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html",children:"AWS documentation on ReEncryption"}),"."]}),"\n",(0,o.jsx)(s.h3,{id:"using-cado-host-to-bypass-kms",children:"Using Cado Host to Bypass KMS"}),"\n",(0,o.jsx)(s.p,{children:"If you cannot obtain a full disk capture, you can bypass KMS encryption by using Cado Host:"}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsx)(s.li,{children:'If SSM is enabled on the system, choose "Use Alternate Triage Acquisition" when acquiring the system.'}),"\n",(0,o.jsx)(s.li,{children:'Alternatively, connect via SSH or RDP and collect forensic artifacts by selecting "Import > Cado Host."'}),"\n"]}),"\n",(0,o.jsx)(s.h3,{id:"creating-an-unencrypted-volume-to-bypass-kms",children:"Creating an Unencrypted Volume to Bypass KMS"}),"\n",(0,o.jsxs)(s.p,{children:["You can remove KMS encryption from a volume by following the steps in this ",(0,o.jsx)(s.a,{href:"https://aws.amazon.com/premiumsupport/knowledge-center/create-unencrypted-volume-kms-key/",children:"AWS guide"}),"."]}),"\n",(0,o.jsx)(s.h3,{id:"debugging-kms-iam-permissions",children:"Debugging KMS IAM Permissions"}),"\n",(0,o.jsxs)(s.p,{children:["You can identify simple permission issues using Cado\u2019s automated health checks. For more detailed debugging, use the ",(0,o.jsx)(s.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html",children:"AWS Policy Simulator"})," to test policies and identify permission issues."]})]})}function p(e={}){const{wrapper:s}={...(0,t.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},28453:(e,s,n)=>{n.d(s,{R:()=>r,x:()=>a});var o=n(96540);const t={},i=o.createContext(t);function r(e){const s=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:r(e.components),o.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7720],{72951:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>l});var o=n(74848),t=n(28453);const i={title:"KMS support",hide_title:!0,sidebar_position:5},r="How does Cado support KMS in AWS?",a={id:"cado/deploy/aws/iam/aws-kms",title:"KMS support",description:"The Cado platform supports importing EC2 instances with encrypted volumes, provided the appropriate permissions are granted to the CadoResponseRole.",source:"@site/docs/cado/deploy/aws/iam/aws-kms.md",sourceDirName:"cado/deploy/aws/iam",slug:"/cado/deploy/aws/iam/aws-kms",permalink:"/cado/deploy/aws/iam/aws-kms",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/iam/aws-kms.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:5,frontMatter:{title:"KMS support",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"IAM permissions description",permalink:"/cado/deploy/aws/iam/iam-description"},next:{title:"Reduce KMS permissions",permalink:"/cado/deploy/aws/iam/tighten-kms"}},c={},l=[{value:"Using Customer Managed Keys (CMK)",id:"using-customer-managed-keys-cmk",level:2},{value:"Recommended Permissions Configuration",id:"recommended-permissions-configuration",level:3},{value:"Cross-Region Support",id:"cross-region-support",level:2},{value:"Cross-Account Using Customer Managed Keys",id:"cross-account-using-customer-managed-keys",level:2},{value:"Cross-Account Using AWS Default Keys",id:"cross-account-using-aws-default-keys",level:2},{value:"Resolving KMS Support Issues",id:"resolving-kms-support-issues",level:2},{value:"How KMS-Encypted EBS Volumes Are Processed",id:"how-kms-encypted-ebs-volumes-are-processed",level:3},{value:"Using Cado Host to Bypass KMS",id:"using-cado-host-to-bypass-kms",level:3},{value:"Creating an Unencrypted Volume to Bypass KMS",id:"creating-an-unencrypted-volume-to-bypass-kms",level:3},{value:"Debugging KMS IAM Permissions",id:"debugging-kms-iam-permissions",level:3}];function d(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-does-cado-support-kms-in-aws",children:"How does Cado support KMS in AWS?"}),"\n",(0,o.jsxs)(s.p,{children:["The Cado platform supports importing EC2 instances with encrypted volumes, provided the appropriate permissions are granted to the ",(0,o.jsx)(s.code,{children:"CadoResponseRole"}),"."]}),"\n",(0,o.jsxs)(s.p,{children:["By default, AWS provides keys in your account, which allow access based on the default policy below. This setup is supported by the Cado platform out of the box. For more information on KMS, refer to the ",(0,o.jsx)(s.a,{href:"https://aws.amazon.com/kms/",children:"AWS Key Management Service (KMS)"})," documentation."]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'{\n "Sid": "Allow access through EBS for all principals in the account that are authorized to use EBS",\n "Effect": "Allow",\n "Principal": {\n "AWS": "*"\n },\n "Action": [\n "kms:Encrypt",\n "kms:Decrypt",\n "kms:ReEncrypt*",\n "kms:GenerateDataKey*",\n "kms:CreateGrant",\n "kms:DescribeKey"\n ],\n "Resource": "*",\n "Condition": {\n "StringEquals": {\n "kms:ViaService": "ec2.eu-west-3.amazonaws.com",\n "kms:CallerAccount": "012345678910"\n }\n }\n}\n'})}),"\n",(0,o.jsxs)(s.p,{children:["This policy allows all ",(0,o.jsx)(s.code,{children:"Principals"})," (users, roles, etc.) in the account and region specified in the ",(0,o.jsx)(s.code,{children:"Condition"})," to perform the listed actions."]}),"\n",(0,o.jsx)(s.h2,{id:"using-customer-managed-keys-cmk",children:"Using Customer Managed Keys (CMK)"}),"\n",(0,o.jsxs)(s.p,{children:["When using CMK KMS keys, the following actions must be granted to ",(0,o.jsx)(s.code,{children:"CadoResponseRole"}),":"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'"kms:Encrypt",\n"kms:Decrypt",\n"kms:ReEncrypt*",\n"kms:GenerateDataKey*",\n"kms:CreateGrant"\n'})}),"\n",(0,o.jsx)(s.h3,{id:"recommended-permissions-configuration",children:"Recommended Permissions Configuration"}),"\n",(0,o.jsxs)(s.p,{children:["The recommended approach is to grant permissions to ",(0,o.jsx)(s.code,{children:"myCadoResponseRole"})," directly while withholding ",(0,o.jsx)(s.code,{children:'"CreateGrant"'})," for specific resources:"]}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsxs)(s.li,{children:["You may choose not to grant ",(0,o.jsx)(s.code,{children:"kms:CreateGrant"})," to ",(0,o.jsx)(s.code,{children:"CadoResponseRole"}),"."]}),"\n",(0,o.jsxs)(s.li,{children:["Your policy should provide access to ",(0,o.jsx)(s.code,{children:"CadoResponseRole"})," for the necessary permissions (excluding ",(0,o.jsx)(s.code,{children:"CreateGrant"}),")."]}),"\n",(0,o.jsxs)(s.li,{children:["Limit the policy to allow ",(0,o.jsx)(s.code,{children:"CreateGrant"})," permission only for AWS resources."]}),"\n"]}),"\n",(0,o.jsxs)(s.p,{children:["A sample policy is shown below (adjust the ",(0,o.jsx)(s.code,{children:"Principal"})," and add ",(0,o.jsx)(s.code,{children:"Condition"})," as needed):"]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'[\n {\n "Sid": "Allow required KMS permissions",\n "Effect": "Allow",\n "Principal": {\n "AWS": "arn:aws:iam::012345678910:role/myCadoResponseRole"\n },\n "Action": [\n "kms:Encrypt",\n "kms:Decrypt",\n "kms:ReEncrypt*",\n "kms:GenerateDataKey*"\n ],\n "Resource": "*"\n },\n {\n "Sid": "Allow attachment of persistent resources",\n "Effect": "Allow",\n "Principal": {\n "AWS": "arn:aws:iam::012345678910:role/myCadoResponseRole"\n },\n "Action": [\n "kms:CreateGrant"\n ],\n "Resource": "*",\n "Condition": {\n "Bool": {\n "kms:GrantIsForAWSResource": true\n }\n }\n }\n]\n'})}),"\n",(0,o.jsx)(s.h2,{id:"cross-region-support",children:"Cross-Region Support"}),"\n",(0,o.jsxs)(s.p,{children:["When performing cross-region acquisitions, ensure that the relevant policy statements apply to the region where your Cado platform is located. Check that the policy ",(0,o.jsx)(s.code,{children:"Conditions"})," do not block the platform's access."]}),"\n",(0,o.jsx)(s.h2,{id:"cross-account-using-customer-managed-keys",children:"Cross-Account Using Customer Managed Keys"}),"\n",(0,o.jsx)(s.p,{children:"When acquiring cross-account resources, follow these guidelines:"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:["Grant ",(0,o.jsx)(s.code,{children:"kms:CreateGrant"})," permissions to the role being assumed in the ",(0,o.jsx)(s.strong,{children:"target account"})," from which EC2 instances are being acquired. For more details, refer to the ",(0,o.jsx)(s.a,{href:"/cado/deploy/cross/cross-account-creation",children:"Cross-Account Acquisition"})," documentation."]}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:['Alternatively, you can use the permissions in the "Custom Keys" section. Ensure that both the primary and secondary account roles are allowed principals for the required actions: ',(0,o.jsx)(s.code,{children:"kms:Encrypt"}),", ",(0,o.jsx)(s.code,{children:"kms:Decrypt"}),", ",(0,o.jsx)(s.code,{children:"kms:ReEncrypt*"}),", and ",(0,o.jsx)(s.code,{children:"kms:GenerateDataKey*"}),"."]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(s.h2,{id:"cross-account-using-aws-default-keys",children:"Cross-Account Using AWS Default Keys"}),"\n",(0,o.jsxs)(s.p,{children:["When importing EC2 instances with default KMS-encrypted volumes for the first time, it is recommended to include the following permission in the ",(0,o.jsx)(s.code,{children:"myCadoResponseRole"})," in the ",(0,o.jsx)(s.strong,{children:"account where the Cado platform is deployed"}),". Failure to do so may result in IAM errors until this permission is added. Once the import is successful, the permission can be removed."]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'{\n\t"Sid": "RequiredForFirstTimeKMSDefaultencryptedImportCanBeDeletedAfter",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"iam:CreateServiceLinkedRole"\n\t],\n\t"Resource": "arn:aws:iam::*:role/aws-service-role/mrk.kms.amazonaws.com/AWSServiceRoleForKeyManagementServiceMultiRegionKeys",\n\t"Condition": {\n\t\t"StringLike": {\n\t\t\t"iam:AWSServiceName": "mrk.kms.amazonaws.com"\n\t\t}\n\t}\n}\n'})}),"\n",(0,o.jsxs)(s.p,{children:["More information can be found in the ",(0,o.jsx)(s.a,{href:"https://docs.aws.amazon.com/kms/latest/developerguide/using-service-linked-roles.html#slr-permissions-multi-region",children:"AWS KMS documentation"}),"."]}),"\n",(0,o.jsxs)(s.p,{children:["To import KMS-encrypted EC2 instances across accounts, the following permissions are required in ",(0,o.jsx)(s.code,{children:"myCadoResponseRole"})," in the ",(0,o.jsx)(s.strong,{children:"account where the Cado platform is deployed"}),". There is no need to modify the cross-account role."]}),"\n",(0,o.jsx)(s.pre,{children:(0,o.jsx)(s.code,{className:"language-json",children:'{\n\t"Sid": "RequiredForKmsEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:Encrypt",\n\t\t"kms:Decrypt",\n\t\t"kms:ReEncrypt*",\n\t\t"kms:GenerateDataKey*",\n\t\t"kms:CreateGrant"\n\t],\n\t"Resource": "*"\n},\n{\n\t"Sid": "RequiredForCrossAccountDefaultKmsEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:CreateKey",\n\t\t"kms:CreateAlias",\n\t\t"kms:DescribeKey",\n\t\t"kms:ListAliases"\n\t],\n\t"Resource": "*"\n},\n{\n\t"Sid": "RequiredForOperationsOnTemporaryKMSResourcesduringDefaultEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:DeleteAlias",\n\t\t"kms:ReplicateKey",\n\t\t"kms:ScheduleKeyDeletion"\n\t],\n\t"Resource": "*",\n\t"Condition": {\n\t\t "ForAllValues:StringLike": {\n\t\t "kms:ResourceAliases": [\n\t\t "alias/CadoResponse-KMS-Alias*"\n\t\t ]\n\t\t },\n\t\t "ForAnyValue:StringLike": {\n\t\t "kms:ResourceAliases": [\n\t\t "alias/CadoResponse-KMS-Alias*"\n\t\t ]\n\t\t }\n\t}\n}\n'})}),"\n",(0,o.jsx)(s.h2,{id:"resolving-kms-support-issues",children:"Resolving KMS Support Issues"}),"\n",(0,o.jsx)(s.p,{children:"Configuring KMS policies can be challenging, especially for cross-account acquisitions or custom setups."}),"\n",(0,o.jsx)(s.h3,{id:"how-kms-encypted-ebs-volumes-are-processed",children:"How KMS-Encypted EBS Volumes Are Processed"}),"\n",(0,o.jsxs)(s.p,{children:["When acquiring KMS-encrypted volumes, the platform attempts to access a snapshot of the volume using its IAM permissions. If access fails, the platform generates a temporary key to re-encrypt the snapshot and create a new volume for processing. The exact steps depend on your KMS key policy and IAM role permissions. Errors will be displayed if the necessary permissions are missing. For more information, refer to the ",(0,o.jsx)(s.a,{href:"https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html",children:"AWS documentation on ReEncryption"}),"."]}),"\n",(0,o.jsx)(s.h3,{id:"using-cado-host-to-bypass-kms",children:"Using Cado Host to Bypass KMS"}),"\n",(0,o.jsx)(s.p,{children:"If you cannot obtain a full disk capture, you can bypass KMS encryption by using Cado Host:"}),"\n",(0,o.jsxs)(s.ul,{children:["\n",(0,o.jsx)(s.li,{children:'If SSM is enabled on the system, choose "Use Alternate Triage Acquisition" when acquiring the system.'}),"\n",(0,o.jsx)(s.li,{children:'Alternatively, connect via SSH or RDP and collect forensic artifacts by selecting "Import > Cado Host."'}),"\n"]}),"\n",(0,o.jsx)(s.h3,{id:"creating-an-unencrypted-volume-to-bypass-kms",children:"Creating an Unencrypted Volume to Bypass KMS"}),"\n",(0,o.jsxs)(s.p,{children:["You can remove KMS encryption from a volume by following the steps in this ",(0,o.jsx)(s.a,{href:"https://aws.amazon.com/premiumsupport/knowledge-center/create-unencrypted-volume-kms-key/",children:"AWS guide"}),"."]}),"\n",(0,o.jsx)(s.h3,{id:"debugging-kms-iam-permissions",children:"Debugging KMS IAM Permissions"}),"\n",(0,o.jsxs)(s.p,{children:["You can identify simple permission issues using Cado\u2019s automated health checks. For more detailed debugging, use the ",(0,o.jsx)(s.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html",children:"AWS Policy Simulator"})," to test policies and identify permission issues."]})]})}function p(e={}){const{wrapper:s}={...(0,t.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},28453:(e,s,n)=>{n.d(s,{R:()=>r,x:()=>a});var o=n(96540);const t={},i=o.createContext(t);function r(e){const s=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:r(e.components),o.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ef0a30ea.0c33aa12.js b/assets/js/ef0a30ea.fb66b6cb.js similarity index 98% rename from assets/js/ef0a30ea.0c33aa12.js rename to assets/js/ef0a30ea.fb66b6cb.js index 1c5b6b5ad..f7f4b7e4d 100644 --- a/assets/js/ef0a30ea.0c33aa12.js +++ b/assets/js/ef0a30ea.fb66b6cb.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9272],{97916:(e,n,r)=>{r.r(n),r.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>s,metadata:()=>d,toc:()=>c});var i=r(74848),t=r(28453);const s={title:"Deploy with Terraform",hide_title:!0,sidebar_position:2},o="How to deploy with Terraform",d={id:"cado/deploy/aws/terraform",title:"Deploy with Terraform",description:"Follow the steps below to deploy the Cado platform using Terraform.",source:"@site/docs/cado/deploy/aws/terraform.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/terraform",permalink:"/cado/deploy/aws/terraform",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/terraform.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"Deploy with Terraform",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Deploy with Cloudformation",permalink:"/cado/deploy/aws/cloudformation"},next:{title:"Cado architecture in AWS",permalink:"/cado/deploy/aws/architecture"}},l={},c=[{value:"Step-by-Step Guide",id:"step-by-step-guide",level:2},{value:"Key Parameters",id:"key-parameters",level:2},{value:"Deploying into Custom Networking",id:"deploying-into-custom-networking",level:2},{value:"Final Steps",id:"final-steps",level:2},{value:"Identifying the AMI ID",id:"identifying-the-ami-id",level:2}];function a(e){const n={a:"a",blockquote:"blockquote",br:"br",code:"code",em:"em",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-deploy-with-terraform",children:"How to deploy with Terraform"}),"\n",(0,i.jsx)(n.p,{children:"Follow the steps below to deploy the Cado platform using Terraform."}),"\n",(0,i.jsx)(n.h2,{id:"step-by-step-guide",children:"Step-by-Step Guide"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Clone the Repository:"}),(0,i.jsx)(n.br,{}),"\n","Clone the Cado Security Deployment Templates from GitHub:",(0,i.jsx)(n.br,{}),"\n",(0,i.jsx)(n.a,{href:"https://github.com/cado-security/Deployment-Templates/tree/main",children:"GitHub Repo"})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Navigate to the Deployment Directory:"}),(0,i.jsx)(n.br,{}),"\n","Go to the root ",(0,i.jsx)(n.strong,{children:"aws_v2"})," folder within the cloned repository."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Configure Deployment Settings:"}),(0,i.jsx)(n.br,{}),"\n","Modify the ",(0,i.jsx)(n.code,{children:"awsVars.tfvars"})," file to match your deployment needs. This file contains key variables for your deployment configuration."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Initialize Terraform:"}),(0,i.jsx)(n.br,{}),"\n","Run the following command to initialize the Terraform working directory:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:"terraform init\n"})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Preview the Deployment Plan:"}),(0,i.jsx)(n.br,{}),"\n","To review the configuration and ensure everything is set up correctly, run:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'terraform plan -var-file="awsVars.tfvars"\n'})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Deploy the Infrastructure:"}),(0,i.jsx)(n.br,{}),"\n","When ready to deploy, run:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'terraform apply -var-file="awsVars.tfvars"\n'})}),"\n",(0,i.jsxs)(n.blockquote,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Note:"})," If you're using Windows, avoid running this command in PowerShell as it may not handle quotes properly. Use the Command Prompt instead."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"key-parameters",children:"Key Parameters"}),"\n",(0,i.jsxs)(n.table,{children:[(0,i.jsx)(n.thead,{children:(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.th,{children:"Parameter Name"}),(0,i.jsx)(n.th,{children:"Value"}),(0,i.jsx)(n.th,{children:"Description"})]})}),(0,i.jsxs)(n.tbody,{children:[(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"region"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(AWS region)"})}),(0,i.jsxs)(n.td,{children:["AWS region for deploying Cado, e.g., ",(0,i.jsx)(n.code,{children:"us-east-1"}),"."]})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"key_name"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(key pair name)"})}),(0,i.jsx)(n.td,{children:"SSH key pair for accessing the Cado instance (optional, but useful for troubleshooting)."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"ami_id"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(AMI ID)"})}),(0,i.jsx)(n.td,{children:"Contact Cado Sales to get the appropriate AMI ID for your region. Provide your AWS Account Number."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"public_deployment"})}),(0,i.jsxs)(n.td,{children:[(0,i.jsx)(n.code,{children:"True"})," or ",(0,i.jsx)(n.code,{children:"False"})]}),(0,i.jsxs)(n.td,{children:["Set to ",(0,i.jsx)(n.code,{children:"True"})," for public IP access. Set to ",(0,i.jsx)(n.code,{children:"False"})," to deploy behind an ALB with a DNS URL."]})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"certificate_arn"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(ARN)"})}),(0,i.jsxs)(n.td,{children:["ARN of the certificate to assign to the ALB (required if ",(0,i.jsx)(n.code,{children:"public_deployment"})," is ",(0,i.jsx)(n.code,{children:"False"}),")."]})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"tags"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(key-value map)"})}),(0,i.jsx)(n.td,{children:"Tags for organizing and identifying your AWS resources."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"vm_size"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"m5.4xlarge"})}),(0,i.jsxs)(n.td,{children:["Choose your instance type (default: ",(0,i.jsx)(n.code,{children:"m5.4xlarge"}),")."]})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"vol_size"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(disk size in GB)"})}),(0,i.jsx)(n.td,{children:"The disk size for the instance (default: 100 GB)."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"ssh_location"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(CIDR range)"})}),(0,i.jsx)(n.td,{children:"IP address or range allowed for SSH access (recommended to restrict to specific IPs)."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"http_location"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(CIDR range)"})}),(0,i.jsx)(n.td,{children:"IP address or range allowed for HTTPS access (recommended to restrict to specific IPs)."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"custom_networking"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(optional)"})}),(0,i.jsx)(n.td,{children:"For custom VPC deployments. Specify VPC and subnet IDs if deploying in an existing network setup."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"proxy"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(proxy URL)"})}),(0,i.jsx)(n.td,{children:"Optional: URL of the proxy server to use for outbound connections."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"proxy_cert_url"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(certificate URL)"})}),(0,i.jsx)(n.td,{children:"Optional: URL to download the proxy certificate, if needed."})]})]})]}),"\n",(0,i.jsx)(n.h2,{id:"deploying-into-custom-networking",children:"Deploying into Custom Networking"}),"\n",(0,i.jsx)(n.p,{children:"For custom networking configurations:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["For ",(0,i.jsx)(n.strong,{children:"Public deployments"}),", supply ",(0,i.jsx)(n.code,{children:"vpc_id"})," and ",(0,i.jsx)(n.code,{children:"public_subnet_id"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["For ",(0,i.jsx)(n.strong,{children:"Private deployments"}),", supply ",(0,i.jsx)(n.code,{children:"vpc_id"}),", ",(0,i.jsx)(n.code,{children:"public_subnet_id"}),", ",(0,i.jsx)(n.code,{children:"public_subnet_b_id"}),", and ",(0,i.jsx)(n.code,{children:"private_subnet_id"}),"."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"final-steps",children:"Final Steps"}),"\n",(0,i.jsxs)(n.ol,{start:"7",children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Initialize the Platform:"}),(0,i.jsx)(n.br,{}),"\n","Once the infrastructure is deployed, a one-time initialization process will begin. The entire deployment and initialization process typically takes 10-15 minutes."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Log into Cado:"}),(0,i.jsx)(n.br,{}),"\n","After deployment, log into the Cado platform. The initial username is ",(0,i.jsx)(n.code,{children:"admin"}),", and the password is the instance ID of your deployed Cado platform. You\u2019ll be prompted to change your password upon first login.",(0,i.jsx)(n.br,{}),"\n",(0,i.jsx)(n.strong,{children:(0,i.jsx)(n.a,{href:"/cado/deploy/logging-in",children:"Log into Cado"})})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Import a License:"}),(0,i.jsx)(n.br,{}),"\n","You will also need to import a license file (in JSON format) after logging in."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"identifying-the-ami-id",children:"Identifying the AMI ID"}),"\n",(0,i.jsxs)(n.p,{children:["To find the latest AMI ID for the Cado platform, visit the following link:",(0,i.jsx)(n.br,{}),"\n",(0,i.jsx)(n.a,{href:"https://cado-public.s3.amazonaws.com/cado_updates_json_v2.json",children:"View Latest AMIs"})]})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},28453:(e,n,r)=>{r.d(n,{R:()=>o,x:()=>d});var i=r(96540);const t={},s=i.createContext(t);function o(e){const n=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function d(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),i.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9272],{97916:(e,n,r)=>{r.r(n),r.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>s,metadata:()=>d,toc:()=>c});var i=r(74848),t=r(28453);const s={title:"Deploy with Terraform",hide_title:!0,sidebar_position:2},o="How to deploy with Terraform",d={id:"cado/deploy/aws/terraform",title:"Deploy with Terraform",description:"Follow the steps below to deploy the Cado platform using Terraform.",source:"@site/docs/cado/deploy/aws/terraform.md",sourceDirName:"cado/deploy/aws",slug:"/cado/deploy/aws/terraform",permalink:"/cado/deploy/aws/terraform",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/aws/terraform.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"Deploy with Terraform",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Deploy with Cloudformation",permalink:"/cado/deploy/aws/cloudformation"},next:{title:"Cado architecture in AWS",permalink:"/cado/deploy/aws/architecture"}},l={},c=[{value:"Step-by-Step Guide",id:"step-by-step-guide",level:2},{value:"Key Parameters",id:"key-parameters",level:2},{value:"Deploying into Custom Networking",id:"deploying-into-custom-networking",level:2},{value:"Final Steps",id:"final-steps",level:2},{value:"Identifying the AMI ID",id:"identifying-the-ami-id",level:2}];function a(e){const n={a:"a",blockquote:"blockquote",br:"br",code:"code",em:"em",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"how-to-deploy-with-terraform",children:"How to deploy with Terraform"}),"\n",(0,i.jsx)(n.p,{children:"Follow the steps below to deploy the Cado platform using Terraform."}),"\n",(0,i.jsx)(n.h2,{id:"step-by-step-guide",children:"Step-by-Step Guide"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Clone the Repository:"}),(0,i.jsx)(n.br,{}),"\n","Clone the Cado Security Deployment Templates from GitHub:",(0,i.jsx)(n.br,{}),"\n",(0,i.jsx)(n.a,{href:"https://github.com/cado-security/Deployment-Templates/tree/main",children:"GitHub Repo"})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Navigate to the Deployment Directory:"}),(0,i.jsx)(n.br,{}),"\n","Go to the root ",(0,i.jsx)(n.strong,{children:"aws_v2"})," folder within the cloned repository."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Configure Deployment Settings:"}),(0,i.jsx)(n.br,{}),"\n","Modify the ",(0,i.jsx)(n.code,{children:"awsVars.tfvars"})," file to match your deployment needs. This file contains key variables for your deployment configuration."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Initialize Terraform:"}),(0,i.jsx)(n.br,{}),"\n","Run the following command to initialize the Terraform working directory:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:"terraform init\n"})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Preview the Deployment Plan:"}),(0,i.jsx)(n.br,{}),"\n","To review the configuration and ensure everything is set up correctly, run:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'terraform plan -var-file="awsVars.tfvars"\n'})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Deploy the Infrastructure:"}),(0,i.jsx)(n.br,{}),"\n","When ready to deploy, run:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'terraform apply -var-file="awsVars.tfvars"\n'})}),"\n",(0,i.jsxs)(n.blockquote,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Note:"})," If you're using Windows, avoid running this command in PowerShell as it may not handle quotes properly. Use the Command Prompt instead."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"key-parameters",children:"Key Parameters"}),"\n",(0,i.jsxs)(n.table,{children:[(0,i.jsx)(n.thead,{children:(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.th,{children:"Parameter Name"}),(0,i.jsx)(n.th,{children:"Value"}),(0,i.jsx)(n.th,{children:"Description"})]})}),(0,i.jsxs)(n.tbody,{children:[(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"region"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(AWS region)"})}),(0,i.jsxs)(n.td,{children:["AWS region for deploying Cado, e.g., ",(0,i.jsx)(n.code,{children:"us-east-1"}),"."]})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"key_name"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(key pair name)"})}),(0,i.jsx)(n.td,{children:"SSH key pair for accessing the Cado instance (optional, but useful for troubleshooting)."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"ami_id"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(AMI ID)"})}),(0,i.jsx)(n.td,{children:"Contact Cado Sales to get the appropriate AMI ID for your region. Provide your AWS Account Number."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"public_deployment"})}),(0,i.jsxs)(n.td,{children:[(0,i.jsx)(n.code,{children:"True"})," or ",(0,i.jsx)(n.code,{children:"False"})]}),(0,i.jsxs)(n.td,{children:["Set to ",(0,i.jsx)(n.code,{children:"True"})," for public IP access. Set to ",(0,i.jsx)(n.code,{children:"False"})," to deploy behind an ALB with a DNS URL."]})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"certificate_arn"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(ARN)"})}),(0,i.jsxs)(n.td,{children:["ARN of the certificate to assign to the ALB (required if ",(0,i.jsx)(n.code,{children:"public_deployment"})," is ",(0,i.jsx)(n.code,{children:"False"}),")."]})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"tags"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(key-value map)"})}),(0,i.jsx)(n.td,{children:"Tags for organizing and identifying your AWS resources."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"vm_size"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"m5.4xlarge"})}),(0,i.jsxs)(n.td,{children:["Choose your instance type (default: ",(0,i.jsx)(n.code,{children:"m5.4xlarge"}),")."]})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"vol_size"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(disk size in GB)"})}),(0,i.jsx)(n.td,{children:"The disk size for the instance (default: 100 GB)."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"ssh_location"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(CIDR range)"})}),(0,i.jsx)(n.td,{children:"IP address or range allowed for SSH access (recommended to restrict to specific IPs)."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"http_location"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(CIDR range)"})}),(0,i.jsx)(n.td,{children:"IP address or range allowed for HTTPS access (recommended to restrict to specific IPs)."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"custom_networking"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(optional)"})}),(0,i.jsx)(n.td,{children:"For custom VPC deployments. Specify VPC and subnet IDs if deploying in an existing network setup."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"proxy"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(proxy URL)"})}),(0,i.jsx)(n.td,{children:"Optional: URL of the proxy server to use for outbound connections."})]}),(0,i.jsxs)(n.tr,{children:[(0,i.jsx)(n.td,{children:(0,i.jsx)(n.code,{children:"proxy_cert_url"})}),(0,i.jsx)(n.td,{children:(0,i.jsx)(n.em,{children:"(certificate URL)"})}),(0,i.jsx)(n.td,{children:"Optional: URL to download the proxy certificate, if needed."})]})]})]}),"\n",(0,i.jsx)(n.h2,{id:"deploying-into-custom-networking",children:"Deploying into Custom Networking"}),"\n",(0,i.jsx)(n.p,{children:"For custom networking configurations:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["For ",(0,i.jsx)(n.strong,{children:"Public deployments"}),", supply ",(0,i.jsx)(n.code,{children:"vpc_id"})," and ",(0,i.jsx)(n.code,{children:"public_subnet_id"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["For ",(0,i.jsx)(n.strong,{children:"Private deployments"}),", supply ",(0,i.jsx)(n.code,{children:"vpc_id"}),", ",(0,i.jsx)(n.code,{children:"public_subnet_id"}),", ",(0,i.jsx)(n.code,{children:"public_subnet_b_id"}),", and ",(0,i.jsx)(n.code,{children:"private_subnet_id"}),"."]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"final-steps",children:"Final Steps"}),"\n",(0,i.jsxs)(n.ol,{start:"7",children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Initialize the Platform:"}),(0,i.jsx)(n.br,{}),"\n","Once the infrastructure is deployed, a one-time initialization process will begin. The entire deployment and initialization process typically takes 10-15 minutes."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Log into Cado:"}),(0,i.jsx)(n.br,{}),"\n","After deployment, log into the Cado platform. The initial username is ",(0,i.jsx)(n.code,{children:"admin"}),", and the password is the instance ID of your deployed Cado platform. You\u2019ll be prompted to change your password upon first login.",(0,i.jsx)(n.br,{}),"\n",(0,i.jsx)(n.strong,{children:(0,i.jsx)(n.a,{href:"/cado/deploy/logging-in",children:"Log into Cado"})})]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Import a License:"}),(0,i.jsx)(n.br,{}),"\n","You will also need to import a license file (in JSON format) after logging in."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"identifying-the-ami-id",children:"Identifying the AMI ID"}),"\n",(0,i.jsxs)(n.p,{children:["To find the latest AMI ID for the Cado platform, visit the following link:",(0,i.jsx)(n.br,{}),"\n",(0,i.jsx)(n.a,{href:"https://cado-public.s3.amazonaws.com/cado_updates_json_v2.json",children:"View Latest AMIs"})]})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},28453:(e,n,r)=>{r.d(n,{R:()=>o,x:()=>d});var i=r(96540);const t={},s=i.createContext(t);function o(e){const n=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function d(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),i.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f3a42d7c.33854c31.js b/assets/js/f3a42d7c.b0c3297b.js similarity index 98% rename from assets/js/f3a42d7c.33854c31.js rename to assets/js/f3a42d7c.b0c3297b.js index cf166838d..cbba040bc 100644 --- a/assets/js/f3a42d7c.33854c31.js +++ b/assets/js/f3a42d7c.b0c3297b.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4741],{16093:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var o=t(74848),n=t(28453);const r={title:"Temporarily access an AWS account with STS",hide_title:!0,sidebar_position:6},i="How to temporarily access an AWS account with STS",a={id:"cado/deploy/cross/aws-sts",title:"Temporarily access an AWS account with STS",description:"In complex cloud environments, setting up long-term roles with access often requires approvals from multiple teams, which can be time-consuming. To simplify this process, you can use a temporary Security Token (STS) to gain access to specific AWS resources without needing to create a permanent role.",source:"@site/docs/cado/deploy/cross/aws-sts.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/aws-sts",permalink:"/cado/deploy/cross/aws-sts",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/aws-sts.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Temporarily access an AWS account with STS",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Access an AWS account with keys",permalink:"/cado/deploy/cross/adding-keys"},next:{title:"Access an AWS account with via AMI Import",permalink:"/cado/deploy/cross/skip-role"}},c={},l=[{value:"Steps to Access AWS with a Temporary Security Token",id:"steps-to-access-aws-with-a-temporary-security-token",level:3},{value:"Setting the Session Duration",id:"setting-the-session-duration",level:3}];function d(e){const s={a:"a",br:"br",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-to-temporarily-access-an-aws-account-with-sts",children:"How to temporarily access an AWS account with STS"}),"\n",(0,o.jsx)(s.p,{children:"In complex cloud environments, setting up long-term roles with access often requires approvals from multiple teams, which can be time-consuming. To simplify this process, you can use a temporary Security Token (STS) to gain access to specific AWS resources without needing to create a permanent role."}),"\n",(0,o.jsx)(s.h3,{id:"steps-to-access-aws-with-a-temporary-security-token",children:"Steps to Access AWS with a Temporary Security Token"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Select AWS Security Token"}),(0,o.jsx)(s.br,{}),"\n","In the Cado platform, go to ",(0,o.jsx)(s.strong,{children:"Import"})," > ",(0,o.jsx)(s.strong,{children:"AWS"})," > ",(0,o.jsx)(s.strong,{children:"Security Token"}),"."]}),"\n",(0,o.jsx)(s.p,{children:(0,o.jsx)(s.img,{alt:"Security Token",src:t(75123).A+"",width:"656",height:"486"})}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Enter the Resource ARN"}),(0,o.jsx)(s.br,{}),"\n","Provide the full ",(0,o.jsx)(s.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html",children:"Amazon Resource Name (ARN)"})," of the AWS resource you want to import."]}),"\n",(0,o.jsx)(s.p,{children:(0,o.jsx)(s.img,{alt:"ARN",src:t(53004).A+"",width:"1642",height:"352"})}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Grant Temporary Access via AWS CLI"}),(0,o.jsx)(s.br,{}),"\n","Use the AWS CLI to generate the STS token for temporary access. This action uses the permissions available in your local AWS CLI environment. Alternatively, you can temporarily assume a predefined role:"]}),"\n",(0,o.jsx)(s.p,{children:(0,o.jsx)(s.img,{alt:"Assume Role",src:t(7790).A+"",width:"1399",height:"757"})}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(s.h3,{id:"setting-the-session-duration",children:"Setting the Session Duration"}),"\n",(0,o.jsx)(s.p,{children:"The maximum session duration for an STS token can be set between 1 hour and 12 hours. However, if you request a session longer than the maximum allowed by your administrator, the operation will fail. For example, if you request a 12-hour session but the administrator's limit is 6 hours, the token generation will not succeed."}),"\n",(0,o.jsxs)(s.p,{children:["More details on session duration limits can be found in the ",(0,o.jsx)(s.a,{href:"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html",children:"AWS documentation"}),"."]})]})}function h(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},53004:(e,s,t)=>{t.d(s,{A:()=>o});const o=t.p+"assets/images/arn-8818b88db740cb8522868b3dabf079e6.png"},7790:(e,s,t)=>{t.d(s,{A:()=>o});const o=t.p+"assets/images/assume-role-f0bb78ade5e1e5a485a0d46d53e17e82.png"},75123:(e,s,t)=>{t.d(s,{A:()=>o});const o=t.p+"assets/images/security-token-ab2cc932ae0b9e1b5f1578ee117529a1.png"},28453:(e,s,t)=>{t.d(s,{R:()=>i,x:()=>a});var o=t(96540);const n={},r=o.createContext(n);function i(e){const s=o.useContext(r);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),o.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4741],{16093:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var o=t(74848),n=t(28453);const r={title:"Temporarily access an AWS account with STS",hide_title:!0,sidebar_position:6},i="How to temporarily access an AWS account with STS",a={id:"cado/deploy/cross/aws-sts",title:"Temporarily access an AWS account with STS",description:"In complex cloud environments, setting up long-term roles with access often requires approvals from multiple teams, which can be time-consuming. To simplify this process, you can use a temporary Security Token (STS) to gain access to specific AWS resources without needing to create a permanent role.",source:"@site/docs/cado/deploy/cross/aws-sts.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/aws-sts",permalink:"/cado/deploy/cross/aws-sts",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/aws-sts.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Temporarily access an AWS account with STS",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Access an AWS account with keys",permalink:"/cado/deploy/cross/adding-keys"},next:{title:"Access an AWS account with via AMI Import",permalink:"/cado/deploy/cross/skip-role"}},c={},l=[{value:"Steps to Access AWS with a Temporary Security Token",id:"steps-to-access-aws-with-a-temporary-security-token",level:3},{value:"Setting the Session Duration",id:"setting-the-session-duration",level:3}];function d(e){const s={a:"a",br:"br",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,n.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(s.h1,{id:"how-to-temporarily-access-an-aws-account-with-sts",children:"How to temporarily access an AWS account with STS"}),"\n",(0,o.jsx)(s.p,{children:"In complex cloud environments, setting up long-term roles with access often requires approvals from multiple teams, which can be time-consuming. To simplify this process, you can use a temporary Security Token (STS) to gain access to specific AWS resources without needing to create a permanent role."}),"\n",(0,o.jsx)(s.h3,{id:"steps-to-access-aws-with-a-temporary-security-token",children:"Steps to Access AWS with a Temporary Security Token"}),"\n",(0,o.jsxs)(s.ol,{children:["\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Select AWS Security Token"}),(0,o.jsx)(s.br,{}),"\n","In the Cado platform, go to ",(0,o.jsx)(s.strong,{children:"Import"})," > ",(0,o.jsx)(s.strong,{children:"AWS"})," > ",(0,o.jsx)(s.strong,{children:"Security Token"}),"."]}),"\n",(0,o.jsx)(s.p,{children:(0,o.jsx)(s.img,{alt:"Security Token",src:t(75123).A+"",width:"656",height:"486"})}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Enter the Resource ARN"}),(0,o.jsx)(s.br,{}),"\n","Provide the full ",(0,o.jsx)(s.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html",children:"Amazon Resource Name (ARN)"})," of the AWS resource you want to import."]}),"\n",(0,o.jsx)(s.p,{children:(0,o.jsx)(s.img,{alt:"ARN",src:t(53004).A+"",width:"1642",height:"352"})}),"\n"]}),"\n",(0,o.jsxs)(s.li,{children:["\n",(0,o.jsxs)(s.p,{children:[(0,o.jsx)(s.strong,{children:"Grant Temporary Access via AWS CLI"}),(0,o.jsx)(s.br,{}),"\n","Use the AWS CLI to generate the STS token for temporary access. This action uses the permissions available in your local AWS CLI environment. Alternatively, you can temporarily assume a predefined role:"]}),"\n",(0,o.jsx)(s.p,{children:(0,o.jsx)(s.img,{alt:"Assume Role",src:t(7790).A+"",width:"1399",height:"757"})}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(s.h3,{id:"setting-the-session-duration",children:"Setting the Session Duration"}),"\n",(0,o.jsx)(s.p,{children:"The maximum session duration for an STS token can be set between 1 hour and 12 hours. However, if you request a session longer than the maximum allowed by your administrator, the operation will fail. For example, if you request a 12-hour session but the administrator's limit is 6 hours, the token generation will not succeed."}),"\n",(0,o.jsxs)(s.p,{children:["More details on session duration limits can be found in the ",(0,o.jsx)(s.a,{href:"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html",children:"AWS documentation"}),"."]})]})}function h(e={}){const{wrapper:s}={...(0,n.R)(),...e.components};return s?(0,o.jsx)(s,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},53004:(e,s,t)=>{t.d(s,{A:()=>o});const o=t.p+"assets/images/arn-8818b88db740cb8522868b3dabf079e6.png"},7790:(e,s,t)=>{t.d(s,{A:()=>o});const o=t.p+"assets/images/assume-role-f0bb78ade5e1e5a485a0d46d53e17e82.png"},75123:(e,s,t)=>{t.d(s,{A:()=>o});const o=t.p+"assets/images/security-token-ab2cc932ae0b9e1b5f1578ee117529a1.png"},28453:(e,s,t)=>{t.d(s,{R:()=>i,x:()=>a});var o=t(96540);const n={},r=o.createContext(n);function i(e){const s=o.useContext(r);return o.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),o.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f48685c1.b688c4b7.js b/assets/js/f48685c1.710a8919.js similarity index 99% rename from assets/js/f48685c1.b688c4b7.js rename to assets/js/f48685c1.710a8919.js index 44b8cd97b..2a0535c0d 100644 --- a/assets/js/f48685c1.b688c4b7.js +++ b/assets/js/f48685c1.710a8919.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2410],{2441:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>r,contentTitle:()=>c,default:()=>h,frontMatter:()=>a,metadata:()=>i,toc:()=>d});var s=o(74848),n=o(28453);const a={title:"Automatically deploy a cross-account role with StackSets in AWS",hide_title:!0,sidebar_position:3},c="How to automatically deploy a cross-account IAM Role in AWS",i={id:"cado/deploy/cross/cross-account-creation-auto",title:"Automatically deploy a cross-account role with StackSets in AWS",description:"To automate the deployment of the IAM Policy and Role in multiple AWS accounts within your organization, you can use AWS CloudFormation StackSets. This method allows you to deploy the necessary IAM roles and policies across all target accounts in your organization.",source:"@site/docs/cado/deploy/cross/cross-account-creation-auto.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/cross-account-creation-auto",permalink:"/cado/deploy/cross/cross-account-creation-auto",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/cross-account-creation-auto.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Automatically deploy a cross-account role with StackSets in AWS",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Manually deploy a cross-account role in AWS",permalink:"/cado/deploy/cross/cross-account-creation"},next:{title:"Manually add a cross-account role to Cado in AWS",permalink:"/cado/deploy/cross/add-cross-account-manual"}},r={},d=[{value:"Steps to Deploy the IAM Policy and Role using CloudFormation StackSets",id:"steps-to-deploy-the-iam-policy-and-role-using-cloudformation-stacksets",level:3},{value:"Automating Cross-Account Addition in Cado",id:"automating-cross-account-addition-in-cado",level:2}];function l(t){const e={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,n.R)(),...t.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.h1,{id:"how-to-automatically-deploy-a-cross-account-iam-role-in-aws",children:"How to automatically deploy a cross-account IAM Role in AWS"}),"\n",(0,s.jsx)(e.p,{children:"To automate the deployment of the IAM Policy and Role in multiple AWS accounts within your organization, you can use AWS CloudFormation StackSets. This method allows you to deploy the necessary IAM roles and policies across all target accounts in your organization."}),"\n",(0,s.jsxs)(e.p,{children:["More information on CloudFormation StackSets can be found here: ",(0,s.jsx)(e.a,{href:"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html",children:"Working with AWS CloudFormation StackSets"}),"."]}),"\n",(0,s.jsx)(e.h3,{id:"steps-to-deploy-the-iam-policy-and-role-using-cloudformation-stacksets",children:"Steps to Deploy the IAM Policy and Role using CloudFormation StackSets"}),"\n",(0,s.jsxs)(e.ol,{children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Open StackSets"}),(0,s.jsx)(e.br,{}),"\n",'From your master StackSet account (the account enabled to deploy resources into other AWS accounts), navigate to "StackSets."']}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"StackSets Role",src:o(21290).A+"",width:"245",height:"82"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Create a New StackSet"}),(0,s.jsx)(e.br,{}),"\n","Click ",(0,s.jsx)(e.strong,{children:"Create StackSet"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Enter the CloudFormation Template URL"}),(0,s.jsx)(e.br,{}),"\n","Enter the S3 URL for the CloudFormation template:"]}),"\n",(0,s.jsx)(e.pre,{children:(0,s.jsx)(e.code,{children:"https://cado-public.s3.amazonaws.com/cloudformation_v2/StacksetCrossIAM.yaml\n"})}),"\n",(0,s.jsxs)(e.p,{children:["Then, click ",(0,s.jsx)(e.strong,{children:"Next"}),"."]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Stacks3",src:o(53203).A+"",width:"592",height:"234"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Proceed Through the Setup"}),(0,s.jsx)(e.br,{}),"\n","Click ",(0,s.jsx)(e.strong,{children:"Next"})," through the following configuration steps."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Select Region"}),(0,s.jsx)(e.br,{}),"\n",'Under "Create StackSet," select any region (IAM roles are global, so this can be any region).']}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Stacks4",src:o(55804).A+"",width:"582",height:"169"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Deploy the StackSet"}),(0,s.jsx)(e.br,{}),"\n","Once deployed, this will create the required IAM Policy and IAM Role in each target AWS account. You can verify the role and policy by navigating to ",(0,s.jsx)(e.strong,{children:"IAM > Roles"})," in the target AWS accounts."]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Stacks5",src:o(8069).A+"",width:"434",height:"115"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(e.admonition,{type:"tip",children:(0,s.jsxs)(e.p,{children:["After deploying the cross-account IAM roles, you will need to add the newly created Role ARN to the Cado platform. Follow the steps outlined ",(0,s.jsx)(e.a,{href:"#step-2-add-the-target-aws-role-arn-to-the-cado-platform",children:"here"}),", or to automate this process, refer to ",(0,s.jsx)(e.a,{href:"#automating-cado-cross-account-creation",children:"Automating Cado Cross-Account Creation"}),"."]})}),"\n",(0,s.jsx)(e.h2,{id:"automating-cross-account-addition-in-cado",children:"Automating Cross-Account Addition in Cado"}),"\n",(0,s.jsx)(e.p,{children:"Once the cross-account IAM role is created, the next step is to add the IAM Role ARN to the Cado platform. This enables access to the target AWS accounts within Cado."}),"\n",(0,s.jsxs)(e.p,{children:["To automate this process via the Cado API, see the example script for adding AWS credentials in the Cado platform:",(0,s.jsx)(e.br,{}),"\n",(0,s.jsx)(e.a,{href:"https://github.com/cado-security/cado-api-examples/blob/main/examples/saving_credentials.py",children:"Example API Script for Adding AWS Credentials"}),"."]})]})}function h(t={}){const{wrapper:e}={...(0,n.R)(),...t.components};return e?(0,s.jsx)(e,{...t,children:(0,s.jsx)(l,{...t})}):l(t)}},21290:(t,e,o)=>{o.d(e,{A:()=>s});const s="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPUAAABSCAYAAACMqJIzAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAACKkSURBVHhe7Z3Xd1xXduZ35SpkEJkECRBMAHOmJJKSOij0tNse27PGXqvfPI8zr15+9avX8n8x8zKrPZ52t1tWt6hMipTEKOYIBpAEiRwKKAAVZv/2rQsUoQJJFSGNVDqfdFhVt84994T97XQOgEBOIQ4ODmWDwD/84z/nrl7vzX90cHD4ocNI/Yc/fZz/6ODg8ENHMP/q4OBQJnCkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHM4Ejt4FBmcKR2cCgzOFI7OJQZHKkdHMoMjtQODmWGHwepQyEJ1tRKqK5eAhUV+YsODuWJ0KHX3/zH6zfv5D9+QwQCEohGJVRbJ5FVayTStkrCLa0Sqm+QQCQikstJLpux1/+fCFZWSeWh1yW+badIJivpx/35b54CxpaokHBjs0RWd0iktU1CTc0Sqq7R71QXMq5sNl/ZweH7gxf6eepALC7RNR2S2H1Awg2NIpGoXlUCZzKSnZyU2b67MnXiU8kmJxeIHQxJIB6zOrm5ue+EGKEVjVL3l38jISXo1OdHZfKT95/53KAqqsT23RJdv8kjcjBg9+RmZyUzPiapSxckdf60jaMk4D3o/OVoM63zkE7nv3BweDGU7n6rJYtv2SbVv/gLia3baMKZ7n8gc/fuSmZ4SK1cQi33Ss/d1boGFeRwc4us+PV/k+o3fqnkTnjXv28IR6Tq9Tek4qXDElHrnBkdsXHNPXwgudS0RHQMkbY2U1ClIqyKpv7Xfye1f/W3Oiet+asODi+O0kitJCU+jW3oUfc7JjM3r8nEu7+Xiff+IBPvvyvjf/x3Gf/dv8jEkXclOza6YBWDQQmq1QtWV5uVD+DGfs8QUG8jtm6DxDq61CqnJKmexsS7v9Nx/YdMHnlHxt/5Nxn9v/9bpr48rla6dOsaiMXUG6iVoLr4AVV2Dg7LhZJJHayqsVga93Pm+lW1YvfNQmfHRiQzNCBz9+9J+mGf5GZmvFuU/KGqanWFNd4ORyUYj2vsXW+fSWKJxua0S4werK6VsMbn0bXrJKpeQHTtegm3YvUrTTF8DRq/oyy4J9LZJZE1azX+bTHFUbR+IXhe/QrtywqLockFRNs71IuIS3Z0VFIXz0t64JG+13GNDFs8PnenVzKDA1934dVyB3WM4ZXtEu1ab30nHkeJSTjs1dH2GQdjRoHwPPrOPNjcMA/A5jjflo4/2rVBItovwgKbKweHJVBaoswsdZ3ENN5ECGfv9koaIX+K5UIwK3bvN1edGDUQjVgSKqoWMdzaZhY9Oz0lsc51UrH3gCR27Jb4tl0S79kqsY09StROtWoJL8lFLO5DyRJpXyOVBw7qPXsksWW79qvbrhHHZ0Y0FFDy0E5QyTR3/67MKiktxs9b5Up1s6PafnY6aX2IqlKItK6SzNSkKqzLqphSz072qfJAMdCPit0HLCkX795q40b5oexoG+VUsXufxHXuLA+hVpr7UCQxJW6GehMTSugqqXj5VZ2LlySxdafENm2WmCq5sIYD5CjMA3JwKILSLLUKeHZ8TDKTExYXI3hYVSzLUsDNNNdbLSBKwawyGXIsF698DoUlvGq1ufbZ6WmLY2dv3zJChCHMS4eUnNvMdfUR794iNW//uZGWdtLqLWSGB7WPyheUh28hC8HzlYTx7s0WO0Po9OBjL2ZWAqOkcrMzGju3StXhnxoRn2UdUVBVP3lLErv22fzM9Wnf7922fsQ3b5fKg6/bXAW14LGQc9CO6H/6r8bwzIPNhYYkoZoaL6ZXJcVnEo6zd27p2AYlqB7P0+bZwaHkLS3L2KrAhpuazG2M5re0QlifHBldtdq4p3kLhwLIqBsLubE2aSXQ5MdHZPbqZSXuTVMSObX0OSUzlnTm6kWL1Wd7b6hQ35GQ3hdRVzQ7lTTXPjc3a1tnVa+/qSSoUwVwW5LHPpLUhXMye+OKtZF+9FCtWtKyzIWWmlAB5VD5yqvmaaTOn5Hpc6clp22z5YUlNNe3boX2tVUiqmgiuP/aBzL23tgLLLcqjgReiHoUc/rM5KcfqNv+lczeuiHp/vtmhXGbM0ODXjJRx0M7eAmZ8VGZOvaxpL46o/WvS1pDF7L1lQcOWd8Y09Spz+07mwsdJ2GAeQ8ODkVQeqZKSTtz/Yolw2bVomL9Ih1rpULdz5pf/qVZpjBxrW1zKQeUMFjR7NSUkT2bSlkMTrzqCanG3hqfI/RpJS0ZZ9xVSmZ42IgNkYjNzfpqierzwqpQsqkpSX5+1JQDVpp7M+qmm8WGgAUgzo6sVnfdLGdcUlcu6r3HTKnY9hQKSZ85pdemzp6UtHoJIY1/45u3SfVP35SaX/21xNXFx+vws994BLj7JLxmLmkMrs/N6fhyM+ptPOgzoqJYIqtWmQfg5R7UfVa9kJtL2xYZ80CxecB8kwvQ8ebok841not5RwOPnevt8FSUTmoFwj9746qM/uZ/ysQff69W8qxZEFxRYkvcYpJX33jrR91wizNXd1rhPW0U2EbPVW9pNZc7o0KeVmH/WuKqCIjNa976lbZZLyklIFnsHPvoi+4lFsfijv3mf8nkR++pS66utLrJuOo1/0mV1iuvWdyLMgupRQ9Veu+D6jpjsePbdkh8qxYUgFp4SMohGOo8C1n1akgy4pbjTVRoQRGZi/4c9zv8uPFiJ8p8qDXB2szdu2OWKpucMBcbC0fBomNtsNpRTmepG411RiFwmGMeSlTc3Oq3/sxIE+/ZIvFNm5UYOyTWtV7jyaiRF4vMM/ku3NhiFhl3fakDHJAK99uy78Sz2g9c8+Rnn6hVH15aGWApsazqNtNXXGBiYXPLVdGwZ40lDrettEy3ta/hR1StNi43Y6UQHjBO4mLyBPQ93NhksTau/qyGGYXWNzc7ZyFCsFLb02fh/jNWEpOWJCNMWGKsDg4vZKmfALEmrrIK59SZkzLTq8TDiqnwmqV6loXByqk7XHHwNYlCenWhp059IVMnT8j0mS9NYRTGsfwJMIvbsd+4qs+x5809xLxkmDn8QbY8VFuf/3YJKOEhNmSCaMlP3lc3eNTc+FBDkz0XF9oPKabPnpKp459K8vgn82Xy4/dk8pMjMnPtiuUNngmtg9Kb/PBPMvnBu9rmSfuMIqh545fqAex89nw6/GixfKT2AQkgNzGqvrcDJhyxnEeemItlki0hJVq0s8vumz51wgiUPPqhWdSZa5eMlPPIqncwQXItY0oDkj1T0CG1xuskprJqOdkmSuze57nFKIZ5LNGOKi6Ov2b9vXd7Xs48E4uhVcmgfKaU2NMnP3+ipM6dtnyBxe0FWLLLOgd4ESTcONY69s5vzUNhfxsPBq/GwaEYSic1p6CW2C4iy4wbDVHIemfVTZ23snmhtmRX4Ukq9ms5aaav1Ceu9BEIBZW0iSeolktnLIOOW8sWWGLLtuL9WQQUTurGFbOg9CmxbZfFreZNAO2/bZk9QfI8LNZvsFgai5uZGLfxWHJOLSnJsMTOPaokKvM3PAX6bJsRjZvJDzwVnDe3Az195jXYoZVnKTCHHy1KP3zS2CzVP31bErv22tlli/80noxv3GwkIW7OJZOWRU6r2+pbbQhvBzKqajQubbDYmyw2LidWMNa9RUJaB4ISO4Zb2rz9aY0/2eNlPxmLRTYd4uOScojDtp20H1hsrsW0PttsuNqBYOiJLa1ZDQ2Ik9kWCze3eZlrJTFZaxDfvkuqXvu5neLCTYfEHEbBqlfsP2h5AhQKSTZTPigqvZ9YOqL9Jc5HaaGgwuqix3ROzGVWGpsHo4TmRF6iW/vE3jW5B50LYmZ+qs32vH/2pva3yggcrKiwM/OcB7Ax9N3zcgi+onRwKEDJpOZ0F6e/sMhsXUHMmJIVMpMJJrae/uqMzFy54G3TABVC4k6SPwgqJ60Qeiybbf0M9JvFRMghfFTb56fAsGRYwkA4ZCfXOJCCu+vFnkNmIdlWIj6OQu7VHdpugxcHa7s8N7amU4kXsj1ii89xpSGYAqWAIkGJEC+T2OJUGQqHvXfGxeEalAXk52DJlFr6OdxpVVYAD4D9az85GG1fLZyeo9gPtijB7XhpntSED4G4jpV50PmiDyTfrE0dl51G07lEscQ2dttps6B6KyjI6dNf2LgdHIqh9B+9VEsUXqFWskmLCj7k5LCE7bmqFbNDElhDdRefAFZehRdFgPDz0124r5AVq8e5aCOmkioYj6mQPzQS2RFLvSc7OW4En1cUCjso0tJqVhdiEPOmHz2we0m4QUQy1Fg928NWa++D5/Gz0mwf2VbSsEcWs7hKasbG9hfuPue9OW2GojALnSe0D8ZvfdBnca+51WrFSc6lH/XrqxJWlYlXGTc/bl4CR24BngptE5szVqwzPyVm8bM+a1aVEUqJfW4Hh6XwYn+fmrgznwjzYzzzCHMq7Aj8IqGfB3Xt3nxcaJZL6/I6/x1l0Xdc9z8XorA9v80s9ThMoq+AvfLC9nz49wL7jvpaqE+CT/vhJ8QsUce9fn+Kgbb8vngPzLebv28xyCv4fS7sm59gLGxn8ZgcHIogL80lAgFUV9G2s2ZnrYjGqbaHWkyAfSCUxKHUo/DeF9T579SiYdX8tvzrxdotbI97KPTLbxNAhmL3+/fOf5e/h/rWHuOayY+NdvV6YbuLQRvz/cjf44+hGPx+U/y2KfPPL2hn8ZgcHIrgxUjt4ODwvYMjtYNDmcGR2sGhzOBI7eBQZnCkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHMUBKpAzmR2mxQGrIhr+QoYWksLBKWJiuRhRKISLOV6HxpCUYl+sSvP3BwcHgRlPRTWhEl9d+lVkiFhCQYCEgg/1Na9j5fgvPXvJ9yWqjDDx4F5+tS75+St2Q4N5dv3cHB4UVQEqkTuYD883ib1AXCRkqIa69Bj8DBUFBCRliu57/L1+Fnm3kN+d9pvf86flbuZd0vp3dwWA6UFlOrpQ5lcxKmZNRyZxdKVL+LcE2JX3gd6841vo9m+S7/vV77Jp2IRiNSWZmQmpoqqaqqkEgkrIqE39kQku3bN8mePVtkxYrafO3vBk1NK2Tv3m3S3d1lSg3Qr4qK+NdLIm59/SGDIcbjUVlRX/udjgVjUF1dKS+9tFN+8far8sYbB2Xjxk677rCAkn6dEUR8M1Up8ZzS0dxpruYnFndbLXWwOmElENFFzyh7lcweuMF7yd8ov5l7JGO5tL0vBix6PB6T5uYVsnbtatm8eb1s3NApK1c2G8lTqRnJqoI5dGiPtK9qkUePB2VkZDx/97cLSLx6dZuSeqvEolG5efOuCfr6dWukp2ed9ae9vdXKKop+np6ekcnJqXwL319AFuadOQbZ/M+Eh8NhU6CvvLJLHj8e/s7GEo/HZdeuzXJg/w6JJ7RfkYjMzMzJ/fuP5InfNPsCQBnHYlEJqQxn+Pn2HyBKzn7za4hYZMiU4e9P5bz3WWVvoLZCEr/YLZW/flXif75PRD/ndJJUF1i9HPXm79fPz1gPJnnHjk3yX/76LXlTtfOWzRuU0C3S071OXnt1v3R2rDJyRfgVS0oolMB3BfRSKBSafzZA2Nav75RXXt5lFnz37q1W9uzeIrtVKJubGqy/33dAXhTo/n3bpaa6Kn/V84pqa6vVQ2kwywkBvgvU1VWbAkVmPvjghPz2396XM2cu2eflAGvS1tYk+/dvU/lqyl/94aFkS/3zZEJisBTwkidmMKZu56tbJTs8IdOfXjKpr/yrl9Vqe38rOjuqWv0JFgfkX9JqqaW4VoSgu3b1yN4928wif/jRCfn4oy/kzNnLtqBnz12WgcFhrRmQzWoZ0bS379yX4WHvlwp+20AQcL/XrGmTZHJKrl27bWTAoyA8QPCOHj0lJ0+el1OnLsrp05ek/9HgD8IKYKUPHNhh47vX1y/j45N2HSXep5/PfXVFLfWQpNPfzVjq6mpkXddqCalSOXfuioyOTmhflvbwvimQtQ3qAVLGtO3+fu+3y/7QUDKpf5YndUhd7No3dknl/o2S2NYp8e0dEmmrl3BjjeRSc5I616tEj0igKiGhjmbjf3ZciW2/ukc/6IX/kxkoSmoIQ3y8f982iWkMd/TTk3Lz1j1JTk3J7OzcfEGozKoUITVWvkXd9u3bu2XD+g7pXLvKLOXM7KzMzaVNy0fVbd6yZb1UVlTI+ERy3pVrbW2UdepGZ7WvMzOzdg1Bx/XfvGWDCRgudXVVpbS0NMrExOQTpMaynFXlMzIyZvf7/YUUjA23Fi9jq7ZF39Z2tluuYGZmRhWY97wVK+q0D6utj/X1NRa3tzQ3yOOBIesbHgtJx271WjZtXGttNDbU2/ja21t0XLS9xtz/ubk5UzwAS8sze9QS0/7ate02hrTOSUqfX6/x8kZtjzYTibi54owHwUe58owO7fuEzhdjwlqjxPCeWIcunZs1alXxYhg7cw1aWhrUi+nQ8YTNKhKi8Nn3tlKp1NeUBNcJWxgvbbKmeIX0EQ9pQt3/Wp23Tf6zde7bNDRjHQkNeCUPwxi32HjXyNqudmuTduhfTGWUfmzatFaVWL31Gy+kqrLC+kNfGe/0dGpeFujHhg0d0thYb2vMHKxZs9IK4+3qWmN9CWtb9KNO55z56dE15HqrtonXmkxOz8vccqBkUv90Mm6kjjRUS/1/flnSQ+MSCKsbptcyQxMSVmKH6qtk+vgVSd8flrkbD43QFX+xTzL9o5Ib4+9BsXgB+dclSM0kIZjdm7pkUhXB8c/PmUAVG38xUiOAq1Y1y09ef8mErLFxhcblDbaYDSqUfff7dfIztuBvv31YhTcmvbf75q0orueB/dvVIozLkLYXiYRs0V89vE9W6oLQRpMqDNqEoNQrJDUK6fr1OyoEntDjtrJ4FOojRIQP7e1tJhjNzY3mXqI4Hj58bOTHAzj4ym4je7c+u0MFplIF7erVXjl0cI/2cZ0qnyYlxUojJWNjrDx7/boOyzvQP8gOKXtv3zeBQ7D37N1qMT+WuFXvbWtrNtLd0fkzN1SVKcTBMtbV1tj7qamUDA6O6Fx3ycsv7ZR79x6qBU9KPBaTw4f3mPKkP006Hoi1SpUOAj08zN8Ky5mieOXlndLW2qyC3a6vTfaszs5VUq997ut7ZEJeCNZxx45uW18UBwqO+WCMM6pQaHufhjk7tQ5jWdFQJ6tVblbqeB72D5iiYO1f1nAIwjVrHRQj3zNf/Q8HTHEcOrh7Pk8DoRtUoaJ8RnTtkYXt2zZZ/8bGJqw+6/D6a/utnSu6HigCwi3mAFnatnWD9WdqaloVT9LCGHIRDTo3DdrH9lWtOj/NKoePTFEsF7FLInXYSB2TWDYowcqYVG7rkOTJG1Khljqk8fP4kXMSwBpp3dRXt0WUODKblszjMZm71S+Jt3ZJ+vZjyY17i/ev2UEZL0JqFrNThRHtPKKEuXTpxpLxUzFSV6kFPXxoj05sgxz77JT86b1jcvnyDbNsW3XCmcN+XXTu3bWzx6zYjRt3VNd4fUEAIFlf30N18UdM4H/+M1VgOrb3jhyTI+9/JucvXFNtrgKgi8RiF5Ka+mh5hA+rD7mwaigm3v/qz35iQvnJp1/IH/90VIl6y4jZoQIOoXH/EECsM6Sn7QsXr8tN7SPP2rplowler3ovjO3zL84ZYTduWCuzqkg+O35GPvjwhJw6fdEIVFNTbePAqoB7dx/os0/afVeu3DKrhOvJHNy580AeqLCv7cI6zcj77x+X48fPyv0Hj3RMaZsbLNcV7TPWmiw0As69jOXosVMyMDBsFgnBvXev38aNkkbpMC88++OPv9Q1uWlrxBhRjA/1uYVA2B9pyDKs/Waes9mM/OGdj+SUhjR4LMz1zp3dcvfuQ/ntb4/Il3o9o3KC9cfLQHnzvAGte+zYaTlx4qxcvHjDiMl4aYN7kRtyByjV0xoqva/re+PmXetDhypNCHrt+m3rI/cmtF5Pz3rzYlgX5BXLjaJM6ZxdvnLTxjY0OGpeQo8qwt7ePuvjqVMXvHbVc8SwsdbM63KgxAwHiS4tJMfyliedTMnYB1/J5LHLEqxJyNzIpCS/vG6TCxEp1MtC5FDAu9/K0kkOnTcdLqrBW1j9/7nBpJMtx7ogDNfMYs5aXMgCoDmxELihT4CHFgFXIRAZ2MuXb8mDBwMmKLPaZv+jASPrYkBuXFw0/PZt3aq5N6rbWqfuWFDqNT5E4K5f6zUC0dbY2KSRhPe49pZ11gczR1gj4kiy65CNuWMdGBOaHusGoSF7WuNMiEtmmn5xfVoJxQEgrAlA6T1W0iGIFRUJ7/njEyagXEPAfK8IFxEhTarFoa3F68D9WCuUIcqBvtLeXVUaKAE8IYuFddwAhTU0NGKCTP9QGtTlmSjcYpjVcIKQhHEjC15/Uva5e1OnzRGECatSZ15ZZ/rP+oZDYfMWUBbcixWlL2Nah+XGhec6XgheGu/p16TOqTcHCwP2peMJKXniA32ds3wDhDZPRsMylGpajRt9ZF2tj6oM57QusuAnWZcDpZFax+gT1SY5X+JbOySuVrvi5U32PtRWJxGNo2N71kls73qJ7ulSK71TZr66IxklvZ8xtwaLgLn0Jlk7qovwTfYjITUuFJZ7ShcHF4j+IlDERVOqhNDIWKfnAYKeqIibEEAY4lPAgtNmjt91vggs7lfnr8pxtQzHT5yRExo+4A7SCHvWCNaoktCPn+kfwoei8PuOxPjPINalzcIkG/dABl/w7FULBFuo511DQdJ/CkTD/T+oLicF9xVX2AfN2Np4zVq7/jMWg9gStxgiT6q3wyt16StWnLWoq6+xOQR8Rx2fQFZX59PaX2KJ+YrO8B/wjQlkqFPFTR8IRchcHziw3fIefI/SQ86wqnh97HEfPrRX623XUKbN6xMTQpvIsTbvFa994D/zecGaoKh4NkqQ8RMu0EdievpIYduTeSD/wT3LhdJIrWACvEnwtqQyuoD8ZYmsCmh6WK306RswQaUnJsHGagk21UigtlJmrj2Q5NHLkp5QkmU8S52fuyLImZCw+FgDP2HzvOC0GrDmFz2DhbKjq0tYhsUwKzdfd2HBnwaIjzt6QV308+evWfhAxhYFaH8NdB4LbXlzmrNxIgzfFnDpXz2812Jr1gCFRdxcCuinty5F5iQ/T8yd73UtJ5hH2uYpeB+jI+NWHqiHQJISi4nSW60EJjzYosT38xtk059ch28HKA5foRX28b6GBac1NLqoniMKcLlQ8ogQBEomL4Tp6VlJXrqn5a5MX78vkdWNElnbIskLt2Xs3TMy9s5JGf+PU5I8cVUy41NKaN/SL62hEHDiMrR9jVoukhq4tM8D+oTVQyFUqsCS8PA5ggvKyS5z4dQNpy6y5x1hLT4laFTcT61lwuBZ0dKAFaUtrA1xf+GYqtXi4UF47jQLXYQoL4yAxbpzKuy/+/0HFtceOfKZhSWlgGw9GWjcWJJYPiB7Rd4Tsu2np6x1qWCOcLVxY3H1z2qI4hfyHbdv37e1JaZlXsk9fPDh5/LRR1/I6TOXVT6eHcdyP2tlSrYERQthkUUsN1uDhX1kztkexKIvF16A1OoS5kkJKebGkzJ+8rqMKWknTt+ULLEX9TSOyKh7kZlRt5GiA2SLyAitVh6lsBRolwUjs4j7SdaZ00SrV7davOxvibBdA5h4hArXFfeWpNDQ0KjF1Zt7NlgGlOTV7l09UlmV0Nj0scbb456bpAJOzExSjq0jnkHCw48DwcDAiCkYEnJYOPpAwot4kec9LxgXGdVxjaE3buiwxBHPpq3uni44Z0kWsubfFrCsuINsBeEaMpeMuRCsEXMTiUQsQUVZCAsWQCz68IH398m2b99obVGXeWE+8bbIBRSGDcsFyHBJY1fCMw72kGgkIUgsTazqbU95XgL9Zqw1NZWWIWdn4Ukl7rnroVDA+k/izovJvW057mdstNmopUetPm09C4ybXRDm0Q4f6Tr7fcRAkEhdzpi6xOy3yOGRkMSyAQmre129e7253ZHGGok2axzdUieJjaskp0RMnrrp3WRazt54Lwbv3b+HRmUiUFyLozwm1ZoiYEw0E9qhsRFEQGjYgphUopH0YcsGF5IzyVg6MqY+WSE+dYljIPbA4xH54svzStJJIxlbMMR9LBqxJRloP4FCEmdQlQMWCYttW0crW4wEbBXhujIWtnrYR0eI8CoIF0gcIfSLQb9QbiwwmWSeS+YUobujz+OQCoJUq4vPd2h6Mq883wfWFkG71dunyk/del0X7idTy3yQ0fVj/66udhMqtrRwASHnivo6234iM8+WEpYMa3RFFYp/0IT2ETq2uxgzHg6JQTLBrAcZebLBjBEvA8VJW8w3mWW8kgsaety8ddfWkO+5d0jn6vadBybwKBj249n7Zsvo0aPifwCQEIxMOmvClh5xK0T0PLkqa7c9r4w71TIjI8gdcsCaQFK2sihrtY+Mhe26Ozon/fZMz8A05bc+/e2+B/2PzbNke5R+2nx1rDJS8oNKeF1XrvTavaw7/WStWDP6Srsk3VAAyJ53ZLjFkmfeTkDaDAbzsxwoidQh7eehISW1vvInWjlcUrmlQxJdrRJb06yFhEtAptRiz/RxKsen8cKrR239V1/+EB5bktQA94WFwbJypntCvYIxFSSI1tt735JPbEeRwMLNG9brjx4PWXKM+g/7B42QUe0nk4sgsmXBNpkXw3qxDplONDdZ6OvXe+XmjXvm0iFk06mU1w9tl+wu1mdCBZ/v2R5hy4aTYpCBhZyaTlld78TV110ryMmZZWIr2o0poUia0RbbbggqoC36dl8tIeQpXHgSLMwJAkF2GDAexkV/aAMPB7DF9UDbgOyMk3mhHqEISvO6xv5s30BYssRYQAjHmMgSs1swODRi/UBh2n61fqYu/Wd+WQvmBUCivnsPzcXs7b2n7XnKiDYHB0ftPhQq/UUGaIPrhFvFlCBgLuhL/8NBrTtic8ja0Ve2q/C6yKNE1QNB0bOrgLsLuVgX7iHEmpqeltva16vXem1LkzGRPKV99tyRI8bLbkCfziPtIlOsN3LL81C8F85ftzVkXtlhgbzMLXPGuqNQ6R+F64xtZNQ7pIKCZfxso6HIFmfZXwQl/ehlTNfnH65FpCYblFAkJGGdxKDGrF5CIP9jlTq57FWzR+1fn39V7cb7UP7af08oeYLPdjWZDOoXJpAQCgSdwnXqoCz8a4B7cKFIdgGuewKxMInWn3z7XKeO/7Wdcy+oCxEYB8/z6/oKy3cxaYc6hZa1GGiL5/pj4n6v797z/HZ4vN+2D397yuurV9+bAw65eOP3u724rj9XXt2F8Xp9fnLbCtfQSyj5c+0RMRgMWZ/8ZwPq+mvAdX88fpWF8XgZfR/efC7MfTHQZ+7n2d5z818o5sej31sF66v3DNrz7w2HeYYnN8wRz2Tf259v4MsB9/j3014oFM6PzZtHvqMO8NeG7/37CucFMEba9deCjlgfFz3/RVEyqf/+ashIDUF9cvqdRhsasflsBOa6X8cv3nfc+z8q+uRBaPkSBQ4OP2Z4aucbAp2SDGosE8xaGaeE8q+BjJUxivCa9t6re22ftYxKWkZz3qs6UZLm9yM5ODgsC0qy1Mpf2TvEL0TwYmK1zfoP0YbnBi2U/Gf+K7jGP+ae05i+fhhNyqQqBAcHhxdHSaTGVMeUg/MGFvLm3xaFT+AlMKMNZZ7agIODw/OiJPcbhs5orJ8K54u+n35aUVd96inFEdrBYflQGqkdHBy+t3CkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHM4Ejt4FBmcKR2cCgzOFI7OJQZHKkdHMoKIv8PJF/1wGcNjX4AAAAASUVORK5CYII="},53203:(t,e,o)=>{o.d(e,{A:()=>s});const s=o.p+"assets/images/stacks3-f7fad534fd7186ff5e760dae641666bf.png"},55804:(t,e,o)=>{o.d(e,{A:()=>s});const s=o.p+"assets/images/stacks4-cf49641e0dcf69bcf71c4388cd810900.png"},8069:(t,e,o)=>{o.d(e,{A:()=>s});const s=o.p+"assets/images/stacks5-f70b7cbaade6620d157c90ee895402ce.png"},28453:(t,e,o)=>{o.d(e,{R:()=>c,x:()=>i});var s=o(96540);const n={},a=s.createContext(n);function c(t){const e=s.useContext(a);return s.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function i(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(n):t.components||n:c(t.components),s.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2410],{2441:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>r,contentTitle:()=>c,default:()=>h,frontMatter:()=>a,metadata:()=>i,toc:()=>d});var s=o(74848),n=o(28453);const a={title:"Automatically deploy a cross-account role with StackSets in AWS",hide_title:!0,sidebar_position:3},c="How to automatically deploy a cross-account IAM Role in AWS",i={id:"cado/deploy/cross/cross-account-creation-auto",title:"Automatically deploy a cross-account role with StackSets in AWS",description:"To automate the deployment of the IAM Policy and Role in multiple AWS accounts within your organization, you can use AWS CloudFormation StackSets. This method allows you to deploy the necessary IAM roles and policies across all target accounts in your organization.",source:"@site/docs/cado/deploy/cross/cross-account-creation-auto.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/cross-account-creation-auto",permalink:"/cado/deploy/cross/cross-account-creation-auto",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/cross-account-creation-auto.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Automatically deploy a cross-account role with StackSets in AWS",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Manually deploy a cross-account role in AWS",permalink:"/cado/deploy/cross/cross-account-creation"},next:{title:"Manually add a cross-account role to Cado in AWS",permalink:"/cado/deploy/cross/add-cross-account-manual"}},r={},d=[{value:"Steps to Deploy the IAM Policy and Role using CloudFormation StackSets",id:"steps-to-deploy-the-iam-policy-and-role-using-cloudformation-stacksets",level:3},{value:"Automating Cross-Account Addition in Cado",id:"automating-cross-account-addition-in-cado",level:2}];function l(t){const e={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,n.R)(),...t.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.h1,{id:"how-to-automatically-deploy-a-cross-account-iam-role-in-aws",children:"How to automatically deploy a cross-account IAM Role in AWS"}),"\n",(0,s.jsx)(e.p,{children:"To automate the deployment of the IAM Policy and Role in multiple AWS accounts within your organization, you can use AWS CloudFormation StackSets. This method allows you to deploy the necessary IAM roles and policies across all target accounts in your organization."}),"\n",(0,s.jsxs)(e.p,{children:["More information on CloudFormation StackSets can be found here: ",(0,s.jsx)(e.a,{href:"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html",children:"Working with AWS CloudFormation StackSets"}),"."]}),"\n",(0,s.jsx)(e.h3,{id:"steps-to-deploy-the-iam-policy-and-role-using-cloudformation-stacksets",children:"Steps to Deploy the IAM Policy and Role using CloudFormation StackSets"}),"\n",(0,s.jsxs)(e.ol,{children:["\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Open StackSets"}),(0,s.jsx)(e.br,{}),"\n",'From your master StackSet account (the account enabled to deploy resources into other AWS accounts), navigate to "StackSets."']}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"StackSets Role",src:o(21290).A+"",width:"245",height:"82"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Create a New StackSet"}),(0,s.jsx)(e.br,{}),"\n","Click ",(0,s.jsx)(e.strong,{children:"Create StackSet"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Enter the CloudFormation Template URL"}),(0,s.jsx)(e.br,{}),"\n","Enter the S3 URL for the CloudFormation template:"]}),"\n",(0,s.jsx)(e.pre,{children:(0,s.jsx)(e.code,{children:"https://cado-public.s3.amazonaws.com/cloudformation_v2/StacksetCrossIAM.yaml\n"})}),"\n",(0,s.jsxs)(e.p,{children:["Then, click ",(0,s.jsx)(e.strong,{children:"Next"}),"."]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Stacks3",src:o(53203).A+"",width:"592",height:"234"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Proceed Through the Setup"}),(0,s.jsx)(e.br,{}),"\n","Click ",(0,s.jsx)(e.strong,{children:"Next"})," through the following configuration steps."]}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Select Region"}),(0,s.jsx)(e.br,{}),"\n",'Under "Create StackSet," select any region (IAM roles are global, so this can be any region).']}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Stacks4",src:o(55804).A+"",width:"582",height:"169"})}),"\n"]}),"\n",(0,s.jsxs)(e.li,{children:["\n",(0,s.jsxs)(e.p,{children:[(0,s.jsx)(e.strong,{children:"Deploy the StackSet"}),(0,s.jsx)(e.br,{}),"\n","Once deployed, this will create the required IAM Policy and IAM Role in each target AWS account. You can verify the role and policy by navigating to ",(0,s.jsx)(e.strong,{children:"IAM > Roles"})," in the target AWS accounts."]}),"\n",(0,s.jsx)(e.p,{children:(0,s.jsx)(e.img,{alt:"Stacks5",src:o(8069).A+"",width:"434",height:"115"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(e.admonition,{type:"tip",children:(0,s.jsxs)(e.p,{children:["After deploying the cross-account IAM roles, you will need to add the newly created Role ARN to the Cado platform. Follow the steps outlined ",(0,s.jsx)(e.a,{href:"#step-2-add-the-target-aws-role-arn-to-the-cado-platform",children:"here"}),", or to automate this process, refer to ",(0,s.jsx)(e.a,{href:"#automating-cado-cross-account-creation",children:"Automating Cado Cross-Account Creation"}),"."]})}),"\n",(0,s.jsx)(e.h2,{id:"automating-cross-account-addition-in-cado",children:"Automating Cross-Account Addition in Cado"}),"\n",(0,s.jsx)(e.p,{children:"Once the cross-account IAM role is created, the next step is to add the IAM Role ARN to the Cado platform. This enables access to the target AWS accounts within Cado."}),"\n",(0,s.jsxs)(e.p,{children:["To automate this process via the Cado API, see the example script for adding AWS credentials in the Cado platform:",(0,s.jsx)(e.br,{}),"\n",(0,s.jsx)(e.a,{href:"https://github.com/cado-security/cado-api-examples/blob/main/examples/saving_credentials.py",children:"Example API Script for Adding AWS Credentials"}),"."]})]})}function h(t={}){const{wrapper:e}={...(0,n.R)(),...t.components};return e?(0,s.jsx)(e,{...t,children:(0,s.jsx)(l,{...t})}):l(t)}},21290:(t,e,o)=>{o.d(e,{A:()=>s});const s="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPUAAABSCAYAAACMqJIzAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAACKkSURBVHhe7Z3Xd1xXduZ35SpkEJkECRBMAHOmJJKSOij0tNse27PGXqvfPI8zr15+9avX8n8x8zKrPZ52t1tWt6hMipTEKOYIBpAEiRwKKAAVZv/2rQsUoQJJFSGNVDqfdFhVt84994T97XQOgEBOIQ4ODmWDwD/84z/nrl7vzX90cHD4ocNI/Yc/fZz/6ODg8ENHMP/q4OBQJnCkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHM4Ejt4FBmcKR2cCgzOFI7OJQZHKkdHMoMjtQODmWGHwepQyEJ1tRKqK5eAhUV+YsODuWJ0KHX3/zH6zfv5D9+QwQCEohGJVRbJ5FVayTStkrCLa0Sqm+QQCQikstJLpux1/+fCFZWSeWh1yW+badIJivpx/35b54CxpaokHBjs0RWd0iktU1CTc0Sqq7R71QXMq5sNl/ZweH7gxf6eepALC7RNR2S2H1Awg2NIpGoXlUCZzKSnZyU2b67MnXiU8kmJxeIHQxJIB6zOrm5ue+EGKEVjVL3l38jISXo1OdHZfKT95/53KAqqsT23RJdv8kjcjBg9+RmZyUzPiapSxckdf60jaMk4D3o/OVoM63zkE7nv3BweDGU7n6rJYtv2SbVv/gLia3baMKZ7n8gc/fuSmZ4SK1cQi33Ss/d1boGFeRwc4us+PV/k+o3fqnkTnjXv28IR6Tq9Tek4qXDElHrnBkdsXHNPXwgudS0RHQMkbY2U1ClIqyKpv7Xfye1f/W3Oiet+asODi+O0kitJCU+jW3oUfc7JjM3r8nEu7+Xiff+IBPvvyvjf/x3Gf/dv8jEkXclOza6YBWDQQmq1QtWV5uVD+DGfs8QUG8jtm6DxDq61CqnJKmexsS7v9Nx/YdMHnlHxt/5Nxn9v/9bpr48rla6dOsaiMXUG6iVoLr4AVV2Dg7LhZJJHayqsVga93Pm+lW1YvfNQmfHRiQzNCBz9+9J+mGf5GZmvFuU/KGqanWFNd4ORyUYj2vsXW+fSWKJxua0S4werK6VsMbn0bXrJKpeQHTtegm3YvUrTTF8DRq/oyy4J9LZJZE1azX+bTHFUbR+IXhe/QrtywqLockFRNs71IuIS3Z0VFIXz0t64JG+13GNDFs8PnenVzKDA1934dVyB3WM4ZXtEu1ab30nHkeJSTjs1dH2GQdjRoHwPPrOPNjcMA/A5jjflo4/2rVBItovwgKbKweHJVBaoswsdZ3ENN5ECGfv9koaIX+K5UIwK3bvN1edGDUQjVgSKqoWMdzaZhY9Oz0lsc51UrH3gCR27Jb4tl0S79kqsY09StROtWoJL8lFLO5DyRJpXyOVBw7qPXsksWW79qvbrhHHZ0Y0FFDy0E5QyTR3/67MKiktxs9b5Up1s6PafnY6aX2IqlKItK6SzNSkKqzLqphSz072qfJAMdCPit0HLCkX795q40b5oexoG+VUsXufxHXuLA+hVpr7UCQxJW6GehMTSugqqXj5VZ2LlySxdafENm2WmCq5sIYD5CjMA3JwKILSLLUKeHZ8TDKTExYXI3hYVSzLUsDNNNdbLSBKwawyGXIsF698DoUlvGq1ufbZ6WmLY2dv3zJChCHMS4eUnNvMdfUR794iNW//uZGWdtLqLWSGB7WPyheUh28hC8HzlYTx7s0WO0Po9OBjL2ZWAqOkcrMzGju3StXhnxoRn2UdUVBVP3lLErv22fzM9Wnf7922fsQ3b5fKg6/bXAW14LGQc9CO6H/6r8bwzIPNhYYkoZoaL6ZXJcVnEo6zd27p2AYlqB7P0+bZwaHkLS3L2KrAhpuazG2M5re0QlifHBldtdq4p3kLhwLIqBsLubE2aSXQ5MdHZPbqZSXuTVMSObX0OSUzlnTm6kWL1Wd7b6hQ35GQ3hdRVzQ7lTTXPjc3a1tnVa+/qSSoUwVwW5LHPpLUhXMye+OKtZF+9FCtWtKyzIWWmlAB5VD5yqvmaaTOn5Hpc6clp22z5YUlNNe3boX2tVUiqmgiuP/aBzL23tgLLLcqjgReiHoUc/rM5KcfqNv+lczeuiHp/vtmhXGbM0ODXjJRx0M7eAmZ8VGZOvaxpL46o/WvS1pDF7L1lQcOWd8Y09Spz+07mwsdJ2GAeQ8ODkVQeqZKSTtz/Yolw2bVomL9Ih1rpULdz5pf/qVZpjBxrW1zKQeUMFjR7NSUkT2bSlkMTrzqCanG3hqfI/RpJS0ZZ9xVSmZ42IgNkYjNzfpqierzwqpQsqkpSX5+1JQDVpp7M+qmm8WGgAUgzo6sVnfdLGdcUlcu6r3HTKnY9hQKSZ85pdemzp6UtHoJIY1/45u3SfVP35SaX/21xNXFx+vws994BLj7JLxmLmkMrs/N6fhyM+ptPOgzoqJYIqtWmQfg5R7UfVa9kJtL2xYZ80CxecB8kwvQ8ebok841not5RwOPnevt8FSUTmoFwj9746qM/uZ/ysQff69W8qxZEFxRYkvcYpJX33jrR91wizNXd1rhPW0U2EbPVW9pNZc7o0KeVmH/WuKqCIjNa976lbZZLyklIFnsHPvoi+4lFsfijv3mf8nkR++pS66utLrJuOo1/0mV1iuvWdyLMgupRQ9Veu+D6jpjsePbdkh8qxYUgFp4SMohGOo8C1n1akgy4pbjTVRoQRGZi/4c9zv8uPFiJ8p8qDXB2szdu2OWKpucMBcbC0fBomNtsNpRTmepG411RiFwmGMeSlTc3Oq3/sxIE+/ZIvFNm5UYOyTWtV7jyaiRF4vMM/ku3NhiFhl3fakDHJAK99uy78Sz2g9c8+Rnn6hVH15aGWApsazqNtNXXGBiYXPLVdGwZ40lDrettEy3ta/hR1StNi43Y6UQHjBO4mLyBPQ93NhksTau/qyGGYXWNzc7ZyFCsFLb02fh/jNWEpOWJCNMWGKsDg4vZKmfALEmrrIK59SZkzLTq8TDiqnwmqV6loXByqk7XHHwNYlCenWhp059IVMnT8j0mS9NYRTGsfwJMIvbsd+4qs+x5809xLxkmDn8QbY8VFuf/3YJKOEhNmSCaMlP3lc3eNTc+FBDkz0XF9oPKabPnpKp459K8vgn82Xy4/dk8pMjMnPtiuUNngmtg9Kb/PBPMvnBu9rmSfuMIqh545fqAex89nw6/GixfKT2AQkgNzGqvrcDJhyxnEeemItlki0hJVq0s8vumz51wgiUPPqhWdSZa5eMlPPIqncwQXItY0oDkj1T0CG1xuskprJqOdkmSuze57nFKIZ5LNGOKi6Ov2b9vXd7Xs48E4uhVcmgfKaU2NMnP3+ipM6dtnyBxe0FWLLLOgd4ESTcONY69s5vzUNhfxsPBq/GwaEYSic1p6CW2C4iy4wbDVHIemfVTZ23snmhtmRX4Ukq9ms5aaav1Ceu9BEIBZW0iSeolktnLIOOW8sWWGLLtuL9WQQUTurGFbOg9CmxbZfFreZNAO2/bZk9QfI8LNZvsFgai5uZGLfxWHJOLSnJsMTOPaokKvM3PAX6bJsRjZvJDzwVnDe3Az195jXYoZVnKTCHHy1KP3zS2CzVP31bErv22tlli/80noxv3GwkIW7OJZOWRU6r2+pbbQhvBzKqajQubbDYmyw2LidWMNa9RUJaB4ISO4Zb2rz9aY0/2eNlPxmLRTYd4uOScojDtp20H1hsrsW0PttsuNqBYOiJLa1ZDQ2Ik9kWCze3eZlrJTFZaxDfvkuqXvu5neLCTYfEHEbBqlfsP2h5AhQKSTZTPigqvZ9YOqL9Jc5HaaGgwuqix3ROzGVWGpsHo4TmRF6iW/vE3jW5B50LYmZ+qs32vH/2pva3yggcrKiwM/OcB7Ax9N3zcgi+onRwKEDJpOZ0F6e/sMhsXUHMmJIVMpMJJrae/uqMzFy54G3TABVC4k6SPwgqJ60Qeiybbf0M9JvFRMghfFTb56fAsGRYwkA4ZCfXOJCCu+vFnkNmIdlWIj6OQu7VHdpugxcHa7s8N7amU4kXsj1ii89xpSGYAqWAIkGJEC+T2OJUGQqHvXfGxeEalAXk52DJlFr6OdxpVVYAD4D9az85GG1fLZyeo9gPtijB7XhpntSED4G4jpV50PmiDyTfrE0dl51G07lEscQ2dttps6B6KyjI6dNf2LgdHIqh9B+9VEsUXqFWskmLCj7k5LCE7bmqFbNDElhDdRefAFZehRdFgPDz0124r5AVq8e5aCOmkioYj6mQPzQS2RFLvSc7OW4En1cUCjso0tJqVhdiEPOmHz2we0m4QUQy1Fg928NWa++D5/Gz0mwf2VbSsEcWs7hKasbG9hfuPue9OW2GojALnSe0D8ZvfdBnca+51WrFSc6lH/XrqxJWlYlXGTc/bl4CR24BngptE5szVqwzPyVm8bM+a1aVEUqJfW4Hh6XwYn+fmrgznwjzYzzzCHMq7Aj8IqGfB3Xt3nxcaJZL6/I6/x1l0Xdc9z8XorA9v80s9ThMoq+AvfLC9nz49wL7jvpaqE+CT/vhJ8QsUce9fn+Kgbb8vngPzLebv28xyCv4fS7sm59gLGxn8ZgcHIogL80lAgFUV9G2s2ZnrYjGqbaHWkyAfSCUxKHUo/DeF9T579SiYdX8tvzrxdotbI97KPTLbxNAhmL3+/fOf5e/h/rWHuOayY+NdvV6YbuLQRvz/cjf44+hGPx+U/y2KfPPL2hn8ZgcHIrgxUjt4ODwvYMjtYNDmcGR2sGhzOBI7eBQZnCkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHMUBKpAzmR2mxQGrIhr+QoYWksLBKWJiuRhRKISLOV6HxpCUYl+sSvP3BwcHgRlPRTWhEl9d+lVkiFhCQYCEgg/1Na9j5fgvPXvJ9yWqjDDx4F5+tS75+St2Q4N5dv3cHB4UVQEqkTuYD883ib1AXCRkqIa69Bj8DBUFBCRliu57/L1+Fnm3kN+d9pvf86flbuZd0vp3dwWA6UFlOrpQ5lcxKmZNRyZxdKVL+LcE2JX3gd6841vo9m+S7/vV77Jp2IRiNSWZmQmpoqqaqqkEgkrIqE39kQku3bN8mePVtkxYrafO3vBk1NK2Tv3m3S3d1lSg3Qr4qK+NdLIm59/SGDIcbjUVlRX/udjgVjUF1dKS+9tFN+8far8sYbB2Xjxk677rCAkn6dEUR8M1Up8ZzS0dxpruYnFndbLXWwOmElENFFzyh7lcweuMF7yd8ov5l7JGO5tL0vBix6PB6T5uYVsnbtatm8eb1s3NApK1c2G8lTqRnJqoI5dGiPtK9qkUePB2VkZDx/97cLSLx6dZuSeqvEolG5efOuCfr6dWukp2ed9ae9vdXKKop+np6ekcnJqXwL319AFuadOQbZ/M+Eh8NhU6CvvLJLHj8e/s7GEo/HZdeuzXJg/w6JJ7RfkYjMzMzJ/fuP5InfNPsCQBnHYlEJqQxn+Pn2HyBKzn7za4hYZMiU4e9P5bz3WWVvoLZCEr/YLZW/flXif75PRD/ndJJUF1i9HPXm79fPz1gPJnnHjk3yX/76LXlTtfOWzRuU0C3S071OXnt1v3R2rDJyRfgVS0oolMB3BfRSKBSafzZA2Nav75RXXt5lFnz37q1W9uzeIrtVKJubGqy/33dAXhTo/n3bpaa6Kn/V84pqa6vVQ2kwywkBvgvU1VWbAkVmPvjghPz2396XM2cu2eflAGvS1tYk+/dvU/lqyl/94aFkS/3zZEJisBTwkidmMKZu56tbJTs8IdOfXjKpr/yrl9Vqe38rOjuqWv0JFgfkX9JqqaW4VoSgu3b1yN4928wif/jRCfn4oy/kzNnLtqBnz12WgcFhrRmQzWoZ0bS379yX4WHvlwp+20AQcL/XrGmTZHJKrl27bWTAoyA8QPCOHj0lJ0+el1OnLsrp05ek/9HgD8IKYKUPHNhh47vX1y/j45N2HSXep5/PfXVFLfWQpNPfzVjq6mpkXddqCalSOXfuioyOTmhflvbwvimQtQ3qAVLGtO3+fu+3y/7QUDKpf5YndUhd7No3dknl/o2S2NYp8e0dEmmrl3BjjeRSc5I616tEj0igKiGhjmbjf3ZciW2/ukc/6IX/kxkoSmoIQ3y8f982iWkMd/TTk3Lz1j1JTk3J7OzcfEGozKoUITVWvkXd9u3bu2XD+g7pXLvKLOXM7KzMzaVNy0fVbd6yZb1UVlTI+ERy3pVrbW2UdepGZ7WvMzOzdg1Bx/XfvGWDCRgudXVVpbS0NMrExOQTpMaynFXlMzIyZvf7/YUUjA23Fi9jq7ZF39Z2tluuYGZmRhWY97wVK+q0D6utj/X1NRa3tzQ3yOOBIesbHgtJx271WjZtXGttNDbU2/ja21t0XLS9xtz/ubk5UzwAS8sze9QS0/7ate02hrTOSUqfX6/x8kZtjzYTibi54owHwUe58owO7fuEzhdjwlqjxPCeWIcunZs1alXxYhg7cw1aWhrUi+nQ8YTNKhKi8Nn3tlKp1NeUBNcJWxgvbbKmeIX0EQ9pQt3/Wp23Tf6zde7bNDRjHQkNeCUPwxi32HjXyNqudmuTduhfTGWUfmzatFaVWL31Gy+kqrLC+kNfGe/0dGpeFujHhg0d0thYb2vMHKxZs9IK4+3qWmN9CWtb9KNO55z56dE15HqrtonXmkxOz8vccqBkUv90Mm6kjjRUS/1/flnSQ+MSCKsbptcyQxMSVmKH6qtk+vgVSd8flrkbD43QFX+xTzL9o5Ib4+9BsXgB+dclSM0kIZjdm7pkUhXB8c/PmUAVG38xUiOAq1Y1y09ef8mErLFxhcblDbaYDSqUfff7dfIztuBvv31YhTcmvbf75q0orueB/dvVIozLkLYXiYRs0V89vE9W6oLQRpMqDNqEoNQrJDUK6fr1OyoEntDjtrJ4FOojRIQP7e1tJhjNzY3mXqI4Hj58bOTHAzj4ym4je7c+u0MFplIF7erVXjl0cI/2cZ0qnyYlxUojJWNjrDx7/boOyzvQP8gOKXtv3zeBQ7D37N1qMT+WuFXvbWtrNtLd0fkzN1SVKcTBMtbV1tj7qamUDA6O6Fx3ycsv7ZR79x6qBU9KPBaTw4f3mPKkP006Hoi1SpUOAj08zN8Ky5mieOXlndLW2qyC3a6vTfaszs5VUq997ut7ZEJeCNZxx45uW18UBwqO+WCMM6pQaHufhjk7tQ5jWdFQJ6tVblbqeB72D5iiYO1f1nAIwjVrHRQj3zNf/Q8HTHEcOrh7Pk8DoRtUoaJ8RnTtkYXt2zZZ/8bGJqw+6/D6a/utnSu6HigCwi3mAFnatnWD9WdqaloVT9LCGHIRDTo3DdrH9lWtOj/NKoePTFEsF7FLInXYSB2TWDYowcqYVG7rkOTJG1Khljqk8fP4kXMSwBpp3dRXt0WUODKblszjMZm71S+Jt3ZJ+vZjyY17i/ev2UEZL0JqFrNThRHtPKKEuXTpxpLxUzFSV6kFPXxoj05sgxz77JT86b1jcvnyDbNsW3XCmcN+XXTu3bWzx6zYjRt3VNd4fUEAIFlf30N18UdM4H/+M1VgOrb3jhyTI+9/JucvXFNtrgKgi8RiF5Ka+mh5hA+rD7mwaigm3v/qz35iQvnJp1/IH/90VIl6y4jZoQIOoXH/EECsM6Sn7QsXr8tN7SPP2rplowler3ovjO3zL84ZYTduWCuzqkg+O35GPvjwhJw6fdEIVFNTbePAqoB7dx/os0/afVeu3DKrhOvJHNy580AeqLCv7cI6zcj77x+X48fPyv0Hj3RMaZsbLNcV7TPWmiw0As69jOXosVMyMDBsFgnBvXev38aNkkbpMC88++OPv9Q1uWlrxBhRjA/1uYVA2B9pyDKs/Waes9mM/OGdj+SUhjR4LMz1zp3dcvfuQ/ntb4/Il3o9o3KC9cfLQHnzvAGte+zYaTlx4qxcvHjDiMl4aYN7kRtyByjV0xoqva/re+PmXetDhypNCHrt+m3rI/cmtF5Pz3rzYlgX5BXLjaJM6ZxdvnLTxjY0OGpeQo8qwt7ePuvjqVMXvHbVc8SwsdbM63KgxAwHiS4tJMfyliedTMnYB1/J5LHLEqxJyNzIpCS/vG6TCxEp1MtC5FDAu9/K0kkOnTcdLqrBW1j9/7nBpJMtx7ogDNfMYs5aXMgCoDmxELihT4CHFgFXIRAZ2MuXb8mDBwMmKLPaZv+jASPrYkBuXFw0/PZt3aq5N6rbWqfuWFDqNT5E4K5f6zUC0dbY2KSRhPe49pZ11gczR1gj4kiy65CNuWMdGBOaHusGoSF7WuNMiEtmmn5xfVoJxQEgrAlA6T1W0iGIFRUJ7/njEyagXEPAfK8IFxEhTarFoa3F68D9WCuUIcqBvtLeXVUaKAE8IYuFddwAhTU0NGKCTP9QGtTlmSjcYpjVcIKQhHEjC15/Uva5e1OnzRGECatSZ15ZZ/rP+oZDYfMWUBbcixWlL2Nah+XGhec6XgheGu/p16TOqTcHCwP2peMJKXniA32ds3wDhDZPRsMylGpajRt9ZF2tj6oM57QusuAnWZcDpZFax+gT1SY5X+JbOySuVrvi5U32PtRWJxGNo2N71kls73qJ7ulSK71TZr66IxklvZ8xtwaLgLn0Jlk7qovwTfYjITUuFJZ7ShcHF4j+IlDERVOqhNDIWKfnAYKeqIibEEAY4lPAgtNmjt91vggs7lfnr8pxtQzHT5yRExo+4A7SCHvWCNaoktCPn+kfwoei8PuOxPjPINalzcIkG/dABl/w7FULBFuo511DQdJ/CkTD/T+oLicF9xVX2AfN2Np4zVq7/jMWg9gStxgiT6q3wyt16StWnLWoq6+xOQR8Rx2fQFZX59PaX2KJ+YrO8B/wjQlkqFPFTR8IRchcHziw3fIefI/SQ86wqnh97HEfPrRX623XUKbN6xMTQpvIsTbvFa994D/zecGaoKh4NkqQ8RMu0EdievpIYduTeSD/wT3LhdJIrWACvEnwtqQyuoD8ZYmsCmh6WK306RswQaUnJsHGagk21UigtlJmrj2Q5NHLkp5QkmU8S52fuyLImZCw+FgDP2HzvOC0GrDmFz2DhbKjq0tYhsUwKzdfd2HBnwaIjzt6QV308+evWfhAxhYFaH8NdB4LbXlzmrNxIgzfFnDpXz2812Jr1gCFRdxcCuinty5F5iQ/T8yd73UtJ5hH2uYpeB+jI+NWHqiHQJISi4nSW60EJjzYosT38xtk059ch28HKA5foRX28b6GBac1NLqoniMKcLlQ8ogQBEomL4Tp6VlJXrqn5a5MX78vkdWNElnbIskLt2Xs3TMy9s5JGf+PU5I8cVUy41NKaN/SL62hEHDiMrR9jVoukhq4tM8D+oTVQyFUqsCS8PA5ggvKyS5z4dQNpy6y5x1hLT4laFTcT61lwuBZ0dKAFaUtrA1xf+GYqtXi4UF47jQLXYQoL4yAxbpzKuy/+/0HFtceOfKZhSWlgGw9GWjcWJJYPiB7Rd4Tsu2np6x1qWCOcLVxY3H1z2qI4hfyHbdv37e1JaZlXsk9fPDh5/LRR1/I6TOXVT6eHcdyP2tlSrYERQthkUUsN1uDhX1kztkexKIvF16A1OoS5kkJKebGkzJ+8rqMKWknTt+ULLEX9TSOyKh7kZlRt5GiA2SLyAitVh6lsBRolwUjs4j7SdaZ00SrV7davOxvibBdA5h4hArXFfeWpNDQ0KjF1Zt7NlgGlOTV7l09UlmV0Nj0scbb456bpAJOzExSjq0jnkHCw48DwcDAiCkYEnJYOPpAwot4kec9LxgXGdVxjaE3buiwxBHPpq3uni44Z0kWsubfFrCsuINsBeEaMpeMuRCsEXMTiUQsQUVZCAsWQCz68IH398m2b99obVGXeWE+8bbIBRSGDcsFyHBJY1fCMw72kGgkIUgsTazqbU95XgL9Zqw1NZWWIWdn4Ukl7rnroVDA+k/izovJvW057mdstNmopUetPm09C4ybXRDm0Q4f6Tr7fcRAkEhdzpi6xOy3yOGRkMSyAQmre129e7253ZHGGok2axzdUieJjaskp0RMnrrp3WRazt54Lwbv3b+HRmUiUFyLozwm1ZoiYEw0E9qhsRFEQGjYgphUopH0YcsGF5IzyVg6MqY+WSE+dYljIPbA4xH54svzStJJIxlbMMR9LBqxJRloP4FCEmdQlQMWCYttW0crW4wEbBXhujIWtnrYR0eI8CoIF0gcIfSLQb9QbiwwmWSeS+YUobujz+OQCoJUq4vPd2h6Mq883wfWFkG71dunyk/del0X7idTy3yQ0fVj/66udhMqtrRwASHnivo6234iM8+WEpYMa3RFFYp/0IT2ETq2uxgzHg6JQTLBrAcZebLBjBEvA8VJW8w3mWW8kgsaety8ddfWkO+5d0jn6vadBybwKBj249n7Zsvo0aPifwCQEIxMOmvClh5xK0T0PLkqa7c9r4w71TIjI8gdcsCaQFK2sihrtY+Mhe26Ozon/fZMz8A05bc+/e2+B/2PzbNke5R+2nx1rDJS8oNKeF1XrvTavaw7/WStWDP6Srsk3VAAyJ53ZLjFkmfeTkDaDAbzsxwoidQh7eehISW1vvInWjlcUrmlQxJdrRJb06yFhEtAptRiz/RxKsen8cKrR239V1/+EB5bktQA94WFwbJypntCvYIxFSSI1tt735JPbEeRwMLNG9brjx4PWXKM+g/7B42QUe0nk4sgsmXBNpkXw3qxDplONDdZ6OvXe+XmjXvm0iFk06mU1w9tl+wu1mdCBZ/v2R5hy4aTYpCBhZyaTlld78TV110ryMmZZWIr2o0poUia0RbbbggqoC36dl8tIeQpXHgSLMwJAkF2GDAexkV/aAMPB7DF9UDbgOyMk3mhHqEISvO6xv5s30BYssRYQAjHmMgSs1swODRi/UBh2n61fqYu/Wd+WQvmBUCivnsPzcXs7b2n7XnKiDYHB0ftPhQq/UUGaIPrhFvFlCBgLuhL/8NBrTtic8ja0Ve2q/C6yKNE1QNB0bOrgLsLuVgX7iHEmpqeltva16vXem1LkzGRPKV99tyRI8bLbkCfziPtIlOsN3LL81C8F85ftzVkXtlhgbzMLXPGuqNQ6R+F64xtZNQ7pIKCZfxso6HIFmfZXwQl/ehlTNfnH65FpCYblFAkJGGdxKDGrF5CIP9jlTq57FWzR+1fn39V7cb7UP7af08oeYLPdjWZDOoXJpAQCgSdwnXqoCz8a4B7cKFIdgGuewKxMInWn3z7XKeO/7Wdcy+oCxEYB8/z6/oKy3cxaYc6hZa1GGiL5/pj4n6v797z/HZ4vN+2D397yuurV9+bAw65eOP3u724rj9XXt2F8Xp9fnLbCtfQSyj5c+0RMRgMWZ/8ZwPq+mvAdX88fpWF8XgZfR/efC7MfTHQZ+7n2d5z818o5sej31sF66v3DNrz7w2HeYYnN8wRz2Tf259v4MsB9/j3014oFM6PzZtHvqMO8NeG7/37CucFMEba9deCjlgfFz3/RVEyqf/+ashIDUF9cvqdRhsasflsBOa6X8cv3nfc+z8q+uRBaPkSBQ4OP2Z4aucbAp2SDGosE8xaGaeE8q+BjJUxivCa9t6re22ftYxKWkZz3qs6UZLm9yM5ODgsC0qy1Mpf2TvEL0TwYmK1zfoP0YbnBi2U/Gf+K7jGP+ae05i+fhhNyqQqBAcHhxdHSaTGVMeUg/MGFvLm3xaFT+AlMKMNZZ7agIODw/OiJPcbhs5orJ8K54u+n35aUVd96inFEdrBYflQGqkdHBy+t3CkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHM4Ejt4FBmcKR2cCgzOFI7OJQZHKkdHMoKIv8PJF/1wGcNjX4AAAAASUVORK5CYII="},53203:(t,e,o)=>{o.d(e,{A:()=>s});const s=o.p+"assets/images/stacks3-f7fad534fd7186ff5e760dae641666bf.png"},55804:(t,e,o)=>{o.d(e,{A:()=>s});const s=o.p+"assets/images/stacks4-cf49641e0dcf69bcf71c4388cd810900.png"},8069:(t,e,o)=>{o.d(e,{A:()=>s});const s=o.p+"assets/images/stacks5-f70b7cbaade6620d157c90ee895402ce.png"},28453:(t,e,o)=>{o.d(e,{R:()=>c,x:()=>i});var s=o(96540);const n={},a=s.createContext(n);function c(t){const e=s.useContext(a);return s.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function i(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(n):t.components||n:c(t.components),s.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/f7d56d82.fb97e207.js b/assets/js/f7d56d82.4375e790.js similarity index 99% rename from assets/js/f7d56d82.fb97e207.js rename to assets/js/f7d56d82.4375e790.js index 0077b4099..5268aed91 100644 --- a/assets/js/f7d56d82.fb97e207.js +++ b/assets/js/f7d56d82.4375e790.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[220],{99305:(e,i,n)=>{n.r(i),n.d(i,{assets:()=>d,contentTitle:()=>a,default:()=>u,frontMatter:()=>s,metadata:()=>r,toc:()=>l});var t=n(74848),o=n(28453);const s={sidebar_position:7,id:"community-intro",title:"Community edition"},a="What is Cado Community Edition?",r={id:"cado/community-intro",title:"Community edition",description:"The Cado platform leverages the cloud's scale, speed, and automation to accelerate investigations and incident response. Cado Community Edition is a free version of the Cado platform that allows you to analyze:",source:"@site/docs/cado/community.md",sourceDirName:"cado",slug:"/cado/community-intro",permalink:"/cado/community-intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/community.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:7,frontMatter:{sidebar_position:7,id:"community-intro",title:"Community edition"},sidebar:"tutorialSidebar",previous:{title:"AI Investigator",permalink:"/cado/investigate/ai investigator"},next:{title:"Manage users",permalink:"/cado/manage/users-authentication/users"}},d={},l=[{value:"Benefits",id:"benefits",level:3},{value:"Getting Started",id:"getting-started",level:2},{value:"Signing Up for Cado Community Edition",id:"signing-up-for-cado-community-edition",level:3},{value:"Deploying in Your Cloud Environment",id:"deploying-in-your-cloud-environment",level:3},{value:"Processing Data",id:"processing-data",level:3},{value:"Analyzing Evidence",id:"analyzing-evidence",level:3},{value:"How Does Cado Community Edition Differ From the Full Cado Platform?",id:"how-does-cado-community-edition-differ-from-the-full-cado-platform",level:2}];function c(e){const i={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",hr:"hr",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i.h1,{id:"what-is-cado-community-edition",children:"What is Cado Community Edition?"}),"\n",(0,t.jsxs)(i.p,{children:["The ",(0,t.jsx)(i.a,{href:"/cado/intro",children:"Cado platform"})," leverages the cloud's scale, speed, and automation to accelerate investigations and incident response. ",(0,t.jsx)(i.strong,{children:"Cado Community Edition"})," is a free version of the Cado platform that allows you to analyze:"]}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsx)(i.li,{children:"Disk images in DD format"}),"\n",(0,t.jsxs)(i.li,{children:["Exports of triaged items from open-source forensics tools such as ",(0,t.jsx)(i.a,{href:"https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape",children:"KAPE"})," and ",(0,t.jsx)(i.a,{href:"https://www.rapid7.com/products/velociraptor/",children:"Velociraptor"})]}),"\n",(0,t.jsx)(i.li,{children:"Sample data published by Cado to demonstrate different incident scenarios in server-based, container-based, and serverless systems in the cloud."}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:"With Cado Community Edition, you can:"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsx)(i.li,{children:"Navigate files and folders"}),"\n",(0,t.jsx)(i.li,{children:"View a timeline of system activities"}),"\n",(0,t.jsx)(i.li,{children:"Analyze captured artifacts for threats and indicators of compromise"}),"\n",(0,t.jsx)(i.li,{children:"Easily pivot and search across artifacts"}),"\n"]}),"\n",(0,t.jsx)(i.h3,{id:"benefits",children:"Benefits"}),"\n",(0,t.jsx)(i.p,{children:"Cado Community Edition provides:"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsxs)(i.li,{children:[(0,t.jsx)(i.strong,{children:"Cloud Scale and Speed"}),": Adds the speed and scalability of cloud-native analysis to your existing data capture processes."]}),"\n",(0,t.jsxs)(i.li,{children:[(0,t.jsx)(i.strong,{children:"Automated Analysis"}),": Conducts automated system analysis using built-in detections from Cado Labs experts."]}),"\n",(0,t.jsxs)(i.li,{children:[(0,t.jsx)(i.strong,{children:"Easier Sharing"}),": Facilitates sharing of artifacts and findings using a cloud-based platform."]}),"\n"]}),"\n",(0,t.jsx)(i.hr,{}),"\n",(0,t.jsx)(i.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,t.jsx)(i.p,{children:"Interested in using Cado Community Edition? Here are key steps to get started:"}),"\n",(0,t.jsx)(i.h3,{id:"signing-up-for-cado-community-edition",children:"Signing Up for Cado Community Edition"}),"\n",(0,t.jsxs)(i.p,{children:["Visit the ",(0,t.jsx)(i.a,{href:"https://www.cadosecurity.com/cado-community-edition/#get-access",children:"Cado Community Edition website"})," to sign up. After signing up, a Cado representative will send you a license and a link to the CloudFormation template."]}),"\n",(0,t.jsx)(i.h3,{id:"deploying-in-your-cloud-environment",children:"Deploying in Your Cloud Environment"}),"\n",(0,t.jsx)(i.p,{children:"You can deploy Cado Community Edition in AWS using CloudFormation. Although many settings can be configured, the default values work well for most cases. You will need a key pair if you plan to access the system via SSH, although it\u2019s usually unnecessary for the Community Edition. We recommend using IP address restrictions to enhance security."}),"\n",(0,t.jsx)(i.admonition,{type:"caution",children:(0,t.jsxs)(i.p,{children:["Using Cado Community Edition will incur AWS charges. To minimize costs, shut down the main instance once processing is complete and you no longer need access. You can also adjust worker size in ",(0,t.jsx)(i.code,{children:"Processing > Settings"}),". The default ",(0,t.jsx)(i.code,{children:"i3"})," series workers offer more disk space for larger disks, but the ",(0,t.jsx)(i.code,{children:"t3"})," series offers lower costs. If cost is a concern, consider using a ",(0,t.jsx)(i.code,{children:"t3.large"})," worker size."]})}),"\n",(0,t.jsx)(i.h3,{id:"processing-data",children:"Processing Data"}),"\n",(0,t.jsxs)(i.p,{children:["After deploying Cado Community Edition, you can import data from the S3 bucket created by the CloudFormation template. You can find the S3 bucket identifier under ",(0,t.jsx)(i.strong,{children:"CloudFormation > Stacks > [stack name] > Outputs > S3Bucket"}),". Please note that Cado Community Edition only supports .dd, dd.gz, and .zip files."]}),"\n",(0,t.jsx)(i.h3,{id:"analyzing-evidence",children:"Analyzing Evidence"}),"\n",(0,t.jsx)(i.p,{children:"Imported data is automatically processed, analyzed, and added to the platform. You will have access to automatic detections, a timeline of events, and more for investigation."}),"\n",(0,t.jsx)(i.hr,{}),"\n",(0,t.jsx)(i.h2,{id:"how-does-cado-community-edition-differ-from-the-full-cado-platform",children:"How Does Cado Community Edition Differ From the Full Cado Platform?"}),"\n",(0,t.jsx)(i.p,{children:"Cado Community Edition offers a subset of features compared to the enterprise version of the Cado platform. In addition to the Community Edition features, the enterprise version also includes:"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsx)(i.li,{children:"Automated capture and processing of cloud-based data across AWS, Azure, and Google Cloud Platform"}),"\n",(0,t.jsx)(i.li,{children:"Analysis of container-based, serverless, and infrastructure-as-code artifacts"}),"\n",(0,t.jsx)(i.li,{children:"Integration of threat feeds and YARA rules for automated analysis"}),"\n",(0,t.jsx)(i.li,{children:"API support for automated data capture and processing"}),"\n",(0,t.jsx)(i.li,{children:"Support for multiple concurrent users with role-based access control"}),"\n"]})]})}function u(e={}){const{wrapper:i}={...(0,o.R)(),...e.components};return i?(0,t.jsx)(i,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,i,n)=>{n.d(i,{R:()=>a,x:()=>r});var t=n(96540);const o={},s=t.createContext(o);function a(e){const i=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function r(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),t.createElement(s.Provider,{value:i},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[220],{99305:(e,i,n)=>{n.r(i),n.d(i,{assets:()=>d,contentTitle:()=>a,default:()=>u,frontMatter:()=>s,metadata:()=>r,toc:()=>l});var t=n(74848),o=n(28453);const s={sidebar_position:7,id:"community-intro",title:"Community edition"},a="What is Cado Community Edition?",r={id:"cado/community-intro",title:"Community edition",description:"The Cado platform leverages the cloud's scale, speed, and automation to accelerate investigations and incident response. Cado Community Edition is a free version of the Cado platform that allows you to analyze:",source:"@site/docs/cado/community.md",sourceDirName:"cado",slug:"/cado/community-intro",permalink:"/cado/community-intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/community.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:7,frontMatter:{sidebar_position:7,id:"community-intro",title:"Community edition"},sidebar:"tutorialSidebar",previous:{title:"AI Investigator",permalink:"/cado/investigate/ai investigator"},next:{title:"Manage users",permalink:"/cado/manage/users-authentication/users"}},d={},l=[{value:"Benefits",id:"benefits",level:3},{value:"Getting Started",id:"getting-started",level:2},{value:"Signing Up for Cado Community Edition",id:"signing-up-for-cado-community-edition",level:3},{value:"Deploying in Your Cloud Environment",id:"deploying-in-your-cloud-environment",level:3},{value:"Processing Data",id:"processing-data",level:3},{value:"Analyzing Evidence",id:"analyzing-evidence",level:3},{value:"How Does Cado Community Edition Differ From the Full Cado Platform?",id:"how-does-cado-community-edition-differ-from-the-full-cado-platform",level:2}];function c(e){const i={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",hr:"hr",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i.h1,{id:"what-is-cado-community-edition",children:"What is Cado Community Edition?"}),"\n",(0,t.jsxs)(i.p,{children:["The ",(0,t.jsx)(i.a,{href:"/cado/intro",children:"Cado platform"})," leverages the cloud's scale, speed, and automation to accelerate investigations and incident response. ",(0,t.jsx)(i.strong,{children:"Cado Community Edition"})," is a free version of the Cado platform that allows you to analyze:"]}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsx)(i.li,{children:"Disk images in DD format"}),"\n",(0,t.jsxs)(i.li,{children:["Exports of triaged items from open-source forensics tools such as ",(0,t.jsx)(i.a,{href:"https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape",children:"KAPE"})," and ",(0,t.jsx)(i.a,{href:"https://www.rapid7.com/products/velociraptor/",children:"Velociraptor"})]}),"\n",(0,t.jsx)(i.li,{children:"Sample data published by Cado to demonstrate different incident scenarios in server-based, container-based, and serverless systems in the cloud."}),"\n"]}),"\n",(0,t.jsx)(i.p,{children:"With Cado Community Edition, you can:"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsx)(i.li,{children:"Navigate files and folders"}),"\n",(0,t.jsx)(i.li,{children:"View a timeline of system activities"}),"\n",(0,t.jsx)(i.li,{children:"Analyze captured artifacts for threats and indicators of compromise"}),"\n",(0,t.jsx)(i.li,{children:"Easily pivot and search across artifacts"}),"\n"]}),"\n",(0,t.jsx)(i.h3,{id:"benefits",children:"Benefits"}),"\n",(0,t.jsx)(i.p,{children:"Cado Community Edition provides:"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsxs)(i.li,{children:[(0,t.jsx)(i.strong,{children:"Cloud Scale and Speed"}),": Adds the speed and scalability of cloud-native analysis to your existing data capture processes."]}),"\n",(0,t.jsxs)(i.li,{children:[(0,t.jsx)(i.strong,{children:"Automated Analysis"}),": Conducts automated system analysis using built-in detections from Cado Labs experts."]}),"\n",(0,t.jsxs)(i.li,{children:[(0,t.jsx)(i.strong,{children:"Easier Sharing"}),": Facilitates sharing of artifacts and findings using a cloud-based platform."]}),"\n"]}),"\n",(0,t.jsx)(i.hr,{}),"\n",(0,t.jsx)(i.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,t.jsx)(i.p,{children:"Interested in using Cado Community Edition? Here are key steps to get started:"}),"\n",(0,t.jsx)(i.h3,{id:"signing-up-for-cado-community-edition",children:"Signing Up for Cado Community Edition"}),"\n",(0,t.jsxs)(i.p,{children:["Visit the ",(0,t.jsx)(i.a,{href:"https://www.cadosecurity.com/cado-community-edition/#get-access",children:"Cado Community Edition website"})," to sign up. After signing up, a Cado representative will send you a license and a link to the CloudFormation template."]}),"\n",(0,t.jsx)(i.h3,{id:"deploying-in-your-cloud-environment",children:"Deploying in Your Cloud Environment"}),"\n",(0,t.jsx)(i.p,{children:"You can deploy Cado Community Edition in AWS using CloudFormation. Although many settings can be configured, the default values work well for most cases. You will need a key pair if you plan to access the system via SSH, although it\u2019s usually unnecessary for the Community Edition. We recommend using IP address restrictions to enhance security."}),"\n",(0,t.jsx)(i.admonition,{type:"caution",children:(0,t.jsxs)(i.p,{children:["Using Cado Community Edition will incur AWS charges. To minimize costs, shut down the main instance once processing is complete and you no longer need access. You can also adjust worker size in ",(0,t.jsx)(i.code,{children:"Processing > Settings"}),". The default ",(0,t.jsx)(i.code,{children:"i3"})," series workers offer more disk space for larger disks, but the ",(0,t.jsx)(i.code,{children:"t3"})," series offers lower costs. If cost is a concern, consider using a ",(0,t.jsx)(i.code,{children:"t3.large"})," worker size."]})}),"\n",(0,t.jsx)(i.h3,{id:"processing-data",children:"Processing Data"}),"\n",(0,t.jsxs)(i.p,{children:["After deploying Cado Community Edition, you can import data from the S3 bucket created by the CloudFormation template. You can find the S3 bucket identifier under ",(0,t.jsx)(i.strong,{children:"CloudFormation > Stacks > [stack name] > Outputs > S3Bucket"}),". Please note that Cado Community Edition only supports .dd, dd.gz, and .zip files."]}),"\n",(0,t.jsx)(i.h3,{id:"analyzing-evidence",children:"Analyzing Evidence"}),"\n",(0,t.jsx)(i.p,{children:"Imported data is automatically processed, analyzed, and added to the platform. You will have access to automatic detections, a timeline of events, and more for investigation."}),"\n",(0,t.jsx)(i.hr,{}),"\n",(0,t.jsx)(i.h2,{id:"how-does-cado-community-edition-differ-from-the-full-cado-platform",children:"How Does Cado Community Edition Differ From the Full Cado Platform?"}),"\n",(0,t.jsx)(i.p,{children:"Cado Community Edition offers a subset of features compared to the enterprise version of the Cado platform. In addition to the Community Edition features, the enterprise version also includes:"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsx)(i.li,{children:"Automated capture and processing of cloud-based data across AWS, Azure, and Google Cloud Platform"}),"\n",(0,t.jsx)(i.li,{children:"Analysis of container-based, serverless, and infrastructure-as-code artifacts"}),"\n",(0,t.jsx)(i.li,{children:"Integration of threat feeds and YARA rules for automated analysis"}),"\n",(0,t.jsx)(i.li,{children:"API support for automated data capture and processing"}),"\n",(0,t.jsx)(i.li,{children:"Support for multiple concurrent users with role-based access control"}),"\n"]})]})}function u(e={}){const{wrapper:i}={...(0,o.R)(),...e.components};return i?(0,t.jsx)(i,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,i,n)=>{n.d(i,{R:()=>a,x:()=>r});var t=n(96540);const o={},s=t.createContext(o);function a(e){const i=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function r(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),t.createElement(s.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f7de62ec.c06cb2d5.js b/assets/js/f7de62ec.1dc201c6.js similarity index 96% rename from assets/js/f7de62ec.c06cb2d5.js rename to assets/js/f7de62ec.1dc201c6.js index 95bca4624..e0df57b5e 100644 --- a/assets/js/f7de62ec.c06cb2d5.js +++ b/assets/js/f7de62ec.1dc201c6.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7519],{46439:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>l,default:()=>h,frontMatter:()=>i,metadata:()=>r,toc:()=>a});var t=n(74848),s=n(28453);const i={title:"How to send logs to Cado",hide_title:!0,sidebar_position:2},l="How to Send Logs to Cado",r={id:"troubleshooting/send-logs",title:"How to send logs to Cado",description:"There are several methods for sending logs to Cado, listed in order of ease:",source:"@site/docs/troubleshooting/send-logs.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/send-logs",permalink:"/troubleshooting/send-logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/send-logs.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:2,frontMatter:{title:"How to send logs to Cado",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"How to get support",permalink:"/troubleshooting/get-support"},next:{title:"Forward logs to SIEMs",permalink:"/troubleshooting/logs-cloudwatch"}},d={},a=[{value:"Downloading Logs for a single processing pipeline",id:"downloading-logs-for-a-single-processing-pipeline",level:2},{value:"Data Privacy",id:"data-privacy",level:2}];function c(e){const o={code:"code",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-send-logs-to-cado",children:"How to Send Logs to Cado"}),"\n",(0,t.jsx)(o.p,{children:"There are several methods for sending logs to Cado, listed in order of ease:"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Automatically through the UI"}),": Navigate to the Help screen in the Cado platform and click on ",(0,t.jsx)(o.code,{children:"Send Logs to Cado"}),". This will automatically package the logs and send them securely to Cado over HTTPS."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Download and upload manually"}),": If automatic sending fails, click on ",(0,t.jsx)(o.code,{children:"Download Logs"})," in the UI. Then, upload the downloaded zip file to the Customer Portal."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Via SSH"}),": If you cannot access the platform via the UI, open an SSH session to the Cado platform using the key from deployment. Run the following command:"]}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"sudo tar -cvzf /var/log/cado_logs.tar.gz /var/log\n"})}),"\n",(0,t.jsx)(o.p,{children:"Then, upload the generated zip file to the Customer Portal."}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.h2,{id:"downloading-logs-for-a-single-processing-pipeline",children:"Downloading Logs for a single processing pipeline"}),"\n",(0,t.jsx)(o.p,{children:'Logs for an individual pipeline can be downloaded by selecting "Platform" on the left menu, then clicking "Download pipeline" on the pipeline you are interested in. This will download a zip file containing the logs just for that pipeline.'}),"\n",(0,t.jsx)(o.h2,{id:"data-privacy",children:"Data Privacy"}),"\n",(0,t.jsx)(o.p,{children:"Secure settings in logs are redacted before sending to Cado."}),"\n",(0,t.jsx)(o.p,{children:"For example, the following log line:"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"Got setting CLOUD_CRED_AWS_Default Acquisition: *****\n"})})]})}function h(e={}){const{wrapper:o}={...(0,s.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>l,x:()=>r});var t=n(96540);const s={},i=t.createContext(s);function l(e){const o=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:l(e.components),t.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7519],{46439:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>l,default:()=>h,frontMatter:()=>i,metadata:()=>r,toc:()=>a});var t=n(74848),s=n(28453);const i={title:"How to send logs to Cado",hide_title:!0,sidebar_position:2},l="How to Send Logs to Cado",r={id:"troubleshooting/send-logs",title:"How to send logs to Cado",description:"There are several methods for sending logs to Cado, listed in order of ease:",source:"@site/docs/troubleshooting/send-logs.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/send-logs",permalink:"/troubleshooting/send-logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/send-logs.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:2,frontMatter:{title:"How to send logs to Cado",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"How to get support",permalink:"/troubleshooting/get-support"},next:{title:"Forward logs to SIEMs",permalink:"/troubleshooting/logs-cloudwatch"}},d={},a=[{value:"Downloading Logs for a single processing pipeline",id:"downloading-logs-for-a-single-processing-pipeline",level:2},{value:"Data Privacy",id:"data-privacy",level:2}];function c(e){const o={code:"code",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"how-to-send-logs-to-cado",children:"How to Send Logs to Cado"}),"\n",(0,t.jsx)(o.p,{children:"There are several methods for sending logs to Cado, listed in order of ease:"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Automatically through the UI"}),": Navigate to the Help screen in the Cado platform and click on ",(0,t.jsx)(o.code,{children:"Send Logs to Cado"}),". This will automatically package the logs and send them securely to Cado over HTTPS."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Download and upload manually"}),": If automatic sending fails, click on ",(0,t.jsx)(o.code,{children:"Download Logs"})," in the UI. Then, upload the downloaded zip file to the Customer Portal."]}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:[(0,t.jsx)(o.strong,{children:"Via SSH"}),": If you cannot access the platform via the UI, open an SSH session to the Cado platform using the key from deployment. Run the following command:"]}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"sudo tar -cvzf /var/log/cado_logs.tar.gz /var/log\n"})}),"\n",(0,t.jsx)(o.p,{children:"Then, upload the generated zip file to the Customer Portal."}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.h2,{id:"downloading-logs-for-a-single-processing-pipeline",children:"Downloading Logs for a single processing pipeline"}),"\n",(0,t.jsx)(o.p,{children:'Logs for an individual pipeline can be downloaded by selecting "Platform" on the left menu, then clicking "Download pipeline" on the pipeline you are interested in. This will download a zip file containing the logs just for that pipeline.'}),"\n",(0,t.jsx)(o.h2,{id:"data-privacy",children:"Data Privacy"}),"\n",(0,t.jsx)(o.p,{children:"Secure settings in logs are redacted before sending to Cado."}),"\n",(0,t.jsx)(o.p,{children:"For example, the following log line:"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"Got setting CLOUD_CRED_AWS_Default Acquisition: *****\n"})})]})}function h(e={}){const{wrapper:o}={...(0,s.R)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},28453:(e,o,n)=>{n.d(o,{R:()=>l,x:()=>r});var t=n(96540);const s={},i=t.createContext(s);function l(e){const o=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:l(e.components),t.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f86d89c8.608f52c1.js b/assets/js/f86d89c8.608f52c1.js new file mode 100644 index 000000000..21053aabc --- /dev/null +++ b/assets/js/f86d89c8.608f52c1.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8335],{65938:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var n=i(74848),o=i(28453);const r={title:"Automating collection from detections",hide_title:!0,sidebar_position:3},s="How to automate data collection from detections",a={id:"cado/discovery-import/automation",title:"Automating collection from detections",description:"The Detections area of the platform (/detections/integrations) helps streamline your Security Operations Center (SOC) by enabling end-to-end workflow automation for investigations. You can easily connect various alert sources, automatically collect and process critical data, and integrate results into tools like SIEMs, task managers, and other productivity systems.",source:"@site/docs/cado/discovery-import/automation.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/automation",permalink:"/cado/discovery-import/automation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/automation.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:3,frontMatter:{title:"Automating collection from detections",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Import from cloud",permalink:"/cado/discovery-import/import-from-cloud"},next:{title:"EC2 and EBS",permalink:"/cado/discovery-import/aws/aws-ec2"}},c={},l=[{value:"Collecting Data After CrowdStrike and Defender Alerts",id:"collecting-data-after-crowdstrike-and-defender-alerts",level:2},{value:"Collecting Data After Alerts from Other XDR Platforms",id:"collecting-data-after-alerts-from-other-xdr-platforms",level:2},{value:"SentinelOne",id:"sentinelone",level:3},{value:"Collecting Data After AWS GuardDuty Alerts",id:"collecting-data-after-aws-guardduty-alerts",level:2},{value:"Collecting Data After Wiz Alerts",id:"collecting-data-after-wiz-alerts",level:2},{value:"Managing Detection Rules",id:"managing-detection-rules",level:2},{value:"How to perform a manual Acquisition",id:"how-to-perform-a-manual-acquisition",level:2}];function d(e){const t={a:"a",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,o.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-automate-data-collection-from-detections",children:"How to automate data collection from detections"}),"\n",(0,n.jsxs)(t.p,{children:["The ",(0,n.jsx)(t.strong,{children:"Detections"})," area of the platform (/detections/integrations) helps streamline your Security Operations Center (SOC) by enabling end-to-end workflow automation for investigations. You can easily connect various alert sources, automatically collect and process critical data, and integrate results into tools like SIEMs, task managers, and other productivity systems."]}),"\n",(0,n.jsx)(t.h2,{id:"collecting-data-after-crowdstrike-and-defender-alerts",children:"Collecting Data After CrowdStrike and Defender Alerts"}),"\n",(0,n.jsx)(t.p,{children:"To get started, watch the video below that demonstrates how to ingest alerts from Microsoft Defender. The same process applies to CrowdStrike. Here's a summary of the steps:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Create an XDR Connection"}),(0,n.jsx)(t.br,{}),"\n","Go to \u2018Settings\u2019 > \u2018Integrations\u2019 > \u2018XDR\u2019 (/settings/integrations/xdr). For details on required API permissions, see the ",(0,n.jsx)(t.a,{href:"/cado/integrations/xdr/crowdstrike",children:"CrowdStrike Integration Guide"})," and the ",(0,n.jsx)(t.a,{href:"/cado/integrations/xdr/defender",children:"Defender Integration Guide"}),"."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Set Up a Detection Rule"}),(0,n.jsx)(t.br,{}),"\n","In the ",(0,n.jsx)(t.strong,{children:"Detections"})," area, select one of the supported threat detection sources (/detections/integrations) to create a detection rule."]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)("video",{src:"/img/detections-set-up.mp4",controls:!0,width:"90%"}),"\n",(0,n.jsx)(t.h2,{id:"collecting-data-after-alerts-from-other-xdr-platforms",children:"Collecting Data After Alerts from Other XDR Platforms"}),"\n",(0,n.jsxs)(t.p,{children:["You can trigger an import from the Cado platform by creating a webhook from your XDR platform, then using the ",(0,n.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Cado API"})," to initiate the import via a SOAR platform or your own API integration."]}),"\n",(0,n.jsx)(t.h3,{id:"sentinelone",children:"SentinelOne"}),"\n",(0,n.jsx)(t.p,{children:"To create a webhook:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["Visit the SentinelOne ",(0,n.jsx)(t.a,{href:"https://www.sentinelone.com/partners/singularity-marketplace/",children:"Singularity Marketplace"}),"."]}),"\n",(0,n.jsx)(t.li,{children:'Search for "Webhook" to create and configure the webhook.'}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"collecting-data-after-aws-guardduty-alerts",children:"Collecting Data After AWS GuardDuty Alerts"}),"\n",(0,n.jsxs)(t.p,{children:["In the ",(0,n.jsx)(t.strong,{children:"Detections"})," area (/detections/integrations), select ",(0,n.jsx)(t.strong,{children:"GuardDuty"})," as the source to create a detection rule. The configuration process is similar to XDR platforms, with a few differences:"]}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["On ",(0,n.jsx)(t.strong,{children:"Page 2"})," of the wizard, select the appropriate AWS Accounts instead of an XDR connection."]}),"\n",(0,n.jsxs)(t.li,{children:["On ",(0,n.jsx)(t.strong,{children:"Page 3"}),", specify response actions if a malicious or suspicious activity is detected by Cado. Under 'Acquisition Type' you can also configure Cado to perform a full acquisition which will acquire the full EBS volume. This is in addition to performing a triage collecion. Note that the full EBS volume will not be processed - processing can be triggered manually in the 'Evidence' tab within the appropriate investigation."]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Currently, Cado supports the following response actions for EC2 instances:"}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Action"}),(0,n.jsx)(t.th,{children:"Description"}),(0,n.jsx)(t.th,{children:"Required Permissions"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Stop Instance"}),(0,n.jsx)(t.td,{children:"Stops an EC2 instance using the AWS API"}),(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"ec2:StopInstances"})})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Isolate Role"}),(0,n.jsx)(t.td,{children:'Adds a "deny all" inline policy to isolate the IAM role attached to the EC2 instance'}),(0,n.jsxs)(t.td,{children:[(0,n.jsx)(t.code,{children:"iam:GetInstanceProfile"}),", ",(0,n.jsx)(t.code,{children:"iam:PutRolePolicy"})]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"Isolate Security Group"}),(0,n.jsx)(t.td,{children:"Replaces the security group of an EC2 instance with a blank one"}),(0,n.jsxs)(t.td,{children:[(0,n.jsx)(t.code,{children:"ec2:CreateSecurityGroup"}),", ",(0,n.jsx)(t.code,{children:"ec2:RevokeSecurityGroupEgress"}),", ",(0,n.jsx)(t.code,{children:"ec2:ModifyInstanceAttribute"})]})]})]})]}),"\n",(0,n.jsx)(t.p,{children:"Ensure the appropriate IAM permissions are added to your Cado role and that the role has access to the resources on which you want to invoke actions."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Full Acquisition",src:i(53128).A+"",width:"2268",height:"1500"})}),"\n",(0,n.jsx)(t.h2,{id:"collecting-data-after-wiz-alerts",children:"Collecting Data After Wiz Alerts"}),"\n",(0,n.jsxs)(t.p,{children:["For instructions on automatically processing systems detected by Wiz, refer to the ",(0,n.jsx)(t.a,{href:"/cado/integrations/cnapp/wiz",children:"Wiz Forensics Integration Guide"}),"."]}),"\n",(0,n.jsx)(t.h2,{id:"managing-detection-rules",children:"Managing Detection Rules"}),"\n",(0,n.jsxs)(t.p,{children:["You can manage detection rules in the ",(0,n.jsx)(t.strong,{children:"Rules"})," area (/detections/rules). This interface allows you to easily create, enable/disable, edit, and delete rules as needed."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Manage Rules",src:i(61003).A+"",width:"3574",height:"809"})}),"\n",(0,n.jsx)(t.h2,{id:"how-to-perform-a-manual-acquisition",children:"How to perform a manual Acquisition"}),"\n",(0,n.jsx)(t.p,{children:"If an acquisition fails or you wish to retry importing a capture, you can easily initiate one manually."}),"\n",(0,n.jsx)(t.p,{children:"For GuardDuty, you have the option to perform either a triage acquisition or a full acquisition. With other providers, you can execute a manual triage acquisition."}),"\n",(0,n.jsxs)(t.p,{children:["Go to ",(0,n.jsx)(t.strong,{children:"Detections"})," > ",(0,n.jsx)(t.strong,{children:"Alert tab"}),", select the ",(0,n.jsx)(t.strong,{children:"Alert"}),", and click ",(0,n.jsx)(t.strong,{children:"Actions"})," > ",(0,n.jsx)(t.strong,{children:"Triage"})," or ",(0,n.jsx)(t.strong,{children:"Full Acquisition"})," to begin the process."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Retry Logic",src:i(79370).A+"",width:"3348",height:"824"})})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},61003:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/detections-rules-760a9711548b55c15038bff71b46791f.png"},53128:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/guardduty-full-acquisition-79fa134fbefe3af0d7032d4b17422839.png"},79370:(e,t,i)=>{i.d(t,{A:()=>n});const n=i.p+"assets/images/retry-logic-5e5aec019c8046515d2e5d06308ba687.png"},28453:(e,t,i)=>{i.d(t,{R:()=>s,x:()=>a});var n=i(96540);const o={},r=n.createContext(o);function s(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f86d89c8.aab0c271.js b/assets/js/f86d89c8.aab0c271.js deleted file mode 100644 index 03eeea644..000000000 --- a/assets/js/f86d89c8.aab0c271.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8335],{65938:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var i=n(74848),o=n(28453);const r={title:"Automating collection from detections",hide_title:!0,sidebar_position:3},s="How to automate data collection from detections",a={id:"cado/discovery-import/automation",title:"Automating collection from detections",description:"The Detections area of the platform (/detections/integrations) helps streamline your Security Operations Center (SOC) by enabling end-to-end workflow automation for investigations. You can easily connect various alert sources, automatically collect and process critical data, and integrate results into tools like SIEMs, task managers, and other productivity systems.",source:"@site/docs/cado/discovery-import/automation.md",sourceDirName:"cado/discovery-import",slug:"/cado/discovery-import/automation",permalink:"/cado/discovery-import/automation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/automation.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:3,frontMatter:{title:"Automating collection from detections",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Import from cloud",permalink:"/cado/discovery-import/import-from-cloud"},next:{title:"EC2 and EBS",permalink:"/cado/discovery-import/aws/aws-ec2"}},c={},l=[{value:"Collecting Data After CrowdStrike and Defender Alerts",id:"collecting-data-after-crowdstrike-and-defender-alerts",level:2},{value:"Collecting Data After Alerts from Other XDR Platforms",id:"collecting-data-after-alerts-from-other-xdr-platforms",level:2},{value:"SentinelOne",id:"sentinelone",level:3},{value:"Collecting Data After AWS GuardDuty Alerts",id:"collecting-data-after-aws-guardduty-alerts",level:2},{value:"Collecting Data After Wiz Alerts",id:"collecting-data-after-wiz-alerts",level:2},{value:"Managing Detection Rules",id:"managing-detection-rules",level:2},{value:"How to perform a manual Acquisition",id:"how-to-perform-a-manual-acquisition",level:2}];function d(e){const t={a:"a",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"how-to-automate-data-collection-from-detections",children:"How to automate data collection from detections"}),"\n",(0,i.jsxs)(t.p,{children:["The ",(0,i.jsx)(t.strong,{children:"Detections"})," area of the platform (/detections/integrations) helps streamline your Security Operations Center (SOC) by enabling end-to-end workflow automation for investigations. You can easily connect various alert sources, automatically collect and process critical data, and integrate results into tools like SIEMs, task managers, and other productivity systems."]}),"\n",(0,i.jsx)(t.h2,{id:"collecting-data-after-crowdstrike-and-defender-alerts",children:"Collecting Data After CrowdStrike and Defender Alerts"}),"\n",(0,i.jsx)(t.p,{children:"To get started, watch the video below that demonstrates how to ingest alerts from Microsoft Defender. The same process applies to CrowdStrike. Here's a summary of the steps:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"Create an XDR Connection"}),(0,i.jsx)(t.br,{}),"\n","Go to \u2018Settings\u2019 > \u2018Integrations\u2019 > \u2018XDR\u2019 (/settings/integrations/xdr). For details on required API permissions, see the ",(0,i.jsx)(t.a,{href:"/cado/integrations/xdr/crowdstrike",children:"CrowdStrike Integration Guide"})," and the ",(0,i.jsx)(t.a,{href:"/cado/integrations/xdr/defender",children:"Defender Integration Guide"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"Set Up a Detection Rule"}),(0,i.jsx)(t.br,{}),"\n","In the ",(0,i.jsx)(t.strong,{children:"Detections"})," area, select one of the supported threat detection sources (/detections/integrations) to create a detection rule."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)("video",{src:"/img/detections-set-up.mp4",controls:!0,width:"90%"}),"\n",(0,i.jsx)(t.h2,{id:"collecting-data-after-alerts-from-other-xdr-platforms",children:"Collecting Data After Alerts from Other XDR Platforms"}),"\n",(0,i.jsxs)(t.p,{children:["You can trigger an import from the Cado platform by creating a webhook from your XDR platform, then using the ",(0,i.jsx)(t.a,{href:"/cado/integrations/api-overview",children:"Cado API"})," to initiate the import via a SOAR platform or your own API integration."]}),"\n",(0,i.jsx)(t.h3,{id:"sentinelone",children:"SentinelOne"}),"\n",(0,i.jsx)(t.p,{children:"To create a webhook:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Visit the SentinelOne ",(0,i.jsx)(t.a,{href:"https://www.sentinelone.com/partners/singularity-marketplace/",children:"Singularity Marketplace"}),"."]}),"\n",(0,i.jsx)(t.li,{children:'Search for "Webhook" to create and configure the webhook.'}),"\n"]}),"\n",(0,i.jsx)(t.h2,{id:"collecting-data-after-aws-guardduty-alerts",children:"Collecting Data After AWS GuardDuty Alerts"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"Create an Environment"}),(0,i.jsx)(t.br,{}),"\n","Navigate to ",(0,i.jsx)(t.strong,{children:"Environments"})," (/environments) and click the ",(0,i.jsx)(t.strong,{children:"Create Environment"})," button. Name the environment and define the scopes by selecting ",(0,i.jsx)(t.strong,{children:"Add Group"}),". For example, you can create a scope that covers all EC2 instances across all accounts, with optional filtering by region or tag."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Create Environments",src:n(82738).A+"",width:"2614",height:"1934"})}),"\n",(0,i.jsxs)(t.p,{children:["Click ",(0,i.jsx)(t.strong,{children:"Save"})," to create the environment."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"Set Up a Detection Rule for GuardDuty"}),(0,i.jsx)(t.br,{}),"\n","In the ",(0,i.jsx)(t.strong,{children:"Detections"})," area (/detections/integrations), select ",(0,i.jsx)(t.strong,{children:"GuardDuty"})," as the source to create a detection rule. The configuration process is similar to XDR platforms, with a few differences:"]}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["On ",(0,i.jsx)(t.strong,{children:"Page 2"})," of the wizard, select the ",(0,i.jsx)(t.strong,{children:"Environment"})," instead of an XDR connection."]}),"\n",(0,i.jsxs)(t.li,{children:["On ",(0,i.jsx)(t.strong,{children:"Page 3"}),", specify response actions if a malicious or suspicious activity is detected by Cado. Under 'Acquisition Type' you can also configure Cado to perform a full acquisition which will acquire the full EBS volume. This is in addition to performing a triage collecion. Note that the full EBS volume will not be processed - processing can be triggered manually in the 'Evidence' tab within the appropriate investigation."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Currently, Cado supports the following response actions for EC2 instances:"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Action"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Required Permissions"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Stop Instance"}),(0,i.jsx)(t.td,{children:"Stops an EC2 instance using the AWS API"}),(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"ec2:StopInstances"})})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Role"}),(0,i.jsx)(t.td,{children:'Adds a "deny all" inline policy to isolate the IAM role attached to the EC2 instance'}),(0,i.jsxs)(t.td,{children:[(0,i.jsx)(t.code,{children:"iam:GetInstanceProfile"}),", ",(0,i.jsx)(t.code,{children:"iam:PutRolePolicy"})]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Security Group"}),(0,i.jsx)(t.td,{children:"Replaces the security group of an EC2 instance with a blank one"}),(0,i.jsxs)(t.td,{children:[(0,i.jsx)(t.code,{children:"ec2:CreateSecurityGroup"}),", ",(0,i.jsx)(t.code,{children:"ec2:RevokeSecurityGroupEgress"}),", ",(0,i.jsx)(t.code,{children:"ec2:ModifyInstanceAttribute"})]})]})]})]}),"\n",(0,i.jsx)(t.p,{children:"Ensure the appropriate IAM permissions are added to your Cado role and that the role has access to the resources on which you want to invoke actions."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Full Acquisition",src:n(53128).A+"",width:"2268",height:"1500"})}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.h2,{id:"collecting-data-after-wiz-alerts",children:"Collecting Data After Wiz Alerts"}),"\n",(0,i.jsxs)(t.p,{children:["For instructions on automatically processing systems detected by Wiz, refer to the ",(0,i.jsx)(t.a,{href:"/cado/integrations/cnapp/wiz",children:"Wiz Forensics Integration Guide"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"managing-detection-rules",children:"Managing Detection Rules"}),"\n",(0,i.jsxs)(t.p,{children:["You can manage detection rules in the ",(0,i.jsx)(t.strong,{children:"Rules"})," area (/detections/rules). This interface allows you to easily create, enable/disable, edit, and delete rules as needed."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Manage Rules",src:n(61003).A+"",width:"3574",height:"809"})}),"\n",(0,i.jsx)(t.h2,{id:"how-to-perform-a-manual-acquisition",children:"How to perform a manual Acquisition"}),"\n",(0,i.jsx)(t.p,{children:"If an acquisition fails or you wish to retry importing a capture, you can easily initiate one manually."}),"\n",(0,i.jsx)(t.p,{children:"For GuardDuty, you have the option to perform either a triage acquisition or a full acquisition. With other providers, you can execute a manual triage acquisition."}),"\n",(0,i.jsxs)(t.p,{children:["Go to ",(0,i.jsx)(t.strong,{children:"Detections"})," > ",(0,i.jsx)(t.strong,{children:"Alert tab"}),", select the ",(0,i.jsx)(t.strong,{children:"Alert"}),", and click ",(0,i.jsx)(t.strong,{children:"Actions"})," > ",(0,i.jsx)(t.strong,{children:"Triage"})," or ",(0,i.jsx)(t.strong,{children:"Full Acquisition"})," to begin the process."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Retry Logic",src:n(79370).A+"",width:"3348",height:"824"})})]})}function h(e={}){const{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},61003:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/detections-rules-760a9711548b55c15038bff71b46791f.png"},82738:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/environments-create-441942bdd5871532daf772ba48b11583.png"},53128:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/guardduty-full-acquisition-79fa134fbefe3af0d7032d4b17422839.png"},79370:(e,t,n)=>{n.d(t,{A:()=>i});const i=n.p+"assets/images/retry-logic-5e5aec019c8046515d2e5d06308ba687.png"},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>a});var i=n(96540);const o={},r=i.createContext(o);function s(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/fc7542e4.aefbd24e.js b/assets/js/fc7542e4.82b369c8.js similarity index 96% rename from assets/js/fc7542e4.aefbd24e.js rename to assets/js/fc7542e4.82b369c8.js index 2584c286a..f57a3bdf8 100644 --- a/assets/js/fc7542e4.aefbd24e.js +++ b/assets/js/fc7542e4.82b369c8.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2299],{72526:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>l,frontMatter:()=>s,metadata:()=>c,toc:()=>d});var n=o(74848),i=o(28453);const s={title:"Google Compute Engine",hide_title:!0,sidebar_position:1},r="How to Import a Google Compute Engine Instance",c={id:"cado/discovery-import/gcp/engine-instance",title:"Google Compute Engine",description:"The Cado platform supports the acquisition of Google Cloud Platform (GCP) Compute Engine instances. Follow these steps to import a GCP Compute instance into Cado:",source:"@site/docs/cado/discovery-import/gcp/engine-instance.md",sourceDirName:"cado/discovery-import/gcp",slug:"/cado/discovery-import/gcp/engine-instance",permalink:"/cado/discovery-import/gcp/engine-instance",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/gcp/engine-instance.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:1,frontMatter:{title:"Google Compute Engine",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Azure Kubernetes Service",permalink:"/cado/discovery-import/azure/azure-aks"},next:{title:"Google Cloud Storage",permalink:"/cado/discovery-import/gcp/storage"}},a={},d=[];function p(e){const t={admonition:"admonition",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-import-a-google-compute-engine-instance",children:"How to Import a Google Compute Engine Instance"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform supports the acquisition of Google Cloud Platform (GCP) Compute Engine instances. Follow these steps to import a GCP Compute instance into Cado:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Select the GCP Project and Bucket"}),": Choose the GCP project and the storage bucket where the disk image will be uploaded before importing it into Cado."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Select the Compute Instance"}),": Choose the specific GCP Compute instance that you need to import."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Review the Details"}),": Verify the details of the instance and click ",(0,n.jsx)(t.strong,{children:"Start Import"})," to begin the acquisition process."]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.admonition,{type:"info",children:(0,n.jsxs)(t.p,{children:["For this feature to work, the GCP project must have the ",(0,n.jsx)(t.strong,{children:"default VPC"})," enabled. GCP Cloud Build requires workers that use the default VPC to help export the acquired disk."]})}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"GCP Compute Import",src:o(37071).A+"",width:"1817",height:"697"})}),"\n",(0,n.jsx)(t.h1,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Compute engine",src:o(6210).A+"",width:"960",height:"540"})})]})}function l(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},6210:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/compute_engine_gcp-a689aba908c405c8419dccb8760a0bfc.png"},37071:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gcp-compute-12976728eda89dfe1698796b854663ea.png"},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>c});var n=o(96540);const i={},s=n.createContext(i);function r(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2299],{72526:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>l,frontMatter:()=>s,metadata:()=>c,toc:()=>d});var n=o(74848),i=o(28453);const s={title:"Google Compute Engine",hide_title:!0,sidebar_position:1},r="How to Import a Google Compute Engine Instance",c={id:"cado/discovery-import/gcp/engine-instance",title:"Google Compute Engine",description:"The Cado platform supports the acquisition of Google Cloud Platform (GCP) Compute Engine instances. Follow these steps to import a GCP Compute instance into Cado:",source:"@site/docs/cado/discovery-import/gcp/engine-instance.md",sourceDirName:"cado/discovery-import/gcp",slug:"/cado/discovery-import/gcp/engine-instance",permalink:"/cado/discovery-import/gcp/engine-instance",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/discovery-import/gcp/engine-instance.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:1,frontMatter:{title:"Google Compute Engine",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Azure Kubernetes Service",permalink:"/cado/discovery-import/azure/azure-aks"},next:{title:"Google Cloud Storage",permalink:"/cado/discovery-import/gcp/storage"}},a={},d=[];function p(e){const t={admonition:"admonition",h1:"h1",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"how-to-import-a-google-compute-engine-instance",children:"How to Import a Google Compute Engine Instance"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform supports the acquisition of Google Cloud Platform (GCP) Compute Engine instances. Follow these steps to import a GCP Compute instance into Cado:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Select the GCP Project and Bucket"}),": Choose the GCP project and the storage bucket where the disk image will be uploaded before importing it into Cado."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Select the Compute Instance"}),": Choose the specific GCP Compute instance that you need to import."]}),"\n"]}),"\n",(0,n.jsxs)(t.li,{children:["\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Review the Details"}),": Verify the details of the instance and click ",(0,n.jsx)(t.strong,{children:"Start Import"})," to begin the acquisition process."]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.admonition,{type:"info",children:(0,n.jsxs)(t.p,{children:["For this feature to work, the GCP project must have the ",(0,n.jsx)(t.strong,{children:"default VPC"})," enabled. GCP Cloud Build requires workers that use the default VPC to help export the acquired disk."]})}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"GCP Compute Import",src:o(37071).A+"",width:"1817",height:"697"})}),"\n",(0,n.jsx)(t.h1,{id:"data-flow-diagram",children:"Data Flow Diagram"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Compute engine",src:o(6210).A+"",width:"960",height:"540"})})]})}function l(e={}){const{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},6210:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/compute_engine_gcp-a689aba908c405c8419dccb8760a0bfc.png"},37071:(e,t,o)=>{o.d(t,{A:()=>n});const n=o.p+"assets/images/gcp-compute-12976728eda89dfe1698796b854663ea.png"},28453:(e,t,o)=>{o.d(t,{R:()=>r,x:()=>c});var n=o(96540);const i={},s=n.createContext(i);function r(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/fe7d0334.9bb05236.js b/assets/js/fe7d0334.5447ecd8.js similarity index 98% rename from assets/js/fe7d0334.9bb05236.js rename to assets/js/fe7d0334.5447ecd8.js index 887d2f394..67b7f8002 100644 --- a/assets/js/fe7d0334.9bb05236.js +++ b/assets/js/fe7d0334.5447ecd8.js @@ -1 +1 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1807],{20192:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>c,metadata:()=>i,toc:()=>d});var t=s(74848),o=s(28453);const c={title:"Adding AWS accounts to Azure/AWS/GCP via Keys",hide_title:!0,sidebar_position:6},r="Adding AWS accounts to Azure, AWS, or GCP via Keys",i={id:"cado/deploy/cross/adding-aws",title:"Adding AWS accounts to Azure/AWS/GCP via Keys",description:"To enable cross-cloud access for AWS accounts, you need to set up an IAM role in each AWS account from which you want Cado to collect data. Follow the steps below to add AWS accounts. Ensure you have the required permissions to create IAM roles.",source:"@site/docs/cado/deploy/cross/adding-aws.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/adding-aws",permalink:"/cado/deploy/cross/adding-aws",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/adding-aws.md",tags:[],version:"current",lastUpdatedAt:1737474289,formattedLastUpdatedAt:"Jan 21, 2025",sidebarPosition:6,frontMatter:{title:"Adding AWS accounts to Azure/AWS/GCP via Keys",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Add cross-account roles in AWS to Cado with the API",permalink:"/cado/deploy/cross/cross-account-creation-api"},next:{title:"Access an AWS account with keys",permalink:"/cado/deploy/cross/adding-keys"}},a={},d=[{value:"Steps to Add an AWS Account",id:"steps-to-add-an-aws-account",level:3},{value:"Adding AWS Accounts to Cado from Azure or GCP Deployments",id:"adding-aws-accounts-to-cado-from-azure-or-gcp-deployments",level:2},{value:"Importing AWS EC2 Data",id:"importing-aws-ec2-data",level:3}];function l(e){const n={a:"a",br:"br",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"adding-aws-accounts-to-azure-aws-or-gcp-via-keys",children:"Adding AWS accounts to Azure, AWS, or GCP via Keys"}),"\n",(0,t.jsx)(n.p,{children:"To enable cross-cloud access for AWS accounts, you need to set up an IAM role in each AWS account from which you want Cado to collect data. Follow the steps below to add AWS accounts. Ensure you have the required permissions to create IAM roles."}),"\n",(0,t.jsx)(n.h3,{id:"steps-to-add-an-aws-account",children:"Steps to Add an AWS Account"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Log in to the Target AWS Account"}),(0,t.jsx)(n.br,{}),"\n","Start by logging into the AWS account where you want to grant access."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Create an IAM Group"}),(0,t.jsx)(n.br,{}),"\n","Follow ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_create.html",children:"these AWS instructions"})," to create an IAM group in the target account."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.strong,{children:"Create an IAM Role"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Create a new IAM role."}),"\n",(0,t.jsxs)(n.li,{children:["Attach a policy with the necessary permissions. You can find the policy ",(0,t.jsx)(n.a,{href:"https://github.com/cado-security/Deployment-Templates/blob/main/cross-account/CrossAccountPolicy.yaml",children:"here"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["For step-by-step instructions on creating roles and policies, refer to AWS documentation on ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html",children:"creating policies"})," and ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html",children:"creating roles"}),"."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Add the IAM User to the Group"}),(0,t.jsx)(n.br,{}),"\n","Once the IAM role is created, add your IAM user to the newly created group by following ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html",children:"this guide"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Generate Access Keys"}),(0,t.jsx)(n.br,{}),"\n","Generate access keys for the IAM user. These keys are needed to access the AWS account. Follow the ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html",children:"AWS instructions"})," to create and securely store the access keys."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.strong,{children:"Add the IAM Role to Cado"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["In the Cado platform, go to ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Accounts"})," and click ",(0,t.jsx)(n.strong,{children:"Create an account"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,t.jsxs)(n.li,{children:["Select the ",(0,t.jsx)(n.strong,{children:"AWS Keys"})," option, then provide a name for the role."]}),"\n",(0,t.jsx)(n.li,{children:"Enter the access key and secret key you generated earlier."}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Verify Access in Cado"}),(0,t.jsx)(n.br,{}),"\n","To verify that Cado can access the AWS account:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Open an investigation in Cado."}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"Import"})," > ",(0,t.jsx)(n.strong,{children:"Cloud"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Choose the AWS role you created."}),"\n",(0,t.jsx)(n.li,{children:"Confirm that resources from the target AWS account are visible."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"adding-aws-accounts-to-cado-from-azure-or-gcp-deployments",children:"Adding AWS Accounts to Cado from Azure or GCP Deployments"}),"\n",(0,t.jsx)(n.p,{children:"You can import AWS accounts into Cado from deployments on Azure or GCP. To do this:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["In the Cado platform, go to ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Accounts"})," and click ",(0,t.jsx)(n.strong,{children:"Create an account"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,t.jsxs)(n.li,{children:["The ",(0,t.jsx)(n.strong,{children:"AWS Role"})," option should already be selected."]}),"\n",(0,t.jsxs)(n.li,{children:["Provide an ",(0,t.jsx)(n.strong,{children:"Account Name"})," and enter the ",(0,t.jsx)(n.strong,{children:"Role ARN"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'."}),"\n",(0,t.jsx)(n.li,{children:"Navigate to the 'Accounts' table and the newly created AWS account should present. If configured correctly, you will see a green coloured health status."}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"importing-aws-ec2-data",children:"Importing AWS EC2 Data"}),"\n",(0,t.jsx)(n.p,{children:"AWS EC2 instances can currently only be imported across clouds using one of the following methods:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:"SSM Triage Acquisition"})}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"EBS Direct Acquisition"}),": Available through ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Experiments"})," > ",(0,t.jsx)(n.strong,{children:"EBS Direct API"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"This limitation exists due to the way data is collected from EC2 instances."})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},28453:(e,n,s)=>{s.d(n,{R:()=>r,x:()=>i});var t=s(96540);const o={},c=t.createContext(o);function r(e){const n=t.useContext(c);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function i(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),t.createElement(c.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1807],{20192:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>c,metadata:()=>i,toc:()=>d});var t=s(74848),o=s(28453);const c={title:"Adding AWS accounts to Azure/AWS/GCP via Keys",hide_title:!0,sidebar_position:6},r="Adding AWS accounts to Azure, AWS, or GCP via Keys",i={id:"cado/deploy/cross/adding-aws",title:"Adding AWS accounts to Azure/AWS/GCP via Keys",description:"To enable cross-cloud access for AWS accounts, you need to set up an IAM role in each AWS account from which you want Cado to collect data. Follow the steps below to add AWS accounts. Ensure you have the required permissions to create IAM roles.",source:"@site/docs/cado/deploy/cross/adding-aws.md",sourceDirName:"cado/deploy/cross",slug:"/cado/deploy/cross/adding-aws",permalink:"/cado/deploy/cross/adding-aws",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado/deploy/cross/adding-aws.md",tags:[],version:"current",lastUpdatedAt:1737541701,formattedLastUpdatedAt:"Jan 22, 2025",sidebarPosition:6,frontMatter:{title:"Adding AWS accounts to Azure/AWS/GCP via Keys",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Add cross-account roles in AWS to Cado with the API",permalink:"/cado/deploy/cross/cross-account-creation-api"},next:{title:"Access an AWS account with keys",permalink:"/cado/deploy/cross/adding-keys"}},a={},d=[{value:"Steps to Add an AWS Account",id:"steps-to-add-an-aws-account",level:3},{value:"Adding AWS Accounts to Cado from Azure or GCP Deployments",id:"adding-aws-accounts-to-cado-from-azure-or-gcp-deployments",level:2},{value:"Importing AWS EC2 Data",id:"importing-aws-ec2-data",level:3}];function l(e){const n={a:"a",br:"br",h1:"h1",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"adding-aws-accounts-to-azure-aws-or-gcp-via-keys",children:"Adding AWS accounts to Azure, AWS, or GCP via Keys"}),"\n",(0,t.jsx)(n.p,{children:"To enable cross-cloud access for AWS accounts, you need to set up an IAM role in each AWS account from which you want Cado to collect data. Follow the steps below to add AWS accounts. Ensure you have the required permissions to create IAM roles."}),"\n",(0,t.jsx)(n.h3,{id:"steps-to-add-an-aws-account",children:"Steps to Add an AWS Account"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Log in to the Target AWS Account"}),(0,t.jsx)(n.br,{}),"\n","Start by logging into the AWS account where you want to grant access."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Create an IAM Group"}),(0,t.jsx)(n.br,{}),"\n","Follow ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_create.html",children:"these AWS instructions"})," to create an IAM group in the target account."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.strong,{children:"Create an IAM Role"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Create a new IAM role."}),"\n",(0,t.jsxs)(n.li,{children:["Attach a policy with the necessary permissions. You can find the policy ",(0,t.jsx)(n.a,{href:"https://github.com/cado-security/Deployment-Templates/blob/main/cross-account/CrossAccountPolicy.yaml",children:"here"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["For step-by-step instructions on creating roles and policies, refer to AWS documentation on ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html",children:"creating policies"})," and ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html",children:"creating roles"}),"."]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Add the IAM User to the Group"}),(0,t.jsx)(n.br,{}),"\n","Once the IAM role is created, add your IAM user to the newly created group by following ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html",children:"this guide"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Generate Access Keys"}),(0,t.jsx)(n.br,{}),"\n","Generate access keys for the IAM user. These keys are needed to access the AWS account. Follow the ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html",children:"AWS instructions"})," to create and securely store the access keys."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.strong,{children:"Add the IAM Role to Cado"})}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["In the Cado platform, go to ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Accounts"})," and click ",(0,t.jsx)(n.strong,{children:"Create an account"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,t.jsxs)(n.li,{children:["Select the ",(0,t.jsx)(n.strong,{children:"AWS Keys"})," option, then provide a name for the role."]}),"\n",(0,t.jsx)(n.li,{children:"Enter the access key and secret key you generated earlier."}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Verify Access in Cado"}),(0,t.jsx)(n.br,{}),"\n","To verify that Cado can access the AWS account:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Open an investigation in Cado."}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"Import"})," > ",(0,t.jsx)(n.strong,{children:"Cloud"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Choose the AWS role you created."}),"\n",(0,t.jsx)(n.li,{children:"Confirm that resources from the target AWS account are visible."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"adding-aws-accounts-to-cado-from-azure-or-gcp-deployments",children:"Adding AWS Accounts to Cado from Azure or GCP Deployments"}),"\n",(0,t.jsx)(n.p,{children:"You can import AWS accounts into Cado from deployments on Azure or GCP. To do this:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["In the Cado platform, go to ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Accounts"})," and click ",(0,t.jsx)(n.strong,{children:"Create an account"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Select ",(0,t.jsx)(n.strong,{children:"AWS"})," from the set of providers."]}),"\n",(0,t.jsxs)(n.li,{children:["The ",(0,t.jsx)(n.strong,{children:"AWS Role"})," option should already be selected."]}),"\n",(0,t.jsxs)(n.li,{children:["Provide an ",(0,t.jsx)(n.strong,{children:"Account Name"})," and enter the ",(0,t.jsx)(n.strong,{children:"Role ARN"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Leave the 'Run account check after adding account' checkbox selected, which will validate the account has the correct permissions after selecting 'Continue'."}),"\n",(0,t.jsx)(n.li,{children:"Navigate to the 'Accounts' table and the newly created AWS account should present. If configured correctly, you will see a green coloured health status."}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"importing-aws-ec2-data",children:"Importing AWS EC2 Data"}),"\n",(0,t.jsx)(n.p,{children:"AWS EC2 instances can currently only be imported across clouds using one of the following methods:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:"SSM Triage Acquisition"})}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"EBS Direct Acquisition"}),": Available through ",(0,t.jsx)(n.strong,{children:"Settings"})," > ",(0,t.jsx)(n.strong,{children:"Experiments"})," > ",(0,t.jsx)(n.strong,{children:"EBS Direct API"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"This limitation exists due to the way data is collected from EC2 instances."})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},28453:(e,n,s)=>{s.d(n,{R:()=>r,x:()=>i});var t=s(96540);const o={},c=t.createContext(o);function r(e){const n=t.useContext(c);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function i(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),t.createElement(c.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/main.4ac10fb0.js b/assets/js/main.8e37210a.js similarity index 99% rename from assets/js/main.4ac10fb0.js rename to assets/js/main.8e37210a.js index f8c12f07c..f33dbdbb3 100644 --- a/assets/js/main.4ac10fb0.js +++ b/assets/js/main.8e37210a.js @@ -1,2 +1,2 @@ -/*! For license information please see main.4ac10fb0.js.LICENSE.txt */ -(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8792],{92413:(e,t,n)=>{"use strict";n.d(t,{A:()=>p});n(96540);var r=n(53259),o=n.n(r),a=n(84054);const i={"00e2a099":[()=>n.e(9259).then(n.bind(n,59248)),"@site/docs/cado/manage/data.md",59248],"0331c271":[()=>n.e(3815).then(n.bind(n,48229)),"@site/docs/cado/deploy/cross/cross-account-creation.md",48229],"08de61b6":[()=>n.e(4561).then(n.bind(n,64691)),"@site/docs/cado/discovery-import/cado-host/artifacts.md",64691],"0be23a04":[()=>n.e(1880).then(n.bind(n,78197)),"@site/docs/cado/deploy/aws/networking/endpoints.md",78197],"0c10e8c1":[()=>n.e(280).then(n.bind(n,90620)),"@site/docs/cado/deploy/aws/aws-bucket.md",90620],"0c245acb":[()=>n.e(9159).then(n.bind(n,72558)),"@site/docs/cado/discovery-import/azure/azure-compute.md",72558],"0c833961":[()=>n.e(4228).then(n.bind(n,8145)),"@site/docs/cado/deploy/gcp/gcp-auto-setup.md",8145],"0e87acb0":[()=>n.e(8275).then(n.bind(n,62008)),"@site/docs/cado/integrations/xdr/defender.md",62008],"138702eb":[()=>n.e(9387).then(n.bind(n,2857)),"@site/docs/cado/discovery-import/import-from-cloud.md",2857],"13eba36a":[()=>n.e(6941).then(n.bind(n,69253)),"@site/docs/cado/deploy/cross/aws-organizations.md",69253],"1487f5c9":[()=>n.e(2012).then(n.bind(n,36814)),"@site/docs/troubleshooting/eula/community-eula.md",36814],"14d87e73":[()=>n.e(9866).then(n.bind(n,14575)),"@site/docs/cado/integrations/forensic-tools.md",14575],17896441:[()=>Promise.all([n.e(1869),n.e(8401)]).then(n.bind(n,83337)),"@theme/DocItem",83337],"19b12360":[()=>n.e(2309).then(n.bind(n,58676)),"@site/docs/cado/deploy/gcp/gcp-cross-project.md",58676],"1bdcb11a":[()=>n.e(2284).then(n.bind(n,38189)),"@site/docs/cado/investigate/automated-investigation.md",38189],"1dc01342":[()=>n.e(8987).then(n.bind(n,60841)),"@site/docs/cado/deploy/cross/azure-cross-tenancy-subscriptions.md",60841],"212ec08f":[()=>n.e(9316).then(n.bind(n,51780)),"@site/docs/cado/discovery-import/aws/aws-lambda.md",51780],"25df0945":[()=>n.e(7714).then(n.bind(n,38357)),"@site/docs/cado/discovery-import/cado-host/deploy.md",38357],"261a6458":[()=>n.e(348).then(n.bind(n,70166)),"@site/docs/cado/investigate/ctf-tutorial.md",70166],"2666b20e":[()=>n.e(1126).then(n.bind(n,13520)),"@site/docs/cado/discovery-import/cado-host/manual-upload.md",13520],28424281:[()=>n.e(8588).then(n.bind(n,89049)),"@site/docs/cado/discovery-import/data-types/import-types.md",89049],"2979d8b1":[()=>n.e(9907).then(n.bind(n,21911)),"@site/docs/cado/deploy/cross/intro.md",21911],"2ad92a42":[()=>n.e(9892).then(n.bind(n,18752)),"@site/docs/cado/deploy/cross/add-cross-account-manual.md",18752],"2b3e752e":[()=>n.e(6612).then(n.bind(n,69687)),"@site/docs/cado/manage/users-authentication/sso/okta.md",69687],"2d5956c8":[()=>n.e(6535).then(n.t.bind(n,4061,19)),"/home/runner/work/product-help/product-help/.docusaurus/docusaurus-plugin-content-pages/default/plugin-route-context-module-100.json",4061],"3162843c":[()=>n.e(1965).then(n.bind(n,73218)),"@site/docs/cado/discovery-import/cado-host/api-deploy.md",73218],"3312fe7e":[()=>n.e(2399).then(n.bind(n,30137)),"@site/docs/cado/deploy/gcp/gcp-deploy.md",30137],"34cfa87e":[()=>n.e(8230).then(n.bind(n,33003)),"@site/docs/cado/discovery-import/aws/ebs-direct-acquisition.md",33003],"38dfc04a":[()=>n.e(7012).then(n.bind(n,1377)),"@site/docs/cado/deploy/gcp/iam-description.md",1377],"3b0c3707":[()=>n.e(7030).then(n.bind(n,83139)),"@site/docs/cado/deploy/gcp/gcp-settings.md",83139],"3c11cd59":[()=>n.e(588).then(n.bind(n,35577)),"@site/docs/cado/discovery-import/openshift.md",35577],"3f319406":[()=>n.e(6773).then(n.t.bind(n,61966,19)),"/home/runner/work/product-help/product-help/.docusaurus/docusaurus-plugin-content-docs/default/plugin-route-context-module-100.json",61966],"41e311c1":[()=>n.e(852).then(n.bind(n,62790)),"@site/docs/cado/manage/monitoring.md",62790],"45ce7214":[()=>n.e(118).then(n.bind(n,55191)),"@site/docs/cado/deploy/aws/security/forensics-account.md",55191],"46b41660":[()=>n.e(6740).then(n.bind(n,14636)),"@site/docs/cado/integrations/api-overview.md",14636],"4745e9e4":[()=>n.e(5116).then(n.bind(n,76427)),"@site/docs/release-notes/release-notes.md",76427],"4a3e894d":[()=>n.e(7123).then(n.bind(n,10153)),"@site/docs/cado/integrations/soar/cortex-xsoar.md",10153],"55d2c3d2":[()=>n.e(8243).then(n.bind(n,13645)),"@site/docs/cado/deploy/aws/regions.md",13645],"56c19fd2":[()=>n.e(949).then(n.bind(n,77137)),"@site/docs/troubleshooting/faq.md",77137],"57e5e07a":[()=>n.e(2614).then(n.bind(n,13124)),"@site/docs/cado/deploy/aws/aws-secret-manager.md",13124],"5a2693c2":[()=>n.e(5058).then(n.bind(n,30763)),"@site/docs/troubleshooting/get-support.md",30763],"5ac9b2e6":[()=>n.e(1100).then(n.bind(n,32185)),"@site/docs/cado/deploy/aws/aws-nfs.md",32185],"5b158446":[()=>n.e(8870).then(n.bind(n,22321)),"@site/docs/cado/discovery-import/kubernetes.md",22321],"5b1f4994":[()=>n.e(5285).then(n.bind(n,72038)),"@site/docs/cado/integrations/siem.md",72038],"5b5d7d75":[()=>n.e(1908).then(n.bind(n,17219)),"@site/docs/cado/discovery-import/xdr.md",17219],"5c704a9a":[()=>n.e(1509).then(n.bind(n,46892)),"@site/docs/cado/deploy/gcp/logs.md",46892],"5d4adb54":[()=>n.e(4076).then(n.bind(n,27863)),"@site/docs/cado/investigate/insights.md",27863],"5dcab45d":[()=>n.e(4681).then(n.bind(n,65251)),"@site/docs/cado/investigate/response-actions.md",65251],"5e95c892":[()=>n.e(9647).then(n.bind(n,83124)),"@theme/DocsRoot",83124],"5e9f5e1a":[()=>Promise.resolve().then(n.bind(n,4784)),"@generated/docusaurus.config",4784],"6019cb09":[()=>n.e(3361).then(n.bind(n,70197)),"@site/docs/cado/deploy/aws/architecture.md",70197],63772713:[()=>n.e(2801).then(n.bind(n,21868)),"@site/docs/cado/integrations/xdr/crowdstrike.md",21868],"64b73e22":[()=>n.e(5624).then(n.bind(n,36434)),"@site/docs/cado/discovery-import/cado-host/intro.md",36434],"67fb56d0":[()=>n.e(5247).then(n.bind(n,29553)),"@site/docs/cado/integrations/soar/tines.md",29553],"69701c38":[()=>n.e(4976).then(n.bind(n,40435)),"@site/docs/cado/integrations/xdr/tanium.md",40435],"6e336265":[()=>n.e(9193).then(n.bind(n,3251)),"@site/docs/cado/discovery-import/intro.md",3251],"6f23eecf":[()=>n.e(8367).then(n.bind(n,67918)),"@site/docs/cado/discovery-import/investigations.md",67918],"6fe3c7a2":[()=>n.e(2948).then(n.bind(n,39036)),"@site/docs/cado/deploy/azure/endpoints.md",39036],"7003eebb":[()=>n.e(8771).then(n.bind(n,36614)),"@site/docs/cado/investigate/detections.md",36614],"7144146f":[()=>n.e(1580).then(n.bind(n,36349)),"@site/docs/cado/discovery-import/cado-host/script-operation.md",36349],"771b2727":[()=>n.e(7096).then(n.bind(n,48565)),"@site/docs/cado/deploy/gcp/endpoints.md",48565],"77bfca5f":[()=>n.e(9992).then(n.bind(n,85122)),"@site/docs/cado/discovery-import/cado-host/aws-credentials.md",85122],"7ac66fa8":[()=>n.e(395).then(n.bind(n,14177)),"@site/docs/cado/discovery-import/aws/aws-ec2.md",14177],"7b974b4c":[()=>n.e(3225).then(n.bind(n,25385)),"@site/docs/cado/deploy/azure/azure-architecture.md",25385],"7c637bf6":[()=>n.e(7839).then(n.bind(n,73481)),"@site/docs/cado/deploy/azure/azure-nfs.md",73481],"7cafbe3b":[()=>n.e(800).then(n.bind(n,94322)),"@site/docs/cado/deploy/aws/cloudformation.md",94322],"7cf0e382":[()=>n.e(4690).then(n.bind(n,60252)),"@site/docs/cado/deploy/aws/iam/iam-description.md",60252],"81e2ac17":[()=>n.e(3707).then(n.bind(n,7674)),"@site/docs/cado/discovery-import/aws/aws-eks.md",7674],"81f0cd88":[()=>n.e(9793).then(n.bind(n,17728)),"@site/docs/cado/manage/users-authentication/sso/ping_saml.md",17728],"8278bf4b":[()=>n.e(6750).then(n.bind(n,83701)),"@site/docs/cado/discovery-import/gcp/storage.md",83701],82887747:[()=>n.e(5140).then(n.bind(n,19725)),"@site/docs/cado/deploy/gcp/data-encryption-overview.md",19725],"884420b0":[()=>n.e(6119).then(n.bind(n,41073)),"@site/docs/cado/deploy/gcp/gcp-architecture.md",41073],"8890cc05":[()=>n.e(555).then(n.bind(n,62017)),"@site/docs/cado/discovery-import/aws/aws-s3.md",62017],"88a5faba":[()=>n.e(2305).then(n.bind(n,21964)),"@site/docs/cado/deploy/gcp/gcp-secret-manager.md",21964],89389604:[()=>n.e(1554).then(n.bind(n,75964)),"@site/docs/cado/deploy/licenses.md",75964],"8a582a55":[()=>n.e(664).then(n.bind(n,23659)),"@site/docs/cado/deploy/aws/iam/ssm.md",23659],"8cc61b5f":[()=>n.e(7479).then(n.bind(n,8387)),"@site/docs/cado/manage/users-authentication/sso/okta_saml.md",8387],"8ea9f2a7":[()=>n.e(6480).then(n.bind(n,746)),"@site/docs/cado/deploy/aws/networking/aws-load-balancer.md",746],"9065b7f6":[()=>n.e(18).then(n.bind(n,72592)),"@site/docs/cado/discovery-import/cado-host/azure-credentials.md",72592],"90b7a613":[()=>n.e(8804).then(n.bind(n,23198)),"@site/docs/cado/deploy/cross/adding-azure.md",23198],"92d849d5":[()=>n.e(70).then(n.bind(n,42399)),"@site/docs/cado/deploy/networking-proxy.md",42399],"92f2ee11":[()=>n.e(8954).then(n.bind(n,6235)),"@site/docs/cado/deploy/logging-in.md",6235],"9307d943":[()=>n.e(7194).then(n.bind(n,94548)),"@site/docs/cado/discovery-import/google-workspace-logs.md",94548],"935f2afb":[()=>n.e(8581).then(n.t.bind(n,35610,19)),"~docs/default/version-current-metadata-prop-751.json",35610],"95dc77a9":[()=>n.e(2898).then(n.bind(n,71770)),"@site/docs/cado/investigate/timeline-search.md",71770],"980335ef":[()=>n.e(7118).then(n.bind(n,49829)),"@site/docs/cado/deploy/aws/security/data-encryption-overview.md",49829],"9b6f7a10":[()=>n.e(2485).then(n.bind(n,22468)),"@site/docs/cado/deploy/gcp/gcp-bucket.md",22468],"9cd36c57":[()=>n.e(2829).then(n.bind(n,38796)),"@site/docs/cado/manage/users-authentication/users.md",38796],"9cd6de3b":[()=>n.e(7).then(n.bind(n,17091)),"@site/docs/cado/discovery-import/data-types/logs.md",17091],"9db271a1":[()=>n.e(9250).then(n.bind(n,43850)),"@site/docs/cado/integrations/webhooks.md",43850],"9ddd9c6e":[()=>n.e(8047).then(n.bind(n,58606)),"@site/docs/cado/discovery-import/azure/azure-storage.md",58606],"9f04a68e":[()=>n.e(9114).then(n.bind(n,20061)),"@site/docs/cado/integrations/soar/splunk-soar.md",20061],a0ecaa82:[()=>n.e(2744).then(n.bind(n,49697)),"@site/docs/cado/discovery-import/data-types/filetypes.md",49697],a1c491f4:[()=>n.e(8644).then(n.bind(n,48437)),"@site/docs/cado/manage/users-authentication/sso/azure-ad.md",48437],a7bd4aaa:[()=>n.e(7098).then(n.bind(n,22881)),"@theme/DocVersionRoot",22881],a843c566:[()=>n.e(6467).then(n.bind(n,14539)),"@site/docs/cado/deploy/cross/adding-gcp.md",14539],a94703ab:[()=>Promise.all([n.e(1869),n.e(9048)]).then(n.bind(n,74644)),"@theme/DocRoot",74644],a972a79c:[()=>n.e(278).then(n.bind(n,54074)),"@site/docs/cado/deploy/aws/security/logging.md",54074],aba992ac:[()=>n.e(9517).then(n.bind(n,16332)),"@site/docs/cado/deploy/azure/iam-description.md",16332],aca7154c:[()=>n.e(234).then(n.bind(n,9473)),"@site/docs/cado/deploy/azure/azure-deploy.md",9473],b02f4114:[()=>n.e(7483).then(n.bind(n,82642)),"@site/docs/cado/deploy/ports.md",82642],b16e3aaf:[()=>n.e(5146).then(n.bind(n,57841)),"@site/docs/cado/investigate/overview.md",57841],b3261dc0:[()=>n.e(7868).then(n.bind(n,51476)),"@site/docs/cado/deploy/azure/azure-secret-manager.md",51476],b3760e48:[()=>n.e(7088).then(n.bind(n,27422)),"@site/docs/cado/deploy/tag.md",27422],b3829f87:[()=>n.e(7574).then(n.bind(n,44771)),"@site/docs/cado/deploy/cross/skip-role.md",44771],b3d88481:[()=>n.e(8567).then(n.bind(n,91253)),"@site/docs/cado/deploy/aws/iam/tighten-kms.md",91253],b3f7620e:[()=>n.e(5754).then(n.bind(n,63837)),"@site/docs/cado/manage/workers.md",63837],b58ec3bd:[()=>n.e(4225).then(n.bind(n,78406)),"@site/docs/cado/discovery-import/azure/azure-aks.md",78406],b89f09e1:[()=>n.e(455).then(n.bind(n,26859)),"@site/docs/cado/discovery-import/data-types/memory.md",26859],baefdef6:[()=>n.e(3056).then(n.bind(n,36405)),"@site/docs/cado/manage/cost-management.md",36405],bc75044d:[()=>n.e(1150).then(n.bind(n,79499)),"@site/docs/cado/deploy/aws/aws-workers.md",79499],bcecf3ad:[()=>n.e(8864).then(n.bind(n,96848)),"@site/docs/cado/discovery-import/aws/memory.md",96848],bd15c322:[()=>n.e(8805).then(n.bind(n,12730)),"@site/docs/cado/discovery-import/cado-host/cli.md",12730],be752dd1:[()=>n.e(9327).then(n.bind(n,76631)),"@site/docs/cado/discovery-import/aws/large-aws-imports.md",76631],c04b47d4:[()=>n.e(999).then(n.bind(n,67850)),"@site/docs/cado/deploy/azure/data-encryption-overview.md",67850],c3746c1b:[()=>n.e(9676).then(n.bind(n,27985)),"@site/docs/cado/deploy/gcp/gcp-nfs.md",27985],c4f5d8e4:[()=>n.e(2634).then(n.bind(n,92157)),"@site/src/pages/index.js",92157],c5ee0868:[()=>n.e(9099).then(n.bind(n,26662)),"@site/docs/cado/discovery-import/virtual-machine.md",26662],c6367126:[()=>n.e(1455).then(n.bind(n,4554)),"@site/docs/cado/discovery-import/m365-logs.md",4554],ca8eea13:[()=>n.e(8180).then(n.bind(n,81863)),"@site/docs/troubleshooting/eula/commercial-eula.md",81863],cb1d6b9e:[()=>n.e(6261).then(n.bind(n,93398)),"@site/docs/cado/discovery-import/cado-host/google-credentials.md",93398],cbfa239e:[()=>n.e(5784).then(n.bind(n,3916)),"@site/docs/cado/manage/expand-disk.md",3916],cd181b23:[()=>n.e(97).then(n.bind(n,20618)),"@site/docs/cado/intro.md",20618],cd5b4d7e:[()=>n.e(8891).then(n.bind(n,78886)),"@site/docs/cado/manage/updating.md",78886],cdeb5142:[()=>n.e(8991).then(n.bind(n,17526)),"@site/docs/cado/discovery-import/aws/aws-lightsail.md",17526],ceeff64a:[()=>n.e(9143).then(n.bind(n,95066)),"@site/docs/cado/manage/platform-security.md",95066],cfa6ff54:[()=>n.e(14).then(n.bind(n,35601)),"@site/docs/cado/deploy/aws/performance-resiliency/high-availability.md",35601],d10ed510:[()=>n.e(2577).then(n.bind(n,16640)),"@site/docs/cado/investigate/browse-disk.md",16640],d1455ea6:[()=>n.e(1520).then(n.bind(n,44628)),"@site/docs/cado/discovery-import/aws/aws-china.md",44628],d2273799:[()=>n.e(8252).then(n.bind(n,80998)),"@site/docs/cado/discovery-import/aws/aws-ami.md",80998],d2932d7e:[()=>n.e(1231).then(n.bind(n,9115)),"@site/docs/cado/deploy/azure/azure-workers.md",9115],d2d32e4b:[()=>n.e(1563).then(n.bind(n,92867)),"@site/docs/cado/integrations/cnapp/wiz.md",92867],d2f06d9d:[()=>n.e(9110).then(n.bind(n,9565)),"@site/docs/cado/discovery-import/third-party.md",9565],d3a982a8:[()=>n.e(9075).then(n.bind(n,95792)),"@site/docs/cado/discovery-import/cado-host/custom-locations.md",95792],d4b22c01:[()=>n.e(6159).then(n.bind(n,96232)),"@site/docs/cado/deploy/aws/networking/internet-routable-addresses.md",96232],d6fae6a2:[()=>n.e(9326).then(n.bind(n,55258)),"@site/docs/cado/deploy/aws/performance-resiliency/aws-backups.md",55258],d86b7bf0:[()=>n.e(8670).then(n.bind(n,12652)),"@site/docs/cado/deploy/azure/azure-bucket.md",12652],d89fafa7:[()=>n.e(3027).then(n.bind(n,80051)),"@site/docs/cado/deploy/gcp/gcp-workers.md",80051],d97f3d64:[()=>n.e(6222).then(n.bind(n,71788)),"@site/docs/cado/discovery-import/cado-host/security.md",71788],daba58e6:[()=>n.e(1443).then(n.bind(n,21709)),"@site/docs/cado/deploy/cross/adding-keys.md",21709],dd15f4d2:[()=>n.e(3325).then(n.bind(n,59823)),"@site/docs/cado/integrations/xdr/sentinelone.md",59823],dddd1328:[()=>n.e(3357).then(n.bind(n,71132)),"@site/docs/cado/deploy/cross/cross-account-creation-api.md",71132],de0e4cc9:[()=>n.e(2628).then(n.bind(n,40179)),"@site/docs/cado/investigate/ai investigator.md",40179],e311a61b:[()=>n.e(1329).then(n.bind(n,61289)),"@site/docs/cado/discovery-import/gcp/kubernetes-engine.md",61289],e6705af2:[()=>n.e(637).then(n.bind(n,65341)),"@site/docs/cado/deploy/cross/cross_vs_individual.md",65341],e752eb53:[()=>n.e(2391).then(n.bind(n,45443)),"@site/docs/troubleshooting/logs-cloudwatch.md",45443],ea7d3df8:[()=>n.e(91).then(n.bind(n,26095)),"@site/docs/cado/investigate/evidence.md",26095],ebdbcfed:[()=>n.e(3752).then(n.bind(n,76570)),"@site/docs/cado/discovery-import/chain_of_custody.md",76570],ec12427e:[()=>n.e(4316).then(n.bind(n,72610)),"@site/docs/cado/discovery-import/aws/aws-ecs.md",72610],ee649c4c:[()=>n.e(7720).then(n.bind(n,72951)),"@site/docs/cado/deploy/aws/iam/aws-kms.md",72951],ef0a30ea:[()=>n.e(9272).then(n.bind(n,97916)),"@site/docs/cado/deploy/aws/terraform.md",97916],f3a42d7c:[()=>n.e(4741).then(n.bind(n,16093)),"@site/docs/cado/deploy/cross/aws-sts.md",16093],f48685c1:[()=>n.e(2410).then(n.bind(n,2441)),"@site/docs/cado/deploy/cross/cross-account-creation-auto.md",2441],f7d56d82:[()=>n.e(220).then(n.bind(n,99305)),"@site/docs/cado/community.md",99305],f7de62ec:[()=>n.e(7519).then(n.bind(n,46439)),"@site/docs/troubleshooting/send-logs.md",46439],f86d89c8:[()=>n.e(8335).then(n.bind(n,65938)),"@site/docs/cado/discovery-import/automation.md",65938],fc7542e4:[()=>n.e(2299).then(n.bind(n,72526)),"@site/docs/cado/discovery-import/gcp/engine-instance.md",72526],fe7d0334:[()=>n.e(1807).then(n.bind(n,20192)),"@site/docs/cado/deploy/cross/adding-aws.md",20192]};var s=n(74848);function l(e){let{error:t,retry:n,pastDelay:r}=e;return t?(0,s.jsxs)("div",{style:{textAlign:"center",color:"#fff",backgroundColor:"#fa383e",borderColor:"#fa383e",borderStyle:"solid",borderRadius:"0.25rem",borderWidth:"1px",boxSizing:"border-box",display:"block",padding:"1rem",flex:"0 0 50%",marginLeft:"25%",marginRight:"25%",marginTop:"5rem",maxWidth:"50%",width:"100%"},children:[(0,s.jsx)("p",{children:String(t)}),(0,s.jsx)("div",{children:(0,s.jsx)("button",{type:"button",onClick:n,children:"Retry"})})]}):r?(0,s.jsx)("div",{style:{display:"flex",justifyContent:"center",alignItems:"center",height:"100vh"},children:(0,s.jsx)("svg",{id:"loader",style:{width:128,height:110,position:"absolute",top:"calc(100vh - 64%)"},viewBox:"0 0 45 45",xmlns:"http://www.w3.org/2000/svg",stroke:"#61dafb",children:(0,s.jsxs)("g",{fill:"none",fillRule:"evenodd",transform:"translate(1 1)",strokeWidth:"2",children:[(0,s.jsxs)("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0",children:[(0,s.jsx)("animate",{attributeName:"r",begin:"1.5s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-opacity",begin:"1.5s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-width",begin:"1.5s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})]}),(0,s.jsxs)("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0",children:[(0,s.jsx)("animate",{attributeName:"r",begin:"3s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-opacity",begin:"3s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-width",begin:"3s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})]}),(0,s.jsx)("circle",{cx:"22",cy:"22",r:"8",children:(0,s.jsx)("animate",{attributeName:"r",begin:"0s",dur:"1.5s",values:"6;1;2;3;4;5;6",calcMode:"linear",repeatCount:"indefinite"})})]})})}):null}var c=n(81604),u=n(23363);function d(e,t){if("*"===e)return o()({loading:l,loader:()=>n.e(2560).then(n.bind(n,72560)),modules:["@theme/NotFound"],webpack:()=>[72560],render(e,t){const n=e.default;return(0,s.jsx)(u.W,{value:{plugin:{name:"native",id:"default"}},children:(0,s.jsx)(n,{...t})})}});const r=a[`${e}-${t}`],d={},p=[],f=[],m=(0,c.A)(r);return Object.entries(m).forEach((e=>{let[t,n]=e;const r=i[n];r&&(d[t]=r[0],p.push(r[1]),f.push(r[2]))})),o().Map({loading:l,loader:d,modules:p,webpack:()=>f,render(t,n){const o=JSON.parse(JSON.stringify(r));Object.entries(t).forEach((t=>{let[n,r]=t;const a=r.default;if(!a)throw new Error(`The page component at ${e} doesn't have a default export. This makes it impossible to render anything. Consider default-exporting a React component.`);"object"!=typeof a&&"function"!=typeof a||Object.keys(r).filter((e=>"default"!==e)).forEach((e=>{a[e]=r[e]}));let i=o;const s=n.split(".");s.slice(0,-1).forEach((e=>{i=i[e]})),i[s[s.length-1]]=a}));const a=o.__comp;delete o.__comp;const i=o.__context;return delete o.__context,(0,s.jsx)(u.W,{value:i,children:(0,s.jsx)(a,{...o,...n})})}})}const p=[{path:"/",component:d("/","4c7"),exact:!0},{path:"/",component:d("/","df9"),routes:[{path:"/",component:d("/","ea9"),routes:[{path:"/",component:d("/","71d"),routes:[{path:"/cado/community-intro",component:d("/cado/community-intro","3bd"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/architecture",component:d("/cado/deploy/aws/architecture","04a"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/aws-bucket",component:d("/cado/deploy/aws/aws-bucket","d82"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/aws-nfs",component:d("/cado/deploy/aws/aws-nfs","9af"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/aws-secret-manager",component:d("/cado/deploy/aws/aws-secret-manager","b9b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/aws-workers",component:d("/cado/deploy/aws/aws-workers","60c"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/cloudformation",component:d("/cado/deploy/aws/cloudformation","9b7"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/iam/aws-kms",component:d("/cado/deploy/aws/iam/aws-kms","152"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/iam/iam-description",component:d("/cado/deploy/aws/iam/iam-description","dc6"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/iam/ssm",component:d("/cado/deploy/aws/iam/ssm","b84"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/iam/tighten-kms",component:d("/cado/deploy/aws/iam/tighten-kms","b87"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/networking/aws-load-balancer",component:d("/cado/deploy/aws/networking/aws-load-balancer","b09"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/networking/endpoints",component:d("/cado/deploy/aws/networking/endpoints","916"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/networking/internet-routable-addresses",component:d("/cado/deploy/aws/networking/internet-routable-addresses","3a4"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/performance-resiliency/aws-backups",component:d("/cado/deploy/aws/performance-resiliency/aws-backups","cd1"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/performance-resiliency/high-availability",component:d("/cado/deploy/aws/performance-resiliency/high-availability","798"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/regions",component:d("/cado/deploy/aws/regions","d88"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/security/data-encryption-overview",component:d("/cado/deploy/aws/security/data-encryption-overview","fc1"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/security/forensics-account",component:d("/cado/deploy/aws/security/forensics-account","9d6"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/security/logging",component:d("/cado/deploy/aws/security/logging","f42"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/aws/terraform",component:d("/cado/deploy/aws/terraform","558"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/azure-architecture",component:d("/cado/deploy/azure/azure-architecture","34f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/azure-bucket",component:d("/cado/deploy/azure/azure-bucket","a00"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/azure-deploy",component:d("/cado/deploy/azure/azure-deploy","1b0"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/azure-nfs",component:d("/cado/deploy/azure/azure-nfs","38f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/azure-secret-manager",component:d("/cado/deploy/azure/azure-secret-manager","ed8"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/azure-workers",component:d("/cado/deploy/azure/azure-workers","b61"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/data-encryption-overview",component:d("/cado/deploy/azure/data-encryption-overview","157"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/endpoints",component:d("/cado/deploy/azure/endpoints","bc2"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/azure/iam-description",component:d("/cado/deploy/azure/iam-description","933"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/add-cross-account-manual",component:d("/cado/deploy/cross/add-cross-account-manual","47f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/adding-aws",component:d("/cado/deploy/cross/adding-aws","f9d"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/adding-azure",component:d("/cado/deploy/cross/adding-azure","fc7"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/adding-gcp",component:d("/cado/deploy/cross/adding-gcp","83b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/adding-keys",component:d("/cado/deploy/cross/adding-keys","c59"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/aws-organizations",component:d("/cado/deploy/cross/aws-organizations","31f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/aws-sts",component:d("/cado/deploy/cross/aws-sts","9f8"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/azure-cross-tenancy-subscriptions",component:d("/cado/deploy/cross/azure-cross-tenancy-subscriptions","225"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/cross_vs_individual",component:d("/cado/deploy/cross/cross_vs_individual","299"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/cross-account-creation",component:d("/cado/deploy/cross/cross-account-creation","270"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/cross-account-creation-api",component:d("/cado/deploy/cross/cross-account-creation-api","748"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/cross-account-creation-auto",component:d("/cado/deploy/cross/cross-account-creation-auto","130"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/intro",component:d("/cado/deploy/cross/intro","f04"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/cross/skip-role",component:d("/cado/deploy/cross/skip-role","08a"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/data-encryption-overview",component:d("/cado/deploy/gcp/data-encryption-overview","b53"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/endpoints",component:d("/cado/deploy/gcp/endpoints","e4b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-architecture",component:d("/cado/deploy/gcp/gcp-architecture","aaa"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-auto-setup",component:d("/cado/deploy/gcp/gcp-auto-setup","846"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-bucket",component:d("/cado/deploy/gcp/gcp-bucket","94a"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-cross-project",component:d("/cado/deploy/gcp/gcp-cross-project","e2d"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-deploy",component:d("/cado/deploy/gcp/gcp-deploy","44f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-nfs",component:d("/cado/deploy/gcp/gcp-nfs","aeb"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-secret-manager",component:d("/cado/deploy/gcp/gcp-secret-manager","f97"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-settings",component:d("/cado/deploy/gcp/gcp-settings","8af"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/gcp-workers",component:d("/cado/deploy/gcp/gcp-workers","815"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/iam-description",component:d("/cado/deploy/gcp/iam-description","132"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/gcp/logs",component:d("/cado/deploy/gcp/logs","9dc"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/licenses",component:d("/cado/deploy/licenses","c09"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/logging-in",component:d("/cado/deploy/logging-in","2a8"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/networking-proxy",component:d("/cado/deploy/networking-proxy","ab3"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/ports",component:d("/cado/deploy/ports","4fe"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/deploy/tag",component:d("/cado/deploy/tag","4b6"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/automation",component:d("/cado/discovery-import/automation","ece"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/aws-ami",component:d("/cado/discovery-import/aws/aws-ami","784"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/aws-china",component:d("/cado/discovery-import/aws/aws-china","ef9"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/aws-ec2",component:d("/cado/discovery-import/aws/aws-ec2","db2"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/aws-ecs",component:d("/cado/discovery-import/aws/aws-ecs","8f4"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/aws-eks",component:d("/cado/discovery-import/aws/aws-eks","dba"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/aws-lambda",component:d("/cado/discovery-import/aws/aws-lambda","fda"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/aws-lightsail",component:d("/cado/discovery-import/aws/aws-lightsail","7b1"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/aws-s3",component:d("/cado/discovery-import/aws/aws-s3","221"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/ebs-direct-acquisition",component:d("/cado/discovery-import/aws/ebs-direct-acquisition","f0b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/large-aws-imports",component:d("/cado/discovery-import/aws/large-aws-imports","712"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/aws/memory",component:d("/cado/discovery-import/aws/memory","422"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/azure/azure-aks",component:d("/cado/discovery-import/azure/azure-aks","f3b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/azure/azure-compute",component:d("/cado/discovery-import/azure/azure-compute","39a"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/azure/azure-storage",component:d("/cado/discovery-import/azure/azure-storage","20e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/api-deploy",component:d("/cado/discovery-import/cado-host/api-deploy","0fd"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/artifacts",component:d("/cado/discovery-import/cado-host/artifacts","6a5"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/aws-credentials",component:d("/cado/discovery-import/cado-host/aws-credentials","076"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/azure-credentials",component:d("/cado/discovery-import/cado-host/azure-credentials","280"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/cli",component:d("/cado/discovery-import/cado-host/cli","522"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/custom-locations",component:d("/cado/discovery-import/cado-host/custom-locations","5f3"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/deploy",component:d("/cado/discovery-import/cado-host/deploy","2d2"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/google-credentials",component:d("/cado/discovery-import/cado-host/google-credentials","91f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/intro",component:d("/cado/discovery-import/cado-host/intro","d92"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/manual-upload",component:d("/cado/discovery-import/cado-host/manual-upload","259"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/script-operation",component:d("/cado/discovery-import/cado-host/script-operation","647"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/cado-host/security",component:d("/cado/discovery-import/cado-host/security","655"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/chain_of_custody",component:d("/cado/discovery-import/chain_of_custody","080"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/data-types/filetypes",component:d("/cado/discovery-import/data-types/filetypes","9b4"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/data-types/import-types",component:d("/cado/discovery-import/data-types/import-types","011"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/data-types/logs",component:d("/cado/discovery-import/data-types/logs","8eb"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/data-types/memory",component:d("/cado/discovery-import/data-types/memory","8af"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/gcp/engine-instance",component:d("/cado/discovery-import/gcp/engine-instance","24f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/gcp/kubernetes-engine",component:d("/cado/discovery-import/gcp/kubernetes-engine","b8c"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/gcp/storage",component:d("/cado/discovery-import/gcp/storage","7d2"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/google-workspace-logs",component:d("/cado/discovery-import/google-workspace-logs","153"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/import-from-cloud",component:d("/cado/discovery-import/import-from-cloud","e52"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/intro",component:d("/cado/discovery-import/intro","5b3"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/investigations",component:d("/cado/discovery-import/investigations","e5b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/kubernetes",component:d("/cado/discovery-import/kubernetes","264"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/m365-logs",component:d("/cado/discovery-import/m365-logs","cf0"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/openshift",component:d("/cado/discovery-import/openshift","9d9"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/third-party",component:d("/cado/discovery-import/third-party","e8f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/virtual-machine",component:d("/cado/discovery-import/virtual-machine","41a"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/discovery-import/xdr",component:d("/cado/discovery-import/xdr","b05"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/api-overview",component:d("/cado/integrations/api-overview","e9e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/cnapp/wiz",component:d("/cado/integrations/cnapp/wiz","f6e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/forensic-tools",component:d("/cado/integrations/forensic-tools","1d9"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/siem",component:d("/cado/integrations/siem","e9c"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/soar/cortex-xsoar",component:d("/cado/integrations/soar/cortex-xsoar","86f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/soar/splunk-soar",component:d("/cado/integrations/soar/splunk-soar","beb"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/soar/tines",component:d("/cado/integrations/soar/tines","323"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/webhooks",component:d("/cado/integrations/webhooks","a33"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/xdr/crowdstrike",component:d("/cado/integrations/xdr/crowdstrike","f5b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/xdr/defender",component:d("/cado/integrations/xdr/defender","bb0"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/xdr/sentinelone",component:d("/cado/integrations/xdr/sentinelone","68c"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/integrations/xdr/tanium",component:d("/cado/integrations/xdr/tanium","472"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/intro",component:d("/cado/intro","ebf"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/ai investigator",component:d("/cado/investigate/ai investigator","c2d"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/automated-investigation",component:d("/cado/investigate/automated-investigation","54b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/browse-disk",component:d("/cado/investigate/browse-disk","e25"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/ctf-tutorial",component:d("/cado/investigate/ctf-tutorial","aa4"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/detections",component:d("/cado/investigate/detections","42b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/evidence",component:d("/cado/investigate/evidence","3ce"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/insights",component:d("/cado/investigate/insights","c7f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/overview",component:d("/cado/investigate/overview","1dd"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/response-actions",component:d("/cado/investigate/response-actions","c48"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/investigate/timeline-search",component:d("/cado/investigate/timeline-search","465"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/cost-management",component:d("/cado/manage/cost-management","957"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/data",component:d("/cado/manage/data","a42"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/expand-disk",component:d("/cado/manage/expand-disk","3d9"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/monitoring",component:d("/cado/manage/monitoring","dc7"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/platform-security",component:d("/cado/manage/platform-security","995"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/updating",component:d("/cado/manage/updating","988"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/users-authentication/sso/azure-ad",component:d("/cado/manage/users-authentication/sso/azure-ad","ee8"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/users-authentication/sso/okta",component:d("/cado/manage/users-authentication/sso/okta","bf4"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/users-authentication/sso/okta_saml",component:d("/cado/manage/users-authentication/sso/okta_saml","14e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/users-authentication/sso/ping_saml",component:d("/cado/manage/users-authentication/sso/ping_saml","d0b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/users-authentication/users",component:d("/cado/manage/users-authentication/users","0b5"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado/manage/workers",component:d("/cado/manage/workers","9c0"),exact:!0,sidebar:"tutorialSidebar"},{path:"/release-notes",component:d("/release-notes","b6e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/troubleshooting/eula/commercial-eula",component:d("/troubleshooting/eula/commercial-eula","992"),exact:!0,sidebar:"tutorialSidebar"},{path:"/troubleshooting/eula/community-eula",component:d("/troubleshooting/eula/community-eula","da2"),exact:!0,sidebar:"tutorialSidebar"},{path:"/troubleshooting/faq",component:d("/troubleshooting/faq","6b1"),exact:!0,sidebar:"tutorialSidebar"},{path:"/troubleshooting/get-support",component:d("/troubleshooting/get-support","b19"),exact:!0,sidebar:"tutorialSidebar"},{path:"/troubleshooting/logs-cloudwatch",component:d("/troubleshooting/logs-cloudwatch","554"),exact:!0,sidebar:"tutorialSidebar"},{path:"/troubleshooting/send-logs",component:d("/troubleshooting/send-logs","5e1"),exact:!0,sidebar:"tutorialSidebar"}]}]}]},{path:"*",component:d("*")}]},60774:(e,t,n)=>{var r,o;!function(){var a,i,s,l,c,u,d,p,f,m,h,g,y,b,v,w,S,k,x,_,E,O,j,C,P,A,T,I,N,R,L=function(e){var t=new L.Builder;return t.pipeline.add(L.trimmer,L.stopWordFilter,L.stemmer),t.searchPipeline.add(L.stemmer),e.call(t,t),t.build()};L.version="2.3.9",L.utils={},L.utils.warn=(a=this,function(e){a.console&&console.warn&&console.warn(e)}),L.utils.asString=function(e){return null==e?"":e.toString()},L.utils.clone=function(e){if(null==e)return e;for(var t=Object.create(null),n=Object.keys(e),r=0;r0){var l=L.utils.clone(t)||{};l.position=[i,s],l.index=o.length,o.push(new L.Token(n.slice(i,a),l))}i=a+1}}return o},L.tokenizer.separator=/[\s\-]+/,L.Pipeline=function(){this._stack=[]},L.Pipeline.registeredFunctions=Object.create(null),L.Pipeline.registerFunction=function(e,t){t in this.registeredFunctions&&L.utils.warn("Overwriting existing registered function: "+t),e.label=t,L.Pipeline.registeredFunctions[e.label]=e},L.Pipeline.warnIfFunctionNotRegistered=function(e){e.label&&e.label in this.registeredFunctions||L.utils.warn("Function is not registered with pipeline. This may cause problems when serialising the index.\n",e)},L.Pipeline.load=function(e){var t=new L.Pipeline;return e.forEach((function(e){var n=L.Pipeline.registeredFunctions[e];if(!n)throw new Error("Cannot load unregistered function: "+e);t.add(n)})),t},L.Pipeline.prototype.add=function(){Array.prototype.slice.call(arguments).forEach((function(e){L.Pipeline.warnIfFunctionNotRegistered(e),this._stack.push(e)}),this)},L.Pipeline.prototype.after=function(e,t){L.Pipeline.warnIfFunctionNotRegistered(t);var n=this._stack.indexOf(e);if(-1==n)throw new Error("Cannot find existingFn");n+=1,this._stack.splice(n,0,t)},L.Pipeline.prototype.before=function(e,t){L.Pipeline.warnIfFunctionNotRegistered(t);var n=this._stack.indexOf(e);if(-1==n)throw new Error("Cannot find existingFn");this._stack.splice(n,0,t)},L.Pipeline.prototype.remove=function(e){var t=this._stack.indexOf(e);-1!=t&&this._stack.splice(t,1)},L.Pipeline.prototype.run=function(e){for(var t=this._stack.length,n=0;n1&&(ae&&(n=o),a!=e);)r=n-t,o=t+Math.floor(r/2),a=this.elements[2*o];return a==e||a>e?2*o:as?c+=2:i==s&&(t+=n[l+1]*r[c+1],l+=2,c+=2);return t},L.Vector.prototype.similarity=function(e){return this.dot(e)/this.magnitude()||0},L.Vector.prototype.toArray=function(){for(var e=new Array(this.elements.length/2),t=1,n=0;t0){var a,i=o.str.charAt(0);i in o.node.edges?a=o.node.edges[i]:(a=new L.TokenSet,o.node.edges[i]=a),1==o.str.length&&(a.final=!0),r.push({node:a,editsRemaining:o.editsRemaining,str:o.str.slice(1)})}if(0!=o.editsRemaining){if("*"in o.node.edges)var s=o.node.edges["*"];else{s=new L.TokenSet;o.node.edges["*"]=s}if(0==o.str.length&&(s.final=!0),r.push({node:s,editsRemaining:o.editsRemaining-1,str:o.str}),o.str.length>1&&r.push({node:o.node,editsRemaining:o.editsRemaining-1,str:o.str.slice(1)}),1==o.str.length&&(o.node.final=!0),o.str.length>=1){if("*"in o.node.edges)var l=o.node.edges["*"];else{l=new L.TokenSet;o.node.edges["*"]=l}1==o.str.length&&(l.final=!0),r.push({node:l,editsRemaining:o.editsRemaining-1,str:o.str.slice(1)})}if(o.str.length>1){var c,u=o.str.charAt(0),d=o.str.charAt(1);d in o.node.edges?c=o.node.edges[d]:(c=new L.TokenSet,o.node.edges[d]=c),1==o.str.length&&(c.final=!0),r.push({node:c,editsRemaining:o.editsRemaining-1,str:u+o.str.slice(2)})}}}return n},L.TokenSet.fromString=function(e){for(var t=new L.TokenSet,n=t,r=0,o=e.length;r=e;t--){var n=this.uncheckedNodes[t],r=n.child.toString();r in this.minimizedNodes?n.parent.edges[n.char]=this.minimizedNodes[r]:(n.child._str=r,this.minimizedNodes[r]=n.child),this.uncheckedNodes.pop()}},L.Index=function(e){this.invertedIndex=e.invertedIndex,this.fieldVectors=e.fieldVectors,this.tokenSet=e.tokenSet,this.fields=e.fields,this.pipeline=e.pipeline},L.Index.prototype.search=function(e){return this.query((function(t){new L.QueryParser(e,t).parse()}))},L.Index.prototype.query=function(e){for(var t=new L.Query(this.fields),n=Object.create(null),r=Object.create(null),o=Object.create(null),a=Object.create(null),i=Object.create(null),s=0;s1?1:e},L.Builder.prototype.k1=function(e){this._k1=e},L.Builder.prototype.add=function(e,t){var n=e[this._ref],r=Object.keys(this._fields);this._documents[n]=t||{},this.documentCount+=1;for(var o=0;o=this.length)return L.QueryLexer.EOS;var e=this.str.charAt(this.pos);return this.pos+=1,e},L.QueryLexer.prototype.width=function(){return this.pos-this.start},L.QueryLexer.prototype.ignore=function(){this.start==this.pos&&(this.pos+=1),this.start=this.pos},L.QueryLexer.prototype.backup=function(){this.pos-=1},L.QueryLexer.prototype.acceptDigitRun=function(){var e,t;do{t=(e=this.next()).charCodeAt(0)}while(t>47&&t<58);e!=L.QueryLexer.EOS&&this.backup()},L.QueryLexer.prototype.more=function(){return this.pos1&&(e.backup(),e.emit(L.QueryLexer.TERM)),e.ignore(),e.more())return L.QueryLexer.lexText},L.QueryLexer.lexEditDistance=function(e){return e.ignore(),e.acceptDigitRun(),e.emit(L.QueryLexer.EDIT_DISTANCE),L.QueryLexer.lexText},L.QueryLexer.lexBoost=function(e){return e.ignore(),e.acceptDigitRun(),e.emit(L.QueryLexer.BOOST),L.QueryLexer.lexText},L.QueryLexer.lexEOS=function(e){e.width()>0&&e.emit(L.QueryLexer.TERM)},L.QueryLexer.termSeparator=L.tokenizer.separator,L.QueryLexer.lexText=function(e){for(;;){var t=e.next();if(t==L.QueryLexer.EOS)return L.QueryLexer.lexEOS;if(92!=t.charCodeAt(0)){if(":"==t)return L.QueryLexer.lexField;if("~"==t)return e.backup(),e.width()>0&&e.emit(L.QueryLexer.TERM),L.QueryLexer.lexEditDistance;if("^"==t)return e.backup(),e.width()>0&&e.emit(L.QueryLexer.TERM),L.QueryLexer.lexBoost;if("+"==t&&1===e.width())return e.emit(L.QueryLexer.PRESENCE),L.QueryLexer.lexText;if("-"==t&&1===e.width())return e.emit(L.QueryLexer.PRESENCE),L.QueryLexer.lexText;if(t.match(L.QueryLexer.termSeparator))return L.QueryLexer.lexTerm}else e.escapeCharacter()}},L.QueryParser=function(e,t){this.lexer=new L.QueryLexer(e),this.query=t,this.currentClause={},this.lexemeIdx=0},L.QueryParser.prototype.parse=function(){this.lexer.run(),this.lexemes=this.lexer.lexemes;for(var e=L.QueryParser.parseClause;e;)e=e(this);return this.query},L.QueryParser.prototype.peekLexeme=function(){return this.lexemes[this.lexemeIdx]},L.QueryParser.prototype.consumeLexeme=function(){var e=this.peekLexeme();return this.lexemeIdx+=1,e},L.QueryParser.prototype.nextClause=function(){var e=this.currentClause;this.query.clause(e),this.currentClause={}},L.QueryParser.parseClause=function(e){var t=e.peekLexeme();if(null!=t)switch(t.type){case L.QueryLexer.PRESENCE:return L.QueryParser.parsePresence;case L.QueryLexer.FIELD:return L.QueryParser.parseField;case L.QueryLexer.TERM:return L.QueryParser.parseTerm;default:var n="expected either a field or a term, found "+t.type;throw t.str.length>=1&&(n+=" with value '"+t.str+"'"),new L.QueryParseError(n,t.start,t.end)}},L.QueryParser.parsePresence=function(e){var t=e.consumeLexeme();if(null!=t){switch(t.str){case"-":e.currentClause.presence=L.Query.presence.PROHIBITED;break;case"+":e.currentClause.presence=L.Query.presence.REQUIRED;break;default:var n="unrecognised presence operator'"+t.str+"'";throw new L.QueryParseError(n,t.start,t.end)}var r=e.peekLexeme();if(null==r){n="expecting term or field, found nothing";throw new L.QueryParseError(n,t.start,t.end)}switch(r.type){case L.QueryLexer.FIELD:return L.QueryParser.parseField;case L.QueryLexer.TERM:return L.QueryParser.parseTerm;default:n="expecting term or field, found '"+r.type+"'";throw new L.QueryParseError(n,r.start,r.end)}}},L.QueryParser.parseField=function(e){var t=e.consumeLexeme();if(null!=t){if(-1==e.query.allFields.indexOf(t.str)){var n=e.query.allFields.map((function(e){return"'"+e+"'"})).join(", "),r="unrecognised field '"+t.str+"', possible fields: "+n;throw new L.QueryParseError(r,t.start,t.end)}e.currentClause.fields=[t.str];var o=e.peekLexeme();if(null==o){r="expecting term, found nothing";throw new L.QueryParseError(r,t.start,t.end)}if(o.type===L.QueryLexer.TERM)return L.QueryParser.parseTerm;r="expecting term, found '"+o.type+"'";throw new L.QueryParseError(r,o.start,o.end)}},L.QueryParser.parseTerm=function(e){var t=e.consumeLexeme();if(null!=t){e.currentClause.term=t.str.toLowerCase(),-1!=t.str.indexOf("*")&&(e.currentClause.usePipeline=!1);var n=e.peekLexeme();if(null!=n)switch(n.type){case L.QueryLexer.TERM:return e.nextClause(),L.QueryParser.parseTerm;case L.QueryLexer.FIELD:return e.nextClause(),L.QueryParser.parseField;case L.QueryLexer.EDIT_DISTANCE:return L.QueryParser.parseEditDistance;case L.QueryLexer.BOOST:return L.QueryParser.parseBoost;case L.QueryLexer.PRESENCE:return e.nextClause(),L.QueryParser.parsePresence;default:var r="Unexpected lexeme type '"+n.type+"'";throw new L.QueryParseError(r,n.start,n.end)}else e.nextClause()}},L.QueryParser.parseEditDistance=function(e){var t=e.consumeLexeme();if(null!=t){var n=parseInt(t.str,10);if(isNaN(n)){var r="edit distance must be numeric";throw new L.QueryParseError(r,t.start,t.end)}e.currentClause.editDistance=n;var o=e.peekLexeme();if(null!=o)switch(o.type){case L.QueryLexer.TERM:return e.nextClause(),L.QueryParser.parseTerm;case L.QueryLexer.FIELD:return e.nextClause(),L.QueryParser.parseField;case L.QueryLexer.EDIT_DISTANCE:return L.QueryParser.parseEditDistance;case L.QueryLexer.BOOST:return L.QueryParser.parseBoost;case L.QueryLexer.PRESENCE:return e.nextClause(),L.QueryParser.parsePresence;default:r="Unexpected lexeme type '"+o.type+"'";throw new L.QueryParseError(r,o.start,o.end)}else e.nextClause()}},L.QueryParser.parseBoost=function(e){var t=e.consumeLexeme();if(null!=t){var n=parseInt(t.str,10);if(isNaN(n)){var r="boost must be numeric";throw new L.QueryParseError(r,t.start,t.end)}e.currentClause.boost=n;var o=e.peekLexeme();if(null!=o)switch(o.type){case L.QueryLexer.TERM:return e.nextClause(),L.QueryParser.parseTerm;case L.QueryLexer.FIELD:return e.nextClause(),L.QueryParser.parseField;case L.QueryLexer.EDIT_DISTANCE:return L.QueryParser.parseEditDistance;case L.QueryLexer.BOOST:return L.QueryParser.parseBoost;case L.QueryLexer.PRESENCE:return e.nextClause(),L.QueryParser.parsePresence;default:r="Unexpected lexeme type '"+o.type+"'";throw new L.QueryParseError(r,o.start,o.end)}else e.nextClause()}},void 0===(o="function"==typeof(r=function(){return L})?r.call(t,n,t,e):r)||(e.exports=o)}()},48848:(e,t,n)=>{"use strict";n.d(t,{o:()=>a,x:()=>i});var r=n(96540),o=n(74848);const a=r.createContext(!1);function i(e){let{children:t}=e;const[n,i]=(0,r.useState)(!1);return(0,r.useEffect)((()=>{i(!0)}),[]),(0,o.jsx)(a.Provider,{value:n,children:t})}},45022:(e,t,n)=>{"use strict";var r=n(96540),o=n(5338),a=n(54625),i=n(80545),s=n(31712);const l=[n(89128),n(85300),n(74753),n(75729),n(58252)];var c=n(92413),u=n(56347),d=n(22831),p=n(74848);function f(e){let{children:t}=e;return(0,p.jsx)(p.Fragment,{children:t})}var m=n(21141),h=n(97639),g=n(98180),y=n(86957),b=n(69817),v=n(2098),w=n(19503),S=n(61482),k=n(64609),x=n(51210);function _(){const{i18n:{currentLocale:e,defaultLocale:t,localeConfigs:n}}=(0,h.A)(),r=(0,v.o)(),o=n[e].htmlLang,a=e=>e.replace("-","_");return(0,p.jsxs)(m.A,{children:[Object.entries(n).map((e=>{let[t,{htmlLang:n}]=e;return(0,p.jsx)("link",{rel:"alternate",href:r.createUrl({locale:t,fullyQualified:!0}),hrefLang:n},t)})),(0,p.jsx)("link",{rel:"alternate",href:r.createUrl({locale:t,fullyQualified:!0}),hrefLang:"x-default"}),(0,p.jsx)("meta",{property:"og:locale",content:a(o)}),Object.values(n).filter((e=>o!==e.htmlLang)).map((e=>(0,p.jsx)("meta",{property:"og:locale:alternate",content:a(e.htmlLang)},`meta-og-${e.htmlLang}`)))]})}function E(e){let{permalink:t}=e;const{siteConfig:{url:n}}=(0,h.A)(),r=function(){const{siteConfig:{url:e,baseUrl:t,trailingSlash:n}}=(0,h.A)(),{pathname:r}=(0,u.zy)();return e+(0,k.applyTrailingSlash)((0,g.A)(r),{trailingSlash:n,baseUrl:t})}(),o=t?`${n}${t}`:r;return(0,p.jsxs)(m.A,{children:[(0,p.jsx)("meta",{property:"og:url",content:o}),(0,p.jsx)("link",{rel:"canonical",href:o})]})}function O(){const{i18n:{currentLocale:e}}=(0,h.A)(),{metadata:t,image:n}=(0,y.p)();return(0,p.jsxs)(p.Fragment,{children:[(0,p.jsxs)(m.A,{children:[(0,p.jsx)("meta",{name:"twitter:card",content:"summary_large_image"}),(0,p.jsx)("body",{className:w.w})]}),n&&(0,p.jsx)(b.be,{image:n}),(0,p.jsx)(E,{}),(0,p.jsx)(_,{}),(0,p.jsx)(x.A,{tag:S.Cy,locale:e}),(0,p.jsx)(m.A,{children:t.map(((e,t)=>(0,p.jsx)("meta",{...e},t)))})]})}const j=new Map;function C(e){if(j.has(e.pathname))return{...e,pathname:j.get(e.pathname)};if((0,d.u)(c.A,e.pathname).some((e=>{let{route:t}=e;return!0===t.exact})))return j.set(e.pathname,e.pathname),e;const t=e.pathname.trim().replace(/(?:\/index)?\.html$/,"")||"/";return j.set(e.pathname,t),{...e,pathname:t}}var P=n(48848),A=n(53366),T=n(36494);function I(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r{const r=t.default?.[e]??t[e];return r?.(...n)}));return()=>o.forEach((e=>e?.()))}const N=function(e){let{children:t,location:n,previousLocation:r}=e;return(0,T.A)((()=>{r!==n&&(!function(e){let{location:t,previousLocation:n}=e;if(!n)return;const r=t.pathname===n.pathname,o=t.hash===n.hash,a=t.search===n.search;if(r&&o&&!a)return;const{hash:i}=t;if(i){const e=decodeURIComponent(i.substring(1)),t=document.getElementById(e);t?.scrollIntoView()}else window.scrollTo(0,0)}({location:n,previousLocation:r}),I("onRouteDidUpdate",{previousLocation:r,location:n}))}),[r,n]),t};function R(e){const t=Array.from(new Set([e,decodeURI(e)])).map((e=>(0,d.u)(c.A,e))).flat();return Promise.all(t.map((e=>e.route.component.preload?.())))}class L extends r.Component{previousLocation;routeUpdateCleanupCb;constructor(e){super(e),this.previousLocation=null,this.routeUpdateCleanupCb=s.A.canUseDOM?I("onRouteUpdate",{previousLocation:null,location:this.props.location}):()=>{},this.state={nextRouteHasLoaded:!0}}shouldComponentUpdate(e,t){if(e.location===this.props.location)return t.nextRouteHasLoaded;const n=e.location;return this.previousLocation=this.props.location,this.setState({nextRouteHasLoaded:!1}),this.routeUpdateCleanupCb=I("onRouteUpdate",{previousLocation:this.previousLocation,location:n}),R(n.pathname).then((()=>{this.routeUpdateCleanupCb(),this.setState({nextRouteHasLoaded:!0})})).catch((e=>{console.warn(e),window.location.reload()})),!1}render(){const{children:e,location:t}=this.props;return(0,p.jsx)(N,{previousLocation:this.previousLocation,location:t,children:(0,p.jsx)(u.qh,{location:t,render:()=>e})})}}const D=L,F="__docusaurus-base-url-issue-banner-container",z="__docusaurus-base-url-issue-banner",M="__docusaurus-base-url-issue-banner-suggestion-container";function B(e){return`\ndocument.addEventListener('DOMContentLoaded', function maybeInsertBanner() {\n var shouldInsert = typeof window['docusaurus'] === 'undefined';\n shouldInsert && insertBanner();\n});\n\nfunction insertBanner() {\n var bannerContainer = document.createElement('div');\n bannerContainer.id = '${F}';\n var bannerHtml = ${JSON.stringify(function(e){return`\n
\n

Your Docusaurus site did not load properly.

\n

A very common reason is a wrong site baseUrl configuration.

\n

Current configured baseUrl = ${e} ${"/"===e?" (default value)":""}

\n

We suggest trying baseUrl =

\n
\n`}(e)).replace(/{if("undefined"==typeof document)return void n();const r=document.createElement("link");r.setAttribute("rel","prefetch"),r.setAttribute("href",e),r.onload=()=>t(),r.onerror=()=>n();const o=document.getElementsByTagName("head")[0]??document.getElementsByName("script")[0]?.parentNode;o?.appendChild(r)}))}:function(e){return new Promise(((t,n)=>{const r=new XMLHttpRequest;r.open("GET",e,!0),r.withCredentials=!0,r.onload=()=>{200===r.status?t():n()},r.send(null)}))};var Y=n(81604);const J=new Set,Z=new Set,X=()=>navigator.connection?.effectiveType.includes("2g")||navigator.connection?.saveData,ee={prefetch(e){if(!(e=>!X()&&!Z.has(e)&&!J.has(e))(e))return!1;J.add(e);const t=(0,d.u)(c.A,e).flatMap((e=>{return t=e.route.path,Object.entries(G).filter((e=>{let[n]=e;return n.replace(/-[^-]+$/,"")===t})).flatMap((e=>{let[,t]=e;return Object.values((0,Y.A)(t))}));var t}));return Promise.all(t.map((e=>{const t=n.gca(e);return t&&!t.includes("undefined")?K(t).catch((()=>{})):Promise.resolve()})))},preload:e=>!!(e=>!X()&&!Z.has(e))(e)&&(Z.add(e),R(e))},te=Object.freeze(ee),ne=Boolean(!0);if(s.A.canUseDOM){window.docusaurus=te;const e=document.getElementById("__docusaurus"),t=(0,p.jsx)(i.vd,{children:(0,p.jsx)(a.Kd,{children:(0,p.jsx)(W,{})})}),n=(e,t)=>{console.error("Docusaurus React Root onRecoverableError:",e,t)},s=()=>{if(ne)r.startTransition((()=>{o.hydrateRoot(e,t,{onRecoverableError:n})}));else{const a=o.createRoot(e,{onRecoverableError:n});r.startTransition((()=>{a.render(t)}))}};R(window.location.pathname).then(s)}},53366:(e,t,n)=>{"use strict";n.d(t,{o:()=>d,l:()=>p});var r=n(96540),o=n(4784);const a=JSON.parse('{"@cmfcmf/docusaurus-search-local":{"default":{"titleBoost":5,"contentBoost":1,"tagsBoost":3,"parentCategoriesBoost":2,"indexDocSidebarParentCategories":0,"maxSearchResults":8}},"docusaurus-plugin-google-gtag":{"default":{"trackingID":["G-9BVXSKWB6Z"],"anonymizeIP":false,"id":"default"}},"docusaurus-plugin-content-docs":{"default":{"path":"/","versions":[{"name":"current","label":"Next","isLast":true,"path":"/","mainDocId":"cado/intro","docs":[{"id":"cado/community-intro","path":"/cado/community-intro","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/architecture","path":"/cado/deploy/aws/architecture","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/aws-bucket","path":"/cado/deploy/aws/aws-bucket","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/aws-nfs","path":"/cado/deploy/aws/aws-nfs","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/aws-secret-manager","path":"/cado/deploy/aws/aws-secret-manager","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/aws-workers","path":"/cado/deploy/aws/aws-workers","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/cloudformation","path":"/cado/deploy/aws/cloudformation","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/iam/aws-kms","path":"/cado/deploy/aws/iam/aws-kms","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/iam/iam-description","path":"/cado/deploy/aws/iam/iam-description","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/iam/ssm","path":"/cado/deploy/aws/iam/ssm","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/iam/tighten-kms","path":"/cado/deploy/aws/iam/tighten-kms","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/networking/aws-load-balancer","path":"/cado/deploy/aws/networking/aws-load-balancer","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/networking/endpoints","path":"/cado/deploy/aws/networking/endpoints","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/networking/internet-routable-addresses","path":"/cado/deploy/aws/networking/internet-routable-addresses","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/performance-resiliency/aws-backups","path":"/cado/deploy/aws/performance-resiliency/aws-backups","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/performance-resiliency/high-availability","path":"/cado/deploy/aws/performance-resiliency/high-availability","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/regions","path":"/cado/deploy/aws/regions","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/security/data-encryption-overview","path":"/cado/deploy/aws/security/data-encryption-overview","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/security/forensics-account","path":"/cado/deploy/aws/security/forensics-account","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/security/logging","path":"/cado/deploy/aws/security/logging","sidebar":"tutorialSidebar"},{"id":"cado/deploy/aws/terraform","path":"/cado/deploy/aws/terraform","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/azure-architecture","path":"/cado/deploy/azure/azure-architecture","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/azure-bucket","path":"/cado/deploy/azure/azure-bucket","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/azure-deploy","path":"/cado/deploy/azure/azure-deploy","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/azure-nfs","path":"/cado/deploy/azure/azure-nfs","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/azure-secret-manager","path":"/cado/deploy/azure/azure-secret-manager","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/azure-workers","path":"/cado/deploy/azure/azure-workers","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/data-encryption-overview","path":"/cado/deploy/azure/data-encryption-overview","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/endpoints","path":"/cado/deploy/azure/endpoints","sidebar":"tutorialSidebar"},{"id":"cado/deploy/azure/iam-description","path":"/cado/deploy/azure/iam-description","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/add-cross-account-manual","path":"/cado/deploy/cross/add-cross-account-manual","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/adding-aws","path":"/cado/deploy/cross/adding-aws","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/adding-azure","path":"/cado/deploy/cross/adding-azure","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/adding-gcp","path":"/cado/deploy/cross/adding-gcp","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/adding-keys","path":"/cado/deploy/cross/adding-keys","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/aws-organizations","path":"/cado/deploy/cross/aws-organizations","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/aws-sts","path":"/cado/deploy/cross/aws-sts","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/azure-cross-tenancy-subscriptions","path":"/cado/deploy/cross/azure-cross-tenancy-subscriptions","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/cross_vs_individual","path":"/cado/deploy/cross/cross_vs_individual","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/cross-account-creation","path":"/cado/deploy/cross/cross-account-creation","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/cross-account-creation-api","path":"/cado/deploy/cross/cross-account-creation-api","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/cross-account-creation-auto","path":"/cado/deploy/cross/cross-account-creation-auto","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/intro","path":"/cado/deploy/cross/intro","sidebar":"tutorialSidebar"},{"id":"cado/deploy/cross/skip-role","path":"/cado/deploy/cross/skip-role","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/data-encryption-overview","path":"/cado/deploy/gcp/data-encryption-overview","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/endpoints","path":"/cado/deploy/gcp/endpoints","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-architecture","path":"/cado/deploy/gcp/gcp-architecture","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-auto-setup","path":"/cado/deploy/gcp/gcp-auto-setup","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-bucket","path":"/cado/deploy/gcp/gcp-bucket","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-cross-project","path":"/cado/deploy/gcp/gcp-cross-project","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-deploy","path":"/cado/deploy/gcp/gcp-deploy","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-nfs","path":"/cado/deploy/gcp/gcp-nfs","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-secret-manager","path":"/cado/deploy/gcp/gcp-secret-manager","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-settings","path":"/cado/deploy/gcp/gcp-settings","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/gcp-workers","path":"/cado/deploy/gcp/gcp-workers","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/iam-description","path":"/cado/deploy/gcp/iam-description","sidebar":"tutorialSidebar"},{"id":"cado/deploy/gcp/logs","path":"/cado/deploy/gcp/logs","sidebar":"tutorialSidebar"},{"id":"cado/deploy/licenses","path":"/cado/deploy/licenses","sidebar":"tutorialSidebar"},{"id":"cado/deploy/logging-in","path":"/cado/deploy/logging-in","sidebar":"tutorialSidebar"},{"id":"cado/deploy/networking-proxy","path":"/cado/deploy/networking-proxy","sidebar":"tutorialSidebar"},{"id":"cado/deploy/ports","path":"/cado/deploy/ports","sidebar":"tutorialSidebar"},{"id":"cado/deploy/tag","path":"/cado/deploy/tag","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/automation","path":"/cado/discovery-import/automation","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/aws-ami","path":"/cado/discovery-import/aws/aws-ami","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/aws-china","path":"/cado/discovery-import/aws/aws-china","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/aws-ec2","path":"/cado/discovery-import/aws/aws-ec2","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/aws-ecs","path":"/cado/discovery-import/aws/aws-ecs","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/aws-eks","path":"/cado/discovery-import/aws/aws-eks","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/aws-lambda","path":"/cado/discovery-import/aws/aws-lambda","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/aws-lightsail","path":"/cado/discovery-import/aws/aws-lightsail","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/aws-s3","path":"/cado/discovery-import/aws/aws-s3","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/ebs-direct-acquisition","path":"/cado/discovery-import/aws/ebs-direct-acquisition","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/large-aws-imports","path":"/cado/discovery-import/aws/large-aws-imports","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/aws/memory","path":"/cado/discovery-import/aws/memory","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/azure/azure-aks","path":"/cado/discovery-import/azure/azure-aks","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/azure/azure-compute","path":"/cado/discovery-import/azure/azure-compute","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/azure/azure-storage","path":"/cado/discovery-import/azure/azure-storage","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/api-deploy","path":"/cado/discovery-import/cado-host/api-deploy","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/artifacts","path":"/cado/discovery-import/cado-host/artifacts","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/aws-credentials","path":"/cado/discovery-import/cado-host/aws-credentials","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/azure-credentials","path":"/cado/discovery-import/cado-host/azure-credentials","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/cli","path":"/cado/discovery-import/cado-host/cli","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/custom-locations","path":"/cado/discovery-import/cado-host/custom-locations","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/deploy","path":"/cado/discovery-import/cado-host/deploy","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/google-credentials","path":"/cado/discovery-import/cado-host/google-credentials","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/intro","path":"/cado/discovery-import/cado-host/intro","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/manual-upload","path":"/cado/discovery-import/cado-host/manual-upload","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/script-operation","path":"/cado/discovery-import/cado-host/script-operation","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/cado-host/security","path":"/cado/discovery-import/cado-host/security","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/chain_of_custody","path":"/cado/discovery-import/chain_of_custody","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/data-types/filetypes","path":"/cado/discovery-import/data-types/filetypes","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/data-types/import-types","path":"/cado/discovery-import/data-types/import-types","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/data-types/logs","path":"/cado/discovery-import/data-types/logs","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/data-types/memory","path":"/cado/discovery-import/data-types/memory","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/gcp/engine-instance","path":"/cado/discovery-import/gcp/engine-instance","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/gcp/kubernetes-engine","path":"/cado/discovery-import/gcp/kubernetes-engine","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/gcp/storage","path":"/cado/discovery-import/gcp/storage","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/google-workspace-logs","path":"/cado/discovery-import/google-workspace-logs","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/import-from-cloud","path":"/cado/discovery-import/import-from-cloud","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/intro","path":"/cado/discovery-import/intro","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/investigations","path":"/cado/discovery-import/investigations","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/kubernetes","path":"/cado/discovery-import/kubernetes","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/m365-logs","path":"/cado/discovery-import/m365-logs","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/openshift","path":"/cado/discovery-import/openshift","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/third-party","path":"/cado/discovery-import/third-party","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/virtual-machine","path":"/cado/discovery-import/virtual-machine","sidebar":"tutorialSidebar"},{"id":"cado/discovery-import/xdr","path":"/cado/discovery-import/xdr","sidebar":"tutorialSidebar"},{"id":"cado/integrations/api-overview","path":"/cado/integrations/api-overview","sidebar":"tutorialSidebar"},{"id":"cado/integrations/cnapp/wiz","path":"/cado/integrations/cnapp/wiz","sidebar":"tutorialSidebar"},{"id":"cado/integrations/forensic-tools","path":"/cado/integrations/forensic-tools","sidebar":"tutorialSidebar"},{"id":"cado/integrations/siem","path":"/cado/integrations/siem","sidebar":"tutorialSidebar"},{"id":"cado/integrations/soar/cortex-xsoar","path":"/cado/integrations/soar/cortex-xsoar","sidebar":"tutorialSidebar"},{"id":"cado/integrations/soar/splunk-soar","path":"/cado/integrations/soar/splunk-soar","sidebar":"tutorialSidebar"},{"id":"cado/integrations/soar/tines","path":"/cado/integrations/soar/tines","sidebar":"tutorialSidebar"},{"id":"cado/integrations/webhooks","path":"/cado/integrations/webhooks","sidebar":"tutorialSidebar"},{"id":"cado/integrations/xdr/crowdstrike","path":"/cado/integrations/xdr/crowdstrike","sidebar":"tutorialSidebar"},{"id":"cado/integrations/xdr/defender","path":"/cado/integrations/xdr/defender","sidebar":"tutorialSidebar"},{"id":"cado/integrations/xdr/sentinelone","path":"/cado/integrations/xdr/sentinelone","sidebar":"tutorialSidebar"},{"id":"cado/integrations/xdr/tanium","path":"/cado/integrations/xdr/tanium","sidebar":"tutorialSidebar"},{"id":"cado/intro","path":"/cado/intro","sidebar":"tutorialSidebar"},{"id":"cado/investigate/ai investigator","path":"/cado/investigate/ai investigator","sidebar":"tutorialSidebar"},{"id":"cado/investigate/automated-investigation","path":"/cado/investigate/automated-investigation","sidebar":"tutorialSidebar"},{"id":"cado/investigate/browse-disk","path":"/cado/investigate/browse-disk","sidebar":"tutorialSidebar"},{"id":"cado/investigate/ctf-tutorial","path":"/cado/investigate/ctf-tutorial","sidebar":"tutorialSidebar"},{"id":"cado/investigate/detections","path":"/cado/investigate/detections","sidebar":"tutorialSidebar"},{"id":"cado/investigate/evidence","path":"/cado/investigate/evidence","sidebar":"tutorialSidebar"},{"id":"cado/investigate/insights","path":"/cado/investigate/insights","sidebar":"tutorialSidebar"},{"id":"cado/investigate/overview","path":"/cado/investigate/overview","sidebar":"tutorialSidebar"},{"id":"cado/investigate/response-actions","path":"/cado/investigate/response-actions","sidebar":"tutorialSidebar"},{"id":"cado/investigate/timeline-search","path":"/cado/investigate/timeline-search","sidebar":"tutorialSidebar"},{"id":"cado/manage/cost-management","path":"/cado/manage/cost-management","sidebar":"tutorialSidebar"},{"id":"cado/manage/data","path":"/cado/manage/data","sidebar":"tutorialSidebar"},{"id":"cado/manage/expand-disk","path":"/cado/manage/expand-disk","sidebar":"tutorialSidebar"},{"id":"cado/manage/monitoring","path":"/cado/manage/monitoring","sidebar":"tutorialSidebar"},{"id":"cado/manage/platform-security","path":"/cado/manage/platform-security","sidebar":"tutorialSidebar"},{"id":"cado/manage/updating","path":"/cado/manage/updating","sidebar":"tutorialSidebar"},{"id":"cado/manage/users-authentication/sso/azure-ad","path":"/cado/manage/users-authentication/sso/azure-ad","sidebar":"tutorialSidebar"},{"id":"cado/manage/users-authentication/sso/okta","path":"/cado/manage/users-authentication/sso/okta","sidebar":"tutorialSidebar"},{"id":"cado/manage/users-authentication/sso/okta_saml","path":"/cado/manage/users-authentication/sso/okta_saml","sidebar":"tutorialSidebar"},{"id":"cado/manage/users-authentication/sso/ping_saml","path":"/cado/manage/users-authentication/sso/ping_saml","sidebar":"tutorialSidebar"},{"id":"cado/manage/users-authentication/users","path":"/cado/manage/users-authentication/users","sidebar":"tutorialSidebar"},{"id":"cado/manage/workers","path":"/cado/manage/workers","sidebar":"tutorialSidebar"},{"id":"release-notes/release-notes","path":"/release-notes/","sidebar":"tutorialSidebar"},{"id":"troubleshooting/eula/commercial-eula","path":"/troubleshooting/eula/commercial-eula","sidebar":"tutorialSidebar"},{"id":"troubleshooting/eula/community-eula","path":"/troubleshooting/eula/community-eula","sidebar":"tutorialSidebar"},{"id":"troubleshooting/faq","path":"/troubleshooting/faq","sidebar":"tutorialSidebar"},{"id":"troubleshooting/get-support","path":"/troubleshooting/get-support","sidebar":"tutorialSidebar"},{"id":"troubleshooting/logs-cloudwatch","path":"/troubleshooting/logs-cloudwatch","sidebar":"tutorialSidebar"},{"id":"troubleshooting/send-logs","path":"/troubleshooting/send-logs","sidebar":"tutorialSidebar"}],"draftIds":[],"sidebars":{"tutorialSidebar":{"link":{"path":"/cado/intro","label":"cado/intro"}}}}],"breadcrumbs":true}}}'),i=JSON.parse('{"defaultLocale":"en","locales":["en"],"path":"i18n","currentLocale":"en","localeConfigs":{"en":{"label":"English","direction":"ltr","htmlLang":"en","calendar":"gregory","path":"en"}}}');var s=n(22654);const l=JSON.parse('{"docusaurusVersion":"3.0.1","siteVersion":"2.0.0","pluginVersions":{"docusaurus-plugin-content-docs":{"type":"package","name":"@docusaurus/plugin-content-docs","version":"3.0.1"},"docusaurus-plugin-content-pages":{"type":"package","name":"@docusaurus/plugin-content-pages","version":"3.0.1"},"docusaurus-plugin-google-gtag":{"type":"package","name":"@docusaurus/plugin-google-gtag","version":"3.0.1"},"docusaurus-plugin-sitemap":{"type":"package","name":"@docusaurus/plugin-sitemap","version":"3.0.1"},"docusaurus-theme-classic":{"type":"package","name":"@docusaurus/theme-classic","version":"3.0.1"},"@cmfcmf/docusaurus-search-local":{"type":"package","name":"@cmfcmf/docusaurus-search-local","version":"1.1.0"},"docusaurus-plugin-client-redirects":{"type":"package","name":"@docusaurus/plugin-client-redirects","version":"3.0.1"}}}');var c=n(74848);const u={siteConfig:o.default,siteMetadata:l,globalData:a,i18n:i,codeTranslations:s},d=r.createContext(u);function p(e){let{children:t}=e;return(0,c.jsx)(d.Provider,{value:u,children:t})}},33832:(e,t,n)=>{"use strict";n.d(t,{A:()=>f});var r=n(96540),o=n(31712),a=n(21141),i=n(64609),s=n(96491),l=n(74848);function c(e){let{error:t,tryAgain:n}=e;return(0,l.jsxs)("div",{style:{display:"flex",flexDirection:"column",justifyContent:"center",alignItems:"flex-start",minHeight:"100vh",width:"100%",maxWidth:"80ch",fontSize:"20px",margin:"0 auto",padding:"1rem"},children:[(0,l.jsx)("h1",{style:{fontSize:"3rem"},children:"This page crashed"}),(0,l.jsx)("button",{type:"button",onClick:n,style:{margin:"1rem 0",fontSize:"2rem",cursor:"pointer",borderRadius:20,padding:"1rem"},children:"Try again"}),(0,l.jsx)(u,{error:t})]})}function u(e){let{error:t}=e;const n=(0,i.getErrorCausalChain)(t).map((e=>e.message)).join("\n\nCause:\n");return(0,l.jsx)("p",{style:{whiteSpace:"pre-wrap"},children:n})}function d(e){let{error:t,tryAgain:n}=e;return(0,l.jsxs)(f,{fallback:()=>(0,l.jsx)(c,{error:t,tryAgain:n}),children:[(0,l.jsx)(a.A,{children:(0,l.jsx)("title",{children:"Page Error"})}),(0,l.jsx)(s.A,{children:(0,l.jsx)(c,{error:t,tryAgain:n})})]})}const p=e=>(0,l.jsx)(d,{...e});class f extends r.Component{constructor(e){super(e),this.state={error:null}}componentDidCatch(e){o.A.canUseDOM&&this.setState({error:e})}render(){const{children:e}=this.props,{error:t}=this.state;if(t){const e={error:t,tryAgain:()=>this.setState({error:null})};return(this.props.fallback??p)(e)}return e??null}}},31712:(e,t,n)=>{"use strict";n.d(t,{A:()=>o});const r="undefined"!=typeof window&&"document"in window&&"createElement"in window.document,o={canUseDOM:r,canUseEventListeners:r&&("addEventListener"in window||"attachEvent"in window),canUseIntersectionObserver:r&&"IntersectionObserver"in window,canUseViewport:r&&"screen"in window}},21141:(e,t,n)=>{"use strict";n.d(t,{A:()=>a});n(96540);var r=n(80545),o=n(74848);function a(e){return(0,o.jsx)(r.mg,{...e})}},35358:(e,t,n)=>{"use strict";n.d(t,{A:()=>f});var r=n(96540),o=n(54625),a=n(64609),i=n(97639),s=n(40877),l=n(31712),c=n(74848);const u=r.createContext({collectLink:()=>{}});var d=n(98180);function p(e,t){let{isNavLink:n,to:p,href:f,activeClassName:m,isActive:h,"data-noBrokenLinkCheck":g,autoAddBaseUrl:y=!0,...b}=e;const{siteConfig:{trailingSlash:v,baseUrl:w}}=(0,i.A)(),{withBaseUrl:S}=(0,d.h)(),k=(0,r.useContext)(u),x=(0,r.useRef)(null);(0,r.useImperativeHandle)(t,(()=>x.current));const _=p||f;const E=(0,s.A)(_),O=_?.replace("pathname://","");let j=void 0!==O?(C=O,y&&(e=>e.startsWith("/"))(C)?S(C):C):void 0;var C;j&&E&&(j=(0,a.applyTrailingSlash)(j,{trailingSlash:v,baseUrl:w}));const P=(0,r.useRef)(!1),A=n?o.k2:o.N_,T=l.A.canUseIntersectionObserver,I=(0,r.useRef)(),N=()=>{P.current||null==j||(window.docusaurus.preload(j),P.current=!0)};(0,r.useEffect)((()=>(!T&&E&&null!=j&&window.docusaurus.prefetch(j),()=>{T&&I.current&&I.current.disconnect()})),[I,j,T,E]);const R=j?.startsWith("#")??!1,L=!j||!E||R;return L||g||k.collectLink(j),L?(0,c.jsx)("a",{ref:x,href:j,..._&&!E&&{target:"_blank",rel:"noopener noreferrer"},...b}):(0,c.jsx)(A,{...b,onMouseEnter:N,onTouchStart:N,innerRef:e=>{x.current=e,T&&e&&E&&(I.current=new window.IntersectionObserver((t=>{t.forEach((t=>{e===t.target&&(t.isIntersecting||t.intersectionRatio>0)&&(I.current.unobserve(e),I.current.disconnect(),null!=j&&window.docusaurus.prefetch(j))}))})),I.current.observe(e))},to:j,...n&&{isActive:h,activeClassName:m}})}const f=r.forwardRef(p)},23230:(e,t,n)=>{"use strict";n.d(t,{A:()=>c,T:()=>l});var r=n(96540),o=n(74848);function a(e,t){const n=e.split(/(\{\w+\})/).map(((e,n)=>{if(n%2==1){const n=t?.[e.slice(1,-1)];if(void 0!==n)return n}return e}));return n.some((e=>(0,r.isValidElement)(e)))?n.map(((e,t)=>(0,r.isValidElement)(e)?r.cloneElement(e,{key:t}):e)).filter((e=>""!==e)):n.join("")}var i=n(22654);function s(e){let{id:t,message:n}=e;if(void 0===t&&void 0===n)throw new Error("Docusaurus translation declarations must have at least a translation id or a default translation message");return i[t??n]??n??t}function l(e,t){let{message:n,id:r}=e;return a(s({message:n,id:r}),t)}function c(e){let{children:t,id:n,values:r}=e;if(t&&"string"!=typeof t)throw console.warn("Illegal children",t),new Error("The Docusaurus component only accept simple string values");const i=s({message:t,id:n});return(0,o.jsx)(o.Fragment,{children:a(i,r)})}},44598:(e,t,n)=>{"use strict";n.d(t,{W:()=>r});const r="default"},40877:(e,t,n)=>{"use strict";function r(e){return/^(?:\w*:|\/\/)/.test(e)}function o(e){return void 0!==e&&!r(e)}n.d(t,{A:()=>o,z:()=>r})},98180:(e,t,n)=>{"use strict";n.d(t,{A:()=>s,h:()=>i});var r=n(96540),o=n(97639),a=n(40877);function i(){const{siteConfig:{baseUrl:e,url:t}}=(0,o.A)(),n=(0,r.useCallback)(((n,r)=>function(e,t,n,r){let{forcePrependBaseUrl:o=!1,absolute:i=!1}=void 0===r?{}:r;if(!n||n.startsWith("#")||(0,a.z)(n))return n;if(o)return t+n.replace(/^\//,"");if(n===t.replace(/\/$/,""))return t;const s=n.startsWith(t)?n:t+n.replace(/^\//,"");return i?e+s:s}(t,e,n,r)),[t,e]);return{withBaseUrl:n}}function s(e,t){void 0===t&&(t={});const{withBaseUrl:n}=i();return n(e,t)}},97639:(e,t,n)=>{"use strict";n.d(t,{A:()=>a});var r=n(96540),o=n(53366);function a(){return(0,r.useContext)(o.o)}},26503:(e,t,n)=>{"use strict";n.d(t,{P_:()=>i,kh:()=>a});var r=n(97639),o=n(44598);function a(e,t){void 0===t&&(t={});const n=function(){const{globalData:e}=(0,r.A)();return e}()[e];if(!n&&t.failfast)throw new Error(`Docusaurus plugin global data not found for "${e}" plugin.`);return n}function i(e,t,n){void 0===t&&(t=o.W),void 0===n&&(n={});const r=a(e),i=r?.[t];if(!i&&n.failfast)throw new Error(`Docusaurus plugin global data not found for "${e}" plugin with id "${t}".`);return i}},11062:(e,t,n)=>{"use strict";n.d(t,{A:()=>a});var r=n(96540),o=n(48848);function a(){return(0,r.useContext)(o.o)}},36494:(e,t,n)=>{"use strict";n.d(t,{A:()=>o});var r=n(96540);const o=n(31712).A.canUseDOM?r.useLayoutEffect:r.useEffect},81604:(e,t,n)=>{"use strict";n.d(t,{A:()=>o});const r=e=>"object"==typeof e&&!!e&&Object.keys(e).length>0;function o(e){const t={};return function e(n,o){Object.entries(n).forEach((n=>{let[a,i]=n;const s=o?`${o}.${a}`:a;r(i)?e(i,s):t[s]=i}))}(e),t}},23363:(e,t,n)=>{"use strict";n.d(t,{W:()=>i,o:()=>a});var r=n(96540),o=n(74848);const a=r.createContext(null);function i(e){let{children:t,value:n}=e;const i=r.useContext(a),s=(0,r.useMemo)((()=>function(e){let{parent:t,value:n}=e;if(!t){if(!n)throw new Error("Unexpected: no Docusaurus route context found");if(!("plugin"in n))throw new Error("Unexpected: Docusaurus topmost route context has no `plugin` attribute");return n}const r={...t.data,...n?.data};return{plugin:t.plugin,data:r}}({parent:i,value:n})),[i,n]);return(0,o.jsx)(a.Provider,{value:s,children:t})}},19802:(e,t,n)=>{"use strict";n.d(t,{zK:()=>h,vT:()=>d,gk:()=>p,Gy:()=>c,HW:()=>g,ht:()=>u,r7:()=>m,jh:()=>f});var r=n(56347),o=n(26503);const a=e=>e.versions.find((e=>e.isLast));function i(e,t){const n=a(e);return[...e.versions.filter((e=>e!==n)),n].find((e=>!!(0,r.B6)(t,{path:e.path,exact:!1,strict:!1})))}function s(e,t){const n=i(e,t),o=n?.docs.find((e=>!!(0,r.B6)(t,{path:e.path,exact:!0,strict:!1})));return{activeVersion:n,activeDoc:o,alternateDocVersions:o?function(t){const n={};return e.versions.forEach((e=>{e.docs.forEach((r=>{r.id===t&&(n[e.name]=r)}))})),n}(o.id):{}}}const l={},c=()=>(0,o.kh)("docusaurus-plugin-content-docs")??l,u=e=>(0,o.P_)("docusaurus-plugin-content-docs",e,{failfast:!0});function d(e){void 0===e&&(e={});const t=c(),{pathname:n}=(0,r.zy)();return function(e,t,n){void 0===n&&(n={});const o=Object.entries(e).sort(((e,t)=>t[1].path.localeCompare(e[1].path))).find((e=>{let[,n]=e;return!!(0,r.B6)(t,{path:n.path,exact:!1,strict:!1})})),a=o?{pluginId:o[0],pluginData:o[1]}:void 0;if(!a&&n.failfast)throw new Error(`Can't find active docs plugin for "${t}" pathname, while it was expected to be found. Maybe you tried to use a docs feature that can only be used on a docs-related page? Existing docs plugin paths are: ${Object.values(e).map((e=>e.path)).join(", ")}`);return a}(t,n,e)}function p(e){void 0===e&&(e={});const t=d(e),{pathname:n}=(0,r.zy)();if(!t)return;return{activePlugin:t,activeVersion:i(t.pluginData,n)}}function f(e){return u(e).versions}function m(e){const t=u(e);return a(t)}function h(e){const t=u(e),{pathname:n}=(0,r.zy)();return s(t,n)}function g(e){const t=u(e),{pathname:n}=(0,r.zy)();return function(e,t){const n=a(e);return{latestDocSuggestion:s(e,t).alternateDocVersions[n.name],latestVersionSuggestion:n}}(t,n)}},89128:(e,t,n)=>{"use strict";n.r(t),n.d(t,{default:()=>r});const r={onRouteDidUpdate(e){let{location:t,previousLocation:n}=e;!n||t.pathname===n.pathname&&t.search===n.search&&t.hash===n.hash||setTimeout((()=>{window.gtag("set","page_path",t.pathname+t.search+t.hash),window.gtag("event","page_view")}))}}},75729:(e,t,n)=>{"use strict";n.r(t),n.d(t,{default:()=>a});var r=n(5947),o=n.n(r);o().configure({showSpinner:!1});const a={onRouteUpdate(e){let{location:t,previousLocation:n}=e;if(n&&t.pathname!==n.pathname){const e=window.setTimeout((()=>{o().start()}),200);return()=>window.clearTimeout(e)}},onRouteDidUpdate(){o().done()}}},74753:(e,t,n)=>{"use strict";var r=n(78181),o=n(4784);!function(e){const{themeConfig:{prism:t}}=o.default,{additionalLanguages:r}=t;globalThis.Prism=e,r.forEach((e=>{"php"===e&&n(19700),n(18692)(`./prism-${e}`)})),delete globalThis.Prism}(r.My)},85225:(e,t,n)=>{"use strict";n.d(t,{A:()=>c});n(96540);var r=n(18215),o=n(23230),a=n(86957),i=n(35358);const s={anchorWithStickyNavbar:"anchorWithStickyNavbar_LWe7",anchorWithHideOnScrollNavbar:"anchorWithHideOnScrollNavbar_WYt5"};var l=n(74848);function c(e){let{as:t,id:n,...c}=e;const{navbar:{hideOnScroll:u}}=(0,a.p)();if("h1"===t||!n)return(0,l.jsx)(t,{...c,id:void 0});const d=(0,o.T)({id:"theme.common.headingLinkTitle",message:"Direct link to {heading}",description:"Title for link to heading"},{heading:"string"==typeof c.children?c.children:n});return(0,l.jsxs)(t,{...c,className:(0,r.A)("anchor",u?s.anchorWithHideOnScrollNavbar:s.anchorWithStickyNavbar,c.className),id:n,children:[c.children,(0,l.jsx)(i.A,{className:"hash-link",to:`#${n}`,"aria-label":d,title:d,children:"\u200b"})]})}},90716:(e,t,n)=>{"use strict";n.d(t,{A:()=>a});n(96540);const r={iconExternalLink:"iconExternalLink_nPIU"};var o=n(74848);function a(e){let{width:t=13.5,height:n=13.5}=e;return(0,o.jsx)("svg",{width:t,height:n,"aria-hidden":"true",viewBox:"0 0 24 24",className:r.iconExternalLink,children:(0,o.jsx)("path",{fill:"currentColor",d:"M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"})})}},96491:(e,t,n)=>{"use strict";n.d(t,{A:()=>ci});var r=n(96540),o=n(18215),a=n(33832),i=n(69817),s=n(56347),l=n(23230),c=n(54067),u=n(74848);const d="__docusaurus_skipToContent_fallback";function p(e){e.setAttribute("tabindex","-1"),e.focus(),e.removeAttribute("tabindex")}function f(){const e=(0,r.useRef)(null),{action:t}=(0,s.W6)(),n=(0,r.useCallback)((e=>{e.preventDefault();const t=document.querySelector("main:first-of-type")??document.getElementById(d);t&&p(t)}),[]);return(0,c.$)((n=>{let{location:r}=n;e.current&&!r.hash&&"PUSH"===t&&p(e.current)})),{containerRef:e,onClick:n}}const m=(0,l.T)({id:"theme.common.skipToMainContent",description:"The skip to content label used for accessibility, allowing to rapidly navigate to main content with keyboard tab/enter navigation",message:"Skip to main content"});function h(e){const t=e.children??m,{containerRef:n,onClick:r}=f();return(0,u.jsx)("div",{ref:n,role:"region","aria-label":m,children:(0,u.jsx)("a",{...e,href:`#${d}`,onClick:r,children:t})})}var g=n(18630),y=n(19503);const b={skipToContent:"skipToContent_fXgn"};function v(){return(0,u.jsx)(h,{className:b.skipToContent})}var w=n(86957),S=n(40002);function k(e){let{width:t=21,height:n=21,color:r="currentColor",strokeWidth:o=1.2,className:a,...i}=e;return(0,u.jsx)("svg",{viewBox:"0 0 15 15",width:t,height:n,...i,children:(0,u.jsx)("g",{stroke:r,strokeWidth:o,children:(0,u.jsx)("path",{d:"M.75.75l13.5 13.5M14.25.75L.75 14.25"})})})}const x={closeButton:"closeButton_CVFx"};function _(e){return(0,u.jsx)("button",{type:"button","aria-label":(0,l.T)({id:"theme.AnnouncementBar.closeButtonAriaLabel",message:"Close",description:"The ARIA label for close button of announcement bar"}),...e,className:(0,o.A)("clean-btn close",x.closeButton,e.className),children:(0,u.jsx)(k,{width:14,height:14,strokeWidth:3.1})})}const E={content:"content_knG7"};function O(e){const{announcementBar:t}=(0,w.p)(),{content:n}=t;return(0,u.jsx)("div",{...e,className:(0,o.A)(E.content,e.className),dangerouslySetInnerHTML:{__html:n}})}const j={announcementBar:"announcementBar_mb4j",announcementBarPlaceholder:"announcementBarPlaceholder_vyr4",announcementBarClose:"announcementBarClose_gvF7",announcementBarContent:"announcementBarContent_xLdY"};function C(){const{announcementBar:e}=(0,w.p)(),{isActive:t,close:n}=(0,S.Mj)();if(!t)return null;const{backgroundColor:r,textColor:o,isCloseable:a}=e;return(0,u.jsxs)("div",{className:j.announcementBar,style:{backgroundColor:r,color:o},role:"banner",children:[a&&(0,u.jsx)("div",{className:j.announcementBarPlaceholder}),(0,u.jsx)(O,{className:j.announcementBarContent}),a&&(0,u.jsx)(_,{onClick:n,className:j.announcementBarClose})]})}var P=n(45755),A=n(24245);var T=n(4799),I=n(70763);const N=r.createContext(null);function R(e){let{children:t}=e;const n=function(){const e=(0,P.M)(),t=(0,I.YL)(),[n,o]=(0,r.useState)(!1),a=null!==t.component,i=(0,T.ZC)(a);return(0,r.useEffect)((()=>{a&&!i&&o(!0)}),[a,i]),(0,r.useEffect)((()=>{a?e.shown||o(!0):o(!1)}),[e.shown,a]),(0,r.useMemo)((()=>[n,o]),[n])}();return(0,u.jsx)(N.Provider,{value:n,children:t})}function L(e){if(e.component){const t=e.component;return(0,u.jsx)(t,{...e.props})}}function D(){const e=(0,r.useContext)(N);if(!e)throw new T.dV("NavbarSecondaryMenuDisplayProvider");const[t,n]=e,o=(0,r.useCallback)((()=>n(!1)),[n]),a=(0,I.YL)();return(0,r.useMemo)((()=>({shown:t,hide:o,content:L(a)})),[o,a,t])}function F(e){let{header:t,primaryMenu:n,secondaryMenu:r}=e;const{shown:a}=D();return(0,u.jsxs)("div",{className:"navbar-sidebar",children:[t,(0,u.jsxs)("div",{className:(0,o.A)("navbar-sidebar__items",{"navbar-sidebar__items--show-secondary":a}),children:[(0,u.jsx)("div",{className:"navbar-sidebar__item menu",children:n}),(0,u.jsx)("div",{className:"navbar-sidebar__item menu",children:r})]})]})}var z=n(7710),M=n(11062);function B(e){return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:24,height:24,...e,children:(0,u.jsx)("path",{fill:"currentColor",d:"M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"})})}function U(e){return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:24,height:24,...e,children:(0,u.jsx)("path",{fill:"currentColor",d:"M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"})})}const $={toggle:"toggle_vylO",toggleButton:"toggleButton_gllP",darkToggleIcon:"darkToggleIcon_wfgR",lightToggleIcon:"lightToggleIcon_pyhR",toggleButtonDisabled:"toggleButtonDisabled_aARS"};function q(e){let{className:t,buttonClassName:n,value:r,onChange:a}=e;const i=(0,M.A)(),s=(0,l.T)({message:"Switch between dark and light mode (currently {mode})",id:"theme.colorToggle.ariaLabel",description:"The ARIA label for the navbar color mode toggle"},{mode:"dark"===r?(0,l.T)({message:"dark mode",id:"theme.colorToggle.ariaLabel.mode.dark",description:"The name for the dark color mode"}):(0,l.T)({message:"light mode",id:"theme.colorToggle.ariaLabel.mode.light",description:"The name for the light color mode"})});return(0,u.jsx)("div",{className:(0,o.A)($.toggle,t),children:(0,u.jsxs)("button",{className:(0,o.A)("clean-btn",$.toggleButton,!i&&$.toggleButtonDisabled,n),type:"button",onClick:()=>a("dark"===r?"light":"dark"),disabled:!i,title:s,"aria-label":s,"aria-live":"polite",children:[(0,u.jsx)(B,{className:(0,o.A)($.toggleIcon,$.lightToggleIcon)}),(0,u.jsx)(U,{className:(0,o.A)($.toggleIcon,$.darkToggleIcon)})]})})}const Q=r.memo(q),V={darkNavbarColorModeToggle:"darkNavbarColorModeToggle_X3D1"};function H(e){let{className:t}=e;const n=(0,w.p)().navbar.style,r=(0,w.p)().colorMode.disableSwitch,{colorMode:o,setColorMode:a}=(0,z.G)();return r?null:(0,u.jsx)(Q,{className:t,buttonClassName:"dark"===n?V.darkNavbarColorModeToggle:void 0,value:o,onChange:a})}var W=n(20020);function G(){return(0,u.jsx)(W.A,{className:"navbar__brand",imageClassName:"navbar__logo",titleClassName:"navbar__title text--truncate"})}function K(){const e=(0,P.M)();return(0,u.jsx)("button",{type:"button","aria-label":(0,l.T)({id:"theme.docs.sidebar.closeSidebarButtonAriaLabel",message:"Close navigation bar",description:"The ARIA label for close button of mobile sidebar"}),className:"clean-btn navbar-sidebar__close",onClick:()=>e.toggle(),children:(0,u.jsx)(k,{color:"var(--ifm-color-emphasis-600)"})})}function Y(){return(0,u.jsxs)("div",{className:"navbar-sidebar__brand",children:[(0,u.jsx)(G,{}),(0,u.jsx)(H,{className:"margin-right--md"}),(0,u.jsx)(K,{})]})}var J=n(35358),Z=n(98180),X=n(40877);function ee(e,t){return void 0!==e&&void 0!==t&&new RegExp(e,"gi").test(t)}var te=n(90716);function ne(e){let{activeBasePath:t,activeBaseRegex:n,to:r,href:o,label:a,html:i,isDropdownLink:s,prependBaseUrlToHref:l,...c}=e;const d=(0,Z.A)(r),p=(0,Z.A)(t),f=(0,Z.A)(o,{forcePrependBaseUrl:!0}),m=a&&o&&!(0,X.A)(o),h=i?{dangerouslySetInnerHTML:{__html:i}}:{children:(0,u.jsxs)(u.Fragment,{children:[a,m&&(0,u.jsx)(te.A,{...s&&{width:12,height:12}})]})};return o?(0,u.jsx)(J.A,{href:l?f:o,...c,...h}):(0,u.jsx)(J.A,{to:d,isNavLink:!0,...(t||n)&&{isActive:(e,t)=>n?ee(n,t.pathname):t.pathname.startsWith(p)},...c,...h})}function re(e){let{className:t,isDropdownItem:n=!1,...r}=e;const a=(0,u.jsx)(ne,{className:(0,o.A)(n?"dropdown__link":"navbar__item navbar__link",t),isDropdownLink:n,...r});return n?(0,u.jsx)("li",{children:a}):a}function oe(e){let{className:t,isDropdownItem:n,...r}=e;return(0,u.jsx)("li",{className:"menu__list-item",children:(0,u.jsx)(ne,{className:(0,o.A)("menu__link",t),...r})})}function ae(e){let{mobile:t=!1,position:n,...r}=e;const o=t?oe:re;return(0,u.jsx)(o,{...r,activeClassName:r.activeClassName??(t?"menu__link--active":"navbar__link--active")})}var ie=n(94549),se=n(80260),le=n(97639);const ce={dropdownNavbarItemMobile:"dropdownNavbarItemMobile_S0Fm"};function ue(e,t){return e.some((e=>function(e,t){return!!(0,se.ys)(e.to,t)||!!ee(e.activeBaseRegex,t)||!(!e.activeBasePath||!t.startsWith(e.activeBasePath))}(e,t)))}function de(e){let{items:t,position:n,className:a,onClick:i,...s}=e;const l=(0,r.useRef)(null),[c,d]=(0,r.useState)(!1);return(0,r.useEffect)((()=>{const e=e=>{l.current&&!l.current.contains(e.target)&&d(!1)};return document.addEventListener("mousedown",e),document.addEventListener("touchstart",e),document.addEventListener("focusin",e),()=>{document.removeEventListener("mousedown",e),document.removeEventListener("touchstart",e),document.removeEventListener("focusin",e)}}),[l]),(0,u.jsxs)("div",{ref:l,className:(0,o.A)("navbar__item","dropdown","dropdown--hoverable",{"dropdown--right":"right"===n,"dropdown--show":c}),children:[(0,u.jsx)(ne,{"aria-haspopup":"true","aria-expanded":c,role:"button",href:s.to?void 0:"#",className:(0,o.A)("navbar__link",a),...s,onClick:s.to?void 0:e=>e.preventDefault(),onKeyDown:e=>{"Enter"===e.key&&(e.preventDefault(),d(!c))},children:s.children??s.label}),(0,u.jsx)("ul",{className:"dropdown__menu",children:t.map(((e,t)=>(0,r.createElement)(Sa,{isDropdownItem:!0,activeClassName:"dropdown__link--active",...e,key:t})))})]})}function pe(e){let{items:t,className:n,position:a,onClick:i,...l}=e;const c=function(){const{siteConfig:{baseUrl:e}}=(0,le.A)(),{pathname:t}=(0,s.zy)();return t.replace(e,"/")}(),d=ue(t,c),{collapsed:p,toggleCollapsed:f,setCollapsed:m}=(0,ie.u)({initialState:()=>!d});return(0,r.useEffect)((()=>{d&&m(!d)}),[c,d,m]),(0,u.jsxs)("li",{className:(0,o.A)("menu__list-item",{"menu__list-item--collapsed":p}),children:[(0,u.jsx)(ne,{role:"button",className:(0,o.A)(ce.dropdownNavbarItemMobile,"menu__link menu__link--sublist menu__link--sublist-caret",n),...l,onClick:e=>{e.preventDefault(),f()},children:l.children??l.label}),(0,u.jsx)(ie.N,{lazy:!0,as:"ul",className:"menu__list",collapsed:p,children:t.map(((e,t)=>(0,r.createElement)(Sa,{mobile:!0,isDropdownItem:!0,onClick:i,activeClassName:"menu__link--active",...e,key:t})))})]})}function fe(e){let{mobile:t=!1,...n}=e;const r=t?pe:de;return(0,u.jsx)(r,{...n})}var me=n(2098);function he(e){let{width:t=20,height:n=20,...r}=e;return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:t,height:n,"aria-hidden":!0,...r,children:(0,u.jsx)("path",{fill:"currentColor",d:"M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"})})}const ge="iconLanguage_nlXk";var ye=n(40961);function be(e,t){var n=void 0;return function(){for(var r=arguments.length,o=new Array(r),a=0;ae.length)&&(t=e.length);for(var n=0,r=new Array(t);ne.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Ie(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Ne(e){for(var t=1;t=3||2===n&&r>=4||1===n&&r>=10}(e);function n(n,r,o){if(t&&void 0!==o){var a=o[0].__autocomplete_algoliaCredentials,i={"X-Algolia-Application-Id":a.appId,"X-Algolia-API-Key":a.apiKey};e.apply(void 0,[n].concat(Pe(r),[{headers:i}]))}else e.apply(void 0,[n].concat(Pe(r)))}return{init:function(t,n){e("init",{appId:t,apiKey:n})},setUserToken:function(t){e("setUserToken",t)},clickedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&n("clickedObjectIDsAfterSearch",Le(t),t[0].items)},clickedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&n("clickedObjectIDs",Le(t),t[0].items)},clickedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r0&&e.apply(void 0,["clickedFilters"].concat(n))},convertedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&n("convertedObjectIDsAfterSearch",Le(t),t[0].items)},convertedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&n("convertedObjectIDs",Le(t),t[0].items)},convertedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r0&&e.apply(void 0,["convertedFilters"].concat(n))},viewedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&t.reduce((function(e,t){var n=t.items,r=Te(t,je);return[].concat(Pe(e),Pe(function(e){for(var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:20,n=[],r=0;r0&&e.apply(void 0,["viewedFilters"].concat(n))}}}function Fe(e){var t=e.items.reduce((function(e,t){var n;return e[t.__autocomplete_indexName]=(null!==(n=e[t.__autocomplete_indexName])&&void 0!==n?n:[]).concat(t),e}),{});return Object.keys(t).map((function(e){return{index:e,items:t[e],algoliaSource:["autocomplete"]}}))}function ze(e){return e.objectID&&e.__autocomplete_indexName&&e.__autocomplete_queryID}function Me(e){return Me="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Me(e)}function Be(e){return function(e){if(Array.isArray(e))return Ue(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Ue(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Ue(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Ue(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n0&&We({onItemsChange:r,items:n,insights:l,state:t}))}}),0);return{name:"aa.algoliaInsightsPlugin",subscribe:function(e){var t=e.setContext,n=e.onSelect,r=e.onActive;function c(e){t({algoliaInsightsPlugin:{__algoliaSearchParameters:qe(qe({},i?{clickAnalytics:!0}:{}),e?{userToken:Ye(e)}:{}),insights:l}})}s("addAlgoliaAgent","insights-plugin"),c(),s("onUserTokenChange",c),s("getUserToken",null,(function(e,t){c(t)})),n((function(e){var t=e.item,n=e.state,r=e.event,a=e.source;ze(t)&&o({state:n,event:r,insights:l,item:t,insightsEvents:[qe({eventName:"Item Selected"},xe({item:t,items:a.getItems().filter(ze)}))]})})),r((function(e){var t=e.item,n=e.source,r=e.state,o=e.event;ze(t)&&a({state:r,event:o,insights:l,item:t,insightsEvents:[qe({eventName:"Item Active"},xe({item:t,items:n.getItems().filter(ze)}))]})}))},onStateChange:function(e){var t=e.state;u({state:t})},__autocomplete_pluginOptions:e}}function Ke(){var e,t=arguments.length>1?arguments[1]:void 0;return[].concat(Be(arguments.length>0&&void 0!==arguments[0]?arguments[0]:[]),["autocomplete-internal"],Be(null!==(e=t.algoliaInsightsPlugin)&&void 0!==e&&e.__automaticInsights?["autocomplete-automatic"]:[]))}function Ye(e){return"number"==typeof e?e.toString():e}function Je(e){return Je="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Je(e)}function Ze(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Xe(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Je(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Je(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Je(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function et(e,t,n){var r,o=t.initialState;return{getState:function(){return o},dispatch:function(r,a){var i=function(e){for(var t=1;te.length)&&(t=e.length);for(var n=0,r=new Array(t);n0},reshape:function(e){return e.sources}},e),{},{id:null!==(n=e.id)&&void 0!==n?n:lt(),plugins:o,initialState:yt({activeItemId:null,query:"",completion:null,collections:[],isOpen:!1,status:"idle",context:{}},e.initialState),onStateChange:function(t){var n;null===(n=e.onStateChange)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onStateChange)||void 0===n?void 0:n.call(e,t)}))},onSubmit:function(t){var n;null===(n=e.onSubmit)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onSubmit)||void 0===n?void 0:n.call(e,t)}))},onReset:function(t){var n;null===(n=e.onReset)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onReset)||void 0===n?void 0:n.call(e,t)}))},getSources:function(n){return Promise.all([].concat(mt(o.map((function(e){return e.getSources}))),[e.getSources]).filter(Boolean).map((function(e){return function(e,t){var n=[];return Promise.resolve(e(t)).then((function(e){return Array.isArray(e),Promise.all(e.filter((function(e){return Boolean(e)})).map((function(e){if(e.sourceId,n.includes(e.sourceId))throw new Error("[Autocomplete] The `sourceId` ".concat(JSON.stringify(e.sourceId)," is not unique."));n.push(e.sourceId);var t={getItemInputValue:function(e){return e.state.query},getItemUrl:function(){},onSelect:function(e){(0,e.setIsOpen)(!1)},onActive:ke,onResolve:ke};Object.keys(t).forEach((function(e){t[e].__default=!0}));var r=ut(ut({},t),e);return Promise.resolve(r)})))}))}(e,n)}))).then((function(e){return tt(e)})).then((function(e){return e.map((function(e){return yt(yt({},e),{},{onSelect:function(n){e.onSelect(n),t.forEach((function(e){var t;return null===(t=e.onSelect)||void 0===t?void 0:t.call(e,n)}))},onActive:function(n){e.onActive(n),t.forEach((function(e){var t;return null===(t=e.onActive)||void 0===t?void 0:t.call(e,n)}))},onResolve:function(n){e.onResolve(n),t.forEach((function(e){var t;return null===(t=e.onResolve)||void 0===t?void 0:t.call(e,n)}))}})}))}))},navigator:yt({navigate:function(e){var t=e.itemUrl;r.location.assign(t)},navigateNewTab:function(e){var t=e.itemUrl,n=r.open(t,"_blank","noopener");null==n||n.focus()},navigateNewWindow:function(e){var t=e.itemUrl;r.open(t,"_blank","noopener")}},e.navigator)})}function wt(e){return wt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},wt(e)}function St(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function kt(e){for(var t=1;te.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var Vt,Ht,Wt,Gt=null,Kt=(Vt=-1,Ht=-1,Wt=void 0,function(e){var t=++Vt;return Promise.resolve(e).then((function(e){return Wt&&t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var on=/((gt|sm)-|galaxy nexus)|samsung[- ]|samsungbrowser/i;function an(e){return an="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},an(e)}var sn=["props","refresh","store"],ln=["inputElement","formElement","panelElement"],cn=["inputElement"],un=["inputElement","maxLength"],dn=["source"],pn=["item","source"];function fn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function mn(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function yn(e){var t=e.props,n=e.refresh,r=e.store,o=gn(e,sn);return{getEnvironmentProps:function(e){var n=e.inputElement,o=e.formElement,a=e.panelElement;function i(e){!r.getState().isOpen&&r.pendingRequests.isEmpty()||e.target===n||!1===[o,a].some((function(t){return n=t,r=e.target,n===r||n.contains(r);var n,r}))&&(r.dispatch("blur",null),t.debug||r.pendingRequests.cancelAll())}return mn({onTouchStart:i,onMouseDown:i,onTouchMove:function(e){!1!==r.getState().isOpen&&n===t.environment.document.activeElement&&e.target!==n&&n.blur()}},gn(e,ln))},getRootProps:function(e){return mn({role:"combobox","aria-expanded":r.getState().isOpen,"aria-haspopup":"listbox","aria-owns":r.getState().isOpen?r.getState().collections.map((function(e){var n=e.source;return Jt(t.id,"list",n)})).join(" "):void 0,"aria-labelledby":Jt(t.id,"label")},e)},getFormProps:function(e){e.inputElement;return mn({action:"",noValidate:!0,role:"search",onSubmit:function(a){var i;a.preventDefault(),t.onSubmit(mn({event:a,refresh:n,state:r.getState()},o)),r.dispatch("submit",null),null===(i=e.inputElement)||void 0===i||i.blur()},onReset:function(a){var i;a.preventDefault(),t.onReset(mn({event:a,refresh:n,state:r.getState()},o)),r.dispatch("reset",null),null===(i=e.inputElement)||void 0===i||i.focus()}},gn(e,cn))},getLabelProps:function(e){return mn({htmlFor:Jt(t.id,"input"),id:Jt(t.id,"label")},e)},getInputProps:function(e){var a;function i(e){(t.openOnFocus||Boolean(r.getState().query))&&Yt(mn({event:e,props:t,query:r.getState().completion||r.getState().query,refresh:n,store:r},o)),r.dispatch("focus",null)}var s=e||{},l=(s.inputElement,s.maxLength),c=void 0===l?512:l,u=gn(s,un),d=zt(r.getState()),p=function(e){return Boolean(e&&e.match(on))}((null===(a=t.environment.navigator)||void 0===a?void 0:a.userAgent)||""),f=t.enterKeyHint||(null!=d&&d.itemUrl&&!p?"go":"search");return mn({"aria-autocomplete":"both","aria-activedescendant":r.getState().isOpen&&null!==r.getState().activeItemId?Jt(t.id,"item-".concat(r.getState().activeItemId),null==d?void 0:d.source):void 0,"aria-controls":r.getState().isOpen?r.getState().collections.map((function(e){var n=e.source;return Jt(t.id,"list",n)})).join(" "):void 0,"aria-labelledby":Jt(t.id,"label"),value:r.getState().completion||r.getState().query,id:Jt(t.id,"input"),autoComplete:"off",autoCorrect:"off",autoCapitalize:"off",enterKeyHint:f,spellCheck:"false",autoFocus:t.autoFocus,placeholder:t.placeholder,maxLength:c,type:"search",onChange:function(e){Yt(mn({event:e,props:t,query:e.currentTarget.value.slice(0,c),refresh:n,store:r},o))},onKeyDown:function(e){!function(e){var t=e.event,n=e.props,r=e.refresh,o=e.store,a=rn(e,Xt);if("ArrowUp"===t.key||"ArrowDown"===t.key){var i=function(){var e=zt(o.getState()),t=n.environment.document.getElementById(Jt(n.id,"item-".concat(o.getState().activeItemId),null==e?void 0:e.source));t&&(t.scrollIntoViewIfNeeded?t.scrollIntoViewIfNeeded(!1):t.scrollIntoView(!1))},s=function(){var e=zt(o.getState());if(null!==o.getState().activeItemId&&e){var n=e.item,i=e.itemInputValue,s=e.itemUrl,l=e.source;l.onActive(tn({event:t,item:n,itemInputValue:i,itemUrl:s,refresh:r,source:l,state:o.getState()},a))}};t.preventDefault(),!1===o.getState().isOpen&&(n.openOnFocus||Boolean(o.getState().query))?Yt(tn({event:t,props:n,query:o.getState().query,refresh:r,store:o},a)).then((function(){o.dispatch(t.key,{nextActiveItemId:n.defaultActiveItemId}),s(),setTimeout(i,0)})):(o.dispatch(t.key,{}),s(),i())}else if("Escape"===t.key)t.preventDefault(),o.dispatch(t.key,null),o.pendingRequests.cancelAll();else if("Tab"===t.key)o.dispatch("blur",null),o.pendingRequests.cancelAll();else if("Enter"===t.key){if(null===o.getState().activeItemId||o.getState().collections.every((function(e){return 0===e.items.length})))return void(n.debug||o.pendingRequests.cancelAll());t.preventDefault();var l=zt(o.getState()),c=l.item,u=l.itemInputValue,d=l.itemUrl,p=l.source;if(t.metaKey||t.ctrlKey)void 0!==d&&(p.onSelect(tn({event:t,item:c,itemInputValue:u,itemUrl:d,refresh:r,source:p,state:o.getState()},a)),n.navigator.navigateNewTab({itemUrl:d,item:c,state:o.getState()}));else if(t.shiftKey)void 0!==d&&(p.onSelect(tn({event:t,item:c,itemInputValue:u,itemUrl:d,refresh:r,source:p,state:o.getState()},a)),n.navigator.navigateNewWindow({itemUrl:d,item:c,state:o.getState()}));else if(t.altKey);else{if(void 0!==d)return p.onSelect(tn({event:t,item:c,itemInputValue:u,itemUrl:d,refresh:r,source:p,state:o.getState()},a)),void n.navigator.navigate({itemUrl:d,item:c,state:o.getState()});Yt(tn({event:t,nextState:{isOpen:!1},props:n,query:u,refresh:r,store:o},a)).then((function(){p.onSelect(tn({event:t,item:c,itemInputValue:u,itemUrl:d,refresh:r,source:p,state:o.getState()},a))}))}}}(mn({event:e,props:t,refresh:n,store:r},o))},onFocus:i,onBlur:ke,onClick:function(n){e.inputElement!==t.environment.document.activeElement||r.getState().isOpen||i(n)}},u)},getPanelProps:function(e){return mn({onMouseDown:function(e){e.preventDefault()},onMouseLeave:function(){r.dispatch("mouseleave",null)}},e)},getListProps:function(e){var n=e||{},r=n.source,o=gn(n,dn);return mn({role:"listbox","aria-labelledby":Jt(t.id,"label"),id:Jt(t.id,"list",r)},o)},getItemProps:function(e){var a=e.item,i=e.source,s=gn(e,pn);return mn({id:Jt(t.id,"item-".concat(a.__autocomplete_id),i),role:"option","aria-selected":r.getState().activeItemId===a.__autocomplete_id,onMouseMove:function(e){if(a.__autocomplete_id!==r.getState().activeItemId){r.dispatch("mousemove",a.__autocomplete_id);var t=zt(r.getState());if(null!==r.getState().activeItemId&&t){var i=t.item,s=t.itemInputValue,l=t.itemUrl,c=t.source;c.onActive(mn({event:e,item:i,itemInputValue:s,itemUrl:l,refresh:n,source:c,state:r.getState()},o))}}},onMouseDown:function(e){e.preventDefault()},onClick:function(e){var s=i.getItemInputValue({item:a,state:r.getState()}),l=i.getItemUrl({item:a,state:r.getState()});(l?Promise.resolve():Yt(mn({event:e,nextState:{isOpen:!1},props:t,query:s,refresh:n,store:r},o))).then((function(){i.onSelect(mn({event:e,item:a,itemInputValue:s,itemUrl:l,refresh:n,source:i,state:r.getState()},o))}))}},s)}}}var bn="1.13.0",vn=[{segment:"autocomplete-core",version:bn}];function wn(e){return wn="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},wn(e)}function Sn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function kn(e){for(var t=1;t=n?null===r?null:0:o}function jn(e){return jn="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},jn(e)}function Cn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Pn(e){for(var t=1;t=5&&((o||!e&&5===r)&&(i.push(r,0,o,n),r=6),e&&(i.push(r,e,0,n),r=6)),o=""},l=0;l"===t?(r=1,o=""):o=t+o[0]:a?t===a?a="":o+=t:'"'===t||"'"===t?a=t:">"===t?(s(),r=1):r&&("="===t?(r=5,n=o,o=""):"/"===t&&(r<5||">"===e[l][c+1])?(s(),3===r&&(i=i[0]),r=i,(i=i[0]).push(2,0,r),r=0):" "===t||"\t"===t||"\n"===t||"\r"===t?(s(),r=2):o+=t),3===r&&"!--"===o&&(r=4,i=i[0])}return s(),i}(e)),t),arguments,[])).length>1?t:t[0]}var Bn=function(e){var t=e.environment,n=t.document.createElementNS("http://www.w3.org/2000/svg","svg");n.setAttribute("class","aa-SubmitIcon"),n.setAttribute("viewBox","0 0 24 24"),n.setAttribute("width","20"),n.setAttribute("height","20"),n.setAttribute("fill","currentColor");var r=t.document.createElementNS("http://www.w3.org/2000/svg","path");return r.setAttribute("d","M16.041 15.856c-0.034 0.026-0.067 0.055-0.099 0.087s-0.060 0.064-0.087 0.099c-1.258 1.213-2.969 1.958-4.855 1.958-1.933 0-3.682-0.782-4.95-2.050s-2.050-3.017-2.050-4.95 0.782-3.682 2.050-4.95 3.017-2.050 4.95-2.050 3.682 0.782 4.95 2.050 2.050 3.017 2.050 4.95c0 1.886-0.745 3.597-1.959 4.856zM21.707 20.293l-3.675-3.675c1.231-1.54 1.968-3.493 1.968-5.618 0-2.485-1.008-4.736-2.636-6.364s-3.879-2.636-6.364-2.636-4.736 1.008-6.364 2.636-2.636 3.879-2.636 6.364 1.008 4.736 2.636 6.364 3.879 2.636 6.364 2.636c2.125 0 4.078-0.737 5.618-1.968l3.675 3.675c0.391 0.391 1.024 0.391 1.414 0s0.391-1.024 0-1.414z"),n.appendChild(r),n},Un=function(e){var t=e.environment,n=t.document.createElementNS("http://www.w3.org/2000/svg","svg");n.setAttribute("class","aa-ClearIcon"),n.setAttribute("viewBox","0 0 24 24"),n.setAttribute("width","18"),n.setAttribute("height","18"),n.setAttribute("fill","currentColor");var r=t.document.createElementNS("http://www.w3.org/2000/svg","path");return r.setAttribute("d","M5.293 6.707l5.293 5.293-5.293 5.293c-0.391 0.391-0.391 1.024 0 1.414s1.024 0.391 1.414 0l5.293-5.293 5.293 5.293c0.391 0.391 1.024 0.391 1.414 0s0.391-1.024 0-1.414l-5.293-5.293 5.293-5.293c0.391-0.391 0.391-1.024 0-1.414s-1.024-0.391-1.414 0l-5.293 5.293-5.293-5.293c-0.391-0.391-1.024-0.391-1.414 0s-0.391 1.024 0 1.414z"),n.appendChild(r),n},$n=function(e){var t=e.environment.document.createElementNS("http://www.w3.org/2000/svg","svg");return t.setAttribute("class","aa-LoadingIcon"),t.setAttribute("viewBox","0 0 100 100"),t.setAttribute("width","20"),t.setAttribute("height","20"),t.innerHTML='\n \n',t},qn=["ontouchstart","ontouchend","ontouchmove","ontouchcancel"];function Qn(e,t,n){e[t]=null===n?"":"number"!=typeof n?n:n+"px"}function Vn(e){this._listeners[e.type](e)}function Hn(e,t,n){var r,o,a=e[t];if("style"===t)if("string"==typeof n)e.style=n;else if(null===n)e.style="";else for(t in n)a&&n[t]===a[t]||Qn(e.style,t,n[t]);else"o"===t[0]&&"n"===t[1]?(r=t!==(t=t.replace(/Capture$/,"")),((o=t.toLowerCase())in e||qn.includes(o))&&(t=o),t=t.slice(2),e._listeners||(e._listeners={}),e._listeners[t]=n,n?a||e.addEventListener(t,Vn,r):e.removeEventListener(t,Vn,r)):"list"!==t&&"tagName"!==t&&"form"!==t&&"type"!==t&&"size"!==t&&"download"!==t&&"href"!==t&&t in e?e[t]=null==n?"":n:"function"!=typeof n&&"dangerouslySetInnerHTML"!==t&&(null==n||!1===n&&!/^ar/.test(t)?e.removeAttribute(t):e.setAttribute(t,n))}function Wn(e){return"onChange"===e?"onInput":e}function Gn(e,t){for(var n in t)Hn(e,Wn(n),t[n])}function Kn(e,t){for(var n in t)"o"===n[0]&&"n"===n[1]||Hn(e,Wn(n),t[n])}var Yn=["children"];function Jn(e){return function(e){if(Array.isArray(e))return Zn(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Zn(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Zn(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Zn(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function er(e){return function(t,n){var r=n.children,o=void 0===r?[]:r,a=Xn(n,Yn),i=e.document.createElement(t);return Gn(i,a),i.append.apply(i,Jn(o)),i}}function tr(e){return tr="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},tr(e)}var nr=["autocompleteScopeApi","environment","classNames","getInputProps","getInputPropsCore","isDetached","state"];function rr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function or(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var sr=function(e){var t=e.autocompleteScopeApi,n=e.environment,r=(e.classNames,e.getInputProps),o=e.getInputPropsCore,a=e.isDetached,i=e.state,s=ir(e,nr),l=er(n)("input",s),c=r(or({state:i,props:o({inputElement:l}),inputElement:l},t));return Gn(l,or(or({},c),{},{onKeyDown:function(e){a&&"Tab"===e.key||c.onKeyDown(e)}})),l};function lr(e){return lr="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},lr(e)}function cr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function ur(e){for(var t=1;t2&&(i.children=arguments.length>3?pr.call(arguments,2):n),"function"==typeof e&&null!=e.defaultProps)for(a in e.defaultProps)void 0===i[a]&&(i[a]=e.defaultProps[a]);return Or(e,i,r,o,null)}function Or(e,t,n,r,o){var a={type:e,props:t,key:n,ref:r,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,constructor:void 0,__v:null==o?++mr:o,__i:-1,__u:0};return null==o&&null!=fr.vnode&&fr.vnode(a),a}function jr(e){return e.children}function Cr(e,t){this.props=e,this.context=t}function Pr(e,t){if(null==t)return e.__?Pr(e.__,e.__i+1):null;for(var n;tt&&hr.sort(br));Ir.__r=0}function Nr(e,t,n,r,o,a,i,s,l,c,u){var d,p,f,m,h,g=r&&r.__k||wr,y=t.length;for(n.__d=l,Rr(n,t,g),l=n.__d,d=0;d0?Or(o.type,o.props,o.key,o.ref?o.ref:null,o.__v):o)?(o.__=e,o.__b=e.__b+1,s=Dr(o,n,i=r+d,u),o.__i=s,a=null,-1!==s&&(u--,(a=n[s])&&(a.__u|=131072)),null==a||null===a.__v?(-1==s&&d--,"function"!=typeof o.type&&(o.__u|=65536)):s!==i&&(s===i+1?d++:s>i?u>l-i?d+=s-i:d--:d=s(null!=l&&0==(131072&l.__u)?1:0))for(;i>=0||s=0){if((l=t[i])&&0==(131072&l.__u)&&o==l.key&&a===l.type)return i;i--}if(s0&&void 0!==arguments[0]?arguments[0]:[];return{get:function(){return e},add:function(t){var n=e[e.length-1];(null==n?void 0:n.isHighlighted)===t.isHighlighted?e[e.length-1]={value:n.value+t.value,isHighlighted:n.isHighlighted}:e.push(t)}}}(n?[{value:n,isHighlighted:!1}]:[]);return t.forEach((function(e){var t=e.split(Yr);r.add({value:t[0],isHighlighted:!0}),""!==t[1]&&r.add({value:t[1],isHighlighted:!1})})),r.get()}function Zr(e){return function(e){if(Array.isArray(e))return Xr(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Xr(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Xr(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Xr(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n",""":'"',"'":"'"},ro=new RegExp(/\w/i),oo=/&(amp|quot|lt|gt|#39);/g,ao=RegExp(oo.source);function io(e,t){var n,r,o,a=e[t],i=(null===(n=e[t+1])||void 0===n?void 0:n.isHighlighted)||!0,s=(null===(r=e[t-1])||void 0===r?void 0:r.isHighlighted)||!0;return ro.test((o=a.value)&&ao.test(o)?o.replace(oo,(function(e){return no[e]})):o)||s!==i?a.isHighlighted:s}function so(e){return so="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},so(e)}function lo(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function co(e){for(var t=1;te.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var jo={clearButton:"aa-ClearButton",detachedCancelButton:"aa-DetachedCancelButton",detachedContainer:"aa-DetachedContainer",detachedFormContainer:"aa-DetachedFormContainer",detachedOverlay:"aa-DetachedOverlay",detachedSearchButton:"aa-DetachedSearchButton",detachedSearchButtonIcon:"aa-DetachedSearchButtonIcon",detachedSearchButtonPlaceholder:"aa-DetachedSearchButtonPlaceholder",detachedSearchButtonQuery:"aa-DetachedSearchButtonQuery",form:"aa-Form",input:"aa-Input",inputWrapper:"aa-InputWrapper",inputWrapperPrefix:"aa-InputWrapperPrefix",inputWrapperSuffix:"aa-InputWrapperSuffix",item:"aa-Item",label:"aa-Label",list:"aa-List",loadingIndicator:"aa-LoadingIndicator",panel:"aa-Panel",panelLayout:"aa-PanelLayout aa-Panel--scrollable",root:"aa-Autocomplete",source:"aa-Source",sourceFooter:"aa-SourceFooter",sourceHeader:"aa-SourceHeader",sourceNoResults:"aa-SourceNoResults",submitButton:"aa-SubmitButton"},Co=function(e,t){var n=e.children;(0,e.render)(n,t)},Po={createElement:Er,Fragment:jr,render:Wr};function Ao(e){var t=e.panelPlacement,n=e.container,r=e.form,o=e.environment,a=n.getBoundingClientRect(),i=(o.pageYOffset||o.document.documentElement.scrollTop||o.document.body.scrollTop||0)+a.top+a.height;switch(t){case"start":return{top:i,left:a.left};case"end":return{top:i,right:o.document.documentElement.clientWidth-(a.left+a.width)};case"full-width":return{top:i,left:0,right:0,width:"unset",maxWidth:"unset"};case"input-wrapper-width":var s=r.getBoundingClientRect();return{top:i,left:s.left,right:o.document.documentElement.clientWidth-(s.left+s.width),width:"unset",maxWidth:"unset"};default:throw new Error("[Autocomplete] The `panelPlacement` value ".concat(JSON.stringify(t)," is not valid."))}}function To(e){return To="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},To(e)}function Io(){return Io=Object.assign?Object.assign.bind():function(e){for(var t=1;te.length)&&(t=e.length);for(var n=0,r=new Array(t);ne.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Jo(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Zo(e){for(var t=1;t0;if(!p.value.core.openOnFocus&&!t.query)return n;var r=Boolean(c.current||p.value.renderer.renderNoResults);return!n&&r||n},__autocomplete_metadata:{userAgents:Do,options:e}}))})),h=ve(Zo({collections:[],completion:null,context:{},isOpen:!1,query:"",activeItemId:null,status:"idle"},p.value.core.initialState)),g={getEnvironmentProps:p.value.renderer.getEnvironmentProps,getFormProps:p.value.renderer.getFormProps,getInputProps:p.value.renderer.getInputProps,getItemProps:p.value.renderer.getItemProps,getLabelProps:p.value.renderer.getLabelProps,getListProps:p.value.renderer.getListProps,getPanelProps:p.value.renderer.getPanelProps,getRootProps:p.value.renderer.getRootProps},y={setActiveItemId:m.value.setActiveItemId,setQuery:m.value.setQuery,setCollections:m.value.setCollections,setIsOpen:m.value.setIsOpen,setStatus:m.value.setStatus,setContext:m.value.setContext,refresh:m.value.refresh,navigator:m.value.navigator},b=s((function(){return Mn.bind(p.value.renderer.renderer.createElement)})),v=s((function(){return function(e){var t=e.autocomplete,n=e.autocompleteScopeApi,r=e.classNames,o=e.environment,a=e.isDetached,i=e.placeholder,s=void 0===i?"Search":i,l=e.propGetters,c=e.setIsModalOpen,u=e.state,d=e.translations,p=er(o),f=l.getRootProps(ur({state:u,props:t.getRootProps({})},n)),m=p("div",ur({class:r.root},f)),h=p("div",{class:r.detachedContainer,onMouseDown:function(e){e.stopPropagation()}}),g=p("div",{class:r.detachedOverlay,children:[h],onMouseDown:function(){c(!1),t.setIsOpen(!1)}}),y=l.getLabelProps(ur({state:u,props:t.getLabelProps({})},n)),b=p("button",{class:r.submitButton,type:"submit",title:d.submitButtonTitle,children:[Bn({environment:o})]}),v=p("label",ur({class:r.label,children:[b]},y)),w=p("button",{class:r.clearButton,type:"reset",title:d.clearButtonTitle,children:[Un({environment:o})]}),S=p("div",{class:r.loadingIndicator,children:[$n({environment:o})]}),k=sr({class:r.input,environment:o,state:u,getInputProps:l.getInputProps,getInputPropsCore:t.getInputProps,autocompleteScopeApi:n,isDetached:a}),x=p("div",{class:r.inputWrapperPrefix,children:[v,S]}),_=p("div",{class:r.inputWrapperSuffix,children:[w]}),E=p("div",{class:r.inputWrapper,children:[k]}),O=l.getFormProps(ur({state:u,props:t.getFormProps({inputElement:k})},n)),j=p("form",ur({class:r.form,children:[x,E,_]},O)),C=l.getPanelProps(ur({state:u,props:t.getPanelProps({})},n)),P=p("div",ur({class:r.panel},C)),A=p("div",{class:r.detachedSearchButtonQuery,textContent:u.query}),T=p("div",{class:r.detachedSearchButtonPlaceholder,hidden:Boolean(u.query),textContent:s});if(a){var I=p("div",{class:r.detachedSearchButtonIcon,children:[Bn({environment:o})]}),N=p("button",{type:"button",class:r.detachedSearchButton,onClick:function(){c(!0)},children:[I,T,A]}),R=p("button",{type:"button",class:r.detachedCancelButton,textContent:d.detachedCancelButtonText,onTouchStart:function(e){e.stopPropagation()},onClick:function(){t.setIsOpen(!1),c(!1)}}),L=p("div",{class:r.detachedFormContainer,children:[j,R]});h.appendChild(L),m.appendChild(N)}else m.appendChild(j);return{detachedContainer:h,detachedOverlay:g,detachedSearchButtonQuery:A,detachedSearchButtonPlaceholder:T,inputWrapper:E,input:k,root:m,form:j,label:v,submitButton:b,clearButton:w,loadingIndicator:S,panel:P}}({autocomplete:m.value,autocompleteScopeApi:y,classNames:p.value.renderer.classNames,environment:p.value.core.environment,isDetached:f.value,placeholder:p.value.core.placeholder,propGetters:g,setIsModalOpen:x,state:h.current,translations:p.value.renderer.translations})}));function w(){Gn(v.value.panel,{style:f.value?{}:Ao({panelPlacement:p.value.renderer.panelPlacement,container:v.value.root,form:v.value.form,environment:p.value.core.environment})})}function S(e){h.current=e;var t={autocomplete:m.value,autocompleteScopeApi:y,classNames:p.value.renderer.classNames,components:p.value.renderer.components,container:p.value.renderer.container,html:b.value,dom:v.value,panelContainer:f.value?v.value.detachedContainer:p.value.renderer.panelContainer,propGetters:g,state:h.current,renderer:p.value.renderer.renderer},n=!it(e)&&!c.current&&p.value.renderer.renderNoResults||p.value.renderer.render;!function(e){var t=e.autocomplete,n=e.autocompleteScopeApi,r=e.dom,o=e.propGetters,a=e.state;Kn(r.root,o.getRootProps(Ro({state:a,props:t.getRootProps({})},n))),Kn(r.input,o.getInputProps(Ro({state:a,props:t.getInputProps({inputElement:r.input}),inputElement:r.input},n))),Gn(r.label,{hidden:"stalled"===a.status}),Gn(r.loadingIndicator,{hidden:"stalled"!==a.status}),Gn(r.clearButton,{hidden:!a.query}),Gn(r.detachedSearchButtonQuery,{textContent:a.query}),Gn(r.detachedSearchButtonPlaceholder,{hidden:Boolean(a.query)})}(t),function(e,t){var n=t.autocomplete,r=t.autocompleteScopeApi,o=t.classNames,a=t.html,i=t.dom,s=t.panelContainer,l=t.propGetters,c=t.state,u=t.components,d=t.renderer;if(c.isOpen){s.contains(i.panel)||"loading"===c.status||s.appendChild(i.panel),i.panel.classList.toggle("aa-Panel--stalled","stalled"===c.status);var p=c.collections.filter((function(e){var t=e.source,n=e.items;return t.templates.noResults||n.length>0})).map((function(e,t){var i=e.source,s=e.items;return d.createElement("section",{key:t,className:o.source,"data-autocomplete-source-id":i.sourceId},i.templates.header&&d.createElement("div",{className:o.sourceHeader},i.templates.header({components:u,createElement:d.createElement,Fragment:d.Fragment,items:s,source:i,state:c,html:a})),i.templates.noResults&&0===s.length?d.createElement("div",{className:o.sourceNoResults},i.templates.noResults({components:u,createElement:d.createElement,Fragment:d.Fragment,source:i,state:c,html:a})):d.createElement("ul",Io({className:o.list},l.getListProps(Ro({state:c,props:n.getListProps({source:i})},r))),s.map((function(e){var t=n.getItemProps({item:e,source:i});return d.createElement("li",Io({key:t.id,className:o.item},l.getItemProps(Ro({state:c,props:t},r))),i.templates.item({components:u,createElement:d.createElement,Fragment:d.Fragment,item:e,state:c,html:a}))}))),i.templates.footer&&d.createElement("div",{className:o.sourceFooter},i.templates.footer({components:u,createElement:d.createElement,Fragment:d.Fragment,items:s,source:i,state:c,html:a})))})),f=d.createElement(d.Fragment,null,d.createElement("div",{className:o.panelLayout},p),d.createElement("div",{className:"aa-GradientBottom"})),m=p.reduce((function(e,t){return e[t.props["data-autocomplete-source-id"]]=t,e}),{});e(Ro(Ro({children:f,state:c,sections:p,elements:m},d),{},{components:u,html:a},r),i.panel)}else s.contains(i.panel)&&s.removeChild(i.panel)}(n,t)}function k(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};o();var t,n,r=p.value.renderer,i=r.components,s=Yo(r,Go);u.current=Uo(s,p.value.core,{components:(t=i,n=function(e){return!e.value.hasOwnProperty("__autocomplete_componentName")},Object.entries(t).reduce((function(e,t){var r=Ho(t,2),o=r[0],a=r[1];return n({key:o,value:a})?Qo(Qo({},e),{},Vo({},o,a)):e}),{})),initialState:h.current},e),l(),a(),m.value.refresh().then((function(){S(h.current)}))}function x(e){requestAnimationFrame((function(){var t=p.value.core.environment.document.body.contains(v.value.detachedOverlay);e!==t&&(e?(p.value.core.environment.document.body.appendChild(v.value.detachedOverlay),p.value.core.environment.document.body.classList.add("aa-Detached"),v.value.input.focus()):(p.value.core.environment.document.body.removeChild(v.value.detachedOverlay),p.value.core.environment.document.body.classList.remove("aa-Detached")))}))}return r((function(){var e=m.value.getEnvironmentProps({formElement:v.value.form,panelElement:v.value.panel,inputElement:v.value.input});return Gn(p.value.core.environment,e),function(){Gn(p.value.core.environment,Object.keys(e).reduce((function(e,t){return Zo(Zo({},e),{},Xo({},t,void 0))}),{}))}})),r((function(){var e=f.value?p.value.core.environment.document.body:p.value.renderer.panelContainer,t=f.value?v.value.detachedOverlay:v.value.panel;return f.value&&h.current.isOpen&&x(!0),S(h.current),function(){e.contains(t)&&e.removeChild(t)}})),r((function(){var e=p.value.renderer.container;return e.appendChild(v.value.root),function(){e.removeChild(v.value.root)}})),r((function(){var e=be((function(e){S(e.state)}),0);return d.current=function(t){var n=t.state,r=t.prevState;(f.value&&r.isOpen!==n.isOpen&&x(n.isOpen),f.value||!n.isOpen||r.isOpen||w(),n.query!==r.query)&&p.value.core.environment.document.querySelectorAll(".aa-Panel--scrollable").forEach((function(e){0!==e.scrollTop&&(e.scrollTop=0)}));e({state:n})},function(){d.current=void 0}})),r((function(){var e=be((function(){var e=f.value;f.value=p.value.core.environment.matchMedia(p.value.renderer.detachedMediaQuery).matches,e!==f.value?k({}):requestAnimationFrame(w)}),20);return p.value.core.environment.addEventListener("resize",e),function(){p.value.core.environment.removeEventListener("resize",e)}})),r((function(){if(!f.value)return function(){};function e(e){v.value.detachedContainer.classList.toggle("aa-DetachedContainer--modal",e)}function t(t){e(t.matches)}var n=p.value.core.environment.matchMedia(getComputedStyle(p.value.core.environment.document.documentElement).getPropertyValue("--aa-detached-modal-media-query"));e(n.matches);var r=Boolean(n.addEventListener);return r?n.addEventListener("change",t):n.addListener(t),function(){r?n.removeEventListener("change",t):n.removeListener(t)}})),r((function(){return requestAnimationFrame(w),function(){}})),Zo(Zo({},y),{},{update:k,destroy:function(){o()}})}var ta=n(21141);const na=n(60774),ra=na;var oa=n(689),aa=n.n(oa);function ia(){const e=(0,s.zy)(),t=(0,s.W6)(),{siteConfig:{baseUrl:n}}=(0,le.A)(),[o,a]=(0,r.useState)({terms:[],isDocsOrBlog:!1});return(0,r.useEffect)((()=>{if(!e.state?.cmfcmfhighlight||0===e.state.cmfcmfhighlight.terms.length)return;a(e.state.cmfcmfhighlight);const{cmfcmfhighlight:n,...r}=e.state;t.replace({...e,state:r})}),[e.state?.cmfcmfhighlight,t,e]),(0,r.useEffect)((()=>{if(0===o.terms.length)return;const e=o.isDocsOrBlog?document.getElementsByTagName("article")[0]:document.getElementsByTagName("main")[0];if(!e)return;const t=new(aa())(e),n={ignoreJoiners:!0};return t.mark(o.terms,n),()=>t.unmark(n)}),[o,n]),null}var sa=n(26503),la=n(61482);function ca(e){let{document:t}=e;const[n,r]=t.sectionRoute.split("#");let o=n;return r&&(o+="#"+r),o}const ua={documents:[],index:ra((function(){this.ref("id"),this.field("title"),this.field("content")}))};const da=()=>{const e=(0,M.A)(),[t,n]=(0,r.useState)((()=>!!e&&"dark"===document.documentElement.getAttribute("data-theme")));(0,r.useEffect)((()=>{const e=new MutationObserver((()=>{n("dark"===document.documentElement.getAttribute("data-theme"))}));return e.observe(document.documentElement,{attributes:!0,attributeFilter:["data-theme"]}),()=>e.disconnect()}),[]);const{siteConfig:{baseUrl:o}}=(0,le.A)(),{titleBoost:a,contentBoost:i,tagsBoost:c,parentCategoriesBoost:u,indexDocSidebarParentCategories:d,maxSearchResults:p}=(0,sa.P_)("@cmfcmf/docusaurus-search-local"),f=(0,s.W6)(),{tags:m}=(0,la.af)(),h=(0,r.useRef)(m);(0,r.useEffect)((()=>{h.current=m}),[m]);const g=(0,r.useRef)({}),y=async e=>{const t=g.current[e];switch(t?.state){case"ready":return t;case void 0:{const t=[];g.current[e]={state:"loading",callbacks:t};const n=await async function(e,t){{let r;try{const n=await fetch(`${e}search-index-${t}.json`);if(!n.ok)return ua;r=await n.json()}catch(n){return ua}return{documents:r.documents,index:ra.Index.load(r.index)}}}(o,e);return t.forEach((e=>e(n))),g.current[e]={state:"ready",...n}}case"loading":return new Promise((e=>{t.callbacks.push(e)}))}},b=(0,l.T)({message:"cmfcmf/d-s-l.searchBar.placeholder",description:"Placeholder shown in the searchbar"}),v=(0,r.useRef)(null),w=(0,r.useRef)(null);return(0,r.useEffect)((()=>{if(v.current)return w.current=ea({container:v.current,placeholder:b,renderer:{createElement:r.createElement,Fragment:r.Fragment,render:ye.render},navigator:{navigate(e){let{item:t,itemUrl:n}=e;f.push(n,{cmfcmfhighlight:{terms:t.terms,isDocsOrBlog:"docs"===t.document.type||"blog"===t.document.type}})}},detachedMediaQuery:"",defaultActiveItemId:0,translations:{clearButtonTitle:(0,l.T)({message:"cmfcmf/d-s-l.searchBar.clearButtonTitle",description:"Title of the button to clear the current search input"}),detachedCancelButtonText:(0,l.T)({message:"cmfcmf/d-s-l.searchBar.detachedCancelButtonText",description:"Text of the button to close the detached search window"}),submitButtonTitle:(0,l.T)({message:"cmfcmf/d-s-l.searchBar.submitButtonTitle",description:"Title of the button to submit a new search"})},getSources(e){let{query:t}=e;return[{sourceId:"search-results",templates:{item(e){let{item:t}=e;const n=ca(t);return r.createElement("a",{href:n,className:"aa-ItemLink",onClick:e=>{e.preventDefault(),f.push(n,{cmfcmfhighlight:{terms:t.terms,isDocsOrBlog:"docs"===t.document.type||"blog"===t.document.type}})}},r.createElement("div",{className:"aa-ItemContent"},r.createElement("div",{className:"aa-ItemContentBody"},r.createElement("div",{className:"aa-ItemContentTitle"},t.document.sectionTitle),t.document.pageTitle!==t.document.sectionTitle&&r.createElement("div",{className:"aa-ItemContentDescription"},t.document.pageTitle))),r.createElement("div",{className:"aa-ItemActions"},r.createElement("button",{className:"aa-ItemActionButton aa-DesktopOnly aa-ActiveOnly",type:"button",title:"Select"},r.createElement("svg",{viewBox:"0 0 24 24",width:"20",height:"20",fill:"currentColor"},r.createElement("path",{d:"M18.984 6.984h2.016v6h-15.188l3.609 3.609-1.406 1.406-6-6 6-6 1.406 1.406-3.609 3.609h13.172v-4.031z"})))))},noResults:()=>r.createElement("div",{className:"aa-ItemContent"},r.createElement("div",{className:"aa-ItemContentBody"},(0,l.T)({message:"cmfcmf/d-s-l.searchBar.noResults",description:"message shown if no results are found"})))},getItemUrl(e){let{item:t}=e;return ca(t)},async getItems(){const e=h.current,n=await Promise.all(e.map((e=>y(e)))),r=(e=>na.tokenizer(e).map((e=>e.str)))(t);return n.flatMap((e=>{let{index:t,documents:n}=e;return t.query((e=>{e.term(r,{fields:["title"],boost:a}),e.term(r,{fields:["title"],boost:a,wildcard:ra.Query.wildcard.TRAILING}),e.term(r,{fields:["content"],boost:i}),e.term(r,{fields:["content"],boost:i,wildcard:ra.Query.wildcard.TRAILING}),e.term(r,{fields:["tags"],boost:c}),e.term(r,{fields:["tags"],boost:c,wildcard:ra.Query.wildcard.TRAILING}),d&&(e.term(r,{fields:["sidebarParentCategories"],boost:u}),e.term(r,{fields:["sidebarParentCategories"],boost:u,wildcard:ra.Query.wildcard.TRAILING}))})).slice(0,p).map((e=>({document:n.find((t=>t.id.toString()===e.ref)),score:e.score,terms:r})))})).sort(((e,t)=>t.score-e.score)).slice(0,p)}}]}}),()=>w.current?.destroy()}),[p]),r.createElement(r.Fragment,null,r.createElement(ta.A,null,r.createElement("body",{"data-theme":t?"dark":"light"})),r.createElement(ia,null),r.createElement("div",{className:"dsla-search-wrapper"},r.createElement("div",{className:"dsla-search-field",ref:v,"data-tags":m.join(",")})))};function pa(e){return(0,u.jsx)(u.Fragment,{children:(0,u.jsx)(da,{...e})})}const fa={navbarSearchContainer:"navbarSearchContainer_Bca1"};function ma(e){let{children:t,className:n}=e;return(0,u.jsx)("div",{className:(0,o.A)(n,fa.navbarSearchContainer),children:t})}var ha=n(19802),ga=n(9048);var ya=n(2780);const ba=e=>e.docs.find((t=>t.id===e.mainDocId));const va={default:ae,localeDropdown:function(e){let{mobile:t,dropdownItemsBefore:n,dropdownItemsAfter:r,queryString:o="",...a}=e;const{i18n:{currentLocale:i,locales:c,localeConfigs:d}}=(0,le.A)(),p=(0,me.o)(),{search:f,hash:m}=(0,s.zy)(),h=[...n,...c.map((e=>{const n=`${`pathname://${p.createUrl({locale:e,fullyQualified:!1})}`}${f}${m}${o}`;return{label:d[e].label,lang:d[e].htmlLang,to:n,target:"_self",autoAddBaseUrl:!1,className:e===i?t?"menu__link--active":"dropdown__link--active":""}})),...r],g=t?(0,l.T)({message:"Languages",id:"theme.navbar.mobileLanguageDropdown.label",description:"The label for the mobile language switcher dropdown"}):d[i].label;return(0,u.jsx)(fe,{...a,mobile:t,label:(0,u.jsxs)(u.Fragment,{children:[(0,u.jsx)(he,{className:ge}),g]}),items:h})},search:function(e){let{mobile:t,className:n}=e;return t?null:(0,u.jsx)(ma,{className:n,children:(0,u.jsx)(pa,{})})},dropdown:fe,html:function(e){let{value:t,className:n,mobile:r=!1,isDropdownItem:a=!1}=e;const i=a?"li":"div";return(0,u.jsx)(i,{className:(0,o.A)({navbar__item:!r&&!a,"menu__list-item":r},n),dangerouslySetInnerHTML:{__html:t}})},doc:function(e){let{docId:t,label:n,docsPluginId:r,...o}=e;const{activeDoc:a}=(0,ha.zK)(r),i=(0,ga.QB)(t,r),s=a?.path===i?.path;return null===i||i.unlisted&&!s?null:(0,u.jsx)(ae,{exact:!0,...o,isActive:()=>s||!!a?.sidebar&&a.sidebar===i.sidebar,label:n??i.id,to:i.path})},docSidebar:function(e){let{sidebarId:t,label:n,docsPluginId:r,...o}=e;const{activeDoc:a}=(0,ha.zK)(r),i=(0,ga.fW)(t,r).link;if(!i)throw new Error(`DocSidebarNavbarItem: Sidebar with ID "${t}" doesn't have anything to be linked to.`);return(0,u.jsx)(ae,{exact:!0,...o,isActive:()=>a?.sidebar===t,label:n??i.label,to:i.path})},docsVersion:function(e){let{label:t,to:n,docsPluginId:r,...o}=e;const a=(0,ga.Vd)(r)[0],i=t??a.label,s=n??(e=>e.docs.find((t=>t.id===e.mainDocId)))(a).path;return(0,u.jsx)(ae,{...o,label:i,to:s})},docsVersionDropdown:function(e){let{mobile:t,docsPluginId:n,dropdownActiveClassDisabled:r,dropdownItemsBefore:o,dropdownItemsAfter:a,...i}=e;const{search:c,hash:d}=(0,s.zy)(),p=(0,ha.zK)(n),f=(0,ha.jh)(n),{savePreferredVersionName:m}=(0,ya.g1)(n),h=f.map((e=>{const t=p.alternateDocVersions[e.name]??ba(e);return{label:e.label,to:`${t.path}${c}${d}`,isActive:()=>e===p.activeVersion,onClick:()=>m(e.name)}})),g=[...o,...h,...a],y=(0,ga.Vd)(n)[0],b=t&&g.length>1?(0,l.T)({id:"theme.navbar.mobileVersionsDropdown.label",message:"Versions",description:"The label for the navbar versions dropdown on mobile view"}):y.label,v=t&&g.length>1?void 0:ba(y).path;return g.length<=1?(0,u.jsx)(ae,{...i,mobile:t,label:b,to:v,isActive:r?()=>!1:void 0}):(0,u.jsx)(fe,{...i,mobile:t,label:b,to:v,items:g,isActive:r?()=>!1:void 0})}},wa=va;function Sa(e){let{type:t,...n}=e;const r=function(e,t){return e&&"default"!==e?e:"items"in t?"dropdown":"default"}(t,n),o=wa[r];if(!o)throw new Error(`No NavbarItem component found for type "${t}".`);return(0,u.jsx)(o,{...n})}function ka(){const e=(0,P.M)(),t=(0,w.p)().navbar.items;return(0,u.jsx)("ul",{className:"menu__list",children:t.map(((t,n)=>(0,r.createElement)(Sa,{mobile:!0,...t,onClick:()=>e.toggle(),key:n})))})}function xa(e){return(0,u.jsx)("button",{...e,type:"button",className:"clean-btn navbar-sidebar__back",children:(0,u.jsx)(l.A,{id:"theme.navbar.mobileSidebarSecondaryMenu.backButtonLabel",description:"The label of the back button to return to main menu, inside the mobile navbar sidebar secondary menu (notably used to display the docs sidebar)",children:"\u2190 Back to main menu"})})}function _a(){const e=0===(0,w.p)().navbar.items.length,t=D();return(0,u.jsxs)(u.Fragment,{children:[!e&&(0,u.jsx)(xa,{onClick:()=>t.hide()}),t.content]})}function Ea(){const e=(0,P.M)();var t;return void 0===(t=e.shown)&&(t=!0),(0,r.useEffect)((()=>(document.body.style.overflow=t?"hidden":"visible",()=>{document.body.style.overflow="visible"})),[t]),e.shouldRender?(0,u.jsx)(F,{header:(0,u.jsx)(Y,{}),primaryMenu:(0,u.jsx)(ka,{}),secondaryMenu:(0,u.jsx)(_a,{})}):null}const Oa={navbarHideable:"navbarHideable_m1mJ",navbarHidden:"navbarHidden_jGov"};function ja(e){return(0,u.jsx)("div",{role:"presentation",...e,className:(0,o.A)("navbar-sidebar__backdrop",e.className)})}function Ca(e){let{children:t}=e;const{navbar:{hideOnScroll:n,style:a}}=(0,w.p)(),i=(0,P.M)(),{navbarRef:s,isNavbarVisible:d}=function(e){const[t,n]=(0,r.useState)(e),o=(0,r.useRef)(!1),a=(0,r.useRef)(0),i=(0,r.useCallback)((e=>{null!==e&&(a.current=e.getBoundingClientRect().height)}),[]);return(0,A.Mq)(((t,r)=>{let{scrollY:i}=t;if(!e)return;if(i=s?n(!1):i+c{if(!e)return;const r=t.location.hash;if(r?document.getElementById(r.substring(1)):void 0)return o.current=!0,void n(!1);n(!0)})),{navbarRef:i,isNavbarVisible:t}}(n);return(0,u.jsxs)("nav",{ref:s,"aria-label":(0,l.T)({id:"theme.NavBar.navAriaLabel",message:"Main",description:"The ARIA label for the main navigation"}),className:(0,o.A)("navbar","navbar--fixed-top",n&&[Oa.navbarHideable,!d&&Oa.navbarHidden],{"navbar--dark":"dark"===a,"navbar--primary":"primary"===a,"navbar-sidebar--show":i.shown}),children:[t,(0,u.jsx)(ja,{onClick:i.toggle}),(0,u.jsx)(Ea,{})]})}var Pa=n(64609);const Aa={errorBoundaryError:"errorBoundaryError_a6uf",errorBoundaryFallback:"errorBoundaryFallback_VBag"};function Ta(e){return(0,u.jsx)("button",{type:"button",...e,children:(0,u.jsx)(l.A,{id:"theme.ErrorPageContent.tryAgain",description:"The label of the button to try again rendering when the React error boundary captures an error",children:"Try again"})})}function Ia(e){let{error:t}=e;const n=(0,Pa.getErrorCausalChain)(t).map((e=>e.message)).join("\n\nCause:\n");return(0,u.jsx)("p",{className:Aa.errorBoundaryError,children:n})}class Na extends r.Component{componentDidCatch(e,t){throw this.props.onError(e,t)}render(){return this.props.children}}const Ra="right";function La(e){let{width:t=30,height:n=30,className:r,...o}=e;return(0,u.jsx)("svg",{className:r,width:t,height:n,viewBox:"0 0 30 30","aria-hidden":"true",...o,children:(0,u.jsx)("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"})})}function Da(){const{toggle:e,shown:t}=(0,P.M)();return(0,u.jsx)("button",{onClick:e,"aria-label":(0,l.T)({id:"theme.docs.sidebar.toggleSidebarButtonAriaLabel",message:"Toggle navigation bar",description:"The ARIA label for hamburger menu button of mobile navigation"}),"aria-expanded":t,className:"navbar__toggle clean-btn",type:"button",children:(0,u.jsx)(La,{})})}const Fa={colorModeToggle:"colorModeToggle_DEke"};function za(e){let{items:t}=e;return(0,u.jsx)(u.Fragment,{children:t.map(((e,t)=>(0,u.jsx)(Na,{onError:t=>new Error(`A theme navbar item failed to render.\nPlease double-check the following navbar item (themeConfig.navbar.items) of your Docusaurus config:\n${JSON.stringify(e,null,2)}`,{cause:t}),children:(0,u.jsx)(Sa,{...e})},t)))})}function Ma(e){let{left:t,right:n}=e;return(0,u.jsxs)("div",{className:"navbar__inner",children:[(0,u.jsx)("div",{className:"navbar__items",children:t}),(0,u.jsx)("div",{className:"navbar__items navbar__items--right",children:n})]})}function Ba(){const e=(0,P.M)(),t=(0,w.p)().navbar.items,[n,r]=function(e){function t(e){return"left"===(e.position??Ra)}return[e.filter(t),e.filter((e=>!t(e)))]}(t),o=t.find((e=>"search"===e.type));return(0,u.jsx)(Ma,{left:(0,u.jsxs)(u.Fragment,{children:[!e.disabled&&(0,u.jsx)(Da,{}),(0,u.jsx)(G,{}),(0,u.jsx)(za,{items:n})]}),right:(0,u.jsxs)(u.Fragment,{children:[(0,u.jsx)(za,{items:r}),(0,u.jsx)(H,{className:Fa.colorModeToggle}),!o&&(0,u.jsx)(ma,{children:(0,u.jsx)(pa,{})})]})})}function Ua(){return(0,u.jsx)(Ca,{children:(0,u.jsx)(Ba,{})})}function $a(e){let{item:t}=e;const{to:n,href:r,label:o,prependBaseUrlToHref:a,...i}=t,s=(0,Z.A)(n),l=(0,Z.A)(r,{forcePrependBaseUrl:!0});return(0,u.jsxs)(J.A,{className:"footer__link-item",...r?{href:a?l:r}:{to:s},...i,children:[o,r&&!(0,X.A)(r)&&(0,u.jsx)(te.A,{})]})}function qa(e){let{item:t}=e;return t.html?(0,u.jsx)("li",{className:"footer__item",dangerouslySetInnerHTML:{__html:t.html}}):(0,u.jsx)("li",{className:"footer__item",children:(0,u.jsx)($a,{item:t})},t.href??t.to)}function Qa(e){let{column:t}=e;return(0,u.jsxs)("div",{className:"col footer__col",children:[(0,u.jsx)("div",{className:"footer__title",children:t.title}),(0,u.jsx)("ul",{className:"footer__items clean-list",children:t.items.map(((e,t)=>(0,u.jsx)(qa,{item:e},t)))})]})}function Va(e){let{columns:t}=e;return(0,u.jsx)("div",{className:"row footer__links",children:t.map(((e,t)=>(0,u.jsx)(Qa,{column:e},t)))})}function Ha(){return(0,u.jsx)("span",{className:"footer__link-separator",children:"\xb7"})}function Wa(e){let{item:t}=e;return t.html?(0,u.jsx)("span",{className:"footer__link-item",dangerouslySetInnerHTML:{__html:t.html}}):(0,u.jsx)($a,{item:t})}function Ga(e){let{links:t}=e;return(0,u.jsx)("div",{className:"footer__links text--center",children:(0,u.jsx)("div",{className:"footer__links",children:t.map(((e,n)=>(0,u.jsxs)(r.Fragment,{children:[(0,u.jsx)(Wa,{item:e}),t.length!==n+1&&(0,u.jsx)(Ha,{})]},n)))})})}function Ka(e){let{links:t}=e;return function(e){return"title"in e[0]}(t)?(0,u.jsx)(Va,{columns:t}):(0,u.jsx)(Ga,{links:t})}var Ya=n(40975);const Ja={footerLogoLink:"footerLogoLink_BH7S"};function Za(e){let{logo:t}=e;const{withBaseUrl:n}=(0,Z.h)(),r={light:n(t.src),dark:n(t.srcDark??t.src)};return(0,u.jsx)(Ya.A,{className:(0,o.A)("footer__logo",t.className),alt:t.alt,sources:r,width:t.width,height:t.height,style:t.style})}function Xa(e){let{logo:t}=e;return t.href?(0,u.jsx)(J.A,{href:t.href,className:Ja.footerLogoLink,target:t.target,children:(0,u.jsx)(Za,{logo:t})}):(0,u.jsx)(Za,{logo:t})}function ei(e){let{copyright:t}=e;return(0,u.jsx)("div",{className:"footer__copyright",dangerouslySetInnerHTML:{__html:t}})}function ti(e){let{style:t,links:n,logo:r,copyright:a}=e;return(0,u.jsx)("footer",{className:(0,o.A)("footer",{"footer--dark":"dark"===t}),children:(0,u.jsxs)("div",{className:"container container-fluid",children:[n,(r||a)&&(0,u.jsxs)("div",{className:"footer__bottom text--center",children:[r&&(0,u.jsx)("div",{className:"margin-bottom--sm",children:r}),a]})]})})}function ni(){const{footer:e}=(0,w.p)();if(!e)return null;const{copyright:t,links:n,logo:r,style:o}=e;return(0,u.jsx)(ti,{style:o,links:n&&n.length>0&&(0,u.jsx)(Ka,{links:n}),logo:r&&(0,u.jsx)(Xa,{logo:r}),copyright:t&&(0,u.jsx)(ei,{copyright:t})})}const ri=r.memo(ni),oi=(0,T.fM)([z.a,S.oq,A.Tv,ya.VQ,i.Jx,function(e){let{children:t}=e;return(0,u.jsx)(I.y_,{children:(0,u.jsx)(P.e,{children:(0,u.jsx)(R,{children:t})})})}]);function ai(e){let{children:t}=e;return(0,u.jsx)(oi,{children:t})}var ii=n(85225);function si(e){let{error:t,tryAgain:n}=e;return(0,u.jsx)("main",{className:"container margin-vert--xl",children:(0,u.jsx)("div",{className:"row",children:(0,u.jsxs)("div",{className:"col col--6 col--offset-3",children:[(0,u.jsx)(ii.A,{as:"h1",className:"hero__title",children:(0,u.jsx)(l.A,{id:"theme.ErrorPageContent.title",description:"The title of the fallback page when the page crashed",children:"This page crashed."})}),(0,u.jsx)("div",{className:"margin-vert--lg",children:(0,u.jsx)(Ta,{onClick:n,className:"button button--primary shadow--lw"})}),(0,u.jsx)("hr",{}),(0,u.jsx)("div",{className:"margin-vert--md",children:(0,u.jsx)(Ia,{error:t})})]})})})}const li={mainWrapper:"mainWrapper_z2l0"};function ci(e){const{children:t,noFooter:n,wrapperClassName:r,title:s,description:l}=e;return(0,y.J)(),(0,u.jsxs)(ai,{children:[(0,u.jsx)(i.be,{title:s,description:l}),(0,u.jsx)(v,{}),(0,u.jsx)(C,{}),(0,u.jsx)(Ua,{}),(0,u.jsx)("div",{id:d,className:(0,o.A)(g.G.wrapper.main,li.mainWrapper,r),children:(0,u.jsx)(a.A,{fallback:e=>(0,u.jsx)(si,{...e}),children:t})}),!n&&(0,u.jsx)(ri,{})]})}},20020:(e,t,n)=>{"use strict";n.d(t,{A:()=>u});n(96540);var r=n(35358),o=n(98180),a=n(97639),i=n(86957),s=n(40975),l=n(74848);function c(e){let{logo:t,alt:n,imageClassName:r}=e;const a={light:(0,o.A)(t.src),dark:(0,o.A)(t.srcDark||t.src)},i=(0,l.jsx)(s.A,{className:t.className,sources:a,height:t.height,width:t.width,alt:n,style:t.style});return r?(0,l.jsx)("div",{className:r,children:i}):i}function u(e){const{siteConfig:{title:t}}=(0,a.A)(),{navbar:{title:n,logo:s}}=(0,i.p)(),{imageClassName:u,titleClassName:d,...p}=e,f=(0,o.A)(s?.href||"/"),m=n?"":t,h=s?.alt??m;return(0,l.jsxs)(r.A,{to:f,...p,...s?.target&&{target:s.target},children:[s&&(0,l.jsx)(c,{logo:s,alt:h,imageClassName:u}),null!=n&&(0,l.jsx)("b",{className:d,children:n})]})}},51210:(e,t,n)=>{"use strict";n.d(t,{A:()=>a});n(96540);var r=n(21141),o=n(74848);function a(e){let{locale:t,version:n,tag:a}=e;const i=t;return(0,o.jsxs)(r.A,{children:[t&&(0,o.jsx)("meta",{name:"docusaurus_locale",content:t}),n&&(0,o.jsx)("meta",{name:"docusaurus_version",content:n}),a&&(0,o.jsx)("meta",{name:"docusaurus_tag",content:a}),i&&(0,o.jsx)("meta",{name:"docsearch:language",content:i}),n&&(0,o.jsx)("meta",{name:"docsearch:version",content:n}),a&&(0,o.jsx)("meta",{name:"docsearch:docusaurus_tag",content:a})]})}},40975:(e,t,n)=>{"use strict";n.d(t,{A:()=>u});var r=n(96540),o=n(15066),a=n(11062),i=n(7710);const s={themedComponent:"themedComponent_mlkZ","themedComponent--light":"themedComponent--light_NVdE","themedComponent--dark":"themedComponent--dark_xIcU"};var l=n(74848);function c(e){let{className:t,children:n}=e;const c=(0,a.A)(),{colorMode:u}=(0,i.G)();return(0,l.jsx)(l.Fragment,{children:(c?"dark"===u?["dark"]:["light"]:["light","dark"]).map((e=>{const a=n({theme:e,className:(0,o.A)(t,s.themedComponent,s[`themedComponent--${e}`])});return(0,l.jsx)(r.Fragment,{children:a},e)}))})}function u(e){const{sources:t,className:n,alt:r,...o}=e;return(0,l.jsx)(c,{className:n,children:e=>{let{theme:n,className:a}=e;return(0,l.jsx)("img",{src:t[n],alt:r,className:a,...o})}})}},94549:(e,t,n)=>{"use strict";n.d(t,{N:()=>y,u:()=>c});var r=n(96540),o=n(31712),a=n(36494),i=n(36350),s=n(74848);const l="ease-in-out";function c(e){let{initialState:t}=e;const[n,o]=(0,r.useState)(t??!1),a=(0,r.useCallback)((()=>{o((e=>!e))}),[]);return{collapsed:n,setCollapsed:o,toggleCollapsed:a}}const u={display:"none",overflow:"hidden",height:"0px"},d={display:"block",overflow:"visible",height:"auto"};function p(e,t){const n=t?u:d;e.style.display=n.display,e.style.overflow=n.overflow,e.style.height=n.height}function f(e){let{collapsibleRef:t,collapsed:n,animation:o}=e;const a=(0,r.useRef)(!1);(0,r.useEffect)((()=>{const e=t.current;function r(){const t=e.scrollHeight,n=o?.duration??function(e){if((0,i.O)())return 1;const t=e/36;return Math.round(10*(4+15*t**.25+t/5))}(t);return{transition:`height ${n}ms ${o?.easing??l}`,height:`${t}px`}}function s(){const t=r();e.style.transition=t.transition,e.style.height=t.height}if(!a.current)return p(e,n),void(a.current=!0);return e.style.willChange="height",function(){const t=requestAnimationFrame((()=>{n?(s(),requestAnimationFrame((()=>{e.style.height=u.height,e.style.overflow=u.overflow}))):(e.style.display="block",requestAnimationFrame((()=>{s()})))}));return()=>cancelAnimationFrame(t)}()}),[t,n,o])}function m(e){if(!o.A.canUseDOM)return e?u:d}function h(e){let{as:t="div",collapsed:n,children:o,animation:a,onCollapseTransitionEnd:i,className:l,disableSSRStyle:c}=e;const u=(0,r.useRef)(null);return f({collapsibleRef:u,collapsed:n,animation:a}),(0,s.jsx)(t,{ref:u,style:c?void 0:m(n),onTransitionEnd:e=>{"height"===e.propertyName&&(p(u.current,n),i?.(n))},className:l,children:o})}function g(e){let{collapsed:t,...n}=e;const[o,i]=(0,r.useState)(!t),[l,c]=(0,r.useState)(t);return(0,a.A)((()=>{t||i(!0)}),[t]),(0,a.A)((()=>{o&&c(t)}),[o,t]),o?(0,s.jsx)(h,{...n,collapsed:l}):null}function y(e){let{lazy:t,...n}=e;const r=t?g:h;return(0,s.jsx)(r,{...n})}},40002:(e,t,n)=>{"use strict";n.d(t,{Mj:()=>h,oq:()=>m});var r=n(96540),o=n(11062),a=n(81269),i=n(4799),s=n(86957),l=n(74848);const c=(0,a.Wf)("docusaurus.announcement.dismiss"),u=(0,a.Wf)("docusaurus.announcement.id"),d=()=>"true"===c.get(),p=e=>c.set(String(e)),f=r.createContext(null);function m(e){let{children:t}=e;const n=function(){const{announcementBar:e}=(0,s.p)(),t=(0,o.A)(),[n,a]=(0,r.useState)((()=>!!t&&d()));(0,r.useEffect)((()=>{a(d())}),[]);const i=(0,r.useCallback)((()=>{p(!0),a(!0)}),[]);return(0,r.useEffect)((()=>{if(!e)return;const{id:t}=e;let n=u.get();"annoucement-bar"===n&&(n="announcement-bar");const r=t!==n;u.set(t),r&&p(!1),!r&&d()||a(!1)}),[e]),(0,r.useMemo)((()=>({isActive:!!e&&!n,close:i})),[e,n,i])}();return(0,l.jsx)(f.Provider,{value:n,children:t})}function h(){const e=(0,r.useContext)(f);if(!e)throw new i.dV("AnnouncementBarProvider");return e}},7710:(e,t,n)=>{"use strict";n.d(t,{G:()=>y,a:()=>g});var r=n(96540),o=n(31712),a=n(4799),i=n(81269),s=n(86957),l=n(74848);const c=r.createContext(void 0),u="theme",d=(0,i.Wf)(u),p={light:"light",dark:"dark"},f=e=>e===p.dark?p.dark:p.light,m=e=>o.A.canUseDOM?f(document.documentElement.getAttribute("data-theme")):f(e),h=e=>{d.set(f(e))};function g(e){let{children:t}=e;const n=function(){const{colorMode:{defaultMode:e,disableSwitch:t,respectPrefersColorScheme:n}}=(0,s.p)(),[o,a]=(0,r.useState)(m(e));(0,r.useEffect)((()=>{t&&d.del()}),[t]);const i=(0,r.useCallback)((function(t,r){void 0===r&&(r={});const{persist:o=!0}=r;t?(a(t),o&&h(t)):(a(n?window.matchMedia("(prefers-color-scheme: dark)").matches?p.dark:p.light:e),d.del())}),[n,e]);(0,r.useEffect)((()=>{document.documentElement.setAttribute("data-theme",f(o))}),[o]),(0,r.useEffect)((()=>{if(t)return;const e=e=>{if(e.key!==u)return;const t=d.get();null!==t&&i(f(t))};return window.addEventListener("storage",e),()=>window.removeEventListener("storage",e)}),[t,i]);const l=(0,r.useRef)(!1);return(0,r.useEffect)((()=>{if(t&&!n)return;const e=window.matchMedia("(prefers-color-scheme: dark)"),r=()=>{window.matchMedia("print").matches||l.current?l.current=window.matchMedia("print").matches:i(null)};return e.addListener(r),()=>e.removeListener(r)}),[i,t,n]),(0,r.useMemo)((()=>({colorMode:o,setColorMode:i,get isDarkTheme(){return o===p.dark},setLightTheme(){i(p.light)},setDarkTheme(){i(p.dark)}})),[o,i])}();return(0,l.jsx)(c.Provider,{value:n,children:t})}function y(){const e=(0,r.useContext)(c);if(null==e)throw new a.dV("ColorModeProvider","Please see https://docusaurus.io/docs/api/themes/configuration#use-color-mode.");return e}},2780:(e,t,n)=>{"use strict";n.d(t,{VQ:()=>y,XK:()=>w,g1:()=>v});var r=n(96540),o=n(19802),a=n(44598),i=n(86957),s=n(9048),l=n(4799),c=n(81269),u=n(74848);const d=e=>`docs-preferred-version-${e}`,p={save:(e,t,n)=>{(0,c.Wf)(d(e),{persistence:t}).set(n)},read:(e,t)=>(0,c.Wf)(d(e),{persistence:t}).get(),clear:(e,t)=>{(0,c.Wf)(d(e),{persistence:t}).del()}},f=e=>Object.fromEntries(e.map((e=>[e,{preferredVersionName:null}])));const m=r.createContext(null);function h(){const e=(0,o.Gy)(),t=(0,i.p)().docs.versionPersistence,n=(0,r.useMemo)((()=>Object.keys(e)),[e]),[a,s]=(0,r.useState)((()=>f(n)));(0,r.useEffect)((()=>{s(function(e){let{pluginIds:t,versionPersistence:n,allDocsData:r}=e;function o(e){const t=p.read(e,n);return r[e].versions.some((e=>e.name===t))?{preferredVersionName:t}:(p.clear(e,n),{preferredVersionName:null})}return Object.fromEntries(t.map((e=>[e,o(e)])))}({allDocsData:e,versionPersistence:t,pluginIds:n}))}),[e,t,n]);return[a,(0,r.useMemo)((()=>({savePreferredVersion:function(e,n){p.save(e,t,n),s((t=>({...t,[e]:{preferredVersionName:n}})))}})),[t])]}function g(e){let{children:t}=e;const n=h();return(0,u.jsx)(m.Provider,{value:n,children:t})}function y(e){let{children:t}=e;return s.C5?(0,u.jsx)(g,{children:t}):(0,u.jsx)(u.Fragment,{children:t})}function b(){const e=(0,r.useContext)(m);if(!e)throw new l.dV("DocsPreferredVersionContextProvider");return e}function v(e){void 0===e&&(e=a.W);const t=(0,o.ht)(e),[n,i]=b(),{preferredVersionName:s}=n[e];return{preferredVersion:t.versions.find((e=>e.name===s))??null,savePreferredVersionName:(0,r.useCallback)((t=>{i.savePreferredVersion(e,t)}),[i,e])}}function w(){const e=(0,o.Gy)(),[t]=b();function n(n){const r=e[n],{preferredVersionName:o}=t[n];return r.versions.find((e=>e.name===o))??null}const r=Object.keys(e);return Object.fromEntries(r.map((e=>[e,n(e)])))}},403:(e,t,n)=>{"use strict";n.d(t,{V:()=>l,t:()=>c});var r=n(96540),o=n(4799),a=n(74848);const i=Symbol("EmptyContext"),s=r.createContext(i);function l(e){let{children:t,name:n,items:o}=e;const i=(0,r.useMemo)((()=>n&&o?{name:n,items:o}:null),[n,o]);return(0,a.jsx)(s.Provider,{value:i,children:t})}function c(){const e=(0,r.useContext)(s);if(e===i)throw new o.dV("DocsSidebarProvider");return e}},33403:(e,t,n)=>{"use strict";n.d(t,{n:()=>s,r:()=>l});var r=n(96540),o=n(4799),a=n(74848);const i=r.createContext(null);function s(e){let{children:t,version:n}=e;return(0,a.jsx)(i.Provider,{value:n,children:t})}function l(){const e=(0,r.useContext)(i);if(null===e)throw new o.dV("DocsVersionProvider");return e}},45755:(e,t,n)=>{"use strict";n.d(t,{e:()=>f,M:()=>m});var r=n(96540),o=n(70763),a=n(82216),i=n(56347),s=n(4799);function l(e){!function(e){const t=(0,i.W6)(),n=(0,s._q)(e);(0,r.useEffect)((()=>t.block(((e,t)=>n(e,t)))),[t,n])}(((t,n)=>{if("POP"===n)return e(t,n)}))}var c=n(86957),u=n(74848);const d=r.createContext(void 0);function p(){const e=function(){const e=(0,o.YL)(),{items:t}=(0,c.p)().navbar;return 0===t.length&&!e.component}(),t=(0,a.l)(),n=!e&&"mobile"===t,[i,s]=(0,r.useState)(!1);l((()=>{if(i)return s(!1),!1}));const u=(0,r.useCallback)((()=>{s((e=>!e))}),[]);return(0,r.useEffect)((()=>{"desktop"===t&&s(!1)}),[t]),(0,r.useMemo)((()=>({disabled:e,shouldRender:n,toggle:u,shown:i})),[e,n,u,i])}function f(e){let{children:t}=e;const n=p();return(0,u.jsx)(d.Provider,{value:n,children:t})}function m(){const e=r.useContext(d);if(void 0===e)throw new s.dV("NavbarMobileSidebarProvider");return e}},70763:(e,t,n)=>{"use strict";n.d(t,{GX:()=>c,YL:()=>l,y_:()=>s});var r=n(96540),o=n(4799),a=n(74848);const i=r.createContext(null);function s(e){let{children:t}=e;const n=(0,r.useState)({component:null,props:null});return(0,a.jsx)(i.Provider,{value:n,children:t})}function l(){const e=(0,r.useContext)(i);if(!e)throw new o.dV("NavbarSecondaryMenuContentProvider");return e[0]}function c(e){let{component:t,props:n}=e;const a=(0,r.useContext)(i);if(!a)throw new o.dV("NavbarSecondaryMenuContentProvider");const[,s]=a,l=(0,o.Be)(n);return(0,r.useEffect)((()=>{s({component:t,props:l})}),[s,t,l]),(0,r.useEffect)((()=>()=>s({component:null,props:null})),[s]),null}},19503:(e,t,n)=>{"use strict";n.d(t,{w:()=>o,J:()=>a});var r=n(96540);const o="navigation-with-keyboard";function a(){(0,r.useEffect)((()=>{function e(e){"keydown"===e.type&&"Tab"===e.key&&document.body.classList.add(o),"mousedown"===e.type&&document.body.classList.remove(o)}return document.addEventListener("keydown",e),document.addEventListener("mousedown",e),()=>{document.body.classList.remove(o),document.removeEventListener("keydown",e),document.removeEventListener("mousedown",e)}}),[])}},82216:(e,t,n)=>{"use strict";n.d(t,{l:()=>s});var r=n(96540),o=n(31712);const a={desktop:"desktop",mobile:"mobile",ssr:"ssr"},i=996;function s(){const[e,t]=(0,r.useState)((()=>"ssr"));return(0,r.useEffect)((()=>{function e(){t(function(){if(!o.A.canUseDOM)throw new Error("getWindowSize() should only be called after React hydration");return window.innerWidth>i?a.desktop:a.mobile}())}return e(),window.addEventListener("resize",e),()=>{window.removeEventListener("resize",e)}}),[]),e}},18630:(e,t,n)=>{"use strict";n.d(t,{G:()=>r});const r={page:{blogListPage:"blog-list-page",blogPostPage:"blog-post-page",blogTagsListPage:"blog-tags-list-page",blogTagPostListPage:"blog-tags-post-list-page",docsDocPage:"docs-doc-page",docsTagsListPage:"docs-tags-list-page",docsTagDocListPage:"docs-tags-doc-list-page",mdxPage:"mdx-page"},wrapper:{main:"main-wrapper",blogPages:"blog-wrapper",docsPages:"docs-wrapper",mdxPages:"mdx-wrapper"},common:{editThisPage:"theme-edit-this-page",lastUpdated:"theme-last-updated",backToTopButton:"theme-back-to-top-button",codeBlock:"theme-code-block",admonition:"theme-admonition",unlistedBanner:"theme-unlisted-banner",admonitionType:e=>`theme-admonition-${e}`},layout:{},docs:{docVersionBanner:"theme-doc-version-banner",docVersionBadge:"theme-doc-version-badge",docBreadcrumbs:"theme-doc-breadcrumbs",docMarkdown:"theme-doc-markdown",docTocMobile:"theme-doc-toc-mobile",docTocDesktop:"theme-doc-toc-desktop",docFooter:"theme-doc-footer",docFooterTagsRow:"theme-doc-footer-tags-row",docFooterEditMetaRow:"theme-doc-footer-edit-meta-row",docSidebarContainer:"theme-doc-sidebar-container",docSidebarMenu:"theme-doc-sidebar-menu",docSidebarItemCategory:"theme-doc-sidebar-item-category",docSidebarItemLink:"theme-doc-sidebar-item-link",docSidebarItemCategoryLevel:e=>`theme-doc-sidebar-item-category-level-${e}`,docSidebarItemLinkLevel:e=>`theme-doc-sidebar-item-link-level-${e}`},blog:{}}},36350:(e,t,n)=>{"use strict";function r(){return window.matchMedia("(prefers-reduced-motion: reduce)").matches}n.d(t,{O:()=>r})},9048:(e,t,n)=>{"use strict";n.d(t,{Nr:()=>f,w8:()=>g,C5:()=>p,B5:()=>_,Vd:()=>S,QB:()=>x,fW:()=>k,OF:()=>w,Y:()=>b});var r=n(96540),o=n(56347),a=n(22831),i=n(19802),s=n(2780),l=n(33403),c=n(403);function u(e){return Array.from(new Set(e))}var d=n(80260);const p=!!i.Gy;function f(e){return"link"!==e.type||e.unlisted?"category"===e.type?function(e){if(e.href&&!e.linkUnlisted)return e.href;for(const t of e.items){const e=f(t);if(e)return e}}(e):void 0:e.href}const m=(e,t)=>void 0!==e&&(0,d.ys)(e,t),h=(e,t)=>e.some((e=>g(e,t)));function g(e,t){return"link"===e.type?m(e.href,t):"category"===e.type&&(m(e.href,t)||h(e.items,t))}function y(e,t){switch(e.type){case"category":return g(e,t)||e.items.some((e=>y(e,t)));case"link":return!e.unlisted||g(e,t);default:return!0}}function b(e,t){return(0,r.useMemo)((()=>e.filter((e=>y(e,t)))),[e,t])}function v(e){let{sidebarItems:t,pathname:n,onlyCategories:r=!1}=e;const o=[];return function e(t){for(const a of t)if("category"===a.type&&((0,d.ys)(a.href,n)||e(a.items))||"link"===a.type&&(0,d.ys)(a.href,n)){return r&&"category"!==a.type||o.unshift(a),!0}return!1}(t),o}function w(){const e=(0,c.t)(),{pathname:t}=(0,o.zy)(),n=(0,i.vT)()?.pluginData.breadcrumbs;return!1!==n&&e?v({sidebarItems:e.items,pathname:t}):null}function S(e){const{activeVersion:t}=(0,i.zK)(e),{preferredVersion:n}=(0,s.g1)(e),o=(0,i.r7)(e);return(0,r.useMemo)((()=>u([t,n,o].filter(Boolean))),[t,n,o])}function k(e,t){const n=S(t);return(0,r.useMemo)((()=>{const t=n.flatMap((e=>e.sidebars?Object.entries(e.sidebars):[])),r=t.find((t=>t[0]===e));if(!r)throw new Error(`Can't find any sidebar with id "${e}" in version${n.length>1?"s":""} ${n.map((e=>e.name)).join(", ")}".\nAvailable sidebar ids are:\n- ${t.map((e=>e[0])).join("\n- ")}`);return r[1]}),[e,n])}function x(e,t){const n=S(t);return(0,r.useMemo)((()=>{const t=n.flatMap((e=>e.docs)),r=t.find((t=>t.id===e));if(!r){if(n.flatMap((e=>e.draftIds)).includes(e))return null;throw new Error(`Couldn't find any doc with id "${e}" in version${n.length>1?"s":""} "${n.map((e=>e.name)).join(", ")}".\nAvailable doc ids are:\n- ${u(t.map((e=>e.id))).join("\n- ")}`)}return r}),[e,n])}function _(e){let{route:t}=e;const n=(0,o.zy)(),r=(0,l.r)(),i=t.routes,s=i.find((e=>(0,o.B6)(n.pathname,e)));if(!s)return null;const c=s.sidebar,u=c?r.docsSidebars[c]:void 0;return{docElement:(0,a.v)(i),sidebarName:c,sidebarItems:u}}},69817:(e,t,n)=>{"use strict";n.d(t,{e3:()=>f,be:()=>d,Jx:()=>m});var r=n(96540),o=n(15066),a=n(21141),i=n(23363);function s(){const e=r.useContext(i.o);if(!e)throw new Error("Unexpected: no Docusaurus route context found");return e}var l=n(98180),c=n(97639);var u=n(74848);function d(e){let{title:t,description:n,keywords:r,image:o,children:i}=e;const s=function(e){const{siteConfig:t}=(0,c.A)(),{title:n,titleDelimiter:r}=t;return e?.trim().length?`${e.trim()} ${r} ${n}`:n}(t),{withBaseUrl:d}=(0,l.h)(),p=o?d(o,{absolute:!0}):void 0;return(0,u.jsxs)(a.A,{children:[t&&(0,u.jsx)("title",{children:s}),t&&(0,u.jsx)("meta",{property:"og:title",content:s}),n&&(0,u.jsx)("meta",{name:"description",content:n}),n&&(0,u.jsx)("meta",{property:"og:description",content:n}),r&&(0,u.jsx)("meta",{name:"keywords",content:Array.isArray(r)?r.join(","):r}),p&&(0,u.jsx)("meta",{property:"og:image",content:p}),p&&(0,u.jsx)("meta",{name:"twitter:image",content:p}),i]})}const p=r.createContext(void 0);function f(e){let{className:t,children:n}=e;const i=r.useContext(p),s=(0,o.A)(i,t);return(0,u.jsxs)(p.Provider,{value:s,children:[(0,u.jsx)(a.A,{children:(0,u.jsx)("html",{className:s})}),n]})}function m(e){let{children:t}=e;const n=s(),r=`plugin-${n.plugin.name.replace(/docusaurus-(?:plugin|theme)-(?:content-)?/gi,"")}`;const a=`plugin-id-${n.plugin.id}`;return(0,u.jsx)(f,{className:(0,o.A)(r,a),children:t})}},4799:(e,t,n)=>{"use strict";n.d(t,{Be:()=>c,ZC:()=>s,_q:()=>i,dV:()=>l,fM:()=>u});var r=n(96540),o=n(36494),a=n(74848);function i(e){const t=(0,r.useRef)(e);return(0,o.A)((()=>{t.current=e}),[e]),(0,r.useCallback)((function(){return t.current(...arguments)}),[])}function s(e){const t=(0,r.useRef)();return(0,o.A)((()=>{t.current=e})),t.current}class l extends Error{constructor(e,t){super(),this.name="ReactContextError",this.message=`Hook ${this.stack?.split("\n")[1]?.match(/at (?:\w+\.)?(?\w+)/)?.groups.name??""} is called outside the <${e}>. ${t??""}`}}function c(e){const t=Object.entries(e);return t.sort(((e,t)=>e[0].localeCompare(t[0]))),(0,r.useMemo)((()=>e),t.flat())}function u(e){return t=>{let{children:n}=t;return(0,a.jsx)(a.Fragment,{children:e.reduceRight(((e,t)=>(0,a.jsx)(t,{children:e})),n)})}}},80260:(e,t,n)=>{"use strict";n.d(t,{Dt:()=>s,ys:()=>i});var r=n(96540),o=n(92413),a=n(97639);function i(e,t){const n=e=>(!e||e.endsWith("/")?e:`${e}/`)?.toLowerCase();return n(e)===n(t)}function s(){const{baseUrl:e}=(0,a.A)().siteConfig;return(0,r.useMemo)((()=>function(e){let{baseUrl:t,routes:n}=e;function r(e){return e.path===t&&!0===e.exact}function o(e){return e.path===t&&!e.exact}return function e(t){if(0===t.length)return;return t.find(r)||e(t.filter(o).flatMap((e=>e.routes??[])))}(n)}({routes:o.A,baseUrl:e})),[e])}},24245:(e,t,n)=>{"use strict";n.d(t,{Mq:()=>p,Tv:()=>c,gk:()=>f});var r=n(96540),o=n(31712),a=n(11062),i=(n(36494),n(4799)),s=n(74848);const l=r.createContext(void 0);function c(e){let{children:t}=e;const n=function(){const e=(0,r.useRef)(!0);return(0,r.useMemo)((()=>({scrollEventsEnabledRef:e,enableScrollEvents:()=>{e.current=!0},disableScrollEvents:()=>{e.current=!1}})),[])}();return(0,s.jsx)(l.Provider,{value:n,children:t})}function u(){const e=(0,r.useContext)(l);if(null==e)throw new i.dV("ScrollControllerProvider");return e}const d=()=>o.A.canUseDOM?{scrollX:window.pageXOffset,scrollY:window.pageYOffset}:null;function p(e,t){void 0===t&&(t=[]);const{scrollEventsEnabledRef:n}=u(),o=(0,r.useRef)(d()),a=(0,i._q)(e);(0,r.useEffect)((()=>{const e=()=>{if(!n.current)return;const e=d();a(e,o.current),o.current=e},t={passive:!0};return e(),window.addEventListener("scroll",e,t),()=>window.removeEventListener("scroll",e,t)}),[a,n,...t])}function f(){const e=(0,r.useRef)(null),t=(0,a.A)()&&"smooth"===getComputedStyle(document.documentElement).scrollBehavior;return{startScroll:n=>{e.current=t?function(e){return window.scrollTo({top:e,behavior:"smooth"}),()=>{}}(n):function(e){let t=null;const n=document.documentElement.scrollTop>e;return function r(){const o=document.documentElement.scrollTop;(n&&o>e||!n&&ot&&cancelAnimationFrame(t)}(n)},cancelScroll:()=>e.current?.()}}},61482:(e,t,n)=>{"use strict";n.d(t,{Cy:()=>i,af:()=>l,tU:()=>s});var r=n(19802),o=n(97639),a=n(2780);const i="default";function s(e,t){return`docs-${e}-${t}`}function l(){const{i18n:e}=(0,o.A)(),t=(0,r.Gy)(),n=(0,r.gk)(),l=(0,a.XK)();const c=[i,...Object.keys(t).map((function(e){const r=n?.activePlugin.pluginId===e?n.activeVersion:void 0,o=l[e],a=t[e].versions.find((e=>e.isLast));return s(e,(r??o??a).name)}))];return{locale:e.currentLocale,tags:c}}},81269:(e,t,n)=>{"use strict";n.d(t,{Wf:()=>l});n(96540);const r="localStorage";function o(e){let{key:t,oldValue:n,newValue:r,storage:o}=e;if(n===r)return;const a=document.createEvent("StorageEvent");a.initStorageEvent("storage",!1,!1,t,n,r,window.location.href,o),window.dispatchEvent(a)}function a(e){if(void 0===e&&(e=r),"undefined"==typeof window)throw new Error("Browser storage is not available on Node.js/Docusaurus SSR process.");if("none"===e)return null;try{return window[e]}catch(n){return t=n,i||(console.warn("Docusaurus browser storage is not available.\nPossible reasons: running Docusaurus in an iframe, in an incognito browser session, or using too strict browser privacy settings.",t),i=!0),null}var t}let i=!1;const s={get:()=>null,set:()=>{},del:()=>{},listen:()=>()=>{}};function l(e,t){if("undefined"==typeof window)return function(e){function t(){throw new Error(`Illegal storage API usage for storage key "${e}".\nDocusaurus storage APIs are not supposed to be called on the server-rendering process.\nPlease only call storage APIs in effects and event handlers.`)}return{get:t,set:t,del:t,listen:t}}(e);const n=a(t?.persistence);return null===n?s:{get:()=>{try{return n.getItem(e)}catch(t){return console.error(`Docusaurus storage error, can't get key=${e}`,t),null}},set:t=>{try{const r=n.getItem(e);n.setItem(e,t),o({key:e,oldValue:r,newValue:t,storage:n})}catch(r){console.error(`Docusaurus storage error, can't set ${e}=${t}`,r)}},del:()=>{try{const t=n.getItem(e);n.removeItem(e),o({key:e,oldValue:t,newValue:null,storage:n})}catch(t){console.error(`Docusaurus storage error, can't delete key=${e}`,t)}},listen:t=>{try{const r=r=>{r.storageArea===n&&r.key===e&&t(r)};return window.addEventListener("storage",r),()=>window.removeEventListener("storage",r)}catch(r){return console.error(`Docusaurus storage error, can't listen for changes of key=${e}`,r),()=>{}}}}}},2098:(e,t,n)=>{"use strict";n.d(t,{o:()=>i});var r=n(97639),o=n(56347),a=n(64609);function i(){const{siteConfig:{baseUrl:e,url:t,trailingSlash:n},i18n:{defaultLocale:i,currentLocale:s}}=(0,r.A)(),{pathname:l}=(0,o.zy)(),c=(0,a.applyTrailingSlash)(l,{trailingSlash:n,baseUrl:e}),u=s===i?e:e.replace(`/${s}/`,"/"),d=c.replace(e,"");return{createUrl:function(e){let{locale:n,fullyQualified:r}=e;return`${r?t:""}${function(e){return e===i?`${u}`:`${u}${e}/`}(n)}${d}`}}}},54067:(e,t,n)=>{"use strict";n.d(t,{$:()=>i});var r=n(96540),o=n(56347),a=n(4799);function i(e){const t=(0,o.zy)(),n=(0,a.ZC)(t),i=(0,a._q)(e);(0,r.useEffect)((()=>{n&&t!==n&&i({location:t,previousLocation:n})}),[i,t,n])}},86957:(e,t,n)=>{"use strict";n.d(t,{p:()=>o});var r=n(97639);function o(){return(0,r.A)().siteConfig.themeConfig}},44356:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e,t){const{trailingSlash:n,baseUrl:r}=t;if(e.startsWith("#"))return e;if(void 0===n)return e;const[o]=e.split(/[#?]/),a="/"===o||o===r?o:(i=o,n?function(e){return e.endsWith("/")?e:`${e}/`}(i):function(e){return e.endsWith("/")?e.slice(0,-1):e}(i));var i;return e.replace(o,a)}},68274:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getErrorCausalChain=void 0,t.getErrorCausalChain=function e(t){return t.cause?[t,...e(t.cause)]:[t]}},64609:function(e,t,n){"use strict";var r=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.getErrorCausalChain=t.applyTrailingSlash=t.blogPostContainerID=void 0,t.blogPostContainerID="__blog-post-container";var o=n(44356);Object.defineProperty(t,"applyTrailingSlash",{enumerable:!0,get:function(){return r(o).default}});var a=n(68274);Object.defineProperty(t,"getErrorCausalChain",{enumerable:!0,get:function(){return a.getErrorCausalChain}})},79231:(e,t,n)=>{"use strict";n.d(t,{zR:()=>x,TM:()=>P,yJ:()=>h,sC:()=>T,AO:()=>m,Fu:()=>g});var r=n(58168);function o(e){return"/"===e.charAt(0)}function a(e,t){for(var n=t,r=n+1,o=e.length;r=0;p--){var f=i[p];"."===f?a(i,p):".."===f?(a(i,p),d++):d&&(a(i,p),d--)}if(!c)for(;d--;d)i.unshift("..");!c||""===i[0]||i[0]&&o(i[0])||i.unshift("");var m=i.join("/");return n&&"/"!==m.substr(-1)&&(m+="/"),m};function s(e){return e.valueOf?e.valueOf():Object.prototype.valueOf.call(e)}const l=function e(t,n){if(t===n)return!0;if(null==t||null==n)return!1;if(Array.isArray(t))return Array.isArray(n)&&t.length===n.length&&t.every((function(t,r){return e(t,n[r])}));if("object"==typeof t||"object"==typeof n){var r=s(t),o=s(n);return r!==t||o!==n?e(r,o):Object.keys(Object.assign({},t,n)).every((function(r){return e(t[r],n[r])}))}return!1};var c=n(78997);function u(e){return"/"===e.charAt(0)?e:"/"+e}function d(e){return"/"===e.charAt(0)?e.substr(1):e}function p(e,t){return function(e,t){return 0===e.toLowerCase().indexOf(t.toLowerCase())&&-1!=="/?#".indexOf(e.charAt(t.length))}(e,t)?e.substr(t.length):e}function f(e){return"/"===e.charAt(e.length-1)?e.slice(0,-1):e}function m(e){var t=e.pathname,n=e.search,r=e.hash,o=t||"/";return n&&"?"!==n&&(o+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(o+="#"===r.charAt(0)?r:"#"+r),o}function h(e,t,n,o){var a;"string"==typeof e?(a=function(e){var t=e||"/",n="",r="",o=t.indexOf("#");-1!==o&&(r=t.substr(o),t=t.substr(0,o));var a=t.indexOf("?");return-1!==a&&(n=t.substr(a),t=t.substr(0,a)),{pathname:t,search:"?"===n?"":n,hash:"#"===r?"":r}}(e),a.state=t):(void 0===(a=(0,r.A)({},e)).pathname&&(a.pathname=""),a.search?"?"!==a.search.charAt(0)&&(a.search="?"+a.search):a.search="",a.hash?"#"!==a.hash.charAt(0)&&(a.hash="#"+a.hash):a.hash="",void 0!==t&&void 0===a.state&&(a.state=t));try{a.pathname=decodeURI(a.pathname)}catch(s){throw s instanceof URIError?new URIError('Pathname "'+a.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):s}return n&&(a.key=n),o?a.pathname?"/"!==a.pathname.charAt(0)&&(a.pathname=i(a.pathname,o.pathname)):a.pathname=o.pathname:a.pathname||(a.pathname="/"),a}function g(e,t){return e.pathname===t.pathname&&e.search===t.search&&e.hash===t.hash&&e.key===t.key&&l(e.state,t.state)}function y(){var e=null;var t=[];return{setPrompt:function(t){return e=t,function(){e===t&&(e=null)}},confirmTransitionTo:function(t,n,r,o){if(null!=e){var a="function"==typeof e?e(t,n):e;"string"==typeof a?"function"==typeof r?r(a,o):o(!0):o(!1!==a)}else o(!0)},appendListener:function(e){var n=!0;function r(){n&&e.apply(void 0,arguments)}return t.push(r),function(){n=!1,t=t.filter((function(e){return e!==r}))}},notifyListeners:function(){for(var e=arguments.length,n=new Array(e),r=0;rt?n.splice(t,n.length-t,o):n.push(o),d({action:r,location:o,index:t,entries:n})}}))},replace:function(e,t){var r="REPLACE",o=h(e,t,p(),w.location);u.confirmTransitionTo(o,r,n,(function(e){e&&(w.entries[w.index]=o,d({action:r,location:o}))}))},go:v,goBack:function(){v(-1)},goForward:function(){v(1)},canGo:function(e){var t=w.index+e;return t>=0&&t{"use strict";var r=n(44363),o={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},a={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},i={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},s={};function l(e){return r.isMemo(e)?i:s[e.$$typeof]||o}s[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},s[r.Memo]=i;var c=Object.defineProperty,u=Object.getOwnPropertyNames,d=Object.getOwnPropertySymbols,p=Object.getOwnPropertyDescriptor,f=Object.getPrototypeOf,m=Object.prototype;e.exports=function e(t,n,r){if("string"!=typeof n){if(m){var o=f(n);o&&o!==m&&e(t,o,r)}var i=u(n);d&&(i=i.concat(d(n)));for(var s=l(t),h=l(n),g=0;g{"use strict";e.exports=function(e,t,n,r,o,a,i,s){if(!e){var l;if(void 0===t)l=new Error("Minified exception occurred; use the non-minified dev environment for the full error message and additional helpful warnings.");else{var c=[n,r,o,a,i,s],u=0;(l=new Error(t.replace(/%s/g,(function(){return c[u++]})))).name="Invariant Violation"}throw l.framesToPop=1,l}}},64634:e=>{e.exports=Array.isArray||function(e){return"[object Array]"==Object.prototype.toString.call(e)}},689:function(e){e.exports=function(){"use strict";var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},t=function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")},n=function(){function e(e,t){for(var n=0;n1&&void 0!==arguments[1])||arguments[1],o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:[],a=arguments.length>3&&void 0!==arguments[3]?arguments[3]:5e3;t(this,e),this.ctx=n,this.iframes=r,this.exclude=o,this.iframesTimeout=a}return n(e,[{key:"getContexts",value:function(){var e=[];return(void 0!==this.ctx&&this.ctx?NodeList.prototype.isPrototypeOf(this.ctx)?Array.prototype.slice.call(this.ctx):Array.isArray(this.ctx)?this.ctx:"string"==typeof this.ctx?Array.prototype.slice.call(document.querySelectorAll(this.ctx)):[this.ctx]:[]).forEach((function(t){var n=e.filter((function(e){return e.contains(t)})).length>0;-1!==e.indexOf(t)||n||e.push(t)})),e}},{key:"getIframeContents",value:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:function(){},r=void 0;try{var o=e.contentWindow;if(r=o.document,!o||!r)throw new Error("iframe inaccessible")}catch(a){n()}r&&t(r)}},{key:"isIframeBlank",value:function(e){var t="about:blank",n=e.getAttribute("src").trim();return e.contentWindow.location.href===t&&n!==t&&n}},{key:"observeIframeLoad",value:function(e,t,n){var r=this,o=!1,a=null,i=function i(){if(!o){o=!0,clearTimeout(a);try{r.isIframeBlank(e)||(e.removeEventListener("load",i),r.getIframeContents(e,t,n))}catch(s){n()}}};e.addEventListener("load",i),a=setTimeout(i,this.iframesTimeout)}},{key:"onIframeReady",value:function(e,t,n){try{"complete"===e.contentWindow.document.readyState?this.isIframeBlank(e)?this.observeIframeLoad(e,t,n):this.getIframeContents(e,t,n):this.observeIframeLoad(e,t,n)}catch(r){n()}}},{key:"waitForIframes",value:function(e,t){var n=this,r=0;this.forEachIframe(e,(function(){return!0}),(function(e){r++,n.waitForIframes(e.querySelector("html"),(function(){--r||t()}))}),(function(e){e||t()}))}},{key:"forEachIframe",value:function(t,n,r){var o=this,a=arguments.length>3&&void 0!==arguments[3]?arguments[3]:function(){},i=t.querySelectorAll("iframe"),s=i.length,l=0;i=Array.prototype.slice.call(i);var c=function(){--s<=0&&a(l)};s||c(),i.forEach((function(t){e.matches(t,o.exclude)?c():o.onIframeReady(t,(function(e){n(t)&&(l++,r(e)),c()}),c)}))}},{key:"createIterator",value:function(e,t,n){return document.createNodeIterator(e,t,n,!1)}},{key:"createInstanceOnIframe",value:function(t){return new e(t.querySelector("html"),this.iframes)}},{key:"compareNodeIframe",value:function(e,t,n){if(e.compareDocumentPosition(n)&Node.DOCUMENT_POSITION_PRECEDING){if(null===t)return!0;if(t.compareDocumentPosition(n)&Node.DOCUMENT_POSITION_FOLLOWING)return!0}return!1}},{key:"getIteratorNode",value:function(e){var t=e.previousNode();return{prevNode:t,node:(null===t||e.nextNode())&&e.nextNode()}}},{key:"checkIframeFilter",value:function(e,t,n,r){var o=!1,a=!1;return r.forEach((function(e,t){e.val===n&&(o=t,a=e.handled)})),this.compareNodeIframe(e,t,n)?(!1!==o||a?!1===o||a||(r[o].handled=!0):r.push({val:n,handled:!0}),!0):(!1===o&&r.push({val:n,handled:!1}),!1)}},{key:"handleOpenIframes",value:function(e,t,n,r){var o=this;e.forEach((function(e){e.handled||o.getIframeContents(e.val,(function(e){o.createInstanceOnIframe(e).forEachNode(t,n,r)}))}))}},{key:"iterateThroughNodes",value:function(e,t,n,r,o){for(var a=this,i=this.createIterator(t,e,r),s=[],l=[],c=void 0,u=void 0,d=function(){var e=a.getIteratorNode(i);return u=e.prevNode,c=e.node};d();)this.iframes&&this.forEachIframe(t,(function(e){return a.checkIframeFilter(c,u,e,s)}),(function(t){a.createInstanceOnIframe(t).forEachNode(e,(function(e){return l.push(e)}),r)})),l.push(c);l.forEach((function(e){n(e)})),this.iframes&&this.handleOpenIframes(s,e,n,r),o()}},{key:"forEachNode",value:function(e,t,n){var r=this,o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:function(){},a=this.getContexts(),i=a.length;i||o(),a.forEach((function(a){var s=function(){r.iterateThroughNodes(e,a,t,n,(function(){--i<=0&&o()}))};r.iframes?r.waitForIframes(a,s):s()}))}}],[{key:"matches",value:function(e,t){var n="string"==typeof t?[t]:t,r=e.matches||e.matchesSelector||e.msMatchesSelector||e.mozMatchesSelector||e.oMatchesSelector||e.webkitMatchesSelector;if(r){var o=!1;return n.every((function(t){return!r.call(e,t)||(o=!0,!1)})),o}return!1}}]),e}(),a=function(){function a(e){t(this,a),this.ctx=e,this.ie=!1;var n=window.navigator.userAgent;(n.indexOf("MSIE")>-1||n.indexOf("Trident")>-1)&&(this.ie=!0)}return n(a,[{key:"log",value:function(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"debug",r=this.opt.log;this.opt.debug&&"object"===(void 0===r?"undefined":e(r))&&"function"==typeof r[n]&&r[n]("mark.js: "+t)}},{key:"escapeStr",value:function(e){return e.replace(/[\-\[\]\/\{\}\(\)\*\+\?\.\\\^\$\|]/g,"\\$&")}},{key:"createRegExp",value:function(e){return"disabled"!==this.opt.wildcards&&(e=this.setupWildcardsRegExp(e)),e=this.escapeStr(e),Object.keys(this.opt.synonyms).length&&(e=this.createSynonymsRegExp(e)),(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.setupIgnoreJoinersRegExp(e)),this.opt.diacritics&&(e=this.createDiacriticsRegExp(e)),e=this.createMergedBlanksRegExp(e),(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.createJoinersRegExp(e)),"disabled"!==this.opt.wildcards&&(e=this.createWildcardsRegExp(e)),e=this.createAccuracyRegExp(e)}},{key:"createSynonymsRegExp",value:function(e){var t=this.opt.synonyms,n=this.opt.caseSensitive?"":"i",r=this.opt.ignoreJoiners||this.opt.ignorePunctuation.length?"\0":"";for(var o in t)if(t.hasOwnProperty(o)){var a=t[o],i="disabled"!==this.opt.wildcards?this.setupWildcardsRegExp(o):this.escapeStr(o),s="disabled"!==this.opt.wildcards?this.setupWildcardsRegExp(a):this.escapeStr(a);""!==i&&""!==s&&(e=e.replace(new RegExp("("+this.escapeStr(i)+"|"+this.escapeStr(s)+")","gm"+n),r+"("+this.processSynomyms(i)+"|"+this.processSynomyms(s)+")"+r))}return e}},{key:"processSynomyms",value:function(e){return(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.setupIgnoreJoinersRegExp(e)),e}},{key:"setupWildcardsRegExp",value:function(e){return(e=e.replace(/(?:\\)*\?/g,(function(e){return"\\"===e.charAt(0)?"?":"\x01"}))).replace(/(?:\\)*\*/g,(function(e){return"\\"===e.charAt(0)?"*":"\x02"}))}},{key:"createWildcardsRegExp",value:function(e){var t="withSpaces"===this.opt.wildcards;return e.replace(/\u0001/g,t?"[\\S\\s]?":"\\S?").replace(/\u0002/g,t?"[\\S\\s]*?":"\\S*")}},{key:"setupIgnoreJoinersRegExp",value:function(e){return e.replace(/[^(|)\\]/g,(function(e,t,n){var r=n.charAt(t+1);return/[(|)\\]/.test(r)||""===r?e:e+"\0"}))}},{key:"createJoinersRegExp",value:function(e){var t=[],n=this.opt.ignorePunctuation;return Array.isArray(n)&&n.length&&t.push(this.escapeStr(n.join(""))),this.opt.ignoreJoiners&&t.push("\\u00ad\\u200b\\u200c\\u200d"),t.length?e.split(/\u0000+/).join("["+t.join("")+"]*"):e}},{key:"createDiacriticsRegExp",value:function(e){var t=this.opt.caseSensitive?"":"i",n=this.opt.caseSensitive?["a\xe0\xe1\u1ea3\xe3\u1ea1\u0103\u1eb1\u1eaf\u1eb3\u1eb5\u1eb7\xe2\u1ea7\u1ea5\u1ea9\u1eab\u1ead\xe4\xe5\u0101\u0105","A\xc0\xc1\u1ea2\xc3\u1ea0\u0102\u1eb0\u1eae\u1eb2\u1eb4\u1eb6\xc2\u1ea6\u1ea4\u1ea8\u1eaa\u1eac\xc4\xc5\u0100\u0104","c\xe7\u0107\u010d","C\xc7\u0106\u010c","d\u0111\u010f","D\u0110\u010e","e\xe8\xe9\u1ebb\u1ebd\u1eb9\xea\u1ec1\u1ebf\u1ec3\u1ec5\u1ec7\xeb\u011b\u0113\u0119","E\xc8\xc9\u1eba\u1ebc\u1eb8\xca\u1ec0\u1ebe\u1ec2\u1ec4\u1ec6\xcb\u011a\u0112\u0118","i\xec\xed\u1ec9\u0129\u1ecb\xee\xef\u012b","I\xcc\xcd\u1ec8\u0128\u1eca\xce\xcf\u012a","l\u0142","L\u0141","n\xf1\u0148\u0144","N\xd1\u0147\u0143","o\xf2\xf3\u1ecf\xf5\u1ecd\xf4\u1ed3\u1ed1\u1ed5\u1ed7\u1ed9\u01a1\u1edf\u1ee1\u1edb\u1edd\u1ee3\xf6\xf8\u014d","O\xd2\xd3\u1ece\xd5\u1ecc\xd4\u1ed2\u1ed0\u1ed4\u1ed6\u1ed8\u01a0\u1ede\u1ee0\u1eda\u1edc\u1ee2\xd6\xd8\u014c","r\u0159","R\u0158","s\u0161\u015b\u0219\u015f","S\u0160\u015a\u0218\u015e","t\u0165\u021b\u0163","T\u0164\u021a\u0162","u\xf9\xfa\u1ee7\u0169\u1ee5\u01b0\u1eeb\u1ee9\u1eed\u1eef\u1ef1\xfb\xfc\u016f\u016b","U\xd9\xda\u1ee6\u0168\u1ee4\u01af\u1eea\u1ee8\u1eec\u1eee\u1ef0\xdb\xdc\u016e\u016a","y\xfd\u1ef3\u1ef7\u1ef9\u1ef5\xff","Y\xdd\u1ef2\u1ef6\u1ef8\u1ef4\u0178","z\u017e\u017c\u017a","Z\u017d\u017b\u0179"]:["a\xe0\xe1\u1ea3\xe3\u1ea1\u0103\u1eb1\u1eaf\u1eb3\u1eb5\u1eb7\xe2\u1ea7\u1ea5\u1ea9\u1eab\u1ead\xe4\xe5\u0101\u0105A\xc0\xc1\u1ea2\xc3\u1ea0\u0102\u1eb0\u1eae\u1eb2\u1eb4\u1eb6\xc2\u1ea6\u1ea4\u1ea8\u1eaa\u1eac\xc4\xc5\u0100\u0104","c\xe7\u0107\u010dC\xc7\u0106\u010c","d\u0111\u010fD\u0110\u010e","e\xe8\xe9\u1ebb\u1ebd\u1eb9\xea\u1ec1\u1ebf\u1ec3\u1ec5\u1ec7\xeb\u011b\u0113\u0119E\xc8\xc9\u1eba\u1ebc\u1eb8\xca\u1ec0\u1ebe\u1ec2\u1ec4\u1ec6\xcb\u011a\u0112\u0118","i\xec\xed\u1ec9\u0129\u1ecb\xee\xef\u012bI\xcc\xcd\u1ec8\u0128\u1eca\xce\xcf\u012a","l\u0142L\u0141","n\xf1\u0148\u0144N\xd1\u0147\u0143","o\xf2\xf3\u1ecf\xf5\u1ecd\xf4\u1ed3\u1ed1\u1ed5\u1ed7\u1ed9\u01a1\u1edf\u1ee1\u1edb\u1edd\u1ee3\xf6\xf8\u014dO\xd2\xd3\u1ece\xd5\u1ecc\xd4\u1ed2\u1ed0\u1ed4\u1ed6\u1ed8\u01a0\u1ede\u1ee0\u1eda\u1edc\u1ee2\xd6\xd8\u014c","r\u0159R\u0158","s\u0161\u015b\u0219\u015fS\u0160\u015a\u0218\u015e","t\u0165\u021b\u0163T\u0164\u021a\u0162","u\xf9\xfa\u1ee7\u0169\u1ee5\u01b0\u1eeb\u1ee9\u1eed\u1eef\u1ef1\xfb\xfc\u016f\u016bU\xd9\xda\u1ee6\u0168\u1ee4\u01af\u1eea\u1ee8\u1eec\u1eee\u1ef0\xdb\xdc\u016e\u016a","y\xfd\u1ef3\u1ef7\u1ef9\u1ef5\xffY\xdd\u1ef2\u1ef6\u1ef8\u1ef4\u0178","z\u017e\u017c\u017aZ\u017d\u017b\u0179"],r=[];return e.split("").forEach((function(o){n.every((function(n){if(-1!==n.indexOf(o)){if(r.indexOf(n)>-1)return!1;e=e.replace(new RegExp("["+n+"]","gm"+t),"["+n+"]"),r.push(n)}return!0}))})),e}},{key:"createMergedBlanksRegExp",value:function(e){return e.replace(/[\s]+/gim,"[\\s]+")}},{key:"createAccuracyRegExp",value:function(e){var t=this,n="!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~\xa1\xbf",r=this.opt.accuracy,o="string"==typeof r?r:r.value,a="string"==typeof r?[]:r.limiters,i="";switch(a.forEach((function(e){i+="|"+t.escapeStr(e)})),o){case"partially":default:return"()("+e+")";case"complementary":return"()([^"+(i="\\s"+(i||this.escapeStr(n)))+"]*"+e+"[^"+i+"]*)";case"exactly":return"(^|\\s"+i+")("+e+")(?=$|\\s"+i+")"}}},{key:"getSeparatedKeywords",value:function(e){var t=this,n=[];return e.forEach((function(e){t.opt.separateWordSearch?e.split(" ").forEach((function(e){e.trim()&&-1===n.indexOf(e)&&n.push(e)})):e.trim()&&-1===n.indexOf(e)&&n.push(e)})),{keywords:n.sort((function(e,t){return t.length-e.length})),length:n.length}}},{key:"isNumeric",value:function(e){return Number(parseFloat(e))==e}},{key:"checkRanges",value:function(e){var t=this;if(!Array.isArray(e)||"[object Object]"!==Object.prototype.toString.call(e[0]))return this.log("markRanges() will only accept an array of objects"),this.opt.noMatch(e),[];var n=[],r=0;return e.sort((function(e,t){return e.start-t.start})).forEach((function(e){var o=t.callNoMatchOnInvalidRanges(e,r),a=o.start,i=o.end;o.valid&&(e.start=a,e.length=i-a,n.push(e),r=i)})),n}},{key:"callNoMatchOnInvalidRanges",value:function(e,t){var n=void 0,r=void 0,o=!1;return e&&void 0!==e.start?(r=(n=parseInt(e.start,10))+parseInt(e.length,10),this.isNumeric(e.start)&&this.isNumeric(e.length)&&r-t>0&&r-n>0?o=!0:(this.log("Ignoring invalid or overlapping range: "+JSON.stringify(e)),this.opt.noMatch(e))):(this.log("Ignoring invalid range: "+JSON.stringify(e)),this.opt.noMatch(e)),{start:n,end:r,valid:o}}},{key:"checkWhitespaceRanges",value:function(e,t,n){var r=void 0,o=!0,a=n.length,i=t-a,s=parseInt(e.start,10)-i;return(r=(s=s>a?a:s)+parseInt(e.length,10))>a&&(r=a,this.log("End range automatically set to the max value of "+a)),s<0||r-s<0||s>a||r>a?(o=!1,this.log("Invalid range: "+JSON.stringify(e)),this.opt.noMatch(e)):""===n.substring(s,r).replace(/\s+/g,"")&&(o=!1,this.log("Skipping whitespace only range: "+JSON.stringify(e)),this.opt.noMatch(e)),{start:s,end:r,valid:o}}},{key:"getTextNodes",value:function(e){var t=this,n="",r=[];this.iterator.forEachNode(NodeFilter.SHOW_TEXT,(function(e){r.push({start:n.length,end:(n+=e.textContent).length,node:e})}),(function(e){return t.matchesExclude(e.parentNode)?NodeFilter.FILTER_REJECT:NodeFilter.FILTER_ACCEPT}),(function(){e({value:n,nodes:r})}))}},{key:"matchesExclude",value:function(e){return o.matches(e,this.opt.exclude.concat(["script","style","title","head","html"]))}},{key:"wrapRangeInTextNode",value:function(e,t,n){var r=this.opt.element?this.opt.element:"mark",o=e.splitText(t),a=o.splitText(n-t),i=document.createElement(r);return i.setAttribute("data-markjs","true"),this.opt.className&&i.setAttribute("class",this.opt.className),i.textContent=o.textContent,o.parentNode.replaceChild(i,o),a}},{key:"wrapRangeInMappedTextNode",value:function(e,t,n,r,o){var a=this;e.nodes.every((function(i,s){var l=e.nodes[s+1];if(void 0===l||l.start>t){if(!r(i.node))return!1;var c=t-i.start,u=(n>i.end?i.end:n)-i.start,d=e.value.substr(0,i.start),p=e.value.substr(u+i.start);if(i.node=a.wrapRangeInTextNode(i.node,c,u),e.value=d+p,e.nodes.forEach((function(t,n){n>=s&&(e.nodes[n].start>0&&n!==s&&(e.nodes[n].start-=u),e.nodes[n].end-=u)})),n-=u,o(i.node.previousSibling,i.start),!(n>i.end))return!1;t=i.end}return!0}))}},{key:"wrapMatches",value:function(e,t,n,r,o){var a=this,i=0===t?0:t+1;this.getTextNodes((function(t){t.nodes.forEach((function(t){t=t.node;for(var o=void 0;null!==(o=e.exec(t.textContent))&&""!==o[i];)if(n(o[i],t)){var s=o.index;if(0!==i)for(var l=1;l{"use strict";n.r(t)},58252:(e,t,n)=>{"use strict";n.r(t)},5947:function(e,t,n){var r,o;r=function(){var e,t,n={version:"0.2.0"},r=n.settings={minimum:.08,easing:"ease",positionUsing:"",speed:200,trickle:!0,trickleRate:.02,trickleSpeed:800,showSpinner:!0,barSelector:'[role="bar"]',spinnerSelector:'[role="spinner"]',parent:"body",template:'
'};function o(e,t,n){return en?n:e}function a(e){return 100*(-1+e)}function i(e,t,n){var o;return(o="translate3d"===r.positionUsing?{transform:"translate3d("+a(e)+"%,0,0)"}:"translate"===r.positionUsing?{transform:"translate("+a(e)+"%,0)"}:{"margin-left":a(e)+"%"}).transition="all "+t+"ms "+n,o}n.configure=function(e){var t,n;for(t in e)void 0!==(n=e[t])&&e.hasOwnProperty(t)&&(r[t]=n);return this},n.status=null,n.set=function(e){var t=n.isStarted();e=o(e,r.minimum,1),n.status=1===e?null:e;var a=n.render(!t),c=a.querySelector(r.barSelector),u=r.speed,d=r.easing;return a.offsetWidth,s((function(t){""===r.positionUsing&&(r.positionUsing=n.getPositioningCSS()),l(c,i(e,u,d)),1===e?(l(a,{transition:"none",opacity:1}),a.offsetWidth,setTimeout((function(){l(a,{transition:"all "+u+"ms linear",opacity:0}),setTimeout((function(){n.remove(),t()}),u)}),u)):setTimeout(t,u)})),this},n.isStarted=function(){return"number"==typeof n.status},n.start=function(){n.status||n.set(0);var e=function(){setTimeout((function(){n.status&&(n.trickle(),e())}),r.trickleSpeed)};return r.trickle&&e(),this},n.done=function(e){return e||n.status?n.inc(.3+.5*Math.random()).set(1):this},n.inc=function(e){var t=n.status;return t?("number"!=typeof e&&(e=(1-t)*o(Math.random()*t,.1,.95)),t=o(t+e,0,.994),n.set(t)):n.start()},n.trickle=function(){return n.inc(Math.random()*r.trickleRate)},e=0,t=0,n.promise=function(r){return r&&"resolved"!==r.state()?(0===t&&n.start(),e++,t++,r.always((function(){0==--t?(e=0,n.done()):n.set((e-t)/e)})),this):this},n.render=function(e){if(n.isRendered())return document.getElementById("nprogress");u(document.documentElement,"nprogress-busy");var t=document.createElement("div");t.id="nprogress",t.innerHTML=r.template;var o,i=t.querySelector(r.barSelector),s=e?"-100":a(n.status||0),c=document.querySelector(r.parent);return l(i,{transition:"all 0 linear",transform:"translate3d("+s+"%,0,0)"}),r.showSpinner||(o=t.querySelector(r.spinnerSelector))&&f(o),c!=document.body&&u(c,"nprogress-custom-parent"),c.appendChild(t),t},n.remove=function(){d(document.documentElement,"nprogress-busy"),d(document.querySelector(r.parent),"nprogress-custom-parent");var e=document.getElementById("nprogress");e&&f(e)},n.isRendered=function(){return!!document.getElementById("nprogress")},n.getPositioningCSS=function(){var e=document.body.style,t="WebkitTransform"in e?"Webkit":"MozTransform"in e?"Moz":"msTransform"in e?"ms":"OTransform"in e?"O":"";return t+"Perspective"in e?"translate3d":t+"Transform"in e?"translate":"margin"};var s=function(){var e=[];function t(){var n=e.shift();n&&n(t)}return function(n){e.push(n),1==e.length&&t()}}(),l=function(){var e=["Webkit","O","Moz","ms"],t={};function n(e){return e.replace(/^-ms-/,"ms-").replace(/-([\da-z])/gi,(function(e,t){return t.toUpperCase()}))}function r(t){var n=document.body.style;if(t in n)return t;for(var r,o=e.length,a=t.charAt(0).toUpperCase()+t.slice(1);o--;)if((r=e[o]+a)in n)return r;return t}function o(e){return e=n(e),t[e]||(t[e]=r(e))}function a(e,t,n){t=o(t),e.style[t]=n}return function(e,t){var n,r,o=arguments;if(2==o.length)for(n in t)void 0!==(r=t[n])&&t.hasOwnProperty(n)&&a(e,n,r);else a(e,o[1],o[2])}}();function c(e,t){return("string"==typeof e?e:p(e)).indexOf(" "+t+" ")>=0}function u(e,t){var n=p(e),r=n+t;c(n,t)||(e.className=r.substring(1))}function d(e,t){var n,r=p(e);c(e,t)&&(n=r.replace(" "+t+" "," "),e.className=n.substring(1,n.length-1))}function p(e){return(" "+(e.className||"")+" ").replace(/\s+/gi," ")}function f(e){e&&e.parentNode&&e.parentNode.removeChild(e)}return n},void 0===(o="function"==typeof r?r.call(t,n,t,e):r)||(e.exports=o)},6969:e=>{e.exports&&(e.exports={core:{meta:{path:"components/prism-core.js",option:"mandatory"},core:"Core"},themes:{meta:{path:"themes/{id}.css",link:"index.html?theme={id}",exclusive:!0},prism:{title:"Default",option:"default"},"prism-dark":"Dark","prism-funky":"Funky","prism-okaidia":{title:"Okaidia",owner:"ocodia"},"prism-twilight":{title:"Twilight",owner:"remybach"},"prism-coy":{title:"Coy",owner:"tshedor"},"prism-solarizedlight":{title:"Solarized Light",owner:"hectormatos2011 "},"prism-tomorrow":{title:"Tomorrow Night",owner:"Rosey"}},languages:{meta:{path:"components/prism-{id}",noCSS:!0,examplesPath:"examples/prism-{id}",addCheckAll:!0},markup:{title:"Markup",alias:["html","xml","svg","mathml","ssml","atom","rss"],aliasTitles:{html:"HTML",xml:"XML",svg:"SVG",mathml:"MathML",ssml:"SSML",atom:"Atom",rss:"RSS"},option:"default"},css:{title:"CSS",option:"default",modify:"markup"},clike:{title:"C-like",option:"default"},javascript:{title:"JavaScript",require:"clike",modify:"markup",optional:"regex",alias:"js",option:"default"},abap:{title:"ABAP",owner:"dellagustin"},abnf:{title:"ABNF",owner:"RunDevelopment"},actionscript:{title:"ActionScript",require:"javascript",modify:"markup",owner:"Golmote"},ada:{title:"Ada",owner:"Lucretia"},agda:{title:"Agda",owner:"xy-ren"},al:{title:"AL",owner:"RunDevelopment"},antlr4:{title:"ANTLR4",alias:"g4",owner:"RunDevelopment"},apacheconf:{title:"Apache Configuration",owner:"GuiTeK"},apex:{title:"Apex",require:["clike","sql"],owner:"RunDevelopment"},apl:{title:"APL",owner:"ngn"},applescript:{title:"AppleScript",owner:"Golmote"},aql:{title:"AQL",owner:"RunDevelopment"},arduino:{title:"Arduino",require:"cpp",alias:"ino",owner:"dkern"},arff:{title:"ARFF",owner:"Golmote"},armasm:{title:"ARM Assembly",alias:"arm-asm",owner:"RunDevelopment"},arturo:{title:"Arturo",alias:"art",optional:["bash","css","javascript","markup","markdown","sql"],owner:"drkameleon"},asciidoc:{alias:"adoc",title:"AsciiDoc",owner:"Golmote"},aspnet:{title:"ASP.NET (C#)",require:["markup","csharp"],owner:"nauzilus"},asm6502:{title:"6502 Assembly",owner:"kzurawel"},asmatmel:{title:"Atmel AVR Assembly",owner:"cerkit"},autohotkey:{title:"AutoHotkey",owner:"aviaryan"},autoit:{title:"AutoIt",owner:"Golmote"},avisynth:{title:"AviSynth",alias:"avs",owner:"Zinfidel"},"avro-idl":{title:"Avro IDL",alias:"avdl",owner:"RunDevelopment"},awk:{title:"AWK",alias:"gawk",aliasTitles:{gawk:"GAWK"},owner:"RunDevelopment"},bash:{title:"Bash",alias:["sh","shell"],aliasTitles:{sh:"Shell",shell:"Shell"},owner:"zeitgeist87"},basic:{title:"BASIC",owner:"Golmote"},batch:{title:"Batch",owner:"Golmote"},bbcode:{title:"BBcode",alias:"shortcode",aliasTitles:{shortcode:"Shortcode"},owner:"RunDevelopment"},bbj:{title:"BBj",owner:"hyyan"},bicep:{title:"Bicep",owner:"johnnyreilly"},birb:{title:"Birb",require:"clike",owner:"Calamity210"},bison:{title:"Bison",require:"c",owner:"Golmote"},bnf:{title:"BNF",alias:"rbnf",aliasTitles:{rbnf:"RBNF"},owner:"RunDevelopment"},bqn:{title:"BQN",owner:"yewscion"},brainfuck:{title:"Brainfuck",owner:"Golmote"},brightscript:{title:"BrightScript",owner:"RunDevelopment"},bro:{title:"Bro",owner:"wayward710"},bsl:{title:"BSL (1C:Enterprise)",alias:"oscript",aliasTitles:{oscript:"OneScript"},owner:"Diversus23"},c:{title:"C",require:"clike",owner:"zeitgeist87"},csharp:{title:"C#",require:"clike",alias:["cs","dotnet"],owner:"mvalipour"},cpp:{title:"C++",require:"c",owner:"zeitgeist87"},cfscript:{title:"CFScript",require:"clike",alias:"cfc",owner:"mjclemente"},chaiscript:{title:"ChaiScript",require:["clike","cpp"],owner:"RunDevelopment"},cil:{title:"CIL",owner:"sbrl"},cilkc:{title:"Cilk/C",require:"c",alias:"cilk-c",owner:"OpenCilk"},cilkcpp:{title:"Cilk/C++",require:"cpp",alias:["cilk-cpp","cilk"],owner:"OpenCilk"},clojure:{title:"Clojure",owner:"troglotit"},cmake:{title:"CMake",owner:"mjrogozinski"},cobol:{title:"COBOL",owner:"RunDevelopment"},coffeescript:{title:"CoffeeScript",require:"javascript",alias:"coffee",owner:"R-osey"},concurnas:{title:"Concurnas",alias:"conc",owner:"jasontatton"},csp:{title:"Content-Security-Policy",owner:"ScottHelme"},cooklang:{title:"Cooklang",owner:"ahue"},coq:{title:"Coq",owner:"RunDevelopment"},crystal:{title:"Crystal",require:"ruby",owner:"MakeNowJust"},"css-extras":{title:"CSS Extras",require:"css",modify:"css",owner:"milesj"},csv:{title:"CSV",owner:"RunDevelopment"},cue:{title:"CUE",owner:"RunDevelopment"},cypher:{title:"Cypher",owner:"RunDevelopment"},d:{title:"D",require:"clike",owner:"Golmote"},dart:{title:"Dart",require:"clike",owner:"Golmote"},dataweave:{title:"DataWeave",owner:"machaval"},dax:{title:"DAX",owner:"peterbud"},dhall:{title:"Dhall",owner:"RunDevelopment"},diff:{title:"Diff",owner:"uranusjr"},django:{title:"Django/Jinja2",require:"markup-templating",alias:"jinja2",owner:"romanvm"},"dns-zone-file":{title:"DNS zone file",owner:"RunDevelopment",alias:"dns-zone"},docker:{title:"Docker",alias:"dockerfile",owner:"JustinBeckwith"},dot:{title:"DOT (Graphviz)",alias:"gv",optional:"markup",owner:"RunDevelopment"},ebnf:{title:"EBNF",owner:"RunDevelopment"},editorconfig:{title:"EditorConfig",owner:"osipxd"},eiffel:{title:"Eiffel",owner:"Conaclos"},ejs:{title:"EJS",require:["javascript","markup-templating"],owner:"RunDevelopment",alias:"eta",aliasTitles:{eta:"Eta"}},elixir:{title:"Elixir",owner:"Golmote"},elm:{title:"Elm",owner:"zwilias"},etlua:{title:"Embedded Lua templating",require:["lua","markup-templating"],owner:"RunDevelopment"},erb:{title:"ERB",require:["ruby","markup-templating"],owner:"Golmote"},erlang:{title:"Erlang",owner:"Golmote"},"excel-formula":{title:"Excel Formula",alias:["xlsx","xls"],owner:"RunDevelopment"},fsharp:{title:"F#",require:"clike",owner:"simonreynolds7"},factor:{title:"Factor",owner:"catb0t"},false:{title:"False",owner:"edukisto"},"firestore-security-rules":{title:"Firestore security rules",require:"clike",owner:"RunDevelopment"},flow:{title:"Flow",require:"javascript",owner:"Golmote"},fortran:{title:"Fortran",owner:"Golmote"},ftl:{title:"FreeMarker Template Language",require:"markup-templating",owner:"RunDevelopment"},gml:{title:"GameMaker Language",alias:"gamemakerlanguage",require:"clike",owner:"LiarOnce"},gap:{title:"GAP (CAS)",owner:"RunDevelopment"},gcode:{title:"G-code",owner:"RunDevelopment"},gdscript:{title:"GDScript",owner:"RunDevelopment"},gedcom:{title:"GEDCOM",owner:"Golmote"},gettext:{title:"gettext",alias:"po",owner:"RunDevelopment"},gherkin:{title:"Gherkin",owner:"hason"},git:{title:"Git",owner:"lgiraudel"},glsl:{title:"GLSL",require:"c",owner:"Golmote"},gn:{title:"GN",alias:"gni",owner:"RunDevelopment"},"linker-script":{title:"GNU Linker Script",alias:"ld",owner:"RunDevelopment"},go:{title:"Go",require:"clike",owner:"arnehormann"},"go-module":{title:"Go module",alias:"go-mod",owner:"RunDevelopment"},gradle:{title:"Gradle",require:"clike",owner:"zeabdelkhalek-badido18"},graphql:{title:"GraphQL",optional:"markdown",owner:"Golmote"},groovy:{title:"Groovy",require:"clike",owner:"robfletcher"},haml:{title:"Haml",require:"ruby",optional:["css","css-extras","coffeescript","erb","javascript","less","markdown","scss","textile"],owner:"Golmote"},handlebars:{title:"Handlebars",require:"markup-templating",alias:["hbs","mustache"],aliasTitles:{mustache:"Mustache"},owner:"Golmote"},haskell:{title:"Haskell",alias:"hs",owner:"bholst"},haxe:{title:"Haxe",require:"clike",optional:"regex",owner:"Golmote"},hcl:{title:"HCL",owner:"outsideris"},hlsl:{title:"HLSL",require:"c",owner:"RunDevelopment"},hoon:{title:"Hoon",owner:"matildepark"},http:{title:"HTTP",optional:["csp","css","hpkp","hsts","javascript","json","markup","uri"],owner:"danielgtaylor"},hpkp:{title:"HTTP Public-Key-Pins",owner:"ScottHelme"},hsts:{title:"HTTP Strict-Transport-Security",owner:"ScottHelme"},ichigojam:{title:"IchigoJam",owner:"BlueCocoa"},icon:{title:"Icon",owner:"Golmote"},"icu-message-format":{title:"ICU Message Format",owner:"RunDevelopment"},idris:{title:"Idris",alias:"idr",owner:"KeenS",require:"haskell"},ignore:{title:".ignore",owner:"osipxd",alias:["gitignore","hgignore","npmignore"],aliasTitles:{gitignore:".gitignore",hgignore:".hgignore",npmignore:".npmignore"}},inform7:{title:"Inform 7",owner:"Golmote"},ini:{title:"Ini",owner:"aviaryan"},io:{title:"Io",owner:"AlesTsurko"},j:{title:"J",owner:"Golmote"},java:{title:"Java",require:"clike",owner:"sherblot"},javadoc:{title:"JavaDoc",require:["markup","java","javadoclike"],modify:"java",optional:"scala",owner:"RunDevelopment"},javadoclike:{title:"JavaDoc-like",modify:["java","javascript","php"],owner:"RunDevelopment"},javastacktrace:{title:"Java stack trace",owner:"RunDevelopment"},jexl:{title:"Jexl",owner:"czosel"},jolie:{title:"Jolie",require:"clike",owner:"thesave"},jq:{title:"JQ",owner:"RunDevelopment"},jsdoc:{title:"JSDoc",require:["javascript","javadoclike","typescript"],modify:"javascript",optional:["actionscript","coffeescript"],owner:"RunDevelopment"},"js-extras":{title:"JS Extras",require:"javascript",modify:"javascript",optional:["actionscript","coffeescript","flow","n4js","typescript"],owner:"RunDevelopment"},json:{title:"JSON",alias:"webmanifest",aliasTitles:{webmanifest:"Web App Manifest"},owner:"CupOfTea696"},json5:{title:"JSON5",require:"json",owner:"RunDevelopment"},jsonp:{title:"JSONP",require:"json",owner:"RunDevelopment"},jsstacktrace:{title:"JS stack trace",owner:"sbrl"},"js-templates":{title:"JS Templates",require:"javascript",modify:"javascript",optional:["css","css-extras","graphql","markdown","markup","sql"],owner:"RunDevelopment"},julia:{title:"Julia",owner:"cdagnino"},keepalived:{title:"Keepalived Configure",owner:"dev-itsheng"},keyman:{title:"Keyman",owner:"mcdurdin"},kotlin:{title:"Kotlin",alias:["kt","kts"],aliasTitles:{kts:"Kotlin Script"},require:"clike",owner:"Golmote"},kumir:{title:"KuMir (\u041a\u0443\u041c\u0438\u0440)",alias:"kum",owner:"edukisto"},kusto:{title:"Kusto",owner:"RunDevelopment"},latex:{title:"LaTeX",alias:["tex","context"],aliasTitles:{tex:"TeX",context:"ConTeXt"},owner:"japborst"},latte:{title:"Latte",require:["clike","markup-templating","php"],owner:"nette"},less:{title:"Less",require:"css",optional:"css-extras",owner:"Golmote"},lilypond:{title:"LilyPond",require:"scheme",alias:"ly",owner:"RunDevelopment"},liquid:{title:"Liquid",require:"markup-templating",owner:"cinhtau"},lisp:{title:"Lisp",alias:["emacs","elisp","emacs-lisp"],owner:"JuanCaicedo"},livescript:{title:"LiveScript",owner:"Golmote"},llvm:{title:"LLVM IR",owner:"porglezomp"},log:{title:"Log file",optional:"javastacktrace",owner:"RunDevelopment"},lolcode:{title:"LOLCODE",owner:"Golmote"},lua:{title:"Lua",owner:"Golmote"},magma:{title:"Magma (CAS)",owner:"RunDevelopment"},makefile:{title:"Makefile",owner:"Golmote"},markdown:{title:"Markdown",require:"markup",optional:"yaml",alias:"md",owner:"Golmote"},"markup-templating":{title:"Markup templating",require:"markup",owner:"Golmote"},mata:{title:"Mata",owner:"RunDevelopment"},matlab:{title:"MATLAB",owner:"Golmote"},maxscript:{title:"MAXScript",owner:"RunDevelopment"},mel:{title:"MEL",owner:"Golmote"},mermaid:{title:"Mermaid",owner:"RunDevelopment"},metafont:{title:"METAFONT",owner:"LaeriExNihilo"},mizar:{title:"Mizar",owner:"Golmote"},mongodb:{title:"MongoDB",owner:"airs0urce",require:"javascript"},monkey:{title:"Monkey",owner:"Golmote"},moonscript:{title:"MoonScript",alias:"moon",owner:"RunDevelopment"},n1ql:{title:"N1QL",owner:"TMWilds"},n4js:{title:"N4JS",require:"javascript",optional:"jsdoc",alias:"n4jsd",owner:"bsmith-n4"},"nand2tetris-hdl":{title:"Nand To Tetris HDL",owner:"stephanmax"},naniscript:{title:"Naninovel Script",owner:"Elringus",alias:"nani"},nasm:{title:"NASM",owner:"rbmj"},neon:{title:"NEON",owner:"nette"},nevod:{title:"Nevod",owner:"nezaboodka"},nginx:{title:"nginx",owner:"volado"},nim:{title:"Nim",owner:"Golmote"},nix:{title:"Nix",owner:"Golmote"},nsis:{title:"NSIS",owner:"idleberg"},objectivec:{title:"Objective-C",require:"c",alias:"objc",owner:"uranusjr"},ocaml:{title:"OCaml",owner:"Golmote"},odin:{title:"Odin",owner:"edukisto"},opencl:{title:"OpenCL",require:"c",modify:["c","cpp"],owner:"Milania1"},openqasm:{title:"OpenQasm",alias:"qasm",owner:"RunDevelopment"},oz:{title:"Oz",owner:"Golmote"},parigp:{title:"PARI/GP",owner:"Golmote"},parser:{title:"Parser",require:"markup",owner:"Golmote"},pascal:{title:"Pascal",alias:"objectpascal",aliasTitles:{objectpascal:"Object Pascal"},owner:"Golmote"},pascaligo:{title:"Pascaligo",owner:"DefinitelyNotAGoat"},psl:{title:"PATROL Scripting Language",owner:"bertysentry"},pcaxis:{title:"PC-Axis",alias:"px",owner:"RunDevelopment"},peoplecode:{title:"PeopleCode",alias:"pcode",owner:"RunDevelopment"},perl:{title:"Perl",owner:"Golmote"},php:{title:"PHP",require:"markup-templating",owner:"milesj"},phpdoc:{title:"PHPDoc",require:["php","javadoclike"],modify:"php",owner:"RunDevelopment"},"php-extras":{title:"PHP Extras",require:"php",modify:"php",owner:"milesj"},"plant-uml":{title:"PlantUML",alias:"plantuml",owner:"RunDevelopment"},plsql:{title:"PL/SQL",require:"sql",owner:"Golmote"},powerquery:{title:"PowerQuery",alias:["pq","mscript"],owner:"peterbud"},powershell:{title:"PowerShell",owner:"nauzilus"},processing:{title:"Processing",require:"clike",owner:"Golmote"},prolog:{title:"Prolog",owner:"Golmote"},promql:{title:"PromQL",owner:"arendjr"},properties:{title:".properties",owner:"Golmote"},protobuf:{title:"Protocol Buffers",require:"clike",owner:"just-boris"},pug:{title:"Pug",require:["markup","javascript"],optional:["coffeescript","ejs","handlebars","less","livescript","markdown","scss","stylus","twig"],owner:"Golmote"},puppet:{title:"Puppet",owner:"Golmote"},pure:{title:"Pure",optional:["c","cpp","fortran"],owner:"Golmote"},purebasic:{title:"PureBasic",require:"clike",alias:"pbfasm",owner:"HeX0R101"},purescript:{title:"PureScript",require:"haskell",alias:"purs",owner:"sriharshachilakapati"},python:{title:"Python",alias:"py",owner:"multipetros"},qsharp:{title:"Q#",require:"clike",alias:"qs",owner:"fedonman"},q:{title:"Q (kdb+ database)",owner:"Golmote"},qml:{title:"QML",require:"javascript",owner:"RunDevelopment"},qore:{title:"Qore",require:"clike",owner:"temnroegg"},r:{title:"R",owner:"Golmote"},racket:{title:"Racket",require:"scheme",alias:"rkt",owner:"RunDevelopment"},cshtml:{title:"Razor C#",alias:"razor",require:["markup","csharp"],optional:["css","css-extras","javascript","js-extras"],owner:"RunDevelopment"},jsx:{title:"React JSX",require:["markup","javascript"],optional:["jsdoc","js-extras","js-templates"],owner:"vkbansal"},tsx:{title:"React TSX",require:["jsx","typescript"]},reason:{title:"Reason",require:"clike",owner:"Golmote"},regex:{title:"Regex",owner:"RunDevelopment"},rego:{title:"Rego",owner:"JordanSh"},renpy:{title:"Ren'py",alias:"rpy",owner:"HyuchiaDiego"},rescript:{title:"ReScript",alias:"res",owner:"vmarcosp"},rest:{title:"reST (reStructuredText)",owner:"Golmote"},rip:{title:"Rip",owner:"ravinggenius"},roboconf:{title:"Roboconf",owner:"Golmote"},robotframework:{title:"Robot Framework",alias:"robot",owner:"RunDevelopment"},ruby:{title:"Ruby",require:"clike",alias:"rb",owner:"samflores"},rust:{title:"Rust",owner:"Golmote"},sas:{title:"SAS",optional:["groovy","lua","sql"],owner:"Golmote"},sass:{title:"Sass (Sass)",require:"css",optional:"css-extras",owner:"Golmote"},scss:{title:"Sass (SCSS)",require:"css",optional:"css-extras",owner:"MoOx"},scala:{title:"Scala",require:"java",owner:"jozic"},scheme:{title:"Scheme",owner:"bacchus123"},"shell-session":{title:"Shell session",require:"bash",alias:["sh-session","shellsession"],owner:"RunDevelopment"},smali:{title:"Smali",owner:"RunDevelopment"},smalltalk:{title:"Smalltalk",owner:"Golmote"},smarty:{title:"Smarty",require:"markup-templating",optional:"php",owner:"Golmote"},sml:{title:"SML",alias:"smlnj",aliasTitles:{smlnj:"SML/NJ"},owner:"RunDevelopment"},solidity:{title:"Solidity (Ethereum)",alias:"sol",require:"clike",owner:"glachaud"},"solution-file":{title:"Solution file",alias:"sln",owner:"RunDevelopment"},soy:{title:"Soy (Closure Template)",require:"markup-templating",owner:"Golmote"},sparql:{title:"SPARQL",require:"turtle",owner:"Triply-Dev",alias:"rq"},"splunk-spl":{title:"Splunk SPL",owner:"RunDevelopment"},sqf:{title:"SQF: Status Quo Function (Arma 3)",require:"clike",owner:"RunDevelopment"},sql:{title:"SQL",owner:"multipetros"},squirrel:{title:"Squirrel",require:"clike",owner:"RunDevelopment"},stan:{title:"Stan",owner:"RunDevelopment"},stata:{title:"Stata Ado",require:["mata","java","python"],owner:"RunDevelopment"},iecst:{title:"Structured Text (IEC 61131-3)",owner:"serhioromano"},stylus:{title:"Stylus",owner:"vkbansal"},supercollider:{title:"SuperCollider",alias:"sclang",owner:"RunDevelopment"},swift:{title:"Swift",owner:"chrischares"},systemd:{title:"Systemd configuration file",owner:"RunDevelopment"},"t4-templating":{title:"T4 templating",owner:"RunDevelopment"},"t4-cs":{title:"T4 Text Templates (C#)",require:["t4-templating","csharp"],alias:"t4",owner:"RunDevelopment"},"t4-vb":{title:"T4 Text Templates (VB)",require:["t4-templating","vbnet"],owner:"RunDevelopment"},tap:{title:"TAP",owner:"isaacs",require:"yaml"},tcl:{title:"Tcl",owner:"PeterChaplin"},tt2:{title:"Template Toolkit 2",require:["clike","markup-templating"],owner:"gflohr"},textile:{title:"Textile",require:"markup",optional:"css",owner:"Golmote"},toml:{title:"TOML",owner:"RunDevelopment"},tremor:{title:"Tremor",alias:["trickle","troy"],owner:"darach",aliasTitles:{trickle:"trickle",troy:"troy"}},turtle:{title:"Turtle",alias:"trig",aliasTitles:{trig:"TriG"},owner:"jakubklimek"},twig:{title:"Twig",require:"markup-templating",owner:"brandonkelly"},typescript:{title:"TypeScript",require:"javascript",optional:"js-templates",alias:"ts",owner:"vkbansal"},typoscript:{title:"TypoScript",alias:"tsconfig",aliasTitles:{tsconfig:"TSConfig"},owner:"dkern"},unrealscript:{title:"UnrealScript",alias:["uscript","uc"],owner:"RunDevelopment"},uorazor:{title:"UO Razor Script",owner:"jaseowns"},uri:{title:"URI",alias:"url",aliasTitles:{url:"URL"},owner:"RunDevelopment"},v:{title:"V",require:"clike",owner:"taggon"},vala:{title:"Vala",require:"clike",optional:"regex",owner:"TemplarVolk"},vbnet:{title:"VB.Net",require:"basic",owner:"Bigsby"},velocity:{title:"Velocity",require:"markup",owner:"Golmote"},verilog:{title:"Verilog",owner:"a-rey"},vhdl:{title:"VHDL",owner:"a-rey"},vim:{title:"vim",owner:"westonganger"},"visual-basic":{title:"Visual Basic",alias:["vb","vba"],aliasTitles:{vba:"VBA"},owner:"Golmote"},warpscript:{title:"WarpScript",owner:"RunDevelopment"},wasm:{title:"WebAssembly",owner:"Golmote"},"web-idl":{title:"Web IDL",alias:"webidl",owner:"RunDevelopment"},wgsl:{title:"WGSL",owner:"Dr4gonthree"},wiki:{title:"Wiki markup",require:"markup",owner:"Golmote"},wolfram:{title:"Wolfram language",alias:["mathematica","nb","wl"],aliasTitles:{mathematica:"Mathematica",nb:"Mathematica Notebook"},owner:"msollami"},wren:{title:"Wren",owner:"clsource"},xeora:{title:"Xeora",require:"markup",alias:"xeoracube",aliasTitles:{xeoracube:"XeoraCube"},owner:"freakmaxi"},"xml-doc":{title:"XML doc (.net)",require:"markup",modify:["csharp","fsharp","vbnet"],owner:"RunDevelopment"},xojo:{title:"Xojo (REALbasic)",owner:"Golmote"},xquery:{title:"XQuery",require:"markup",owner:"Golmote"},yaml:{title:"YAML",alias:"yml",owner:"hason"},yang:{title:"YANG",owner:"RunDevelopment"},zig:{title:"Zig",owner:"RunDevelopment"}},plugins:{meta:{path:"plugins/{id}/prism-{id}",link:"plugins/{id}/"},"line-highlight":{title:"Line Highlight",description:"Highlights specific lines and/or line ranges."},"line-numbers":{title:"Line Numbers",description:"Line number at the beginning of code lines.",owner:"kuba-kubula"},"show-invisibles":{title:"Show Invisibles",description:"Show hidden characters such as tabs and line breaks.",optional:["autolinker","data-uri-highlight"]},autolinker:{title:"Autolinker",description:"Converts URLs and emails in code to clickable links. Parses Markdown links in comments."},wpd:{title:"WebPlatform Docs",description:'Makes tokens link to WebPlatform.org documentation. The links open in a new tab.'},"custom-class":{title:"Custom Class",description:"This plugin allows you to prefix Prism's default classes (.comment can become .namespace--comment) or replace them with your defined ones (like .editor__comment). You can even add new classes.",owner:"dvkndn",noCSS:!0},"file-highlight":{title:"File Highlight",description:"Fetch external files and highlight them with Prism. Used on the Prism website itself.",noCSS:!0},"show-language":{title:"Show Language",description:"Display the highlighted language in code blocks (inline code does not show the label).",owner:"nauzilus",noCSS:!0,require:"toolbar"},"jsonp-highlight":{title:"JSONP Highlight",description:"Fetch content with JSONP and highlight some interesting content (e.g. GitHub/Gists or Bitbucket API).",noCSS:!0,owner:"nauzilus"},"highlight-keywords":{title:"Highlight Keywords",description:"Adds special CSS classes for each keyword for fine-grained highlighting.",owner:"vkbansal",noCSS:!0},"remove-initial-line-feed":{title:"Remove initial line feed",description:"Removes the initial line feed in code blocks.",owner:"Golmote",noCSS:!0},"inline-color":{title:"Inline color",description:"Adds a small inline preview for colors in style sheets.",require:"css-extras",owner:"RunDevelopment"},previewers:{title:"Previewers",description:"Previewers for angles, colors, gradients, easing and time.",require:"css-extras",owner:"Golmote"},autoloader:{title:"Autoloader",description:"Automatically loads the needed languages to highlight the code blocks.",owner:"Golmote",noCSS:!0},"keep-markup":{title:"Keep Markup",description:"Prevents custom markup from being dropped out during highlighting.",owner:"Golmote",optional:"normalize-whitespace",noCSS:!0},"command-line":{title:"Command Line",description:"Display a command line with a prompt and, optionally, the output/response from the commands.",owner:"chriswells0"},"unescaped-markup":{title:"Unescaped Markup",description:"Write markup without having to escape anything."},"normalize-whitespace":{title:"Normalize Whitespace",description:"Supports multiple operations to normalize whitespace in code blocks.",owner:"zeitgeist87",optional:"unescaped-markup",noCSS:!0},"data-uri-highlight":{title:"Data-URI Highlight",description:"Highlights data-URI contents.",owner:"Golmote",noCSS:!0},toolbar:{title:"Toolbar",description:"Attach a toolbar for plugins to easily register buttons on the top of a code block.",owner:"mAAdhaTTah"},"copy-to-clipboard":{title:"Copy to Clipboard Button",description:"Add a button that copies the code block to the clipboard when clicked.",owner:"mAAdhaTTah",require:"toolbar",noCSS:!0},"download-button":{title:"Download Button",description:"A button in the toolbar of a code block adding a convenient way to download a code file.",owner:"Golmote",require:"toolbar",noCSS:!0},"match-braces":{title:"Match braces",description:"Highlights matching braces.",owner:"RunDevelopment"},"diff-highlight":{title:"Diff Highlight",description:"Highlights the code inside diff blocks.",owner:"RunDevelopment",require:"diff"},"filter-highlight-all":{title:"Filter highlightAll",description:"Filters the elements the highlightAll and highlightAllUnder methods actually highlight.",owner:"RunDevelopment",noCSS:!0},treeview:{title:"Treeview",description:"A language with special styles to highlight file system tree structures.",owner:"Golmote"}}})},8722:(e,t,n)=>{const r=n(6969),o=n(98380),a=new Set;function i(e){void 0===e?e=Object.keys(r.languages).filter((e=>"meta"!=e)):Array.isArray(e)||(e=[e]);const t=[...a,...Object.keys(Prism.languages)];o(r,e,t).load((e=>{if(!(e in r.languages))return void(i.silent||console.warn("Language does not exist: "+e));const t="./prism-"+e;delete n.c[n(63157).resolve(t)],delete Prism.languages[e],n(63157)(t),a.add(e)}))}i.silent=!1,e.exports=i},19700:()=>{!function(e){function t(e,t){return"___"+e.toUpperCase()+t+"___"}Object.defineProperties(e.languages["markup-templating"]={},{buildPlaceholders:{value:function(n,r,o,a){if(n.language===r){var i=n.tokenStack=[];n.code=n.code.replace(o,(function(e){if("function"==typeof a&&!a(e))return e;for(var o,s=i.length;-1!==n.code.indexOf(o=t(r,s));)++s;return i[s]=e,o})),n.grammar=e.languages.markup}}},tokenizePlaceholders:{value:function(n,r){if(n.language===r&&n.tokenStack){n.grammar=e.languages[r];var o=0,a=Object.keys(n.tokenStack);!function i(s){for(var l=0;l=a.length);l++){var c=s[l];if("string"==typeof c||c.content&&"string"==typeof c.content){var u=a[o],d=n.tokenStack[u],p="string"==typeof c?c:c.content,f=t(r,u),m=p.indexOf(f);if(m>-1){++o;var h=p.substring(0,m),g=new e.Token(r,e.tokenize(d,n.grammar),"language-"+r,d),y=p.substring(m+f.length),b=[];h&&b.push.apply(b,i([h])),b.push(g),y&&b.push.apply(b,i([y])),"string"==typeof c?s.splice.apply(s,[l,1].concat(b)):c.content=b}}else c.content&&i(c.content)}return s}(n.tokens)}}}})}(Prism)},18692:(e,t,n)=>{var r={"./":8722};function o(e){var t=a(e);return n(t)}function a(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=a,e.exports=o,o.id=18692},63157:(e,t,n)=>{var r={"./":8722};function o(e){var t=a(e);return n(t)}function a(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=a,e.exports=o,o.id=63157},98380:e=>{"use strict";var t=function(){var e=function(){};function t(e,t){Array.isArray(e)?e.forEach(t):null!=e&&t(e,0)}function n(e){for(var t={},n=0,r=e.length;n "));var s={},l=e[r];if(l){function c(t){if(!(t in e))throw new Error(r+" depends on an unknown component "+t);if(!(t in s))for(var i in o(t,a),s[t]=!0,n[t])s[i]=!0}t(l.require,c),t(l.optional,c),t(l.modify,c)}n[r]=s,a.pop()}}return function(e){var t=n[e];return t||(o(e,r),t=n[e]),t}}function o(e){for(var t in e)return!0;return!1}return function(a,i,s){var l=function(e){var t={};for(var n in e){var r=e[n];for(var o in r)if("meta"!=o){var a=r[o];t[o]="string"==typeof a?{title:a}:a}}return t}(a),c=function(e){var n;return function(r){if(r in e)return r;if(!n)for(var o in n={},e){var a=e[o];t(a&&a.alias,(function(t){if(t in n)throw new Error(t+" cannot be alias for both "+o+" and "+n[t]);if(t in e)throw new Error(t+" cannot be alias of "+o+" because it is a component.");n[t]=o}))}return n[r]||r}}(l);i=i.map(c),s=(s||[]).map(c);var u=n(i),d=n(s);i.forEach((function e(n){var r=l[n];t(r&&r.require,(function(t){t in d||(u[t]=!0,e(t))}))}));for(var p,f=r(l),m=u;o(m);){for(var h in p={},m){var g=l[h];t(g&&g.modify,(function(e){e in d&&(p[e]=!0)}))}for(var y in d)if(!(y in u))for(var b in f(y))if(b in u){p[y]=!0;break}for(var v in m=p)u[v]=!0}var w={getIds:function(){var e=[];return w.load((function(t){e.push(t)})),e},load:function(t,n){return function(t,n,r,o){var a=o?o.series:void 0,i=o?o.parallel:e,s={},l={};function c(e){if(e in s)return s[e];l[e]=!0;var o,u=[];for(var d in t(e))d in n&&u.push(d);if(0===u.length)o=r(e);else{var p=i(u.map((function(e){var t=c(e);return delete l[e],t})));a?o=a(p,(function(){return r(e)})):r(e)}return s[e]=o}for(var u in n)c(u);var d=[];for(var p in l)d.push(s[p]);return i(d)}(f,u,t,n)}};return w}}();e.exports=t},2694:(e,t,n)=>{"use strict";var r=n(6925);function o(){}function a(){}a.resetWarningCache=o,e.exports=function(){function e(e,t,n,o,a,i){if(i!==r){var s=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw s.name="Invariant Violation",s}}function t(){return e}e.isRequired=e;var n={array:e,bigint:e,bool:e,func:e,number:e,object:e,string:e,symbol:e,any:e,arrayOf:t,element:e,elementType:e,instanceOf:t,node:e,objectOf:t,oneOf:t,oneOfType:t,shape:t,exact:t,checkPropTypes:a,resetWarningCache:o};return n.PropTypes=n,n}},5556:(e,t,n)=>{e.exports=n(2694)()},6925:e=>{"use strict";e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},22551:(e,t,n)=>{"use strict";var r=n(96540),o=n(69982);function a(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n